Roger Halbheer on Security
We always talk about it, right? Security is a top management responsibility but who is really taking this responsibility? Typically the CSO gets under pressure, once incidents happen. Well, Marissa Mayer – the CEO of Yahoo – does, now: Yahoo CEO Loses Bonus Over Security Lapses And with GDPR just around the corner with fines…
One of the discussions I have with a lot of customers is around managed security services. Especially themes like Security Operation Centers seem to be fairly emotional as quite some customers want to build and run one themselves (and yes, I know the challenges around regulation). One of the points I often make is the…
First of all I have to apologize: I had quite some technical issues with my blog and therefore had some time between now and the last post…. Today I would like to tap your brains: It is close to Christmas and therefore a typical time to hand your wish list to Santa (in our case…
Actually the article I was looking at was called: The 4 Biggest Mistakes Businesses Make Trying To Secure Endpoints. However, a major part – in my opinion – is not only true for the endpoint but for security in companies as such: Underestimating Human Error: Well it starts with the administrator who is taking wrong…
Unfortunately, we do not see too many women in security – even though there are huge opportunities irrespective of the gender. Over the years, I had the pleasure to work with great women in this business. We will run an event on Thursday, April 28, 2016 at 6.30pm at the Accenture Office in Zurich with…
I read this article (Surviving an Insecure Cyber Workforce) this morning about “the user” (and was once more disappointed – initially. They talk about the importance of awareness, the technology to make sure that the user does not access anything outside their business needs and only well audited etc. and at the very, very end…
No, they are still not coming from me but this article is actually really interesting: Top 15 security predictions for 2016. A few of them are remarkable: At your criminal service (Kaspersky/Seculert) The profitability of cyber-attacks means sophisticated criminal gangs with modern organizational models and tools will replace common cyber criminals as the primary threat.…
I just got informed today, that I have been elected as a full member of the Swiss Academy of Engineering Sciences. The vision of the SATW is: SATW is recognized as the principal organisation for the communication of independent, objective and comprehensive information about technology – as a basis for the forming of well-founded opinions…
Back when I was working at Microsoft I was joking that the company was been run on Mail and Spreadsheets. I guess I was not THAT wrong and I guess a lot of companies are the same. Key data still resides in any kind of SAP (or the like) installation and then the data is…
When you do risk management, one of the key questions is always, how a possible incident impacts the trust and then the customer base. Do you really lose customers when incidents happen? Well, the VW group learns this the hard way currently but how does online trust really impact the business? Ponemon published an interesting…
When I look at the recent events and data exfiltration cases, it really looks like we are at the losing end of a battle. It seems to be fairly simple to compromise a network and exfiltrate data nowadays. Now you may claim that you deployed all kinds of cool technology like hardened clients, data loss…
As criminals get access to better technology and as the underground markets get more active, it is not surprising that targeted attacks become more mainstream. This is something we have seen over the last 6-8 months as well as extortion threats grew in parallel. There is another trend I see talking to other organizations: Midsize…
Just read this post by Martijn Grooten ‘Why I fell victim to a LinkedIn scam – and why I would do so again tomorrow’. It is basically about when you accept connection requests on LinkedIn, Xing, Facebook etc. I agree with Martjin that I treat stuff I write on these platforms as public but still,…
In my last blog post I claimed that I have not seen a good security metrics system working so far and asked whether it is a failure. On different channels I got some reactions, which I would like to share here. One claim is that – as risk management is at the heart of security…
The insider threat is a real threat – nothing new here, this is something we know since quite a long time. Protecting data against misuse by insider (accidentally or criminal) is a key challenge for security organizations as you have to protect data against abuse by people who need to have access to the same…
Now for something completely different: I guess that the link between business and security is one of the big challenges of today. How can we make security more relevant for the business or coming from the other side, how can we enable the business to understand, what we do in security? A few months ago,…
One of the key challenges in the every day’s world of a CSO is reporting. How and especially what do we report to the board and how do we make it relevant to the people there? We all know that finance has a fairly clear and standardized reporting scheme as the subject matured over time…
A teacher in the US reached a settlement with his former employer regarding an age discrimination suit. It was agreed that the $80k settlement should remain confidential. However, the teacher informed the court that they had to tell their daughter “something”. Which led the girl to post on Facebook (“only” to her 1200 “friends”): Mama…
The ones who regularly read my blog know, that I am absolutely convinced that we need to change in the security industry in certain ways: We need not only to position security as a business enabler but we need to live this. The point I made numerous times was that IT is here to help…
