Apr 5, 2021Security Operations FrameworkSecurity Operations is the technology, controls, and processes that allow a security organization to be able to prevent, detect, and identify cyber intrusions and be able to accurately and efficiently respond to and recover from them. — After building a few security operations teams and programs, I was inspired to write down my basic framework. …Security Operations8 min readSecurity Operations8 min read
Mar 10, 2021An Adversary’s Perspective: 2FABefore you turn on 2FA, think about it from an an adversary’s perspective. Lots of security teams like to turn on 2FA because it’s “obvious,” it’s a compliance requirement, and it’s nearly 100% effective against password reuse and credential stuffing attacks. And while password reuse and credential stuffing are two…Security5 min readSecurity5 min read
Jan 19, 2021Seven Deadly Sins of Security TeamsWhen I talk to organizations and executives, I see the same security mistakes and misconceptions over and over again. I see security leaders make these mistakes and wonder how they could have alienated their coworkers and their executive leaders. …Security5 min readSecurity5 min read
Jul 7, 2020Mature Controls at Any SizeThis is a followup to an old article I wrote called A Mature Security Program at Any Size where I laid out security processes and procedures that you could implement and scale at any size organization. In this article, I will do the same thing for a set of basic…Security4 min readSecurity4 min read
Jun 29, 2020What You Need To Know About Cyber InsuranceMany organizations use cyber insurance to satisfy legal or regulatory requirements, as a financial risk mitigation, or as a last resort control. However, most folks don’t know where their insurance policies fall short. Here’s what you need to know. Types of Insurance Business Owners Policy (Commercial Business Policy) — An insurance package policy…Cyber Insurance4 min readCyber Insurance4 min read
Mar 25, 2020Adversary-Based Risk AnalysisMost risk analysis is done by assessing potential impact and ease of an attack. This kind of risk analysis that’s done in the absence of an adversary is naive and leads to bad priorities. …Risk Analysis3 min readRisk Analysis3 min read
Dec 24, 2019Adversary-Based Threat ModelingMost threat models start with attack surface or critical assets. Those threat models are useless and lead to bad decision-making. In this post, I demonstrate how to develop more accurate and actionable threat models, based on our adversaries. Process Determine our adversaries Understand our adversaries Build their playbooks from threat intelligence …Security5 min readSecurity5 min read
Jul 8, 2019Adversary AxiomsThe new principles of cybersecurity. Constraints Adversaries of all kinds — criminal enterprises, intelligence agencies, and lone wolves — have political, financial, and technical constraints just like conventional organizations have. “Attackers are resource constrained” — Dino A. Dai Zovi (source) “Attackers have bosses and budgets” — Phil Venables (source) Operational Requirements Adversaries determine…Security2 min readSecurity2 min read
May 20, 2019Celebrity and CEO Guide To SecurityEverybody needs good security these days. Here’s some common advice that I recommend for high-risk individuals. Account Security Most folks are worried about their accounts. Their e-mail, which could allow password resets for all their other accounts. Their mobile device backup (iCloud or Google), which could contain intimate photos and location information…Security5 min readSecurity5 min read
May 6, 2019Vendor Security ReviewVendors are increasingly becoming one of the easiest and cheapest ways to attack organizations. Passwords are being reused from previous breaches. Vendor access is being leveraged into lateral movement. Software supply chains are being used to place malware into otherwise secure systems. …Security6 min readSecurity6 min read
