These are ideas I’d like to write about (sometimes the idea morphs but it starts here):
Twitter breach and internal support toolsPart 1 and Part 2externalities in risk modelslink- A Canadian perspective on breach class action lawsuits
- Boards vs management - responsibilities for information security risk management
Acceptable risklink- Third party risk management
The one risk to bind them alllink- Doing a SOC2 wrong
- Drieu vs Zoom
- The evolving threat landscape
- Target state and BHAGs
- Three Lines of Defense and management accountability
- Don’t take your vulnerability report to the Board
- Operational Risk isn’t solved; so cyber risk isn’t either
- Privacy vs Security - why privacy is easier
- Privacy: an engineering perspective
- Small Business security
- Strategy and roadmaps
- Outsourcing - what can you outsource?
- Risk decisioning - who is senior enough?
externalities in threat modelslink- Who owns security?
- Security awareness is the least you can do
- Breaches will happen, what can a consumer do?
- Innovation at the Edge vs the Enterprise Vendor Assessment
- Closed Source / Proprietary security governance
- Why GRC sucks and lessons learned from SAP
- Disclosures
Five year old lessons from a CVSSv2 10.0 vulnerabilitylink- Governance structure OR why I’m okay with committees
- FAIR… lessons learned
- Privileged Account Management is really about culture change
- The CXO that didn’t patch
- A story about not lying to customers
- Ethics and risk
- Designing risk appetites [DRAFT]
- Kill the endpoint [DRAFT]
- Do the right thing even if it will hurt
- Most fun app pen test
- Crypto keys and how to mishandle them
- Did the red team tell you anything you didn’t now? AKA who is the audience of a red team report?
- Continuous verification
- The impact of getting security wrong
- Breaches and CISO longevity
- AI goal alignment
- AI in security - surprise, it’s not AI and it’s not observable
- How well do we understand risk?
- Policy exceptions and other things hackers don’t care about
- The role that analysts play in our decisions
- Falling to the level of training
- Compensation
- The need for policy writers with technical experience
- Federated business models and risk aggregation
- The ethics of bad code and platforms
- It’s easy to be kind
- Proprietary methods, for pay standards and unavailable research
- Security poverty line vs benchmarking vs acceptable risk (or why comparing yourself to others is dangerous)
- Your business doesn’t care about maturity scales AKA talk actual risk
- Band-aiding legacy technologies and behaviours AKA making it security’s problem
Trust doesn’t scalelinkWristwatches and Time servers - a story about manual processes you wouldn’t think existlink- The non-impossibility of getting someone to do something they shouldn’t
- why “user action” is a false comfort in scoring
- consider Windows DNS vuln, social engineering
- The internet is a big place… there’s a slim percentage of one person doing something but it’s almost a certainty someone will do that thing
- Big orgs, slow change
- Leadership isn’t about you
- The likelihood of a breach
- Policy management is change management
- Vendor assessments are an unreliable governance tool
- Survivor bias and the possibility of non-visible hackers (reflection on Project Freta)
- On NYSFed vs First Title Insurance
- Risk Budgets