Being an InfoSec Professional / Cybersecurity

The internet is not a highway, but security is like driving a car

I think it is safe to say that the internet is not an information superhighway anymore.  Maybe it was once, but now the interstates are threatening to become toll roads, the blue highways have sponsors and so many things are on the internet that if you do make a wrong turn you could literally end … Continue reading

Being an InfoSec Professional / Cybersecurity / Links

Misuse of the word “firewall”

Political reporters/analysts have taken to using the word “firewall”.  To which we as cybersec geeks can only respond “huh”? To be bi-partisan about it, I provide two examples. Writing about the South Carolina Democratic Party primary, CNN says “At the heart of Clinton’s strategy to sew up the Democratic nomination is the notion that minority … Continue reading

Being an InfoSec Professional / Cybersecurity

The “Big” Risk Transfer

There is time between those risk management milestones.   During that time, risk is in limbo.   During that limbo, it’s the CISO that owns the risk.  Orchestrating the transfer of risk to the appropriate risk owner is one of the most under appreciated things that a CISO does. Here’s a hypothetical example: let’s say that there … Continue reading

Breach announcements / Cybersecurity / Data Science / Privacy

When is a breach notification not a breach notification (part three)?

When it is presidential primary news.  When the “family feud” is more newsworthy than the data.  When there are no less than four parties involved who one can identify as data custodians of one kind or another. In a single sentence, the incident can be described as follows (the four data custodians are numbered in … Continue reading

I am not a number, I am a data point
Cybersecurity / Data Science / Privacy

I am not a number, I am a data point

Identity has changed.  The post-World War II generation was concerned about being identified as a number. The sight of emaciated humans with identifying numbers tattooed on their inner forearms made this very real and very scary.  By the late 1960’s the TV show The Prisoner portrayed the hero objecting on a regular basis: “I am … Continue reading

Breach announcements / Cybersecurity


Sample (analysis follows): The cyber security threat landscape is awash in an ever changing fabric of “slings and arrows”.  It’s not just a matter of “if” script kiddies will attack the enterprise but “when” nation states.  And big, big breaches. Before the 20th century, there are only two recorded Denial of Service attacks: the burning … Continue reading