20 Questions Security Pros Should Ask Themselves Before Moving To The Cloud

In my last four DarkReading pieces, I focused on 20 questions security practitioners can ask vendors across four separate markets to better understand their offering.  In my latest piece, I play 20 questions again, but with a twist.  Curious what that twist is?  Have a look at my latest in DarkReading to find out: http://www.darkreading.com/operations/20-questions-security-pros-should-ask-themselves-before-moving-to-the-cloud/a/d-id/1327748?.

What can the printing press teach us about security?

It's kind of an odd comparison, don't you think?  What could the printing press possibly teach us about security?  I discuss that very question in my latest piece in SecurityWeek: http://www.securityweek.com/important-security-lesson-taken-printing-press.  Hope you enjoy.

20 Questions Smart Security Pros Should Ask About 'Intelligence'

You guessed it -- it's time to play 20 questions again.  This time, let's tackle the topic of intelligence.  My latest piece in DarkReading discusses: http://www.darkreading.com/operations/20-questions-smart-security-pros-should-ask-about-intelligence-/a/d-id/1327565.  I hope you find the piece thought provoking, helpful, and informative.

Focus on the Ends, Not the Means

Do the ends justify the means?  This two-thousand year old question can teach us a valuable information security lesson.  Curious what I might be referring to?  Have a look at my latest piece in SecurityWeek: http://www.securityweek.com/cyber-defenders-must-focus-ends-not-means.  Curated for you.

Searching for answers? Try listening.

I'm often amazed at how difficult many people find listening to be.  I'd argue that this impedes their growth and maturity, most acutely in the security field.  Curious what I'm getting at?  Have a look at my latest piece in SecurityWeek: http://www.securityweek.com/answer-right-front-you.  Hope you enjoy.

20 Endpoint Security Questions You Never Thought to Ask

As you're all aware by now, I love a good game of 20 questions.  This month's installment of the 20 questions series deals with endpoint.  My latest DarkReading piece discusses: http://www.darkreading.com/endpoint/20-endpoint-security-questions-you-never-thought-to-ask-/a/d-id/1327305?.  I think you'll find the piece useful, and perhaps interesting as well.

Collection, Sensing, and Alerting: Yesterday's News

Security has evolved to the point that I can now say that collection, sensing, and alerting are yesterday’s news. How can I make such a provocative statement? Wikipedia. Confused? That’s certainly understandable. I explain in my latest SecurityWeek piece: http://www.securityweek.com/collection-sensing-and-alerting-yesterdays-news.

Analytics is What's Next for Detection

Analytics, when done correctly, stands to be the next frontier for detection.  It's a logical evolution from signature-based and detonation-based detection.  Curious what I mean by that?  My latest piece in The Business Journals discusses: http://www.bizjournals.com/bizjournals/how-to/technology/2016/10/how-to-keep-pace-with-evolving-online-attackers.html.  I hope you find the piece thought provoking.

Want better security? Be a pragmatist.

What does being a pragmatist have to do with improving the security posture of an organization?  I discuss that exact question in my latest SecurityWeek piece: http://www.securityweek.com/want-better-security-be-pragmatist.  If you are a pragmatist, have you ever felt alone, or perhaps even ridiculed in the security world?  You are far from alone.  Have a look at the piece to see what I mean by that.

Anyone interested in another game of 20 questions?

It's time for another game of 20 questions.  The last installment was around analytics.  This time, we're exploring security-as-a-service offerings.  Interested in playing another game of 20 questions?  Have a look at my latest DarkReading piece on the topic: http://www.darkreading.com/vulnerabilities---threats/20-questions-to-explore-with-security-as-a-service-providers/a/d-id/1327101?.  Hope you enjoy.

Ever wonder how you can get more out of visualization?

Ever wonder how you can get more out of visualization?  Or, perhaps, why many visualizations do not provide value to security operations and incident response?  These are certainly excellent questions.  I discuss them and share tips for getting more out of visualization in my latest SecurityWeek piece: http://www.securityweek.com/why-data-reduction-key-meaningful-visualizations.  I hope you find the piece helpful.

Anyone up for a game of 20 questions?

A game of twenty questions never hurt anyone.  In fact, it happens to be a great way to approach the topic of analytics.  Curious what I mean by that?  Have a look at my latest DarkReading piece of a discussion on the topic: http://www.darkreading.com/vulnerabilities---threats/20-questions-security-leaders-need-to-ask-about-analytics/a/d-id/1326918?.  I hope you enjoy.

The Only Constant is Change

Sometimes it seems like change is everywhere.  So much so that one might feel that the only constant is change.  There is something to that, and I explore the topic in more depth in my latest SecurityWeek piece: http://www.securityweek.com/information-security-only-constant-change.  In particular, I examine how organizations can stay focused on what matters amidst a sea of distractions.  I hope you enjoy the piece.

It's All About The Base

Want to get the most out of your scarce security analyst resources?  It's all about the base.  Other than making a silly pun, what do I mean by that?  Have a look at my latest piece in SecurityWeek for a more in-depth discussion: http://www.securityweek.com/maximizing-security-analyst-resources-its-all-about-base.

Theory Vs Practice: Getting The Most Out Of Infosec

Theory and practice are two very different things.  In fact, I would argue that they are two different philosophies, or mindsets, that often guide how people approach information security.  But which one is more effective?  I discuss this topic in my latest DarkReading piece: http://www.darkreading.com/analytics/theory-vs-practice-getting-the-most-out-of-infosec/a/d-id/1326564?

The Pen is Mightier Than Hot Air

Documentation isn't exactly a lot of fun, but it is extremely important to improving security operations and incident response.  I discuss the reasons why, as well as list a few areas where documentation can assist in my latest SecurityWeek piece: http://www.securityweek.com/pen-mightier-hot-air-why-documentation-key.  Hope you enjoy.

5 Failsafe Techniques For Interviewing Security Candidates

Hiring is, and will likely remain, a strategic challenge for quite some time.  At the same time, a bad hire can have disastrous consequences for an organization.  Given this, interviewing candidates well becomes extremely important.  How can organizations interview well?  My thoughts in my latest DarkReading piece: http://www.darkreading.com/vulnerabilities---threats/5-failsafe-techniques-for-interviewing-security-candidates/a/d-id/1326360?.

Hacking is Sexy, But Defending is the Grown-up Thing To Do

Hacking is most definitely sexy.  But shouldn't equal attention be paid to those who toil day in and day out defending their organizations from compromise?  My thoughts on the topic in my latest SecurityWeek piece:  http://www.securityweek.com/hacking-sexy-defending-grown-thing-do.  Defending is an important piece of the security puzzle too often missing from the broader dialogue.

The Increasing Importance Of Security Analytics

Although many people talk about analytics in the security field, there is still a tremendous amount of confusion around the topic.  I discuss this in depth in my latest SecurityWeek piece: http://www.securityweek.com/increasing-importance-security-analytics.  I think it's a dialogue the infosec community sorely needs to have.

Mind The Gap: CISOs Versus 'Operators'

In order for a security organization to evolve and mature, it needs to mind the gap.  What exactly am I referring to here?  Check out my latest piece in DarkReading to find out: http://www.darkreading.com/vulnerabilities---threats/mind-the-gap-cisos-versus-operators/a/d-id/1326050?.  I think it's an important topic, and I hope you will agree.

How can SMBs deal with security work overload?

Almost all security organizations have more work than they can realistically do.  SMBs feel this pain more acutely than others.  What can security organizations do to ease the pain?  My thoughts in my latest piece in The Business Journals: http://www.bizjournals.com/bizjournals/how-to/technology/2016/06/how-to-deal-with-tech-security-work-overload.html

Security Teams: Trust the One You're With

What can Stephen Sills' 1970 "Love The One You're With" teach us about information security?  I discuss that within the context of trust in my latest SecurityWeek piece: http://www.securityweek.com/security-teams-trust-one-youre.  I think you'll enjoy it.

All the world's a stage

One can always create another stage upon which to present.  But is that necessarily a good thing for the advancement of the information security profession?  My thoughts in my latest DarkReading piece: http://www.darkreading.com/operations/a-wish-list-for-the-security-conference-stage/a/d-id/1325694

Security Resources: Don't Put All Your Eggs in One Basket

Are you at risk of putting all of your security resources in one basket?  Curious what I mean by that?  Have a look at my latest SecurityWeek piece for a discussion on the topic: http://www.securityweek.com/security-resources-dont-put-all-your-eggs-one-basket.  Hope you enjoy it and find it thought provoking.

What is the Point of Analysis Anyway?

What is the point of analysis anyway?  Does that sound like a provocative or radical question?  I argue that it shouldn't be.  Rather, it's a question that needs to be asked -- and answered.  Curious what I mean by that?  Have a look at my latest piece in SecurityWeek: http://www.securityweek.com/incident-response-what-point-analysis-anyway.

Time to get back to basics when it comes to information security

There is elegance in simplicity.  I'd argue that particularly for small and medium-sized businesses, it's time to get back to basics when it comes to security.  Curious what I mean by that?  Have a look at my latest piece in The Business Journals: http://www.bizjournals.com/bizjournals/how-to/technology/2016/04/information-security-basics.html.  Hope you enjoy.

8 Signs Your Security Culture Lacks Consistency

Culture is an important but often overlooked aspect of a security organization.  In particular, a culture of consistency leads to a better overall security posture.  Does your security organization foster a culture of consistency, or the opposite?  Curious what I mean by that?  Have a look at my latest piece in DarkReading: http://www.darkreading.com/operations/8-signs-your-security-culture-lacks-consistency-/a/d-id/1325286?.

Cyber Insurance: Security Tool or Hype?

Is cyber insurance a useful security tool, or is it merely hype?  I discuss this topic in my latest SecurityWeek piece: http://www.securityweek.com/cyber-insurance-security-tool-or-hype.  I think you'll find my perspective a bit different than others you may have seen, and I hope you enjoy the piece.

What can the common cold teach us about infosec?

Does your security team most often treat the symptoms of problems, rather than the problems themselves?  Interested in reading more about what I'm referring to?  My latest piece in SecurityWeek discusses: http://www.securityweek.com/your-security-team-treating-symptoms-rather-problems.

Cloud Security: Understanding New Risks, Rising To New Challenges

Whether we like it or not, the move to the cloud is upon us.  Further, the pace at which this move is occurring appears to be accelerating with each passing day.  As information security professionals, we need to understand how we can get ahead of what is turning out to be one of the biggest business transformations of our time.  I discuss this in my latest DarkReading piece: http://www.darkreading.com/cloud/cloud-security-understanding-new-risks-rising-to-new-challenges/a/d-id/1324769?.  I think you'll find the piece very relevant to many of the security issues and challenges we're currently working through as a community.

Incident Response: Work Smarter Not Harder

It will probably come as no surprise that most organizations have more work than they have people available to do that work.  Since a large increase in staff is unlikely in most organizations, organizations need to think a little bit outside of the box in terms of how they approach the hectic workload an operational security environment brings with it.  My thoughts on this topic in my latest SecurityWeek piece: http://www.securityweek.com/incident-response-work-smarter-not-harder.  Hope you enjoy.

What Can Eminem Teach Us About Educating the Next Generation of Security Leaders?

What can Eminem teach us about educating the next generation of security leaders?  It's an interesting question, isn't it?  Or perhaps you are wondering what one thing has to do with the other?  A fair question of course.  I discuss this topic in my latest DarkReading Piece: http://www.darkreading.com/public-vs-private-is-a-prestigious-infosec-college-degree-worth-it/a/d-id/1324417?.  Hope I've piqued your curiousity and that you enjoy the piece.

When is intelligence not intelligent?

When is intelligence not intelligent?  That is a question worth discussing in my opinion.  Have a look at my latest piece in The Business Journals if I've got you wondering what exactly I mean: http://www.bizjournals.com/bizjournals/how-to/growth-strategies/2016/02/when-intelligence-isn-t-intelligent.html.  Hope you enjoy!

What is the Difference Between Information and Intelligence?

What is the difference between information and intelligence?  There is a difference of course, and it's an important one.  Unfortunately, in my experience, this difference is not particularly well understood by many people in the security profession.  Curious what I'm referring to?  Have a look at my latest piece in SecurityWeek: http://www.securityweek.com/what-difference-between-information-and-intelligence.

What is the Real Cost of "Good Enough" Security?

What is the real cost of good enough security?  It's an interesting question, isn't it?  My thoughts in my latest SecurityWeek piece: http://www.securityweek.com/what-real-cost-good-enough-security.  Hope you enjoy.

Careers In Infosec: Don't Be Fooled By The Credential Alphabet

What is the relationship between professional certifications, university degrees, and the qualifications of a candidate?  Given the talent shortage in information security, how can we identify and recruit talent that may not have the prior security experience we were hoping for?  I discuss these topics in my latest DarkReading piece: http://www.darkreading.com/careers-and-people/careers-in-infosec-dont-be-fooled-by-the-credential-alphabet/a/d-id/1324066?.

Relationships: Critical to the Security Posture of Your Organization

What is the value of relationships in the security profession?  Simply put, it is far greater than some people realize.  My thoughts on this topic in my latest piece in SecurityWeek: http://www.securityweek.com/relationships-critical-security-posture-your-organization.

The Matrix Reloaded: Security Goals vs. Operational Requirements

There is no shortage of hype in the information security world.  But how can an organization cut through the hype to identify the people, process, and technology necessary for them to improve their security posture?  My latest piece in DarkReading discusses an approach: http://www.darkreading.com/attacks-breaches/the-matrix-reloaded-security-goals-v-operational-requirements/a/d-id/1323796?.