What I’ve learnt writing cyber strategies with grand scopes
As part of my new role, one of my first tasks has been to develop a cybersecurity strategy for the Health and Social Care sector. I was recently asked: “How…
Why I don’t like PIGs in Security Risk
Probability times Impact Graphs (PIGs), sometimes called a risk matrix, are endemic in security risk assessment and management. They were adopted decades ago and embedded within standards and practices. They’re…
Security Folkways and Deliberate Security Culture
Security culture remains an elusive amorphous ‘thing’ that we all aspire to improve but don’t really understand why or how. This is not unusual in organisations and institutions who try…
Homebrew Monte Carlo Simulations for Security Risk Analysis Part 2
Previously I wrote about how I had implemented the simple quantitative analysis from Doug Hubbard’s book ‘How to measure anything in cybersecurity’ into javascript. When I wrote that code for…
What are we missing in risk?
I’ve recently been talking with some executives who bemoan the risk management in their organisations. They don’t trust the risks as they are presented and worry about putting their finite…
Open Security Summit 2020
This was a busy week but once again the Open Security Summit proved why it is one of my favourite events on the security calendar. There is now a huge…
Commercial & Government Cyber Conversation
In these remote-first times I recently took part in a zoom conversation led by Henry Harrison at Garrison on the growing similarities between commercial and government cyber security. I was…
Through the barricades..
I was speaking with a peer recently about the value of bow-tie diagrams and how they allow you to separate controls from mitigations and it became obvious I was using…
Capital One Data Breach 2019 – So what are we learning? (1 of 3)
This is the first installment of a three part series.. Over the next three installments, let’s work through the reality of the following questions in light of the recent Capital…
Cybersecurity Metrics: Are we fooling ourselves?
UWEBC INFORMATION TECHNOLOGY PEER GROUP MEETING Value of IT: Using Metrics to Build a Narrative of IT’s Impact within the Enterprise July 23, 2019 09:00 AM – 03:00…