Jul 31Member-onlyNew (And Not So New) Roles in SecurityIt’s Not Just About Engineers — Every security leader is required to build a security team that can manage an organization’s security risks and requirements. Historically, that has meant hiring security engineers, architects or technical analysts. After all, security is a technically-driven profession. It’s true to say that technical resources (that is, folks who build, maintain…Cybersecurity5 min read
Jul 8Human Error in CybersecurityWhy blaming people for incidents is self-defeating — “Human Error” is a favorite go-to when explaining a cybersecurity incident. Those pesky people! Even I have been known to say that our security jobs would be much easier if we worked with dolphins, instead. And I was only half joking. …Cybersecurity4 min read
Jun 1Security: Putting It In ContextWe Are All The Exception To The Rule — Recently, I attended a closed door meeting where a bunch of really smart and experienced security leaders talked about security stuff. As we delved into security trends and issues, the only common thread was that all the leaders had different ideas: what was important, what was urgent, how to address…Cybersecurity4 min read
May 10Board-Level SecurityWhat Directors Should Be Doing To Manage Cyber Risk, and Why They Don’t — We live in interesting times. Not so long ago, security was seen as a technology problem, to be managed by technologists. It was the domain of techno geeks and hackers, an annoyance that never rose to the level of c-suites and board rooms. Early frameworks contained an acknowledgement that security…Security7 min read
Apr 18Attempted Murder of a Sacred Security CowQuestioning a basic tenet of Security — I’ve been thinking a lot about Identity lately. It’s part of the Zero Trust philosophy, it’s a fundamental element of security, and it was Identity Management Day on April 12. …Cybersecurity5 min read
Mar 13Once Upon A Time In SecurityStories We Tell Our Security Selves, And A Call For Change — I believe that to be a successful cybersecurity leader you need to be a good story teller. My belief in this principle stems from years of trying to convince stakeholders to invest in security programs, to foster engagement in security problems, and to stop stakeholders from being the cause of…Security7 min read
Feb 6Non-Security Things That Can Sink A Security ProgramDon’t Look Up — Security professionals have a tendency to take ownership of lots of stuff. We carry the fate of our companies in our hands, and take the responsibility for protecting our organizations to heart. …Cybersecurity7 min read
Jan 42020…2?5 things that won’t change in Information Security — and why that’s a Good Thing. — This is the time of year for predictions. What will the next 12 months look like? What should we expect? What do we need to prepare ourselves for in the months ahead? Thinking about the future, looking into a crystal ball, is an important activity for information security leaders. We…6 min read
Oct 22, 2021Six Things To Know About Dorothy#ShareTheMicInCyber — It’s that time of year again, where we take some time to share the voices of underrepresented people in cybersecurity. The hope, of course, is that minorities in cybersecurity are heard as often as everyone else’s — but we’re not there yet. So until then, I am happy to be…Cybersecurity3 min read
Jan 23, 2021Security Leadership: Moving OnHow to Know When It’s Time To Go — This week, after spending more than seven years as CISO, I resigned. It was lovely to get an avalanche of good wishes from colleagues and teammates. I’m excited about my future opportunities. I was asked “why now?” and my response was “because I knew it was time”. …Security6 min read
