Posts Tagged ‘management’

Don’t over think cyber risk

I have been overthinking cyber risk. I’ve been trying to build a reliable model that I could rely on to mechanism my risk assessments. I’ll continue to refine my ideas because I enjoy the intellectual challenge. However, I am of the opinion that until we have the cybersecurity equivalent of Fischer Black, we need to accept the inherent inaccuracy of cyber risk modelling and use it to support quick decision-making rather than build grand unifying frameworks that ultimately only serve to mislead us further. It’s vital to start scouring the vast quantities of data we create for feedback on our decisions rather than try to base them on a level of knowledge that is not achievable.

At this point in state of the art, cybersecurity risks may be too hard to model reliably due to many factors. That is not to say that cyber risk assessment shouldn’t happen, as Jack Jones says “You can’t avoid measurement“, but the limitations of cyber risk management should be recognised, and any strategic response to cyber risk should account for that.
(more…)

Talking Up Security

A keynote I gave to GDSCon 2017 on how security practitioners should engage with senior executives.

Strategic Security Management Challenges

I was recently asked by a consultancy firm to provide a keynote talking about the challenges I had faced as a security leader during my career and how the consultancy could start thinking about how to help people in my position. I appreciated the customer-first orientation they were adopting, refreshing in a world of consultancies that have a habit of leading sales engagements with why it would be both foolish and dangerous not to buy their off-the-shelf industrialised services that were designed for smaller more focused firms with less in-house capability.

Large global enterprises share much in common but the key themes of concern for a security leader in my experience are:

  • Complexity (the old enemy of security),
  • Scale,
  • Availability of the right people and
  • Culture

(more…)

Not so basic but definitely essential.

We keep talking about new shiny, and increasingly fragile, controls that will prevent attacks or fiendishly clever algorithms or AI to which we can outsource all that hard or fast thinking we’re not good at but we are all still staring down the barrels of a loaded data breach gun waiting for it to go off. The thing is we seem to be holding that gun to our own heads and it’s not like we don’t realise. All the talk of ‘basics’, ‘essentials, ‘foundations’ points at a relatively common set of issues usually focused on some combination of the following:

  • IT Maintenance (patching, replacing end-of-life platforms, inventories, baseline builds etc),
  • Network security (internal segmentation),
  • Access Management (efficient joiners, movers, leavers processes, privileged user management)
  • Security Monitoring (effective visibility),
  • Incident Response (tested plans, exercised staff)

(more…)

Cyber Resilience: Part Six Recommended Reading

 

Here are the sources used when developing the thinking behind this blog series:

(more…)

Twitter RSS