Why blaming people for incidents is self-defeating — “Human Error” is a favorite go-to when explaining a cybersecurity incident. Those pesky people! Even I have been known to say that our security jobs would be much easier if we worked with dolphins, instead. And I was only half joking. …

We Are All The Exception To The Rule — Recently, I attended a closed door meeting where a bunch of really smart and experienced security leaders talked about security stuff. As we delved into security trends and issues, the only common thread was that all the leaders had different ideas: what was important, what was urgent, how to address…

What Directors Should Be Doing To Manage Cyber Risk, and Why They Don’t — We live in interesting times. Not so long ago, security was seen as a technology problem, to be managed by technologists. It was the domain of techno geeks and hackers, an annoyance that never rose to the level of c-suites and board rooms. Early frameworks contained an acknowledgement that security…

Questioning a basic tenet of Security — I’ve been thinking a lot about Identity lately. It’s part of the Zero Trust philosophy, it’s a fundamental element of security, and it was Identity Management Day on April 12. …

Stories We Tell Our Security Selves, And A Call For Change — I believe that to be a successful cybersecurity leader you need to be a good story teller. My belief in this principle stems from years of trying to convince stakeholders to invest in security programs, to foster engagement in security problems, and to stop stakeholders from being the cause of…