Plan-B Security

Being in information security is not all flowers and sunshine. Often, then things go wrong, there's a dollar amount associated with it, and reducing your liability leads to finger pointing and a hot-potato version of the blame game. Learn how the Okta breach was exacerbated by the inaction of the customers who were affected, and learn how to prevent it from happing to you in the future.

This is a fun way of taking an existing framework for resolving conflict and building relationships and growing your security program. The 5 Love Languages is a concept that's been around a long time thanks to Gary Chapman, the original creator. Using the 5 languages of Quality Time, Words of Affirmation, Physical Touch, Gift Giving and Acts of Service, we'll practice translating these to...

We talk about how personal events in our lives don't hold us back but give us skills to use in unexpected ways. My own experiences taught me how to turn data into a story, and remove emotion from defending my ego and move the emotion to the response of the listener. In security, everything is a battle - storytelling allows you to connect risk, threats, facts and the unknown with your audience...

Continued from last week's Security Leadership Strategy and Tactics conversation where we learn how to take the strategy and add it up to the sum of the bigger picture. We learn how Key Results are the journey to your goal, and how commanders intent keeps the organization focused, with or without you. This is one of my favorite yet!

Leading a team is hard, and it's even harder in the face of changing economical conditions, where money may not be flowing to where a business needs to stay secure, but instead where they can use it to make more money. Learn a few ways using the CITER risk-scenario model to justify investment and cost, and how to turn it into Objectives and Key Results.

Dig in to the details around Device Trust, where it's good and where it's bad. We walk through the fundamentals a program needs to have in place to start building on the device authorization and device attestation stories, which combined provide the device trust principles. There's a few ways to thwart device trust, and a few attack vectors it's not able to solve either. So join us...

Multi-factor Authentication is the the best way to protect your online life, keeping your data safe, secure and private. However, not all MFA is created equal. Let's listen to a few ways of thinking about the MFA problem and what the future of account security looks like. I'll also touch on the MGM, Caesars and Retool announcements as they relate to MFA and what we can learn and do differe...

The principle of most private is something I have been noodling on for a long time. It's not perfect, and will definitely see changes in the future, but it was a great way again to change the mindset. Least privilege is often a blocker to productivity, and a huge friction point for companies. Most private supports least privilege by adding intent and context into the conversation, allowing sec...

The 4 C's of cyber security are more of a philosophical pillar around building a security culture. Learn how Consistency, Clarity, Collaboration and Creativity play into sharing the security vision, working with others to make security a priority, and solving road blocks in a positive and effective manner.

Risk and Threat modeling (yes, they are different) are two effective ways to start building out the requirements for your security program. Solutioning through scenarios is like that, with a little more table top exercise sprinkled in. Also, learn how an old model from my Telecom days, the FCAPS model, plays a vital role in how I approach problems and come up with solutions.

Companies go through different rates of growth and have different information security needs as a result. Learn about a few common stages of growth, signs that your company might be in it, and what you might be able to accomplish. When the business doesn't want security to get in the way of getting a product launched, focus on the corporate side. Once you've made impact, start building com...

Right off the heels of BlackHat, DEFCON31 and BSidesLV, also known as Hacker Summercamp, hear about an impromptu conversation at dinner with a stranger around how to become more "Security" minded using the FTC's Start with Security guidance, making the jump from IT to Security a real possibility!