We have always known the bugs were there. Not the ones we found and patched, the ones nobody had found yet. The ones sitting quietly in code that was written before some of your security team were born, running in systems that have never been seriously tested, doing their job reliably enough that nobody thought…
I got a new coffee machine yesterday. Four espressos later, nothing was quite right and I did not know why. By morning I had worked it out. Two fundamental errors, hiding underneath everything I had been adjusting. There is a security culture lesson in there and it is a good one.
I started writing this post in the summer of 2018, about two months after GDPR came into force. Life got in the way and I never finished it. Reading it back now, what strikes me is not how much has changed. It is how much has not. So let me finish what I started, with…
In security and governance, the biggest risk is often not the threat itself. It is the absence of anyone willing to own the decision about what to do about it. After more than two decades working in information security across complex organisations, the pattern I see most consistently is not a lack of capability. It…
Following on from my previous article regarding the General Data Protection Regulation (GDPR) titled GDPR and what it means to you (Part 1), we’ll pick up where we left off and discuss some important areas to focus on, this is by no means a definitive list but will get you started. There are numerous methods to approach…
Following on from my previous article regarding the General Data Protection Regulation (GDPR) titled GDPR and what it means to you (Part 1), we’ll pick up where we left off and discuss some important areas to focus on, this is by no means a definitive list but will get you started. There are numerous methods to approach…
As you’ll probably know by now, the European General Directive known as the General Data Protection Regulation (Regulation (EU) 2016/679) comes into force across on the 25th May 2018 by which time all EU member states must have implemented the regulation in their territory. As this is a regulation, it’s a Law that cannot be ignored or…
