This will be Part 3 of my series of articles on Zero Trust. Applications perhaps receive the least amount of attention when it comes to implementing Zero Trust. The level of trust given to applications is often surprising considering the rate at which vulnerabilities are being discovered (yes, title quote…

This will be Part 2 of my series of articles on Zero Trust. And let's start with data, the "chewy core" of the traditional M&M Information Security model. In the traditional cybersecurity model, data is protected via encryption and access control, and an entity (user or device) gains the “trust”…

Zero Trust is a term attributed to Stephen Marsh and mentioned in his ’94 doctoral thesis “Formalising Trust as a a Computational Concept” (link to original thesis). The more than 200 page thesis delves into aspects of defining Trust and it’s relationship to Time, Memory, Optimism vs. Pessimism, Pragmatism vs…

EDIT: As I was revisiting this article, I felt I had to make a few changes. These are marked and reflect the change in D-ATP since this article was written. There are several additions to the D-ATP feature set that I believe should go into a new article. Stay tuned. …

Scenario: As part of their cloud-strategy, your organization migrated to Azure on an accelerated timescale. This often meant rules were “bent”, exceptions were handed out freely, and access governance was overlooked. …

After some discussions with peers from other organizations, I was surprised by the lack of automation and end-to-end process for managing phishing incidents. So, without much preamble, let’s jump in to what an IR playbook would look like that relies heavily on automation. Scenario: Acme runs their email on the…

It is amazing that in the face of overwhelming evidence, organizations still struggle to comprehend the complexity of cyber-security and underestimate the importance of the right people and right tools to secure their business. …