Innovative ideas on the ends and means of modern information security

We value your feedback! Please contact us through social media or email, or leave a comment. Thank you for visiting.

Secure What Matters

A case (and method) for impact-driven infosec based on asset value

Security teams spend vast amounts assessing and addressing the likelihood of incidents through threat intelligence, vulnerability management, and more. But if this is done to protect assets that don’t really matter, those investments become waste.

Teams struggle to know what systems would matter most if they were to go down, and what data would be most damaging if it were taken or corrupted. Using access and insight to determine the value of systems, data, and users helps build a truly risk-informed, rational security program.

Read more ...

1 May 2019

Custom Incident Response Plans for Everyone

Expanding our efforts to bring quality plans to every organization

Starting with a high-quality incident response plan template is good, but we can do better with a convenient tool to customize that template for your organization. We’ve released an easy-to-use app that lets you enter simple information about your organization and download a customized plan. The output is ready to use immediately, and contains instructions for how to improve the plan over time.

Incident response planning is a cornerstone of information security and a required component of many compliance regimes - get started with a free custom plan ASAP.

Read more ...

1 Apr 2019

An IR Plan You Will Actually Use

Concise, directive, specific, flexible, and free

Incident response planning is a cornerstone of information security programs, but too many plans end up on a shelf gathering dust until the next audit.

A stale, unused plan is almost worse than having no plan: it can lull the organization into a false sense of security, without any meaningful preparedness.

We can definitely do better, with plans that are more concise, directive, specific, flexible, and free. We’ve created a high-quality incident response plan template to get everyone started.

Read more ...

1 Sep 2017

Why Infosec?

A model for clarity of purpose in information security

Existing information security (infosec) frameworks ignore or presuppose why we invest and participate in infosec—the purpose. Moreover, stakeholders have different motivations, which leads to equivocation, miscommunication, and ineffectiveness.

A model for why infosec improves communication, priorities, and impact:

  • Infosec motivations fall into four categories: economics, edicts, ethics, and excitement (E4)
  • These categories fall along two axes: focus (protector vs. protectee) and discretion (flexible vs. rigid)

Read more ...

1 Aug 2017