The "hacker in a hoodie" image has been used for years by the media to call attention to articles about cyber security incidents. It's time that graphic is retired. Here's why.

FUD - Fear, Uncertainty, and Doubt - is sometimes used to sell products or services. One popular FUD element is statistics, whether spinning valid numbers or making them up. Regardless of the type of FUD, bowing to the instinctual urges to respond can obfuscate genuine information security risks.

Information security theater, improvements that look and sound good but make no real impact to overall security stance of an organization, can do more harm than good. Are you understanding the information security risks of your organization before designing and implementing controls?

Information Security and Information Technology Security are not the same. If your program is focused on Information Technology Security only, you've got gaps.

In order to stay healthy, we need to exercise regularly. To maintain our information security program's fitness, we need to exercise it as well.

Information security policies direct the governance of the information security program. What are elements of effective policies, and what mistakes do SMBs often make with their information security policy program?

Learn how quantitative information security risk assessments can help community institutions (and all small and midsized businesses). A presentation to the Bankers' Bank of the West Information Security for Community Institutions conference October 25, 2019.

Governance, Risk, and Compliance - how it can benefit information security for businesses of all sizes.

In this extended episode, vCISO Services principal Greg Schaffer speaks at InfoSec Nashville 2019 about what a virtual CISO is and how they help small and midsized businesses.

vCISO Services principal Greg Schaffer discusses the virtual CISO role in a short interview at the National Cyber Summit.