Cybersecurity Programs

25th August 2022

Communication, not computers, is the key cybersecurity leadership skill.

CFO: You’re asking for a security budget increase of 20% from last year and we’ve already reached our ratio on technology spend. CISO: …but our budget was cut 30% the year before due to other strategic projects and we haven’t addressed some key gaps… CFO: We didn’t have any security issues last year though and…

18th August 2022

Nudge your way to better Cybersecurity

Our local post office parking lot was under construction for many months. I have no idea what they were working on and it would not be notable except… … it used to be super-convenient to mail letters* there. [*Yes, those physical paper things. What can I say, I have a certain nostalgia for an age gone…

21st July 2022

Don’t Flip-Flop on Defense-in-Depth!

We just returned from our annual vacation on Cape Cod. It’s always been an ideal place to relax and recharge. This year was no exception, thanks in no small part to seven days of picture-perfect weather. But it wasn’t entirely stress free. That’s because on the very first day, my right flip-flop broke. I know, I know,…

7th July 2022

Applying Mazda’s “Gram Strategy” to Cybersecurity and Risk Management

Imagine being sixteen years old, gassing up your mothers old Chevy Cavalier and seeing a sleek smurf-blue roadster zip past the gas station. Time stops. You immediately fall in love with it. Time starts again, and you disappointedly climb into your mom’s clunker and sullenly drive yourself home. You spend the next twenty years thinking…

23rd June 2022

The Purses and Flagpoles of Security Policies

I never knew what a danger soccer moms’ purses were. That is, until I attended my very first professional soccer game at Gillette Stadium. A friend of ours invited a few families to join them to watch the game. Until a few hours before arrival I could not have confidently named the home team. It’s…

26th May 2022

Guide to SOC 2 compliance documentation

Nobody really wants to do their homework. Which is unfortunate, because homework plays an important role in helping to absorb, retain, and learn to use the information someone is studying. In the security and compliance world, writing documentation is the homework. It helps employees standardize the right policies and procedures to successfully reduce risk and…

5th May 2022

When your Business Continuity/Disaster Recovery Plan is a Disaster…

Picture it: As a part of your new job running a corporate SOC 2 compliance program, you’ve started the arduous process of reviewing old documentation. Most of it is in pretty good shape…until you come across the Business Continuity/Disaster Recovery (BC/DR) Plan. While your company’s name is all over it, the instructions for temporary physical…

21st April 2022

Patching Keeps the Lights On (Except when it Doesn’t)

You probably don’t give much thought to lightbulbs. I wouldn’t either, except that somehow, we own a house with lots of them. We have so many that in any given week, one, two, sometimes three of them burn out. And (of course), they are not all of the same type. Some are floodlight bulbs. Some…

24th March 2022

I have “Zero Trust” in VPNs.

You should probably have zero trust in your VPN service: You’re enjoying a quiet Friday afternoon in your office when you receive a stomach-dropping alert from one of your systems. A co-worker of yours, Jane, has exfiltrated thousands of your customer records from the company database. A distraught Jane is questioned by human resources, she…

17th March 2022

Don’t be an Attacker’s First Option

Longtime readers of this blog (thank you!) know that for the past several years, I have been coaching the basketball teams of both of my children. When the kids were really little, it was mostly about teaching fundamentals and getting them comfortable with the rules of the game. However, now that my son is playing…