How you set priorities around building a #cybersecurity program differs based on your perspective. On today's #cybersunday, I talk about how the perspective of the advisor must be tempered by the perspective of the practitioner working day-to-day in the trenches.

#prioritization #perspective

I was quoted in an article last week about the latest CISA directive on #assetmanagement and #vulnerabilitymanagement (link below). I was the cynical voice in that article, and I wanted to explain a little more on this #CyberSunday about whether these two #cybersecurity #fundamentals should be paired as closely as they are by #CISA.

Link to article: https://securityboulevard.com/2022/10/cisa-directs-federal-agencies-to-boost-system-visibility/

In today's #CyberSunday, I go a little outside the normal #cybersecurity discussion and talk about how #liftandshift isn't always negative when it comes to moving workloads into the cloud. I specifically talk about my experiences with a couple of different security vendors (I didn't name anyone specifically) who took different approaches and the positive and negatives associated with those cloud moves.



#cloud #cloudinfrastructure #digitaltransformation 

Securing the digital transformation is not a new problem. It is actually an old problem with modern concerns. A lot of people are talking about how concerned they are with machine identities, APIs, IoT, etc.. But these things aren't new. They've actually been in existence for quite a long time. What we're REALLY saying is that these things are proliferating out of control, and they're not properly secured. But why has it become a problem?

Today's #CyberSunday is all about my take on this issue.

#digitaltransformation #machineidentities #internetofthings #apis

Dr. Gerald Auger and I gave a talk last week at the Houston Technology Summit titled "Building Cooperation and Understanding Between Security and IT". We talked a lot about the differences in skills and mission between the two groups, and how there should be more empathy between them. Here's my #CyberSunday quick take on our presentation.

#cybersecurity #informationsecurity #informationtechnology #empathy #cooperation

Is regulatory compliance fundamental to your #cybersecurity program? In this #CyberSunday, I compare regulations against standards and talk about which one comes before the other.

#regulations #compliance

There have a been a few times in the history of #cybersecurity product development when a new solution has been truly innovative. But what is extremely rare is when a tool is innovative, fills a true need, and is practical to install/deploy. In this #cybersunday, I give some examples of what I see as innovative products, talk about whether they filled a big need at the time they came out, and whether they were practical to deploy.

#innovation #productdevelopment #practical

There were two big themes from discussions with our customers at #BlackHat. One is a commonly discussed problem these days (lack of people). The other takes us back to the fundamentals of #cybersecurity (asset management). And neither were buzzwords or #vaporware.

#CyberSunday #SecurityFundamentals #SkillsShortage #assetmanagement #people

I'm headed out to Vegas tomorrow for the #BlackHat #cybersecurity conference, and it made me think about a couple of questions that have been on my mind for a bit: do you prefer local cons or national cons, and do you mainly go to cons for the talks or checking out the vendors? I weigh in with my opinions (sorta - I'm a bit biased because I run #HouSecCon). What's your take?

#CyberSunday #CyberConferences #HackerSummerCamp

Low-Code/No-Code dev tools are fueling the rise of the "Citizen Developer", but there are real security implications around the tools that enable the non-developer to build applications. I'm just starting to research this more, but here are some of my initial thoughts on today's #CyberSunday.

#lowcodenocode #appsec #cybersecurity