Tag: Strategies
Stalking is an issue that many CISOs have faced, sometimes unexpectedly. Some stalking cases clearly fall within our job duties. For example, an employee using company IT resources to harass or spy on another individual, employee or not. In these kinds of cases, it is clear that the security team must reach out to the…
Read MoreExecutive impersonation scams are on the rise, costing businesses billions of dollars annually. Organizations of all sizes can be targeted and fall victim to these crimes. Understanding how these crimes are committed and the numerous variations and vectors of attack will help reduce the possibility that your organization will be victimized. Overview Let’s face it,…
Read MoreSometimes we all feel like we’re losing the security game. But, just like when you’re losing the Craft of Minewar, you can use add-ons to energize your security game. Here are seven definitive things you can put into your security program to guarantee a winning score. 1. Filter inbound Internet app access. You are often…
Read MoreThe constructs of a business model canvas are rooted in scientific modeling, business modeling, and system information modeling—all driven by logic. The business model canvased is modeled using the following: Inputs (This is what we want to do) What are our goals and objectives? (Value Proposition) Who and where do we need to engage…
Read MoreWhat better way to diagnose a failed security program than to point at an inferior assessment of risk? If an organization omits or misjudges a critical risk, then the decisions that flow from that finding will be incorrect. A problem with standardizing risk assessment is that the measurement of relevant risk is going to…
Read MoreSecurity issues are so prominent in most customers’ minds that CISOs are being pulled into the sales cycle more and more often. In the face of increasing cyber attacks, customers are understandably questioning the resilience of products and services. Even businesses outside of the tech industry are facing scrutiny from customers and major suppliers since…
Read MoreAll too often, I hear colleagues wax poetic on the disdain their directors and managers have towards the mission of cyber security. I’m always eager to provide some sage couples counseling wisdom toward these difficult relationships between CISOs and their colleagues. 1. Designate FUD as your Friend rather than Adversary Someone once said that Fear,…
Read MoreAh, CISOs. Such magnificent and noble creatures. There’s such a wide variety in the wild that you might have a hard time believing they are all part of the same species. Let’s take a short field expedition to familiarize ourselves with a few common varieties. And wipe all that sunscreen off your face, you won’t…
Read MoreThere’s an expression in geekdom called “yak shaving” that refers to doing busywork that appears important but is actually useless. The essence is that yak shaving is easier to do than dealing with the actual problem at hand (which is often complex and hard).1 Too Much Security Awareness Training There’s only so much security training…
Read MoreIn Part I of this blog series, we introduced information modeling as a method to reduce compliance gaps. In this blog, we create a master model of protection based on the business model of a fictitious company called Eclipse Cloud Services (ECS). The master protection model forms the basis of contextualizing access to the infrastructure,…
Read More