risk thinking on Ben Sapiro's Draft Thoughts

Complexity Firewall

Wed, 03 Nov 2021 00:00:00 +0000

I periodically get asked “are we secure?” or “is this system secure?”. That’s not an unusual question for a CISO, or any one cyber security professional in a leadership role, to be asked. How can we answer that question? Can we answer that question in a genuine and complete matter? What if we’re wrong? What if our answers turns out to be wrong later?

Assume the enemy knows the system

Fri, 01 Jan 2021 00:00:00 +0000

One of my favourite memories from my consulting days is a developer that decided to modify the DES encryption algorithm because “it was too well known”.

Downstream Exposure / Upstream Breach

Thu, 24 Dec 2020 00:00:00 +0000

I’ve written before about externalities. When an organizations actions cause harm to others. The recent SolarWinds breach has got me thinking about when someone causes harm to others via a third party. Are you the route into your customer’s organization?

Thoughts on the SolarWinds breach

Sun, 20 Dec 2020 00:00:00 +0000

You’re likely not a target of the SolarWinds breach but you still need to secure your digital supply chain.

Externalities

Mon, 03 Aug 2020 00:00:00 +0000

We all take risks; but do we consider how those risks impact others? Should we include the cost to others when we make risk based decisions not to address certain information security issues?

Acceptable Risk

Thu, 30 Jul 2020 00:00:00 +0000

Every individual, company and society is willing to take risk. In everything we do there is risk, we use risk as leverage (in the financial sense) to achieve some benefit at lower cost. Figuring out where that bright red line of too much risk is not easy. Figuring out where you are relative to that position requires effort.

Risk Models

Thu, 30 Jul 2020 00:00:00 +0000

I had included a list of risk modelling techniques as part of the Acceptable Risk posting. I extracted the list because the content wasn’t core to that article. Here’s the list if you’re interested.

The One Risk Statement To Bind Them All

Sun, 26 Jul 2020 08:57:45 -0400

How many risk statements do you need to describe the information security risks to Management? Probably just one.