Cybersecurity Programs

27th July 2023

Canadians: don’t overlook Cybersecurity when Expanding into the U.S.!

As Canadians, we generally don’t define ourselves by what we are but rather what we are not. That is, we are not Americans. I’m a Canadian. I’ve worked primarily in Canada but I’ve had the great fortune to work with some incredibly talented and driven individuals from Europe, Asia, the Middle East and of course…

25th May 2023

Adopting a Security-first SDLC Approach

He just wanted a job. Or so said a self-described penetration tester who compromised the hosting platform Packagist to replace abandoned PHP modules with ones he controlled. He didn’t deploy any malicious code, just a note that he was looking for a job. His compromise could have pushed malicious code to the over 500 million…

18th May 2023

Cybersecurity Comes With a Price

Thump, Thump, Clang! Uh oh, there was clearly something wrong with the car. So I took it to the dealer to have a look. They found a bunch of typical stuff in need of attention – brake pads, tires, etc. But they also discovered a problem with the subframe; the right rear trailing arm had…

27th April 2023

Internal Audits – Keep your Cybersecurity Plates Spinning!

Plate spinning is a balancing act! While it’s hard to get a single plate started, the real difficulty is keeping them all going at once. You have to regularly check-in on the plates you started earlier – or else disaster! A good cybersecurity program will have a mix of controls, some are automated, set in…

13th April 2023

So your company needs a cybersecurity program…

Building a cybersecurity program is a challenging and time-consuming project, especially if you have a workload full of engineering or IT responsibilities. Of course, it’s even more time-consuming if you don’t already have the cybersecurity knowledge needed to just start working on it. This is a project that many companies hire new, specialized full-time employees or…

16th February 2023

Your Cybersecurity Needs a Fitness Plan

I began skiing when I was 12. I grew up in Florida, but we would come up north occasionally to visit my aunt and uncle and they would take me, my brother, and our cousins out on the slopes. I loved it and I kept skiing for many years after that. But eventually, wear, tear,…

2nd February 2023

SOC 2 Physical Security Requirements

You spend all of your time carefully configuring all of your technology and network to make it as difficult as possible for an attacker to compromise you… only for your penetration tester to walk in your front door and walk out with three laptops and a hard drive filled with your confidential data. This is…

21st December 2022

Threat Intelligence: Worry about the Right Things

Parents think about threat intelligence all the time: “what could hurt our kid?” But what exactly do they worry about? No doubt this changes as children age. There was a great article on NPR where the author of “The Paranoid Parents Guide”1 shared two lists. A list of the top 5 things parents worry about….

15th December 2022

Least privilege is key to good cybersecurity.

Last weekend, Mrs. Black and I were enjoying an all too rare dinner out together. Just the two of us at a local restaurant, while the kids were happily at home in the care of their favorite sitter. Towards the end of dinner, I got up and went to the restroom. Two minutes later, and with…

20th October 2022

Modernize your Cybersecurity Measurements

Among our various Black Family traditions, one of my favorites is reading to my kids at bedtime. It’s a great way to power down after a busy day and enjoy some screen-free, quality time together. Recently, my 11-year-old son and I have been reading Alexandre Dumas’s The Count of Monte Cristo. First published in 1844, it has…