by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Mar 24th, 2021
Following up on my short post, let´s talk about the money side of patching. Patching costs. It needs people, tools, test environments and maintenance windows when systems are down. For some legacy systems it means paying for extended support or rebuilding applications. I understand why it is tempting to postpone. But look at the other […]
Posted in Business, Security Architecture on Feb 14th, 2021
After two months of writing about compliance I have had a few questions from managers along the lines of: Fine, but what should it cost? There is no single answer, but here is how I suggest you think about it. Split the cost in three: the work to implement the controls, the work to prove […]
Posted in Business, Security Architecture on Jan 22nd, 2021
In my previous post I described the spreadsheet where all compliance requirements are mapped into one big set of rules. This post is about what it costs. The first cost is time. Every new system needs to be checked against hundreds of rules. Projects that should take months take a year. The business waits, or […]
Posted in Business, Security Architecture on Dec 24th, 2020
A last business post for this year, about patching. It is the least exciting topic in security and one of the most important. This year we have seen VPN gateways, remote desktop servers and old drivers used to get into companies. In almost every case the patch already existed. Sometimes for months, sometimes for years. […]
Posted in Business, Methodology, Security Architecture, Technology on Nov 21st, 2020
Following my previous post, let´s talk money, because that is usually where the PAW discussion ends up. When an admin needs two devices, an extra logon and a few more minutes for each task, someone in management eventually does the math. Ten minutes a day for twenty admins is a lot of hours per year. […]
Posted in Business, Security Architecture on Sep 5th, 2020
Following my last post, a word to management about the cost of information classification. I have seen several classification projects that ran for years, produced impressive documents with five or six levels and a matrix of handling rules, and then never got used. The users didn´t understand the difference between level three and four, so […]
Posted in Business, Security Architecture on Jun 19th, 2020
Something I have noticed during this spring is that the incidents I work on cost more than they used to. Not only because the attackers ask for more money, although they do, but because everything around the incident has become harder. When everyone works from home it takes longer to gather the right people. Laptops […]