by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Dec 14th, 2021
This week the world found out about a vulnerability in Log4j, a logging library used in a huge number of Java applications. It can be exploited remotely by simply getting the application to log a specific text string. The attackers started scanning for it within hours. The first question every customer asked was: Where do […]
Posted in Security Architecture, Technology on Dec 11th, 2021
Following my previous post, let me go a bit further on the technical side of seeing the whole environment. Most IT organisations are split by technology: servers, clients, network, cloud, applications. Security has often followed the same split. One team for endpoint protection, one for the firewalls, one for identity, one for the SIEM. Each […]
Posted in Security Architecture, Technology on Feb 5th, 2021
There is one moment every security architect fears. You arrive at a new customer, you ask about their requirements and someone proudly opens a spreadsheet. It has every regulation and standard the company needs to follow mapped against each other. ISO 27001, NIST, GDPR, the industry regulator, a couple of customer contracts. Hundreds of rows, […]
Posted in Security Architecture, Technology on Jan 3rd, 2021
A new year and a new theme. This year I want to spend some time on compliance, because it is one of the most misunderstood parts of security. Let me start with a statement that usually upsets someone: Compliance is never good security. At best it is a baseline. Every standard and regulation is written […]
Posted in Security Architecture, Security metrics, Technology on Sep 4th, 2020
I have a theorem I have been pushing for many years. Information classification as we know it is an effect of security being expensive. Think about where it comes from. Governments and the military classified information because protecting it cost money. Safes, guards, couriers, cleared staff, separate networks. You couldn´t afford to protect everything at […]
Posted in Business, Speaker, Technology on Feb 15th, 2020
I have just spent a week in Rome at a Microsoft training on security architecture. Good food, good company and, believe it or not, a lot of good discussions on the difference between architecture and engineering. One discussion stuck with me. A colleague asked why so many customers have excellent engineers but still end up […]
Posted in Security Architecture on Jun 17th, 2019
I get the question surprisingly often: ‘If we go for Zero Trust, can we get rid of the firewalls?’ Short answer: No. Zero Trust is not a new religion that makes everything before it obsolete. It is an extension of the security we have always done. Defense in depth, least privilege, separation of duties, logging. […]