Cybersecurity or Information Security related information that is usually usable. I lump IT/AI into this area as well.
Building a Threat and Vulnerability Intelligence (TVI) program from the ground up requires more than just collecting feeds; it needs a clear strategy for ingestion, operational response, and executive alignment. In this post, I will walk through how I used real-time intelligence, operationalized technical workflows across IOCs, TTPs, third parties, and zero-days, and established a…
I really nerded out when I was first getting my hands dirty in GRC. Back then, I kept getting assigned to assessment after assessment across so many different frameworks. When I first learned about the concept of a Common Controls Framework (CCF), my brain practically melted. You’re kidding me, right‽ It sounds complicated on the…
FAIR helps people measure cyber risk in money. Instead of saying a risk is “high,” “medium,” or “low,” or as “red”, “yellow”, or “green”, FAIR asks better questions: FAIR is useful because businesses need to make decisions. For example, should a company spend $50,000 on a new security tool? Should it hire more security staff?…
You know, its almost comical how many people hear about the pay in cybersecurity and want to fast track it. Then they show up in reddit’s r/cybersecurity asking questions about getting into the field. The comical part is that it feels like many of them believe that they just have to be good at hack…
Google posted a series called Hacking Google and it was pretty interesting. I wanted to share it with everyone. There’s quite a few (9) of these short videos.
OMG I loved the chaos of the Phoenix Project! Reading this, you’ll find a resemblance to The Goal and… Spoiler Alert! It is inspired by it. I think I loved reading this because I could relate so well to the $hit-show that the main character gets put into and it reminded me of joining a…
There is sometimes confusion about which is better. Having both, I just want to say that in the CISSP vs CISM, the CISSP mindset is about protecting an enterprise using security architecture, controls, and risk management, and that the CISM mindset is about managing the information security program aligned to business risk. Think about that….