Isolation
By common sense, systems isolated from the network will have immunity from cyber attack over the wire but still be
"Insecure" Tunnel
Older TLS (Transport Layer Security) version is marked insecure by vulnerability scanner. Certain cybersecurity practitioners make decision solely based on
Coverage
Security technology alone cannot reassure protection. It requires human judgment: What is the value of target being protected? Risks to
Misconception
Many cybersecurity practitioners has misconception that technical controls are means to secure the cyber environment. They insist for encryption, MFA,
Dynamic Policy
Written directives for cybersecurity are getting more challenges to formulate into policies due to dynamic business nature. If too rigid,
Unnecessary Control #2
Control must be enforceable. If control can be circumvented or bypassed, then there is no point to deploy such control.
Full Coverage
This time, I talk about auditor instead of cybersecurity practitioner that I have come across. In an ICS audit, auditor
Let me drop everything ...
Politics are always incurred in work and culture of an organizations especially large one. Cybersecurity becomes a hot topic and
Perimeter
When you move the contents to the cloud, it is above the perimeter. Even if you are pretty sure you
Administrative Control
Certain cybersecurity practitioners insist to impose technical controls to secure the infrastructure/system. To some degrees yes, basic technical controls will
Dual Standards
It is no harm to have dual standard to fit specific use case. As long as the directive is clearly
Competency
Recently I gave a talk to a local university students about cyber survivability. At the end of the session, it's