I’ve spent more than 30 years in information security, and here’s a truth that still makes people uncomfortable: Information security isn’t really about information or security. It’s about people. But not just one kind of people. Every security incident—every breach, outage, or “technical failure”—involves three distinct groups of people, whether we acknowledge it or not: The people who make decisions — those who design systems,…
Every Christmas, people talk about peace, joy, giving, gratitude… all the good stuff. Meanwhile, the criminals are rubbing their hands together like it’s their holiday. Because for them? It is. The truth is simple and uncomfortable: The holiday season is the Super Bowl for scammers, thieves, and every flavor of dirtbag who preys on distraction, kindness, stress, and chaos. Every year, too many good people…
People ask me all the time: “Evan, what’s the single most important thing I can do to protect myself and my organization?” They expect me to say MFA, patch your systems, buy the latest shiny tool, or maybe hire a great vCISO. Nope. My answer is always the same, it never changes: Learn, embrace, and master situational awareness. Everything else evolves from there. What I…
For most of us, ransomware stories feel abstract — something that happens to “other companies,” something insurance will cover, something you can recover from with backups and a good IT team. Then came the collapse of KNP Logistics Group, better known under its flagship brand Knights of Old. A 158-year-old British haulage company — hundreds of trucks, hundreds of employees, generations of history — was…
It’s Not Real Until It Hurts: Why No One Demands Change If nobody is going to hold you accountable, why be accountable? Believe it or not, some people will claim that we’ve made progress in cybersecurity. Sure, there are more tools, more frameworks, more professionals, and more funding than ever—but let’s be honest. When you zoom out and look at the full picture, we haven’t…
Let’s not waste time. Yes, accountability in cybersecurity is broken. Badly. In fact, it’s been broken for a long time. We talk a big game in this industry about “responsibility” and “doing the right thing,” but when something goes wrong–when someone gets hurt, when data is stolen, when systems fail–who’s actually held accountable? Rarely the people who should. And that’s the problem. Responsibility ≠ Accountability…
There’s a big difference between data and information, and frankly, not enough people get it. In cybersecurity–and life–that misunderstanding isn’t just annoying. It’s dangerous. Here’s the short version: Data is raw. It’s messy, unfiltered, and full of potential. Information is processed. It’s someone else’s version of the story. And given the choice, I’ll take the data. Every single time. The Problem With “Information” When someone…
Some nights I sit back, sip my coffee (or whatever’s strong enough to keep me from flipping tables), and let the question roll around in my head like it owns the place: Does any of this actually matter? I’ve been in this game long enough to know how the sausage is made. Security programs built on duct tape and prayers. Execs who think “acceptable risk”…
Look, cybersecurity is heavy enough. Ransomware sucks. Breaches suck. People reusing the same dumb passwords for 20 years? That really sucks. But sometimes, this industry serves up stories so ridiculous, so head-shakingly absurd, that you just have to laugh. Here are 10 cybersecurity facts that won’t help you secure a damn thing—but might make you spit your coffee or at least shake your head in…
If you’ve spent more than a few minutes in the cybersecurity industry, you know that credibility is everything—or at least it should be. That’s why the news that Mark Lanterman, a well-known cyber forensic expert involved in over 2,000 cases, is under FBI investigation is a gut punch to many of us. Brian Krebs’ report lays it out: serious questions are being raised about whether…