What do you think this is?

Some major breaches have seen the light of day lately, and everybody agrees that they will keep coming. I don’t believe you will find any security professional respecting himself to tell you that this will stop. The reasons are many, but the most important one is the (lack of) security design. Systems, processes and services have been moving to production without security design for years. And unfortunately in many cases they still do.

In our (security) profession it is becoming common to jump on each other’s throat; and the result is the public blaming of the CISO involved - like leaving them alone to take some hard steps in the middle of no man’s land.

Read more ...

Building a Security Operations Center from scratch is not an easy thing. But since it’s not the first time I’m doing it, I am familiar with the challenges. These challenges include the building of the processes in a company-adjusted manner, the selection of the toolset and integrations to match the company’s enterprise architecture, network architecture and of course my own security architecture, but nowadays, and due to the significant skill shortage in cybersecurity the major challenge is finding the right people.

Read more ...

A common problem for information security professionals, is that security is perceived as a business blocker; hindering the operational efficiency and adding controls that make everybody’s life more difficult. But is this actually the case?

Read more ...