Privacy and cryptography

Everything I've written on privacy and cryptography, with the research pieces first. Each one ends with something you can do on Monday.

Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.

What's in a five-angle short

Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.

1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
4What good looks like: the result that would tell you it worked, and the number I'd watch.
5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.

Filter these articles

Research & Analysis Privacy and cryptography · 17 min

How Do You Make Data Classification Enforce Access Rules?

Turn classification labels into tested read, edit, export and sharing rules, accounting for attribute quality, copies, masking and policy changes.
Research & Analysis Privacy and cryptography · 17 min

How Do You Minimize Security Logs Without Losing Useful Evidence?

Decide which security-log fields to keep, transform or restrict, then test detection, identity resolution and retention before removing useful evidence.
Research & Analysis Privacy and cryptography · 17 min

What Should a Post-Quantum Cryptographic Inventory Include?

Build a post-quantum inventory that connects algorithms, data lifetimes, trust dependencies and vendor constraints to a testable migration plan.
Short Privacy and cryptography · 2 min

Anonymity limits

I would not begin anonymity limits by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Short Privacy and cryptography · 2 min

Cryptographic agility

I would not begin cryptographic agility by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
Short Privacy and cryptography · 2 min

Data minimization

I would not begin data minimization by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
Short Privacy and cryptography · 2 min

Digital identity

I would not begin digital identity by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Short Privacy and cryptography · 2 min

Encryption at rest

I would not begin encryption at rest by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
Short Privacy and cryptography · 2 min

Encryption in transit

I would not begin encryption in transit by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
Short Privacy and cryptography · 2 min

Encryption isn't a strategy. It's a key-management problem

"It's encrypted" ends a lot of conversations that should continue. Encryption moves the problem; it doesn't remove it. The question that matters is who can g...
Short Privacy and cryptography · 2 min

Key management

I would not begin key management by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
Short Privacy and cryptography · 2 min

Metadata privacy

I would not begin metadata privacy by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
Short Privacy and cryptography · 2 min

Privacy threat modeling

I would not begin privacy threat modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
Short Privacy and cryptography · 2 min

Secure file transfer

I would not begin secure file transfer by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...