So you’re a new CISO and you just arrived at the organization. What should your personal interaction project plan look like? I tell CISO’s that they should plan on a few days to simply spin up their technology, get their…
You’re not in our industry WTF do you know about infosec?
This is more from my noisy search for my next windmill to tilt at in what will be the great success of helping an organization become more resilient, capable, and respected for the information security posture they exhibit. I like…
Attribution of cyber adversaries
Key Points: Attribution has three distinct layers; political, technical, and forensic with each having different confidence levels and analysis strategies Adversaries must interact with systems to exploit them and this creates evidence or anomalies that can be used for attribution…
Hiring military leaders off the street
Lots of snark talk from the military types out there. I understand it, but don’t have to agree with it. Over the weekend Military Times put out an article that above the fold states. Defense Secretary Ash Carter wants to…
Authoritarianism or similar rather than leadership
Leadership is not about the tell it is about the do. To many people look at a leadership task as telling other people what to do. They take an authoritarian perspective on the principle of getting things done. I see…
Leadership: Putting strategy back into human interaction
We spend a lot of time talking about leadership where we think of it as getting people to do something through some form of incentive or disincentive. Simply churning and burning our way to action through carrots and sticks though…
Motorcycle Monday
Am I looking for a job?
I’m a senior executive, a subject matter expert, and an influential strategic leader in cyber security. Why would I always be looking for a job, why would I always be keeping my ear to the ground, and why would I…
Tail of the Dragon
Motorcycle Monday
Digital forensic books
A not comprehensive reading list. Some of these are new, some are old, but they give a good overview of the discipline. If the book has exercises it is a good idea to do them. Operating System and Platform…
NDU Presentation to the faculty
I’ve been asked to talk about a variety of topics. This particular topic was a strategic look at three policy changes that might degrade, deter, or disrupt adversary capability in cyberspace. NDU IRMC 2016 Presentation (PPT)
Motorcycle Monday
Some ICS Reading Resources
Quick hit on some things for reading up on control system security. One of my favorites is Kurtz, R., (2006) “Securing SCADA Systems” this particular book is older, but it has a great section on comparing ICS security protocols. Meant…
Metrics of Precision for Leaders of Security Programs
Slides for my talk at National Defense University Information Resources Management College (IRMC) Metrics_of_Precision_For_Leaders_Of_Security_Programs