If the end result is the response to an attack, why don’t more metrics measure the response? Take phishing. We need to track the time it takes for IT to investigate and blackhole a phish. That’s what drives organizational immunity. Also, smoothies per mile, but that’s another video.
Watch more videos on my YouTube channel.
Start small. Start some where. Start iterating and improving. From frameworks like ISO 27001 to maturity models like BSIMM, we can make a minimum version which reduces risk with a reasonable amount of work. Then get started.
Watch more videos on my YouTube channel.
A million downloads can’t be wrong. Except, of course, when the mobile apps access excessive amounts of personal data. Oh, and, except when the data is transmitted in clear text. Leave it to the presidential campaigns to remind us: trust no one.
Watch more videos on my YouTube channel.
Flexibility gives the defense an advantage. Reusable and repurposable systems, particularly for disaster recovery, are a good place to begin building that flexibility. Also, seriously, twelve people is a lot for dinner.
Watch more videos on my YouTube channel.
Rogue wireless access points, those WiFi networks that our organization didn’t authorize, are another path for criminals and malicious insiders. We can block rogue WiFi two ways: at the signal and on the wire. Here’s how.
Watch more videos on my YouTube channel.
Each IT security control is a balancing act between several factors. Ease of use, difficulty of abuse, performance, and others all play a part. To demonstrate this, let’s look at Windows built-in whitelisting tool: AppLocker. You can bypass AppLocker because of decisions made to achieve balance.
Watch more videos on my YouTube channel.
Shiny new red blinking boxes. It’s just what we always wanted. Excellent. Next question: how do we phase in these new firewalls?
Watch more videos on my YouTube channel.
Phishing and other social engineering tactics used to hijack DNS.
Watch more videos on my YouTube channel.
The criminals adopt PTES, holiday pay, org charts, call escalations, and other corporate best practices. It’s us against them, practices against practices, in an arms race to protect our organizations.
Watch more videos on my YouTube channel.
Years ago, a API address company made a decision on the default. This has led to years of attribution to Kansas. A small farmhouse in Kansas, to be exact. This is their story.
Watch more videos on my YouTube channel.