Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
An encrypted backup is not a backup: what ransomware changed
Ransomware made the standard backup scheme insufficient. Here is exactly what to check.
Security incident response: who makes the decisions
During an incident there is no time to build a command chain on the fly. I look at what needs to be defined in advance and why this is a management question, not a technical one.
Ransomware in 2016: this is an operational threat, not an IT incident
The ransomware wave in early 2016 shows that encryption attacks have become a business continuity problem, not just a security one.
Breach notification delay: the management risk that gets underestimated
Companies discover breaches months after the event. I look at why this is a leadership problem, not just a security team problem.
Energy grids and ICS security: the control system is no longer separate from cyber risk
Why attacks on industrial control systems have become a reality for the energy sector, and how managers need to rethink security for OT infrastructure.
Patching CVEs is a business decision, not just an IT task
Why vulnerability patching keeps getting delayed, what the real cost of that delay is, and how to frame it so it gets prioritised.
Privileged access: the insider threat matters more than the outer perimeter
Why controlling privileged accounts is the most underrated security lever for a manager, and how to set up sensible protection.
Password reuse is a corporate risk
How data breaches at third-party services become a threat to corporate accounts.
Access rights that outlive the employee
Why revoking permissions at offboarding is not a formality, and how to keep it from falling through the cracks.
NIST Cybersecurity Framework as a language between security and management
What the first version of NIST CSF offers and why it is primarily a risk management tool, not a technical standard.
Privilege escalation: why access control is an operations problem
Why most serious incidents begin inside the perimeter, and how to think about privilege management as a continuous process rather than a project.
Shellshock: when the old foundation becomes an attack surface
What the bash vulnerability says about the risks embedded in long-running infrastructure, and why this is a conversation for management, not only for the security team.