Dynamic Policy
Written directives for cybersecurity are getting more challenges to formulate into policies due to dynamic business nature. If too rigid,
Unnecessary Control #2
Control must be enforceable. If control can be circumvented or bypassed, then there is no point to deploy such control.
Full Coverage
This time, I talk about auditor instead of cybersecurity practitioner that I have come across. In an ICS audit, auditor
Let me drop everything ...
Politics are always incurred in work and culture of an organizations especially large one. Cybersecurity becomes a hot topic and
Perimeter
When you move the contents to the cloud, it is above the perimeter. Even if you are pretty sure you
Administrative Control
Certain cybersecurity practitioners insist to impose technical controls to secure the infrastructure/system. To some degrees yes, basic technical controls will
Dual Standards
It is no harm to have dual standard to fit specific use case. As long as the directive is clearly
Competency
Recently I gave a talk to a local university students about cyber survivability. At the end of the session, it's
Seasonal Factor
There are network anomaly detection technologies to alert abnormal network traffic of potential cyberattack. The pre-requisite is let the technology
Enforcement #4
Cybersecurity policy establishment and cybersecurity policy enforcement are usually executed independently in an organization. Normally, policy authors are more knowledgeable
Opportunist
Policy statement must be clearly defined and published. It must also be precise without ambiguity but subject to interpretation by
Spare Capacity
Availability is one of the protection objectives in cybersecurity. When deploying new systems, the design must cater for spare capacity.