Recent Posts

Why perpetuate the lie?

Why perpetuate the lie?

We are all happy with our past companies, our past managers, and never argue with people. We always try to find a common ground while making concessions, and the people we interact and discuss with are never wrong. Oh, and the sun sets in the east (as true as the previous statements).

A leader uses DNS to educate

A leader uses DNS to educate

Once upon a time I spent a total of 4 hours (over three days) in meetings, stating that I will definitely not approve a security exception. At least, not until someone demonstrates that the exception requested, removes the root cause or is a valid workaround.

What to do with the center of security?

What to do with the center of security?

Some years ago, during a (quite extended) phishing avalanche in the company I was at the time, the (then) CIO said: Let's fire every user that falls for a phishing mail! That will solve the problem for good. I considered it a joke, and I replied pretty much with a rhyme: Let's train them before we blame them and I didn't give it a second throught. We went on to deploy some training modules, but never really implemented the technical controls on the mail server; an activity that if had been implemented, several of those phishing mails would never have entered the company. I think that this is not strictly a user failure and I'm inclined to blame the IT deparment more than the user.

Sailing as an infosec lesson

Sailing as an infosec lesson

Last Thursday I took my CRISC exams and - the restless person I am - I had already arranged to take sailing classes over the weekend. I always wanted to take sailing classes, and I had gone sailing once several years ago when I was still living in Greece. My idea was that when I grow old I will buy a small sailing boat and sail around my beloved Crete.

Steps in no-man's land

Steps in no-man's land

Some major breaches have seen the light of day lately, and everybody agrees that they will keep coming. I don't believe you will find any security professional respecting himself to tell you that this will stop. The reasons are many, but the most important one is the (lack of) security design. Systems, processes and services have been moving to production without security design for years. And unfortunately in many cases they still do.

In our (security) profession it is becoming common to jump on each other's throat; and the result is the public blaming of the CISO involved - like leaving them alone to take some hard steps in the middle of no man's land.