by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Sep 17th, 2021
After my post on Rowhammer I got a worried mail from a manager. Should we be protecting against this? My answer: Probably not. At least not before you have done everything else. Rowhammer is fascinating, but it is hard to exploit in practice and there are very few, if any, known real world attacks using […]
Posted in Business, Security Architecture on Apr 17th, 2021
With all the ransomware this spring, many managers have asked me about cyber insurance. Is it worth it? My honest answer is: Read the policy before you decide, because the problem is often that it demands a lot and covers little. To get insured you have to fill in a long questionnaire about your security. […]
Posted in Security Architecture, Technology on Jan 3rd, 2021
A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security. Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline. Every standard and regulation is written […]
Posted in Business, Security Architecture on Oct 27th, 2020
When I look back at the incidents I have worked on, very few of them were caused by a lack of money. Most of them were caused by money spent on the wrong things. The next generation firewall that nobody configured. The expensive SIEM that collected everything except the logs that mattered. The awareness training […]
Posted in Business, Security Architecture on May 23rd, 2020
In the previous post I went through the numbers on VPN and remote access attacks this spring. Here is what I think management should take away from them. First, the attackers move faster than our change processes. A VPN patch that waits for the next quarterly maintenance window is a patch that comes too late. […]
Posted in Business on Sep 2nd, 2019
In January next year Windows 7 and Windows Server 2008 reach end of support. That is six months from now. If you are in management and think this is something for the IT department, keep reading. An old server is rarely a technical problem. It is a business decision that nobody made. Someone decided that […]