Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
Zero trust: what it actually means and when it is worth the investment
Zero trust has become one of the biggest buzzwords in security. I break down what is behind it and who it is actually relevant for.
Colonial Pipeline: when a cyberattack stops physical infrastructure
The May 2021 Colonial Pipeline attack showed that the boundary between IT security and operational security has disappeared.
Colonial Pipeline: when cybersecurity becomes physical resilience
A breakdown of the Colonial Pipeline attack for managers: why the incident changes the security conversation for companies with physical infrastructure.
Hafnium and Exchange: the patch that waited too long
The March 2021 Microsoft Exchange mass exploitation showed that patch management is not a technical task - it is an organisational one.
SolarWinds: a supply chain attack explained for managers
What happened with SolarWinds, and why this incident changes the security conversation for companies that do not think of themselves as targets.
SolarWinds: supply chain risk now belongs in the risk model
The SolarWinds attack in December 2020 showed that trusted software can be an attack vector. What this means for how companies must think about their software suppliers.
Ransomware hits hospitals in a pandemic: a lesson for every security leader
In autumn 2020, several European hospitals were hit by ransomware attacks during the second wave of COVID-19. What this pattern tells us about operational risk.
Nine months of remote work: how the attack surface changed
By autumn 2020, companies that shifted to remote work in the spring had accumulated new security risks - often without realising it. What changed and what to look at now.
COVID phishing: how the threat landscape shifted in two months
A briefing for managers: how attackers are exploiting the pandemic and remote work, and what to do without panic.
Zoom in a crisis: the security settings managers need to check
In March 2020 Zoom went from a niche tool to company infrastructure overnight. A practical checklist for managers who are not security specialists.
VPN under load: what to check when the whole office went home
A practical guide for managers: how to assess the security and reliability of remote access during a mass shift to remote work.
Data leaks through contractors: how it happens and what to do
A breakdown of the mechanics of data leaks through external contractors, and practical access control measures.