by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Jan 22nd, 2021
Following my previous post, a word to management about compliance. In many companies compliance has become a game of doing as little as possible. The auditor comes once a year, the team prepares the evidence, the findings are negotiated down to something manageable and everybody is happy until next year. I understand it. Compliance costs […]
Posted in Business, Security Architecture on Apr 27th, 2020
In my previous post I wrote about measuring security posture. This one is for management. What should the board actually look at? Not the number of blocked attacks. Every vendor will happily show you millions of blocked spam mails and scans. It looks impressive and tells you nothing about your risk. The board needs a […]
Posted in Business, Methodology on Nov 19th, 2019
One of the most common misunderstandings I meet in board rooms is that moving to the cloud means moving the security responsibility as well. ‘Microsoft takes care of that now.’ Well, partly. The cloud provider takes care of the physical datacenter, the hardware and, depending on the service, a good part of the platform. That […]