Leadership & resilience
Does your business actually need a full-time CISO?
It's a question I suspect more organisations should be asking, preferably before advertising the vacancy.
SECURITY. TECHNOLOGY. LIFE IN BETWEEN.Security is a business decision,
Security is a business decision,
not just a technical problem.
Observations, questions and a little constructive challenge.
Independent commentary by Chun Wong.
A wider perspective.
ON THE NOTEBOOK
The latest thinking.
Privacy & data
Cross-border data: the transfer mechanism is only the beginning
The problem doesn't end at the contract boundary
Privacy & data
Privacy is where law, governance and architecture collide
Privacy is often treated as a Legal or compliance problem. Understandable, given the legislation, contractual obligations and potential penalties involved. But having worked across information security,…
Leadership & resilience
The real success of a transformation programme starts after it ends
Transformation programmes tend to have very visible beginnings and endings. That is inherent in the idea of a programme. There is a business case, a sponsor, a programme team, consultants, workshops, steering…
AI & governance
The EU AI Act: Stop Reading it as Only a Legal Document
The EU AI Act is obviously a legal document. Lawyers should read it as one. The problem starts when everybody else does too. We have been here before. When GDPR arrived, an enormous amount of organisational…
Leadership & resilience
Security Pragmatism: Accepting Risk
Security people are trained to find problems. It is, after all, their raison d'être. Good security leaders also need to know when not to fix them. That may sound counter-intuitive. If there is a security risk,…
6 recent articles · Swipe or use the arrowsBrowse all writing ↗
IN FOCUS
From the archive.
Security & risk
The value of patching, The cost of not patching
(One) Major cause of data breaches Over 50% of data breaches are due to published exploits where fixes or patches are available. The actual percentage varies to which study you refer to. The vulnerabilities…
Read the article ↗IDEAS, EXPERIENCE & OBSERVATIONS
54 articlesThe notebook.
54 articles
Leadership & resilience
Does your business actually need a full-time CISO?
It's a question I suspect more organisations should be asking, preferably before advertising the vacancy.
Privacy & data
Cross-border data: the transfer mechanism is only the beginning
The problem doesn't end at the contract boundary
Privacy & data
Privacy is where law, governance and architecture collide
Privacy is often treated as a Legal or compliance problem. Understandable, given the legislation, contractual obligations and potential penalties involved. But having worked across information security,…
Leadership & resilience
The real success of a transformation programme starts after it ends
Transformation programmes tend to have very visible beginnings and endings. That is inherent in the idea of a programme. There is a business case, a sponsor, a programme team, consultants, workshops, steering…
AI & governance
The EU AI Act: Stop Reading it as Only a Legal Document
The EU AI Act is obviously a legal document. Lawyers should read it as one. The problem starts when everybody else does too. We have been here before. When GDPR arrived, an enormous amount of organisational…
Leadership & resilience
Security Pragmatism: Accepting Risk
Security people are trained to find problems. It is, after all, their raison d'être. Good security leaders also need to know when not to fix them. That may sound counter-intuitive. If there is a security risk,…
Security & risk
Payment Risks Have Changed. The Security Fundamentals Haven’t.
I’ve been around payments for more than two decades, since Cybersource days. Long enough to remember when internet payments themselves felt new, payment gateways were interesting pieces of technology, and…
AI & governance
The Modern CISO’s Role in AI Governance: Where to Lead, Enable and Challenge
The Core Point In the first six articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler, operational resilience, the operating…
AI & governance
When AI Acts on Your Behalf… Who is in Control?
Governing Agentic Systems in Practice The Core Point In the first six articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler,…
AI & governance
AI Governance Assurance: How Do You Know It Is Working?
The Core Point In the first five articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler, operational resilience and the…
AI & governance
AI Governance in Practice: Why Policies Fail (and What Works Instead)
The Core Point In the first four articles in this series, I examined AI governance as a board-level imperative, consequence-led risk tiering, security as a commercial enabler and operational resilience when…
AI & governance
AI and Operational Resilience: What Happens When the Model Fails? (4 of 6)
The Core Point In the first three articles in this series, I considered why AI governance has become a board-level issue, why risk should be assessed by consequence rather than technology and how security can…
Leadership & resilience
Security as a Commercial Enabler: Turning Trust into Business Value (3 of 6)
In the first article in this series, I argued that AI governance is becoming a board-level security issue. In the second, I proposed starting with the consequence of an AI use case rather than the model or…
AI & governance
AI Governance in Practice: Start with the Consequence, Not the Technology (Part 2 of 6)
In the first article in this series, AI Governance: The Board-Level Security Imperative , I argued that AI governance is no longer simply a technology, legal or policy issue. It is now a board-level concern…
AI & governance
AI Governance: The Board-Level Security Imperative (1 of 6)
Executive Summary AI governance is evolving into a board-level security issue because AI now influences data use, decision-making, operational resilience, regulatory exposure and client trust. The fundamental…
AI & governance
The hidden difficulty of using AI platforms in business
AI tools are becoming increasingly useful for security, risk, governance, policy drafting, document review and general business productivity. A significant part of my work is in GRC. That has been the centre…
Technology & society
Obsolete by design - Right to keep things working
Right to Repair is often framed around physical repair: batteries, screens, components, spare parts, tools and manuals. That is still important. But I think the bigger issue is now wider than repair. It is…
Privacy & data
Post-Brexit, GDPR and UK Data Protection
Brexit and Data Transfers Updated 28th Jun 2021 European Commission (EC) has granted the UK Data Protection Act (2018) adequacy with GDPR (2016) with a clause to revoke this if the EC decides that the UK does…
Privacy & data
What's on your infosec and data privacy related bookshelf?
We all read books, articles, white papers and posts. From "ABC" to "Zen and the Art of Motorcycle Maintenance". I've picked three to kickstart this. I'll start off with an old time favourite of mine, "The…
Security & risk
UK plans for contact tracing app - Civil liberties
Part 3 in a series Dedicated Data privacy and COVID-19 posts and articles Part 2 -Apps providing COVID-19 diagnosis from your voice - Privacy and ethical concerns. -…
Privacy & data
Privacy, ethics and COVID-19
Part 2 - Explores two applications developed to help track COVID-19 Part 1 - Is a high-level, nation approach to COVID-19 Test, Track and Trace efforts I update my articles as more information comes to light…
Privacy & data
Data Protection and the use of personal data during the Covid 19 pandemic
The Corona Virus I doubt it has escaped any ones' attention that we're in the middle of a health and economic emergency. Many people have succumbed to viral pneumonia since November 2019 and has become a…
Security & risk
Pretty face ruse - Clickbait
I've decided to expand on the Scamology article I wrote a few days ago, with more in-depth and real, live examples. Clickbait - what is it? Clickbait, usually a combination of a photograph and an extreme,…
Security & risk
Scamology
Time for an update on the various techniques which ensnare the unwary and a few that even seasoned professionals may be unsure of. If you haven't read my previous musings on this subject, do take a look at…
Privacy & data
Data the new Oil ? – Cleaning up the mess
Cleaning up the mess Some have said “Data is the new oil”. The analogy does work for certain aspects and characteristics, namely it is valuable and creates a huge mess when you have a leak (data breach). Oil…
Security & risk
You’ve been stuffed – Password redux -> Credential stuffing & Account takeovers
Evolution I wrote a piece on passwords more than 3 years ago and it generated many comments from industry players. I’ve also written articles on data breaches regularly. This time round I've combined the two.…
Security & risk
Stealing your house - Diverting your money
Authorised Push Payment fraud Authorised Push Payment fraud - convincing you to authorise a bank transfer to scammers. It's a form of social engineering and can be devastating to the victim. According to…
Privacy & data
GDPR - One year on (and the big fines have started)
25th May 2018 has passed, the F.U.D. (Fear, Uncertainty and Doubt) pedalled by consultancies, software companies and (some) certified data protection experts has mainly dissipated into the ether. For some, it…
Security & risk
How to steal 172M USD (or more) - Invoice Scams
Invoice Scams – Business Email Compromise For two years, between 2013 and 2015 Evaldas Rimasauskas, sent out a slew of invoices to Google and Facebook with which he managed to extract 172M USD. He did get…
Security & risk
How to ruin the reputation of your (118 year old) company, lose your job and your liberty
Unfortunately there are so many cases I can use to illustrate this. Most topical at this time at the start of autumn (fall) 2017 is Equifax. They provide credit scoring services to the public and businesses in…
Privacy & data
GDPR - How do we go about it ?
Think I'm on a roll, this is my 5th GDPR themed post. Here's a more practical article that'll help you towards alignment with GDPR. Content for this web log. Essentials for success. Information Security…
Security & risk
The value of patching, The cost of not patching
(One) Major cause of data breaches Over 50% of data breaches are due to published exploits where fixes or patches are available. The actual percentage varies to which study you refer to. The vulnerabilities…
Security & risk
Do you know what you have ? Do you know what you doing ?
My 4th GDPR themed article. It's designed to encourage debate and discussion, hopefully help you on the journey to GDPR compliance Do you know what you have ? Do you know what you doing with it ? Two very…
Security & risk
Effective Cyber Security for the work place and home ...
I have summarised a few tips that'll help you along that route. It isn't set and forget, it's a continual process. Business Essentials for successful Cyber Defence Simple to say ... Top-level commitment to…
Security & risk
Massive Attack
There have been very public examples of cyber attacks, affecting organisations on a global scale. Despite prominence given to recent outbreaks, such as Wannacry in May 2017 and NotPetya in June 2017, the first…
Privacy & data
UK GDPR – Flies in the ointment and devils in the detail
This is the third article on GDPR, the first dealt with Brexit and GDPR, the second confirmation that UK will be implementing stronger Data Protection. Complications There may be some "gotchas", possible…
Privacy & data
The Queen's Speech, GDPR & Post-Brexit
Following on from my initial article on GDPR and Brexit in September last year, there is no doubt that the UK will continue with strong data protection laws when the UK leaves the European Union (Brexit), this…
Leadership & resilience
A for Availability - BCP and DR failures
DR/ BCP effectiveness A look into the A part of C I A. Namely A for Availability. Often overlooked and not always tested with rigour. Closely coupled with Change management, Resource management and long term…
Privacy & data
GDPR - Nothing to do with us; UK is leaving the European Union, so we don’t need to do anything.
(GDPR - General Data Protection Regulations 2016) Bit of history to put things into perspective, in 1950, the Council of Europe created an international treaty to protect human rights and fundamental freedoms…
Security & risk
Passwords – Not fit-for-purpose, misused and Ugly
It’s a perennial subject, but one worth reiterating, as old habits die hard. “Popular Passwords”, from the numerous loss and publication of unencrypted password lists, a league table has been created. The data…
Security & risk
Another day, another Data Breach - OPM - US government's Office of Personnel Management
I'm sure you've seen this one in the news already. I have resisted commenting immediately, so that we can all take a step back and avoid knee-jerk, reactive comments. 21.5m USA federal employees and associates…
Security & risk
Comments disabled
I've disabled comments as I've been getting too many unwanted messages. Do please contact me via LinkedIn…
Security & risk
Ponemon Institute - 2015 Cost of Data Breach Study: United States
US study at a glance $6.5 million is the average total cost of data breach 11% increase in total cost of data breach $217 is the average cost per lost or stolen record 8% increase in cost per lost or stolen…
Security & risk
UK Healthcare sector accounted for 40% of data breaches
2014 Q4 figures released by the ICO (Information Commissioner’s Office) reveals that of the data breaches reported to them, over 40% originated from the healthcare sector. Local government and education are a…
Security & risk
World Leader's PI leaked
The personal details of all 31 leaders at the recent G20 summit in Australia have been accidentally leaked by the Australian immigration department. Despite being notified of the high-profile breach four…
Security & risk
2014 - The Year of 1 Billion Data Record Losses
Gemalto the digital security services company and Safenet have released a report titled "2014 - Year of Mega Breaches & Identity Theft" [caption id="" align="alignnone" width="1500"] 2014 Data Breaches Gemalto…
Security & risk
Data Loss Visualisation
Came across a very useful tool for visualising data loss incidents (at least the ones we know about...). The figure above links to the original site. Well worth a…
Security & risk
Significant data theft from Anthem - one of USA largest health insurers
Anthem, the US's second biggest health insurer with about 70 million people on its books across the country, admitted late on 4th February 2015, that it was the target of an external cyber attack. These…
Security & risk
First post of 2015 - Insider Threat - Data theft from 350000 Morgan Stanley's clients
A Morgan Stanley employee, Galen Marsh stole sensitive information from 350000 wealth management clients in December 2014, of which 900 client's data was posted on Pastebin, an internet expose site with a link…
Security & risk
My predictions for security/breaches/data loss in 2015 (and beyond)
Top of the list is existing vulnerabilities; the ones that have been published, the ones with patches issued 6 months ago. Coming joint first will be ingress aided by social engineering, the "click here for…
Security & risk
SONY
Sony has been on the spotlight recently, all for the wrong reasons. In April 2011, Sony's Playstation Network was taken offline by a massive DDOS attack for 23 days. During this time Anonymous stole the…
Security & risk
Target
Target data loss woes Even though the hack occurred in 2013, it wasn't till the next year that the full extent and the ramifications were known to the wider public. So far the figures are, the CIO and CEO,…
Security & risk
Solarwinds last week, Mimecast this week - Who to trust?
Solarwinds , a network and security tools supplier announced in mid-December 2020 that their Orion software tools was compromised by malware and made into a trojan. The original breach has been confirmed by…
Technology & society
Brexit - What happens to financial services?
The EU-UK Trade and Cooperation Agreement (TCA 2020) concluded between the EU and the UK on December 24th 2020 sets out preferential arrangements in areas such as trade in goods and services. UK becomes a…
No matching articles. Try another search or topic.