Just like common sense isn’t always common, best practices aren’t always.  The best.  This matters when describing security controls.  And since it seems to be a professional trade secret, I want to come clean about it. There are at least three qualitative ways to describe a security control: How much it complies with something How … Continue reading →