Microsoft CVEs, MITRE ATT&CK, and what Secure by Design Cannot Fix
Did you know that 70% of Microsoft CVEs between 2006-2018 were memory safety bugs? How hardware Secure by Design can help...and how it can't.
Security
39 posts
The Identity Lesson You Must Learn From Midnight Blizzard
Endpoint security is not the fulcrum around which you should be building. You'll miss a lot if you do.
Vulnerability Management: Reactionary Security FUD At Its Worst
There's no such thing as a critical vulnerability, generically. There's only a critical vulnerability that can be exploited in your environment, specifically.
The Missing Key To Understanding How the Midnight Blizzard Attack Worked
How does compromising an app in one tenant get you into another tenant? There is a key piece of info that will help you to understand.
“Materiality” Relies on Risk Quantification—Which Is Why Many Businesses Struggle to Understand It
The ambiguity of "materiality" is an invitation to risk management maturity.
Understanding the Evolution of “Tier 0” in Modern Access Control Models
Does "Tier 0" still matter? Yes and no. Yes, as a principle; No, as an access control model. Here's what to do instead.
How to Build a Thriving Career in Cybersecurity (and beyond)…Without Burning Out
I've learned most of these lessons the hard way. Here's 6 key things to consider.
Security and Compliance Aren’t the Same—But They Both Have the Same Objective
Two lenses, same objective: risk management.
Why CISOs Don’t Want Tool Jockeys…And What They Want Instead
What skills do CISOs want, more than technical skills? What should you prioritize, to stand out from the crowd?
Interacting With CISOs: 4 Tips for Security People
Authenticity doesn't guarantee success, but the lack of authenticity guarantees failure. Here's a few things to consider.