Blog

ZDnet article on identification and authentication

January 19, 2024

Identification can no longer be just identity. Authentication can no longer be just authenticating. Compromised identity remains a foundational component for most attacks today. To overcome these vulnerabilities, organizations must step up their defenses around identification and authentication.

I’ve a guest article on ZDNet covering the problem and providing steps for a good defense.

Authentication is more complicated than ever. 4 ways to improve cyber defenses for our new reality

Bad actors are taking advantage of complex identity infrastructure to sneak in the front door, says Wolfgang Goerlich, advisory CISO for Cisco Duo.

Pre-mortems – #2 on SDxCentral’s Top 10 Stories

December 30, 2023

SDxCentral posted the top ten stories of  2023. I was surprised and pleased my pre-mortem on Zero Trust came in at number two on the list. I’m not tagging this as news, as I covered the story when it came out here: https://jwgoerlich.com/a-pre-mortem-on-zero-trust/

But! That did remind me. Since the original article came out, the video came out. If you want to see the RSA talk that landed the second spot on SDxCentral’s top ten, you can see it now. Right here. Right now. So much fun.

ConsumerAffairs says use multiple emails

December 14, 2023

According to tech experts who say that if you slice and dice your email addresses the right way, you’ll not only declutter your digital life, but you will protect yourself better when it comes to phishing and financial scams.

Excerpt from: Multiple email address for different functions beefs up security.

How many email addresses do you have? If you’re like most Americans, you have two – personal and work. But there’s a large number – 28% – who have four or more email addresses. The privacy and scam experts that ConsumerAffairs spoke to were pretty much in agreement that the magic number is four or five email addresses and they’re shoulder to shoulder on what those addresses should be, too.

Wolfgang Goerlich  insists a separate shopping — including for subscriptions and newsletters — email account is an absolute must. “For example, a shipping scam or invoicing scam sent to an email address not used for shopping is easily spotted,” he told ConsumerAffairs.

“Say one of your email addresses gets compromised because of clicking on a scam, or falling for a phishing email, the criminal wouldn’t be able to get into your bank if it’s through a separate address. And when a website or app gets breached, and they often do, it helps to keep things separate.”

Read the full article: https://www.consumeraffairs.com/news/multiple-email-address-for-different-functions-beefs-up-security-121423.html

Wolf’s Additional Thoughts

My recommendation is breaking email into: personal, professional, shopping, banking and finance, dating and relationships. Take that last category. People have been embarrassed, harassed, or even blackmailed when dating sites were compromised and their work email addresses were tied to those sites and leaked.

For the longest time, maintaining separate email addresses was a bit of a pain. You had to create them, remember to check them, and periodically clear out the inboxes. Today the major email providers make it easier to maintain several accounts. Moreover, on phones, it is easy to create separate email addresses for practically every website. Apple iPhone can do this natively with “hide my email” and Google Android devices can do this with third-party apps.

It’s never been easier to maintain a separation of email, and arguably, it’s never been more important to do so.


This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

 

9 in 10 organizations embraced zero-trust, CSO

November 22, 2023

Nearly 90% organizations have begun embracing zero-trust security, but many still have a long way to go, according to a report by multinational technology company Cisco. “The more organizations know about zero trust, the less they feel competent in zero trust,” Goerlich adds. “The more they learn, the more they realize they need to go further.”

Excerpt from 9 in 10 organizations have embraced zero-trust security globally.

“What often happens to security concepts that begin as buzzwords and capture momentum is they fade off into business as usual,” Goerlich says. “What we’re seeing is people no longer asking, ‘Are you doing zero trust?’ It’s, ‘Are you securing this new line of business? Are you securing our mergers and acquisitions? Are you protecting us against ransomware? Are you enabling the business to keep up to changing market demands and changes in the threat landscape?”

“Now that we have the outcomes identified,” Goerlich continues, “we can apply the appropriate technologies and appropriate pillars to achieve those outcomes. What we’re going to continue to see is zero-trust principles becoming fundamental security principles. As we move forward, good security is good security, and good security will include some of these zero-trust principles baked into every layer.”

Read the full article: https://www.csoonline.com/article/1249027/9-in-10-organizations-have-embraced-zero-trust-security-globally.html


This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

 

Investments in cybersecurity initiatives, Spiceworks

August 26, 2023

“Good security first delivers a business outcome and then, and only then, as a result, increases security,” noted J. Wolfgang Goerlich, advisory CISO at Cisco Secure.

Excerpt from In the Line of Fire: Understanding and Conquering Cybersecurity Risks

The benefits of adopting zero trust go beyond its drivers. Through zero trust, organizations not only avoid risk (and thus unnecessary costs) but also save capital through operational efficiencies and enable business.

Since implementing zero trust takes two or more years, Goerlich pointed out that organizations may not necessarily have 100% zero trust. “Today, the strongest predictor of whether or not organizations feel that they are achieving zero trust is whether or not they have automation, orchestration in place,” he said.

Aberdeen found that endpoint detection and response (EDR) and extended detection and response (XDR) are becoming mainstream as a result of zero trust thinking.

Goerlich reiterated this and added that organizations increasingly pair extended detection and response (XDR) with zero trust. “If you have a zero trust project in progress, you are 40% more likely to say, ‘I have an XDR/EDR project,’” Goerlich said. “ Because as we harden that layer, criminals are going to move. If you have end-to-end protection, where do they go? They go to the edge.”

Read the full article: https://www.spiceworks.com/it-security/cyber-risk-management/articles/cybersecurity-risk-management-zero-trust/


This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

Joining Midori on the Consent Dojo

July 12, 2023

We “Value” Your Privacy: Digital Consent with J Wolfgang Goerlich + Midori

  • How has consent been co-opted with things like end user agreements and cookies, and what can we do about it?
  • What can we consent to when it comes to digital toys and tech, including sex toys and sex tech?
  • What are consent technologies, and are there new developments, innovative technologies, or new approaches?
  • How are people advocating for themselves, individually or collectively, to take back control over our tech?

A pre-mortem on Zero Trust

May 1, 2023

Zero trust offers organizations an approach that can help to significantly improve security posture and help to minimize risk. But what would happen if, let’s say, an organization had fully implemented zero trust and yet at some point several years into the future had a breach? What would be the likely reasons?

Excerpt from: How a pre-mortem can tell you what’s wrong with Zero Trust

“Our out of scope is in scope for adversaries,” Goerlich said.

“Whenever a control reaches critical mass, the control will be bypassed,” he said. “Another way of saying that is all a better mousetrap does is breed better mice.”

He suggests that organizations deploying zero trust today, look at their roadmaps and make sure they have plans to sustain support, interest and engagement for years to come. Goerlich also recommends that zero trust implementers shore up out-of-scope areas to help reduce the attack surface.

Read the full article: https://www.sdxcentral.com/articles/analysis/how-a-pre-mortem-can-tell-you-whats-wrong-with-zero-trust/2023/04/


This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

Empathy, kindness, and behavior economics on We Hack Purple Podcast

February 21, 2023

Tanya Janca invited me onto her We Hack Purple Podcast to discuss vulnerabilities beyond code. Along the way, we cover behavior economics and the importance of empathy in cybersecurity design. “Kindness is the original security principle” makes an appearance, as we talk about how all this and more applies to building better products.

Our conversation was sponsored by the Diana Initiative, a conference committed to helping all those underrepresented in Information Security.

 


To see listen to other podcast interviews, click to view the Podcasts page or the Podcasts category.

Cybersecurity Maturity Model Certification (CMMC): considerations for self-attesting

February 13, 2023

Suppliers who need to achieve Level 1, the most basic certification, may forgo seeking outside help and perform initial and annual assessments themselves.

Excerpt from: Navigating Cybersecurity Maturity Model Certification (CMMC) 2.0

“Suppliers with strong confidence in their audit and compliance teams, and suppliers with sufficient staffing, are ideally positioned should they decide to achieve Level 1 without external support,” added Wolfgang Goerlich, advisory chief information security officer, Cisco Secure, the portfolio of security products offered by San Francisco-based Cisco. “Such internal compliance initiatives can move quicker than bringing in a third-party when the people on the team have the relationships and understanding of how the practices are performed.”

The approach Goerlich describes may save money, but it won’t provide external validation and new perspectives.

“Achieving Level 1 with an internal project team answers the question, ‘What are we doing?’ but cannot answer the questions, ‘What are others doing, and what should we be doing?’” Goerlich said.

Read the full article: https://www.sme.org/technologies/articles/2023/february/navigating-cybersecurity-maturity-model-certification-cmmc-2.0/


This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.