Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
NIST Cybersecurity Framework 2.0: the framework gets broader and closer to business
What changed in the new version of NIST CSF and why the update matters not only to security teams but to executives who are responsible for risk management.
The Okta breach: what happens when your identity provider is compromised
A look at the Okta incident in October 2023 and practical conclusions for companies that rely on centralised authentication.
Zero trust networking: a practical starting point for non-security teams
Zero trust is talked about constantly but implemented rarely. Here is a grounded explanation of what it means in practice and where a company with limited security resources should actually start.
AI API keys are becoming the new security perimeter
Why connecting to language models through an API creates a new class of risks and what to do about it now, before the keys have spread across the entire infrastructure.
Software supply chain attacks: when the vulnerability arrives with an update
An attack delivered through a trusted software vendor is one of the hardest threat vectors to defend against. I look at how it works and what businesses can actually do.
LastPass and the lesson in secrets management: what happened and what it means
The 2022 LastPass breach became one of the most discussed incidents in credential management. I look at what happened and what conclusions matter for business.
Identity after the perimeter: what zero trust is and why founders need to understand it
The corporate perimeter has ceased to exist. A breakdown of what this means for security and what practical steps follow from this logic.
SSO and SaaS sprawl: why identity architecture matters before the breach
How the accumulation of SaaS tools creates an identity problem that security tools alone cannot fix - and what to do about it before something goes wrong.
Ransomware in 2022: operational continuity matters more than antivirus
What the LockBit wave says about how companies should think about protection - not as a technical task but as an operational one.
The Okta breach: what it means when an identity provider is compromised
In March 2022 Okta confirmed a breach. A look at the lesson a director should take from this, not just a security specialist.
Log4Shell: the management lessons from the incident
Breaking down the Log4Shell vulnerability as a management lesson - about hidden dependencies, response speed, and invisible risk.
Log4Shell: if you do not know your dependencies, you do not know your attack surface
The Log4Shell vulnerability showed that most companies have no idea which libraries are running inside their systems.