Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
FSTEC Order 21: what it changes in the practical protection of personal data
The Russian market gets a more concrete language for protection measures, security levels, and threat classes. What this means for companies that process personal data.
Incident communication: who says what while the technical team still has no answers
Reputational damage from an incident begins before the technical answer arrives. The communication plan needs to exist before it is needed.
Payment infrastructure as a target: what retail teaches us
The real lesson from payment data incidents is about segmentation, logs, and response time - not just protecting card numbers.
Supply chain risk before the SBOM era: why dependencies need to be tracked systematically now
Opaque transitive dependencies are not an academic problem. They are already an active attack vector.
Touch ID and corporate identity: what biometrics is actually useful for, and what to avoid overstating
Biometrics is a convenient authentication factor - not a substitute for a proper identity architecture.
Least privilege in practice: why access needs to shrink, not just grow faster
Granting access without managing its lifecycle is convenient right up until the moment it becomes a real business risk.
The Adobe breach as a lesson in password storage and the cost of old schemes
What the large-scale 2013 breach tells us about the price of outdated secrets storage and how companies respond to incidents.
Questions the board should ask after the surveillance disclosures
Backup, jurisdiction, logging, contracts, operator access - what leadership needs to verify after the PRISM story.
After PRISM: the cloud is no longer just a cost question
The NSA surveillance disclosure turned trust in cloud providers from a technical question into a political and legal one.
Cross-border cloud: where your data physically is and how to verify it
Trust in a cloud provider requires concrete answers: where is the data stored physically, who has access to it, and how is that confirmed in practice.
BYOD stops being an IT question and becomes a management one
When employees' personal devices enter the corporate access perimeter, this is no longer a problem for the IT team - it is a decision the leadership has to make.
SIEM without maturity is an expensive noise machine
A good SOC starts with solid telemetry and defined scenarios, not with buying a platform.