Archive for the ‘Security’ Category

No more Department of No

As organisations come to terms with the impact of digital transformation, there have been louder calls for security teams to stop being the Department of No. In general terms, this is a positive trend but there is a danger for security teams as the ‘shift left’  of digital transformation exposes more and more that security teams haven’t been living the much-espoused business enablement or business partnership calls that we’ve heard so often in the past. 

Security teams need to take this as a wake-up call for to rethink what actual value they are delivering and how a change in their approach could increase the value they provide.

(more…)

A change to the cyber risk landscape

On June 27th 2017 a cyber-attack called ‘NotPetya’ was launched against a large number of firms. The attack was notable for three reasons;

  • it used a third-party software update mechanism to spread,
  • it was a geopolitically motivated destructive attack that caused extensive damage to uninvolved bystanders
  • it used automated techniques that previously were only associated with sophisticated manual attackers that reduced the time the attack took to spread across networks from days to minutes.

This has crystallised a potential cyber risk that has been a concern for some time such that untargeted and destructive attacks would become as sophisticated as manual attacks by highly capable threat actors.
(more…)

Stifling, Suffocating, Security?

Security risk management requires balancing a number of stakeholders needs. The risk owners, ultimately a board of directors of an institution, set a risk appetite (whether implicitly or explicitly) , the business managers and leaders then seek to operate within that appetite to drive growth or deliver their mission. There is commonly a tension between the hunger for growth versus the desire for safety which tends to be very easily handled at an executive level but becomes increasingly more contentious the further down an organisation a disagreement occurs.
(more…)

Talking Up Security

A keynote I gave to GDSCon 2017 on how security practitioners should engage with senior executives.

Strategic Security Management Challenges

I was recently asked by a consultancy firm to provide a keynote talking about the challenges I had faced as a security leader during my career and how the consultancy could start thinking about how to help people in my position. I appreciated the customer-first orientation they were adopting, refreshing in a world of consultancies that have a habit of leading sales engagements with why it would be both foolish and dangerous not to buy their off-the-shelf industrialised services that were designed for smaller more focused firms with less in-house capability.

Large global enterprises share much in common but the key themes of concern for a security leader in my experience are:

  • Complexity (the old enemy of security),
  • Scale,
  • Availability of the right people and
  • Culture

(more…)

Twitter RSS