All Posts

All Aboard the 5G Paranoia Train

We’re getting excited and stressed out about the impending 5G network that appears will control our lives and all our cities. Will it be as…

How Much Damage Can the Network at a Hacker Conference Take?

For a normal organization, it would be a year’s worth of malicious traffic. At the Black Hat conference, their network sees the same in about…

Defense in Depth: Software Fixing Hardware Problems

As we have seen with the Boeing 737 MAX crashes, when software tries to fix hardware flaws, it can turn deadly. What are the security…

25 Tips to Reduce the Frustration of Vulnerability Management

Vulnerability management (VM) has become synonymous with frustration. Breaches often result from exploited vulnerabilities that are known, yet not patched. The compromise was avoidable. Why…

Do You Know the Secret Cybersecurity Handshake?

We get the feeling that as we’re adding more solutions and requiring more certificates, we’re just making the problem of finding great security talent harder…

Defense in Depth: Tools for Managing 3rd Party Risk

Are there any good tools that really help to manage third-party risk? Can tools alone solve this problem? What else is required? Check out this…

What Do Security Vendors Say or Do That Sets Off Your BS Detector?

Due to the popularity of my article, “30 Behaviors of Security Vendors That Set Off a CISO’s BS Detector” I decided to ask the same…

If At First You Don’t Succeed, There’s Always Blackmail

We note that blackmail has become an option even in cybersecurity sales. It appears some vendors have become so desperate that they’ve resorted to borderline…

Defense in Depth: CISO Burnout

Are CISOs the most stressed individuals on a security team, or do mental health issues affect everyone in security? Check out this post and discussion for…

How Would I Go About Stealing Your Data?

At Security BsidesSF I asked attendees, “How would I go about stealing your data?” A handful said I couldn’t, which is probably true since I’m…

When Abusing Our Privacy, Does Size Matter?

Do the biggest tech companies abuse our privacy because they have no competitive incentive to protect it? That debate and more on the latest episode…

Defense in Depth: RSA 2019: Success or Failure?

Is the RSA Conference a must attend for security professionals? Or is it enough to “just be in San Francisco that week”? Check out this…

What is the Defense in Depth podcast?

Myself, David Spark(@dspark), the creator of CISO Series, and Allan Alford (@AllanAlfordinTX), CISO at Mitel, explain what their new podcast, Defense in Depth, is all about. Please subscribe. Please write…

We’re Releasing Security Studies of Made Up Numbers

Since no one ever checks a research study’s methodology, why not just make up all the numbers? You’re in the risk analysis business, right? Chances…

Hey #RSAC Exhibitors, Stop Looking So Bored

Every year I go to the RSA Conference, the trade show floor gets bigger, the attempts to attract people through gimmicks gets more intense, and…

Defense in Depth: Security IS the Business

If a company’s brand and value is built on trust, then your security department is critical to building the value of the company. Check out…

A Pesticide-Free Podcast Made with ‘All Natural’ Intelligence

We eschew those cybersecurity firms touting claims of artificial intelligence for our organic conversation-based approach to podcasting. This show, like all the previous ones is…

Prepping for RSA 2019

David Spark (@dspark) and Allan Alford (@allanalfordintx), co-hosts of the Defense in Depth podcast with their advice for both vendors and practitioners on how to…

Best Responses to “30 Security Vendor Behaviors That Set Off a CISO’s BS Detector”

This article on what not to say to a CISO caused a flurry of responses, and I pulled out my favorites to highlight in this…

Defense in Depth: Threat Intelligence

Do companies who deliver “threat intelligence” deliver on that promise, or is there more the customer needs to bring to the table to be able…

What Most People Get Wrong About VPNs

A little behind the scenes look at the recording of the February 26th episode of the CISO/Security Vendor Relationship Podcast with Francis Dinha, CEO of…

You Get a Private Network! You Get a Private Network!

We’re giving away private networks to everybody. Even if you think you don’t need one, you want one. It’s all on this week’s episode of…

Live Recording (3/6/19) of CISO/Security Vendor Relationship Podcast in San Francisco

Another reminder for fans of the CISO/Security Vendor Relationship Podcast (this one includes video!). We’re doing a live recording of the show on Wednesday, March…

Defense in Depth: Secure Controls Framework

Is the free to use Secure Controls Framework the one meta-framework to rule them all? Check out this post and discussion for the basis of…