It's flooding a bit in Houston, and that made me... of course... think of #cybersecurity. On today's #CyberSunday, I am talking about making sure you pay attention to the small things in your program, so that they don't turn into bigger things.

Credential stuffing is an often-used attack. But for the love of all that is holy, your master password in your password manager should not be susceptible to this!!! Today, I talk about what credential stuffing is, what password manager has been hit by it recently, and generally get grumpy about the whole thing.

#CyberSunday #credentialstuffing #bigmistake #cybersecurity

The CI/CD OWASP Top 10 came out last month (not sure how I missed that!). What does that mean? Well, that depends on what you're responsible for in the CI/CD pipeline! Here are some thoughts form me on the topic on today's #CyberSunday.

#cicd #cicdpipelines #owasp #owasptop10 #development #appsec

The holidays should be a time to celebrate food, friends, and family (and football). Maybe this is also a good time to measure the effectiveness of your #managedsecurity provider.

#mdr #securitymetrics #Thanksgiving #cybersecurity #CyberSunday

How you set priorities around building a #cybersecurity program differs based on your perspective. On today's #cybersunday, I talk about how the perspective of the advisor must be tempered by the perspective of the practitioner working day-to-day in the trenches.

#prioritization #perspective

I was quoted in an article last week about the latest CISA directive on #assetmanagement and #vulnerabilitymanagement (link below). I was the cynical voice in that article, and I wanted to explain a little more on this #CyberSunday about whether these two #cybersecurity #fundamentals should be paired as closely as they are by #CISA.

Link to article: https://securityboulevard.com/2022/10/cisa-directs-federal-agencies-to-boost-system-visibility/

In today's #CyberSunday, I go a little outside the normal #cybersecurity discussion and talk about how #liftandshift isn't always negative when it comes to moving workloads into the cloud. I specifically talk about my experiences with a couple of different security vendors (I didn't name anyone specifically) who took different approaches and the positive and negatives associated with those cloud moves.



#cloud #cloudinfrastructure #digitaltransformation 

Securing the digital transformation is not a new problem. It is actually an old problem with modern concerns. A lot of people are talking about how concerned they are with machine identities, APIs, IoT, etc.. But these things aren't new. They've actually been in existence for quite a long time. What we're REALLY saying is that these things are proliferating out of control, and they're not properly secured. But why has it become a problem?

Today's #CyberSunday is all about my take on this issue.

#digitaltransformation #machineidentities #internetofthings #apis

Dr. Gerald Auger and I gave a talk last week at the Houston Technology Summit titled "Building Cooperation and Understanding Between Security and IT". We talked a lot about the differences in skills and mission between the two groups, and how there should be more empathy between them. Here's my #CyberSunday quick take on our presentation.

#cybersecurity #informationsecurity #informationtechnology #empathy #cooperation

Is regulatory compliance fundamental to your #cybersecurity program? In this #CyberSunday, I compare regulations against standards and talk about which one comes before the other.

#regulations #compliance