I’ve recently been involved in some strategic cyber security work in the UK financial services sector. The financial services sector is a complex and coupled system. While some components are clearly more important there are few components that are inconsequential if they cannot be relied upon. No financial services organisation…
Tag: security
Cyber’s Dirty Secret?
In 2011 the U.S. Securities and Exchange Commission (SEC) issued guidance on the disclosure of Cyber risks and Cyber incidents where they may significantly affect the risk of investing in the company reporting to the SEC. This was controversial at the time and has led to an interesting revelation recently; many of the biggest…
Security defect triage in delivery projects
The guys at Recx asked me to look at a draft of their recent blog post ‘The Business v Security Bugs – Risk Management of Software Security Vulnerabilities by ISVs where they describe some of the business constraints and influences on security defect triage for Independent Software Vendors and make the…
How to develop a security test strategy, part one
This is the first of a series of posts describing how to put together a security testing strategy and the associated test plans. Part two is here and part three is here. What is a security test strategy A security test strategy is a key document deliverable to get into…
User-Sourced Security Monitoring
One of the constant challenges I face delivering big systems is meeting the protective monitoring requirements. A lot of the requirement to spot technical events (low level network probing, back door installation, beaconing and command and control channels) can be covered with a bundle of vendor products integrated into a…