Category: Leadership

Defense

Changing a security posture requires changing your own behaviours

I’m sure you will have had a marketing firm or some random sales person on Linkedin tell you that security should be simple and that their product will save you from all the ATPs and nation state hax0rs under the sun. However let’s get real, thats almost certainly not true and also security isnt simple or we’d all be out of jobs and everyon woulndn’t be getting owned all the time.

Getting real
I think there’s a huge honestly part that needs to occur if you are going to actually improve a companies security posture.

Leading and acting in a manner which doesn’t contradict the message

Don’t be unrealistic – absolute security doesn’t exist, if someone is talking in those terms they are probably bullshitting and are highly unlikely to be an actual practitioner

Sort out the commmon vectors, phishing and exposed insecure configurations are clearly areas to focus on but also you should assume breach and harden the inside of your networks! (too many people don’t do this)

People like efficiencies, improvements when they don’t have to be the change, chaning behaviours is really hard.

Technology costs money, I hate to break it to people but if your approach to technology management is solely on the bottom line that is going to have a significant impact not only on your business operational capabilities but from a security point of view you are likely going to be in a weak posture. Don’t get me wrong you don’t need to buy ALL the things but expertise, logging, monitoring and management tools/technical tools cost money. Don’t shoot the messenger but don’t expect the moon on the stick either (it’s just not realistic).

Cyber Criminals operate in all time zones, your staff likely use company computing assets across a range of hours and probably sometimes in the evenings and weekends. Your security operations capability needs to be able to cover this (accepting the risk entirely is a bonkers idea, at least put people on call, oh and that means paying them too!)

The biggest improvement step to me is the cultural one, it’s the change from ignoring, assuming it ‘won’t happen to me’ and when people who are in leadership and management positions stop using bad practises. Being honest and recognising security is a challenge, it’s not a project, it’s a way or running and managing technology services.

By having a strong security posture you will need far deeper knowledge of your business, it’s assets and it’s customers. This sounds like a massive business advantage to me!

Defense

Cyber Security Assesments for Normal People

Ok so you might think I’m mad with the title but bear with me!

So, the world is in an interesting place, we’ve got a pandemic, we’ve got prolific cyber crime and we have all kinds of different views on how we should tackle this problem.

Now I love a framework and there’s ton’s of them. But the truth is they are complex, detailed, nuanced and generally require a level of nerd that a lot of organistaions do not have.

In 2020 during the pandemic I decided to try and write something to simplify this position, whilst I didn’t want to be too narrow, I wanted to try and capture the breadth of cyber security that is relevent to the general purpose organistaion. I came up with a set of 140 questions which I believe are a good take on things to consider and ask when conducting a security review at a high level. (yes 140 questions is a high level view, this stuff is complex as hell at the detailed end of things, and the devil is in the detail).

Read more “Cyber Security Assesments for Normal People”
Leadership

A Small Measure of Cyber Peace

The still of cyberspace

The alert queue is empty, the estate is patched, the whirr of fans hums in the background. In marketing everyone wants to be excited and to talk about the next big thing. Whilst the physical and digital worlds move at breakneck speed, there’s sometimes the opportunity to be still, to have no incidents to respond to, to have no major changes. These times can be rare, but they are also needed.

Often when I look at and use cyber maturity frameworks there is a lot of focus on cyber capabilities rather than business capabilities that are cyber enabled. What do I mean by cyber enabled? Well, you see, the way I view this game is that much like the roads serve no purpose if they are not travelled, cyber security capabilities are similar. What organisations should be looking for in my view is cyber enablement of the business rather than security as a separate domain. Integrating customer experiences with technology in a secure manner and adding value are often areas I see people not focus on. It’s a similar story with service management, the focus can be on the activity rather than the business outcomes that are enabled by digital services.

Read more “A Small Measure of Cyber Peace”