Along with many, I’ve found David Bianco’s Pyramid of Pain to be a really useful rubric to understand breaches. It’s held up really well over the years (circa 2013!) and across a myriad of incidents. …

Time appreciation, asking the right questions, undigitize, scoping… a partial recipe for success — I’ve had the chance to attend a few hackathons over the past few years either as a mentor, volunteer, or sponsor. This past weekend I was at UCLA for LAHACKS, a huge hackathon focused on social innovation held every year. Hackathons are gatherings of people who spend a short time…

This month’s House Oversight & Government Committee report about the Equifax data breach is worthwhile reading for cybersecurity practitioners. The ~100 page document is instructional with implications across the gamut of security functions: compliance and governance, crypto, DFIR, vulnerability management and remediation, and so on. While some of the shortcomings…

I recently delivered a presentation to members of ISACA’s Toronto Chapter. I’ve taken the research and feedback from the talk to draft an article about the implementation and management of a risk register. Thank you to those who attended, and I look forward to readers’ views in the comments! Introduction …

A recent GAO report examines the maturity of 24 US Government departments’ security regimes. While subject to different standards and regimes, enterprises face similar challenges as the agencies mentioned in the report. For example, “Twenty-three of the 24 agencies did not have effective processes for remediating information security weaknesses.”* Remediation is hugely challenging as it tends to involve a cross-section of teams and multiple stakeholders. Remediation projects can have significant budgetary implications. It’s critical to maintain an integrated risk registry with ownership within the governance team to drive remediation in a deliberate manner. Remediation can be linked explicitly to personnel metrics of success to elevate its importance.

Who are you, and what do you want? A system is only as secure as the weakest security control deployed to protect it; typically, that starts with an identity and access management (IAM) system as the highest priority control: who can access a given object or resource, and how? The…

The Federal Risk and Authorization Management Program (FedRAMP) is a compliance regime to which cloud vendors (i.e. Cloud Service Providers) selling to government agencies are subject. Compliance with FedRAMP is a mandatory step for vendors with cloud-based SaaS/IaaS/PaaS/etc offerings to work with and support agencies. Once complete, a FedRAMP assessment…

2017 marks the 10-year anniversary of Cisco’s declaration that “botnets are the primary security threat on the Internet today.” At the time, it was consumers’ access to broadband connections that gave botnets the ability to launch distributed denial of service (DDoS) attacks; today, unsecured Internet of Things (IoT) devices on…

The business case for establishing a Cyber threat intelligence (CTI) capability is getting stronger in some sectors and verticals, and is becoming a focal point for corporate information security teams. In this brief article, I’d like to summarize some considerations and issues related to building capacity in this area. CTI…