Black Swan Security

1. What I’ve learnt writing cyber strategies with grand scopes

   An approach to developing a better strategy in your cyber strategy.

   The post What I’ve learnt writing cyber strategies with grand scopes first appeared on Black Swan Security.

2. What do we protect in Cybersecurity?

   A short post comparing an information asset led approach to cybersecurity vs a critical service and customer-led approach.

   The post What do we protect in Cybersecurity? first appeared on Black Swan Security.

3. Managing Identity Consciously

   I had cause recently to participate in a workshop considering identity across an enterprise and I wanted to share some of my thinking which was unexpectedly useful. Identity is a slippery thing, it has real world hooks but in the digital world it can be many-faceted and complex. Both real…

   The post Managing Identity Consciously first appeared on Black Swan Security.

4. Why I don’t like PIGs in Security Risk

   Probability times Impact Graphs (PIGs), sometimes called a risk matrix, are endemic in security risk assessment and management. They were adopted decades ago and embedded within standards and practices. They’re still there and extensively used across the discipline despite the academic work since they were introduced which has shown that…

   The post Why I don’t like PIGs in Security Risk first appeared on Black Swan Security.

5. Security Folkways and Deliberate Security Culture

   Security culture remains an elusive amorphous ‘thing’ that we all aspire to improve but don’t really understand why or how. This is not unusual in organisations and institutions who try to understand why the interactions and communication between the people who make the goals of the group happen take on…

   The post Security Folkways and Deliberate Security Culture first appeared on Black Swan Security.

6. Homebrew Monte Carlo Simulations for Security Risk Analysis Part 2

   Previously I wrote about how I had implemented the simple quantitative analysis from Doug Hubbard’s book ‘How to measure anything in cybersecurity’ into javascript. When I wrote that code for Monte Carlo simulation I was working with percentage probabilities derived from expected rates of occurrence which I spoke about here.…

   The post Homebrew Monte Carlo Simulations for Security Risk Analysis Part 2 first appeared on Black Swan Security.

7. Open Security Summit 2020

   This was a busy week but once again the Open Security Summit proved why it is one of my favourite events on the security calendar. There is now a huge list of content recorded at the the summit and during the training sessions available for free, I will be returning…

   The post Open Security Summit 2020 first appeared on Black Swan Security.

8. What are we missing in risk?

   I’ve recently been talking with some executives who bemoan the risk management in their organisations. They don’t trust the risks as they are presented and worry about putting their finite resources of money and time in the wrong places because of it. They worry that as soon as the analysts…

   The post What are we missing in risk? first appeared on Black Swan Security.

9. Commercial & Government Cyber Conversation

   In these remote-first times I recently took part in a zoom conversation led by Henry Harrison at Garrison on the growing similarities between commercial and government cyber security. I was joined by Russell Kempley, James Chappell and Bernard Parsons MBE. We ranged from the constraints of high-threat club government security…

   The post Commercial & Government Cyber Conversation first appeared on Black Swan Security.

10. Through the barricades..

    I was speaking with a peer recently about the value of bow-tie diagrams and how they allow you to separate controls from mitigations and it became obvious I was using these terms in a way that needed to be explained. Barrier model risk methods developed in the safety and reliability…

    The post Through the barricades.. first appeared on Black Swan Security.