Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
Contractor and vendor access: an underestimated risk point
Third parties with access to your systems are one of the least-controlled security perimeters. How to think about this from a management perspective.
The Capital One breach: the cloud is not to blame, configuration is
In July 2019 Capital One lost data on over 100 million customers. I look at what happened and why the main lesson is not about the cloud - it is about access management.
Cloud security after the first wave of containers: more than just the network
Why the perimeter security model does not work in a container environment - and what actually needs protecting instead.
Attack through a software vendor: when your perimeter starts elsewhere
Why a compromise of third-party software is a threat to your infrastructure, and how to think about managing this risk.
GDPR: nine months in and the first major fine
In January 2019 Google was fined 50 million euros under GDPR. What it means and why having a privacy policy is not the same as actual compliance.
Data breach: what to do in the first 72 hours
A practical breakdown of how companies respond to personal data incidents - and why most of them get it wrong.
GDPR: lessons from the first months of enforcement
What the first weeks of real GDPR enforcement revealed, and how it changes the practical approach to handling personal data.
GDPR: personal data becomes an architecture problem
What GDPR changes in how companies must design their systems, not just what policies to write.
Cambridge Analytica: a data governance lesson beyond platforms
What the Facebook and Cambridge Analytica story means for ordinary companies - not platforms, but those that use data about people in their daily work.
GDPR data inventory is not a legal task
Why the personal data register that GDPR requires is operationally useful - and how to build it properly before the regulation comes into force.
Meltdown and Spectre: when the CPU layer became a security problem
What processor vulnerabilities mean for executives, and why they change the conversation about security at the infrastructure level.
GDPR takes effect in six months: what companies with EU exposure need to do
The European data protection regulation goes live in May 2018. Companies with European customers or offices are required to comply, regardless of where they are based.