Writing

Security Blog

  • CISO TALK: Navigating Boardroom Realities and Liability
    CISO TALK: Navigating Boardroom Realities and Liability

    I appeared with Mitch Ashley and JJ Minella on Techstrong TV to discuss the realities of a CISO’s journey into the boardroom, liability, and the SEC’s new disclosure rules.

  • 6 Steps to Landing a Job in Cybersecurity
    6 Steps to Landing a Job in Cybersecurity

    Looking to move into a cybersecurity career? Start with these six steps to evaluate and prepare yourself.

  • Why assessing third parties for security risk is still an unsolved problem
    Why assessing third parties for security risk is still an unsolved problem

    A recent ranking of the most cyber-secure companies reveals weaknesses in current third-party risk management practices. A Forbes article is making the rounds right now about America’s most cyber-secure companies, and I can already see the cybersecurity outrage machine up in arms. Full confession: I haven’t yet read the article, but I’m about to. I’m writing this…

  • Learning More from Accidents
    Learning More from Accidents

    When accidents happen, there’s a seductive call to look for a root cause – that is, a chain of events without which, the accident would not have happened.  In hindsight, root causes are apparently easy to identify; one works backwards from the accident, identifying causal threads until reaching the “root cause.”  It’s simple, and it’s generally wrong.…

  • Software liability reform is liable to push us off a cliff
    Software liability reform is liable to push us off a cliff

    Regulatory mandates for software security like those in the Biden Administration’s National Cybersecurity Strategy could cause more problems than they solve. Like “SBOMs will solve everything,” there is a regular cry to reform software liability, specifically in the case of products with insecurities and vulnerabilities. US Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly’s comments this…

  • What the Uber verdict means to CISOs: You’re (probably) not going to jail
    What the Uber verdict means to CISOs: You’re (probably) not going to jail

    CISOs and potential CISOs worried about criminal risk won’t go to jail if they follow four simple steps. There seem to be two reactions to the verdict in the Sullivan case. One reaction, often from CISOs already stressed by being outside the room where it happens, is to decide that being a CISO isn’t worth the risk…

  • TikTok resets the clock on security leadership
    TikTok resets the clock on security leadership

    Roland Cloutier is stepping down as global CSO to become a strategic advisor to TikTok’s CEO. The clock is ticking on the CSO succession plan. The best time to do succession planning was last year.   But the next best time is right now. The news this morning that Roland Cloutier is stepping away from the TikTok…

  • We don’t need another infosec hero
    We don’t need another infosec hero

    By setting yourself up as the defender, the solver of problems, you cast your business colleagues as hapless victims or, worse, threats. This is not a useful construct for engagement. There’s this belief among a lot of security professionals that we are special, in that we are the defenders of our companies.  We like to…

  • The cloud security emperor has no pants
    The cloud security emperor has no pants

    “Shared responsibility” usually means that no one is responsible for minding the gap. Don’t fall in. As anyone who has worked on a cross-functional team with no clear owner knows, “shared” or “joint” responsibility often means that everyone assumes that someone else is taking care of the problem. Without clear effort to make sure that…

  • The security user experience (SUX)
    The security user experience (SUX)

    Security processes that treat the very users we protect as unwanted burdens and alienate them in the process are a path to failure. The next time you receive a phishing email, forward it to wherever your organization tells you to report phishing attempts.  What response would you appreciate? Maybe a brief thank you or follow-up…

Leadership Newsletter

  • Kindle a light, not a bonfire
    Kindle a light, not a bonfire

    Leadership Moment: Spotting burnout A quick-read article on HBR covers burnout, when chronic stress creates a sort of perpetual exhaustion, and spotlights six categories of stress: workload, values, reward, control, fairness, and community. While I haven’t yet read the source book (The Burnout Challenge: Managing People’s Relationships with Their Jobs), I’d likely place “control” as… Read this …

  • Notice who you take for granted
    Notice who you take for granted

    Leadership Moments: Make-A-Hero David Ortiz – Big Papi to Bostonians – was recently honored by Make-a-Wish for his work in the community. By granting the wishes of children with critical illnesses, Big Papi has brought a little more light into the world; it’s a use of his position and celebrity that exemplifies sports leadership. It’s… Read this …

  • Plan for the future
    Plan for the future

    Leadership Moment: Founder’s Syndrome Founder’s Syndrome occurs when a company founder remains in control for too long. Their approach, which might have been fantastic a decade ago, may no longer be appropriate for the situation that they find themselves in. While they might ostensibly be seeking a successor, what they seem to be looking for… Read this …

Fiction