‘Data-driven’ does not mean ‘reliable’ nor ‘objective’
It is absurd when people use "data-driven" and it sounds like they meant "reliable" or "this is it, we've figured it all out". In reality, we've been slowly waking up…
In cybersecurity, get the foundation right, the details will always be a moving target
I've always had an interest in humanities and social sciences, and how they affect other domain areas, through us, people. Science nowadays says that making mistakes is not only an…
Machine learning in offensive security
At Symantec, I worked on implementing machine learning techniques to strengthen defenses capabilities and enhance the ATP product with advanced detections and protections. It certainly has increased the cost and…
Wrong priorities, increased risk
Setting up priorities can be hard and challenging, and cybersecurity (like almost everything else in life) is a prioritization issue. Beyond treating cybersecurity as a business priority and setting up…
Beyond compliance – Good governance and frameworks can make a huge difference in solving the cyber risk puzzle
Compliance with regulations is part of doing business and probably merely seen as a way to avoid the legal, financial, or reputational damage that might result from non-compliance. While poor…
Cybersecurity – a supply chain issue
How on earth can you ensure your supply chain is secured? On average, a large enterprise uses up to 15 security vendors, according to 451Research. In reality, the supply chains…
The attack landscape is evolving – risk metrics and assessment aren’t
If you've read some of my previous posts, this might sound a bit familiar. This is part of a recurring theme about measuring security, which, let's face it, we don't…
Is cybersecurity doomed to playing catch-up to bad actors?
I was recently listening to a podcast that started with stories about hacking into poker players' machines and ended up with an interview with Mikko Hypponen of F-Secure about the…
The information overload is destined to result in bad security
I've always been interested in arguments from the field of psychology that study how we make decisions, react, and are affected by a number of aspects, including biases (which I've…
Is risk assessment any different from risk perception?
I had already mentioned our tendency of self-deception in a previous post. And I was recently reading an article where the Dunning-Kruger effect was mentioned and I thought, here is…