by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Dec 31st, 2021
It is New Year´s Eve again. The champagne is cooling, the family is getting ready and the security architect is, as tradition demands, writing a blog post. What a year. It started with me ranting about compliance and ended with half the world searching their servers for Log4j. In between there was more ransomware than […]
Posted in Business, Security Architecture on Nov 25th, 2021
A last business post for the year, and it ties together the two previous ones. Many security organisations are built on old competence areas. Network security, server security, application security, compliance. Each with its own manager, budget and priorities. It made sense when the threats followed the same lines. They don´t anymore. Look at the […]
Posted in Business on Oct 26th, 2021
In my previous post I wrote about the holidays being high season for attackers. This one is for management: prepare your readiness now, not on the 23rd of December. First, decide who is on call. Not just in IT but in management. If you are hit on Christmas Eve, someone needs the authority to make […]
Posted in Business, Security Architecture on Sep 17th, 2021
After my post on Rowhammer I got a worried mail from a manager. Should we be protecting against this? My answer: Probably not. At least not before you have done everything else. Rowhammer is fascinating, but it is hard to exploit in practice and there are very few, if any, known real world attacks using […]
Posted in Business, Security Architecture on Aug 13th, 2021
Following my short post from New York, something more serious. The last eighteen months have been one crisis after another for security people. First the move to working from home, then a constant wave of ransomware, supply chain attacks and critical vulnerabilities that had to be patched yesterday. Many of the people I work with […]
Posted in Business, Security Architecture on Jul 13th, 2021
A short question for management: If an attacker logged on to one of your servers with a stolen admin account last night, would you know? In the incidents I work on, the answer is almost always no. Not because the company didn´t have tools, but because nobody had the full picture. The firewall logs were […]
Posted in Business on Jun 14th, 2021
There are two reasons companies get a SOC. Because they must, or because they want to. The first kind is bought to satisfy a regulator, an auditor or a customer. The requirement says ‘continuous security monitoring’, so a service is purchased, preferably the cheapest one that ticks the box. It collects some logs, sends a […]
Posted in Business, Security Architecture on May 30th, 2021
In my previous post I wrote about a service provider that lost more than 50 Active Directory forests in one attack. This one is for management, and especially for those who outsource IT operations. When you outsource your IT you don´t outsource your risk. You change it. Your security now depends on how the provider […]
Posted in Business, Security Architecture on Apr 17th, 2021
With all the ransomware this spring, many managers have asked me about cyber insurance. Is it worth it? My honest answer is: Read the policy before you decide, because the problem is often that it demands a lot and covers little. To get insured you have to fill in a long questionnaire about your security. […]
Posted in Business, Security Architecture on Mar 24th, 2021
Following up on my short post, let´s talk about the money side of patching. Patching costs. It needs people, tools, test environments and maintenance windows when systems are down. For some legacy systems it means paying for extended support or rebuilding applications. I understand why it is tempting to postpone. But look at the other […]