I ask almost every CISO (Chief Information Security Officer, for the non-security folks) I meet the same question. “Tell me what you do — but explain it like you’re talking to some random stranger walking down the street. Not to me.” Then I wait. More often than not, within 30 seconds, I stop them. “You’ve already lost me.” The look I get is hard to…
It was 2:00 in the morning. I had an information security assessment report due in a matter of hours. FRSecure was young — just a handful of employees — and I was routinely working 90-plus hour weeks. Not because I was lazy with my time. Because there was that much work to do. I wasn’t procrastinating. I just hadn’t had time to finish. Sitting there,…
In my previous post, I made the claim that as long as Americans keep buying drugs, someone will keep supplying them. Mexico has not always been the primary supplier of drugs to American consumers. The supply has shifted repeatedly over time, tracking enforcement pressure, geopolitics, and—most importantly—where demand could be profitably met. This is one of the strongest pieces of evidence that the drug war…
And Mexico Keeps Getting Stuck With Ours WARNING: This post may trigger some people. If you are one of those people, my advice is to buy a mirror and use it. The drug war is not complicated. We pretend it is. We wrap it in politics, policy debates, border arguments, and moral posturing. But at its core, it’s a simple supply-and-demand problem. And the…
Security is long-term. Most leadership is not. This is the sixth and final part of the Accountability in Cybersecurity is Broken series, exploring the root causes behind why accountability is critical to our mutual success and why it’s fundamentally broken. If you’ve been following along (Part 1, Part 2, Part 3, Part 4, Part 5), you know I’m fed up. After 30+ years in this…
Confusion sells. Simplicity doesn’t. And that’s no accident—it’s a damn business model. IMPORTANT RANT ALERT – This post calls out vendors, “experts”, and so-called professionals. It’s VERY important to note, that many vendors, experts, and professionals in our industry are good (“good” is subjective, of course). Here, I’m calling out the bad examples, purposeful or not. So, any offense taken is only meant for those…
Part 4 of the “Accountability in Cybersecurity is Broken” Series NOTE: Let me preface this by stating that I am not a lawyer, nor am I qualified to give you legal advice. I am a 30+ year information security veteran who’s tired of seeing people get screwed over by a system that’s not working (for them). Also, to be fair, this is me sharing my…
Part 3 of the “Accountability in Cybersecurity is Broken” Series The Day I Learned the Truth The first time I realized politics was a dirty business was in 1998. Our U.S. Representative came to visit our workplace. At one point, he asked us: “What do you think my #1 priority is in Washington?” Naively, I answered: “To represent your constituents at the Federal level.” He…
We’ve got a serious problem in this industry. Not the kind that shows up on a risk register or a compliance checklist. I’m talking about the complete lack of real accountability when information security fails. The Same Old Story Massive breach? No worries. Slap together a PR statement filled with buzzwords (“sophisticated threat actor,” “zero-day vulnerability,” “we take your security seriously”), toss a CISO under…
And why do I care. I’ll go in reverse. Why Do I Care? First, why do I care about UPL? Simple. Because I care about people. From my perspective, people suffer from the brokenness between our legal system and information security. Also, I care because I’m planning to write more opinions about things that are broken between our legal system and information security. In all…