there are hundreds of security frameworks out there, all somehow accredited and accepted by industry, all good, but compliance with any, or even all of them does not mean anything to state of security, does not affect the state of security and it is not a metric for security. being compliant is different than being […]
you have probably heard or even sick of it: security is a journey…it never ends…security is not a destination…yada yada is security really a journey, or let’s say, does it have to be an endless journey where we actually do not enjoy or even hate to have such a journey? security as a journey yes […]
security community has been certainly obsessed with creating a new acronym every day instead of focusing on techniques and enhancing what is already there. basically we do not even try to enhance any thing, we just need to understand definitions and satisfy what has already been stated. XDR is one of those things now particularly […]
it has been relatively a long time since threat intelligence sources started to integrate what they call as “dark web” into their system of data/intelligence gathering, prioritization and delivery as a service to threat hunters. nothing really wrong with that, it is actually a reasonable and even crucial part of any threat hunting system, but […]
information security management is almost similar to every other thing that is Subject to Management, or requires management, and I am not going to explain why we need a management function in a system to make sure system is running and functioning as expected, at least not in this article. by similarity, I mean there […]
There is a difference between knowing the path and walking the path, right? just because I have something, does not mean I know something, or I do something. just because there are technologies, software or tools for a thing, let’s say GDPR compliance metrics, patch management, ITIL platforms, vulnerability scanning, application security testing…and so on, […]
It is really funny when they call it one of the most sophisticated hacks in history and stuff like that, because it is actually one of the most stupid hacks of all time. Nothing about SolarWinds or whatever they want to call it is really surprising to me. Except for one thing: how those companies […]
Solarigate, Sunbusrt, UNC2452 or whatever they call it, how even fireEye, SolarWinds, Crowdstrike and many other involved are able to sell and survive after this disaster, and how security community is able to trust them again? it is interesting that how these top security companies with lots of managed service and bunch of products in […]
no doubt that users are the main problem in the whole concept of cyber defense, as we call it weakest link. Now, Awareness and Training as security community typically has been doing is neither effective nor actually deliverable. Imagine we would want to continue law enforcement and public awareness by means of “Most Wanted” posted […]
Multiple reputable security solutions in the market that calls itself AI, including some I have personally used, is not even close to what I would consider an AI system. So I started asking a simple question: is there anyone actually checking these claims? The answer is not very encouraging. The term AI has become another […]
“Talk doesn’t cook rice.” Ancient Chinese Proverb There is a saying in Persian…you won’t taste sweetness in your mouth just by say Sweet, Sweet, Sweet…but it looks like industry believe we can be Secure just by saying Secure, Security, Sec… just by putting a Sec in front or end of a product, service, name, process, […]
we presume Security is always equal inconvenient, either form consumer point of view, or developer. as a consumer you have to remember passwords and configure stuff, and as a developer to need to make sure you put controls around authentication process and how passwords are being used. I agree that is inconvenient but are we […]