Shorts
Short, self-contained pieces: one subject, one argument, a few minutes to read, sources at the end. When you need the full evidence, go to the research.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Network incident response
I would not begin network incident response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Network segmentation
I would not begin network segmentation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Network telemetry
I would not begin network telemetry by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Remote access security
I would not begin remote access security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Routing trust
I would not begin routing trust by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...
-
Secure network architecture
I would not begin secure network architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...
-
Wireless security
I would not begin wireless security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Your network is flat. Here's what that costs you
Flat networks are the default because they're easy. Everything can talk to everything, nothing breaks, and the diagram fits on one page. The cost shows up on...
-
Backup integrity
I would not begin backup integrity by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Business continuity
I would not begin business continuity by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Crisis exercises
I would not begin crisis exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Disaster recovery
I would not begin disaster recovery by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Identity recovery
I would not begin identity recovery by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Operational dependency mapping
I would not begin operational dependency mapping by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
Ransomware recovery: what to restore first
Everything is down and everyone wants their system back first. The order you restore in decides how long the outage lasts and whether you get reinfected half...
-
Recovery testing
I would not begin recovery testing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Resilience architecture
I would not begin resilience architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Service restoration priorities
I would not begin service restoration priorities by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
Third-party continuity
I would not begin third-party continuity by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Your Recovery Time Objective Is a Business Promise
A two-hour recovery target sounds reassuring until somebody asks what returns in two hours, whether the data is trustworthy, and who decides it is safe.
-
Anonymity limits
I would not begin anonymity limits by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Cryptographic agility
I would not begin cryptographic agility by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Data minimization
I would not begin data minimization by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Digital identity
I would not begin digital identity by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Encryption at rest
I would not begin encryption at rest by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Encryption in transit
I would not begin encryption in transit by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Encryption isn't a strategy. It's a key-management problem
"It's encrypted" ends a lot of conversations that should continue. Encryption moves the problem; it doesn't remove it. The question that matters is who can g...
-
Key management
I would not begin key management by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Metadata privacy
I would not begin metadata privacy by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Privacy threat modeling
I would not begin privacy threat modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Secure file transfer
I would not begin secure file transfer by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Alert fatigue
I would not begin alert fatigue by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...
-
Continuous Monitoring Is Not Continuous Assurance
A dashboard can show a hundred green indicators and still tell me very little about whether an attacker can reach a critical system. Monitoring collects obse...
-
Detection engineering
I would not begin detection engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Nine questions before you sign a managed SOC contract
Outsourcing detection can be the right call. Outsourcing accountability can't be. The contract is where those two get confused, so these are the questions I'...
-
Purple teaming
I would not begin purple teaming by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
SIEM architecture
I would not begin SIEM architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
SOAR automation
I would not begin SOAR automation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
SOC operating model
I would not begin SOC operating model by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
SOC performance metrics
I would not begin SOC performance metrics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
SOC staffing
I would not begin SOC staffing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
Telemetry strategy
I would not begin telemetry strategy by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
The Security Dashboard Nobody Can Use
A dashboard can be full of healthy percentages and still leave leadership unable to say whether the organization is safer.
-
Threat hunting
I would not begin threat hunting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
When to retire a detection rule
Every SOC I've looked at has rules nobody remembers writing. They fire, an analyst closes them, and the cycle repeats until someone finally asks what the rul...
-
Why Your SOC Is Busy but Not Effective
A security operations center can be busy around the clock and still miss the incident that matters. I don't find the number of alerts closed particularly rea...
-
A security review developers don't dread
If the security review happens at the end, it's a gate, and gates get argued with. If it happens at the start, it's a design conversation, and design convers...
-
API engineering
I would not begin API engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
An SBOM Is an Inventory. It Isn't Proof Your Software Is Safe.
There's a familiar move in technology procurement: take something genuinely useful, turn it into a checkbox, and then quietly start treating the checkbox as ...
-
CI/CD security
I would not begin CI/CD security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
Nothing matches. Try another word, or ask me directly.