It looks like there is a coordinated effort in the US government to promote so-called “zero trust architecture”. I wrote my last article on the NIST ridiculousness in this arena, and since posting it, I have found that there are several other Federal attempts to promote the so-called architecture both within and outside of government. …
Don’t trust Zero Trust – The Whole of Government Approach Read More »
Until recently, the concept of zero trust architecture as a cybersecurity approach was a minor thorn in the side of those of us trying to achieve effective risk management in cyber systems. Similarly, the so-called “best practices” approach to cyber security that I have heard about for years has produced no such “best” anything. The …
Don’t trust Zero Trust or so-called Best Practices Read More »
People who think they know believe the messaging from browser providers who say things like “Site Not Secured” when accessing a site that runs hypertext transfer protocol (http) instead of http ‘secure’ (https). Let’s stop this myth today. What is https supposed to do? Let’s assume it actually does that… To be clear, I am …
Encrypted is not Secured, and https is even worse Read More »
I have seen many companies claim to follow “best practices” or have 100% secure somethings. Rest assured, there is no such thing. Hyperbole and selling fear and easy resolution are the hallmarks of poor quality companies in this space. Either They don’t know OR They know and are misleading. I am not certain which is …
There is no “best practice” or “100%” in Cyber Security!! Read More »
One of the key components of authorized access, which we seek to facilitate, is determining whether the access is in fact authorized, and doing so quickly and efficiently without interfering with ease of use or slowing the smooth flow of commerce. This process is supported by authentication, the demonstration that a request is authentic (typically …
Data centers are a prime target for compromise because (to misquote Willie Horton) “that’s where the data is”. The people running data centers know this, and when you hear terms like “advanced persistent threat”, the data centers are in most cases the ultimate target. But the data centers have to execute too! They understand that …
How secure is your data center and how can you tell? Read More »
Some years ago, a Verizon study showed that most leaks of confidential information from cyber attack involved content or systems not in the security inventory. Of course it is stupidly obvious that if you don’t know you have it you are unlikely to properly control it. But on the other hand, how many of us …
For a long time, the intelligence and counterintelligence aspects of cybersecurity have been considered a lesser element among many in the field. When people I know bring up things like perception management and counter-influence they are often told that’s not part of cybersecurity. My view of this is pretty simple. If people are using something …
