Connect/Okta and Identity Sync Hardening
One area commonly overlooked (by defenders, but not by attackers) is identity sync infrastructure. If you harden your AD but don't do this, you are wasting your time.
Security
39 posts
The Fish, the Fishbowl, and All the Things We Thought We Knew
The fishbowl distorts perception, but in a way which confirms our biases. How does this hurt us in security and transformation, and what should we do about it?
Business Leaders: How to Help the Technologists to Help You
We all sometimes need to be reminded that security risk is not the only risk, and sometimes not even the most important risk, that a business faces.
It’s Time to Retire “Attackers Only Have to be Right Once; Defenders Have to be Right 100% of the Time”, and Here’s Why
Along with "people are the weakest link", this phrase has been shaping unhealthy cultures in security for years. It's time to stop saying it, and here's why.
What Should be the North Star for Your Career Focus?
What voice do you want to have in the world? Never, ever give yourself so fully to what you're doing now that it undermines your development into who you want to become.
G before RC
The order of the letters in "GRC" is not arbitrary. If you don't Govern your environment well, you cannot manage Risk and Compliance well.
What Moves the Cyber Resilience Needle the Most? It’s Probably Not What You Think
It's simple, but it's not easy: if you change the tech but not the culture, none of the gains you realize in the short term will be sustainable in the long term.
When To Say No To A Good Opportunity
Sometimes an opportunity looks and feels right, but it isn't. Here's how you can tell the difference.
Azure Has A Kerberos Problem, But It’s Not The One You Think
Blaming Azure for Kerberos exploits isn't a hot take—it's nonsense. Focus on the real root causes instead (which are different than you might think).
Integrating Threat Modeling with DevOps
Because DevOps has effectively joined the Operational and Dev domains, it introduces security dependencies which neither domain had to consider before.