Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
Patching CVEs is a business decision, not just an IT task
Why vulnerability patching keeps getting delayed, what the real cost of that delay is, and how to frame it so it gets prioritised.
Privileged access: the insider threat matters more than the outer perimeter
Why controlling privileged accounts is the most underrated security lever for a manager, and how to set up sensible protection.
Password reuse is a corporate risk
How data breaches at third-party services become a threat to corporate accounts.
Access rights that outlive the employee
Why revoking permissions at offboarding is not a formality, and how to keep it from falling through the cracks.
NIST Cybersecurity Framework as a language between security and management
What the first version of NIST CSF offers and why it is primarily a risk management tool, not a technical standard.
Privilege escalation: why access control is an operations problem
Why most serious incidents begin inside the perimeter, and how to think about privilege management as a continuous process rather than a project.
Shellshock: when the old foundation becomes an attack surface
What the bash vulnerability says about the risks embedded in long-running infrastructure, and why this is a conversation for management, not only for the security team.
After Heartbleed: the audit you actually need to run
Nearly two months have passed since Heartbleed was disclosed. A look at what is worth checking and doing if you have not done it yet.
Heartbleed: when someone else's code becomes your problem
The OpenSSL vulnerability showed how much business depends on invisible components that nobody controls and nobody is accountable for.
The Target breach and the end of perimeter security
What the largest retail data breach on record says about why protecting the perimeter is no longer a viable security strategy.
Multitenancy and trust boundaries in SaaS
Where the convenience of a shared platform ends and the noisy-neighbour risk begins.
Personal data compliance is not just a legal problem
Data architecture and access controls directly shape legal risk. Technical decisions made today will become legal problems tomorrow.