Compliance is not security
Our Defense Industrial Base (DIB) faces continual attacks that harm our national defense. As such, we need real security to
Category: Cyber Risk
CMMC 2.0 is dead. They just don’t know it yet.
I was pretty excited as I drove onto the sprawling and meticulously landscaped campus. I was heading to a meeting
Google makes some noise in the security market. Did they get lured into a bad deal?
Google’s announcement that it would be buying security firm Mandiant for $5.4 billion made some waves in the security world
CMMC’s worst ‘best practices’
There is a buzz around the DoD’s reported review of the Cybersecurity Maturity Model Certification (CMMC) program. It is unclear
The Security Screwtape Letters
The other day I got a FedEx package containing a USB drive and handwritten note. The note said: Please provide
The economics of a hospital ransomware breach
Ransomware attacks on hospitals have been in the news a lot lately. Have security professionals done a good job of
Security Myopia
If you attended business school any time over the last 50 years you probably read the timeless Harvard Business Review
Ransomware Economics 201
In my previous post I outlined why the most cost-effective way to recover from a ransomware attack is to pay
Ransomware Economics 101
Recently, travel management company CWT became yet another victim of a ransomware attack. The company paid the attackers over 400
Unknown unknowns
In 2002, Donald Rumsfeld, who was the US Secretary of Defense at the time, was asked a question about the
Security Economics 