Steps for Successful Vulnerability Management: Lessons from the Pitch
When I was younger, I played a variety of team sports and enjoyed competing against opponents with my teammates. Winning was always a matter of applying sound tactics and strategy, attacking and defending well and using a blend of skill, talent and luck. Now that I’m older, I watch more ... Read More
Tribbles, Supply Chains, and Industrial Cyber Security
In the original Star Trek episode “The Trouble with Tribbles,” an unscrupulous merchant, Cyrano Jones, gives a small furry animal called a Tribble to communications officer Uhura. Uhura takes the Tribble aboard the Starship Enterprise where the animal begins to quickly reproduce, thereby threatening to overrun the ship and cause ... Read More
Security vs. Compliance: What’s the Difference?
Security and compliance – a phrase often uttered in the same breath as if they are two sides of the same coin, two members of the same team or two great tastes that go great together. As much as I would like to see auditors, developers, and security analysts living ... Read More
DevOps Days – PDX 2018 Review
I had the opportunity to go to my local DevOps Days this year – DevOps PDX. If you’ve never been, and this was my first time attending, I highly recommend finding the next one closest to you and going. When I say closest to you, it’s quite likely there will ... Read More
How DevOps and CIS Security Controls Fit Together
The Center for Internet Security’s Critical Security Controls has become an industry standard set of controls for securing the enterprise. Now on version 8, the original 20 controls are down to 18 with several sub controls added. The first six basic controls can prevent 85 percent of the most common ... Read More
Back to the Future: Stick to the Fundamentals for DevOps Security
In early August, I will be leading a couple of sessions at the Community College Cyber Summit about cyber security fundamentals. I’ve also been spending time working with my amazing colleagues here at Tripwire on a really cool new offering for DevOps pipelines – Tripwire for DevOps (learn more here) ... Read More
Ease the Squeeze – Cyber Security with Small Teams
The competition is fierce; each team looking to find the best talent and get the most from every member. Sometimes, to fill a position you have to go to your bench, but this is a battle, and you are in it to win it. No, it isn’t the national team ... Read More
How to Receive a Clean SOC 2 Report
Controls—SOC 2 is all about controls. It’s right there in the name: Service Organization Controls, S-O-C. A SOC 2 report is a de facto requirement for any organization that wants to store any customer data in the cloud, which means most SaaS or cloud service providers. Unlike PCI DSS, which ... Read More
SOX – Not Just for Foxes and Baseball; A Sarbanes-Oxley IT Compliance Primer
There are Red Sox, White Sox, and Fox in Socks. At the turn of the century, a new SOX entered our lexicon: The Sarbanes-Oxley Act of 2002. This financial regulation was a response to large corporate misdeeds at the time, most notably Enron misleading its board through poor accounting practices ... Read More
