A balancing act
I had a great conversation with Nick Selby this afternoon, and one of the many topics we discussed was triggered by a couple of his recent blog posts about critical infrastructure- one touching on the 60 Minutes piece hack-job and another on Fudsec about where the risk should be placed. At first, I was really wound up about Nick's post on the 60 Minutes piece because he seemed t

IT as Utility, that is just stupid. And Wrong.
This set of ideas just won't die, no matter how wrong they are. "IT will be completely commoditized" "IT will be just another utility, like power and water" And my favorite: ""IT is dead" We've heard this idiocy from a variety of smart people, including

Layer 8 post: The meaning of metrics
Always accurate, insightful, and irreverent, there's another great post over on the Layer 8 blog, this time taking aim at the "security metrics" landscape.  "The meaning of metrics" has a great take on metrics, and really separates reality from navel-gazing.  It also provides some memorable quips and quotes.  I especially like: "Keep applying the “so what?” criterion to your metrics." and words to live by: &qu

Whose customers are they?
Those nice folks who give money to your company, you know, the customers- whose customers are they? Are they the company's customers, or the salesman's? Or a bit of both? Maybe it is more complicated than that, if your company sells through partners/agents/resellers- now whose customers are they? And the tricky bit- you aren't trying to secure customer data without everyone involved understanding, and agreeing on, whose customers they are, and who is responsible for the data, are you? That would be waste of time, wouldn't it? If you are new at this, especially if you only see it from an information security perspective, this may seem fairly s

Widgititis
I know, that cool Podcast.com widget over there needs an update.  I tried that, but they are having "technical difficulties" at Podcast.com right now.  I'll be adding Exotic Liability, Threatpost podcasts, and others, with some details soon- if they get the widget fixed.  If not, I'll swap it out for a different widget. While you're waiting, head over to Pauldotcom and listen to me humiliate myself and several others on their Halloween episode.  Not or the faint of heart, easily offended, or anyone burdened by a sense of decorum.  The re