There is no silver bullet in any aspect of information security. All the answers like EDR, MFA, SIEM… might get you in a better or worse security posture, it all depends to how you implement and manage but none of them are silver bullet in their area (malware protection, authentication, monitoring…). It is all about […]
problem solving is not searching searching might give you an answer. but it won’t give you understanding. “water usually finds the way out of a leaky pipe, but it won’t fix the plumbing.” systems are complex. success is luck without insight. troubleshooting is its own skill you learn to troubleshoot by knowing what parts interact. […]
How to have an accurate vendor risk assessment? Assessing your vendors, suppliers, business associates…or any other term you give to who is providing services to your firm is crucial and even might be required from a regulatory stand point (i.e. like in HIPAA). I do not want to get into detail of what would be […]
A Security Questionnaire, RFI, VRA (Vendor Risk Assessment), VR Management…helps customers identify and evaluate the risks of using a vendor’s product or service. Performing such a review is sometimes mandatory based on the industry (e.g. healthcare). During this standard business process, customer collects written information about security capabilities of a supplier and you could barely […]
Know how to code and take your computer security effectiveness to next level
Have you ever listened to your tech team trying to justify all the tasks left behind, delayed or procrastinated? Do you have an IT team brining excuses for every project there are facing and try to blame everything except the root cause? Then you are not alone! Here is a known list of IT staff […]
Is having an information security management system equal to actual security? Nop! Having an information security management system is not an indication of quality of security controls. Management systems are easier way of administration in a standard and systematic way, but they do not necessarily an indication of security control effectiveness. As an example, ISO […]
The simple sign is your Trust and Confidence: Do you have faith in your security program? For a moment be honest and ask yourself: am I confident with my company security program? Do I have faith in our security team? Do they really know what they are doing? Does my information security officer worth pay […]
Real hackers do not randomly find a flaw in a system. There is a systematic approach to hack a system! Regardless of size and type of an online entity and its online presence, a giant company with ten thousand of employee, or a home user of the Net, the only reason a system (may) have […]
Sales pitch force us to worry about things that are not so important; Change your mindset to win the battle! “Battle” would not be the right term if we didn’t have a market full of competition to sell cybersecurity products rather than focusing on the right and real way of defense. In other words, focusing […]
Real issues are not going to be solved by any of those known popular internet applications! Currently it does not but technology could solve our problems if two factors considered: Definition of ‘Problem’ Justifying practical ‘Application’ The former seems so obvious but that is actually the root cause of why technology is not able to solve […]
The Open House Problem Why are we not able to secure? Because we open everything…and then ask people to be careful. It is like opening all the doors of a house and telling everyone inside: be alert. We call this awareness. Awareness of what? Of a problem we created by design? “You don’t warn people […]