Information security: Is psychology more important than technology?
I believe that 3 psychological reasons are the root cause of why many organizations worldwide do not take a leadership position in enterprise information protection. Preventing information security events is an admission of weakness. Why spend money on technology when the first step is admitting that you’re vulnerable? We live in an age of instant […]
Is security a washing machine?
Most security appliance vendors use fluffy charts with a 4 step “information risk management” cycle. It’s always a 4 step cycle, like Symantec’s DLP “Discover, Monitor, Protect and Manage” and it’s usually on a circular chart but sometimes in a Gartner-style magic quadrant or on a line. It’s like a washing machine cycle that never […]
Data discovery for data loss prevention
A few years ago I did some work for an Israeli startup called nLayers that did applications, servers and devices discovery. They were later acquired by EMC. I thought it was a brilliant idea at the time, since large IT organizations don’t really know what assets they have in their IT portfolio. Therefore, it should […]
It’s My Way or “La Puerta”
The role of a supervisor in protecting company data. There is a feeling of entitlement in the Western world that enables employees to use company resources for private purposes. If can use a pencil, you can use a phone, if you can use a phone, you can use your PC to surf the Net on […]
Data protection for an SME
As Ben Franklin said – “an ounce of prevention is worth a pound of cure”. Three misconceptions regarding data protection and data loss prevention are prevalent in small to medium sized organisations – whether in manufacturing, distribution or education or in a service business. In my professional security practice over the past 5 years providing […]
Three simple ways of preventing data loss
When I was a solid state physics grad student at Bar Ilan, I had two advisors – Prof. Nathan Aviezer and Prof. Moshe Kaveh (who is now the President of the university). Aviezer was fond of saying that he only does simple things. I was calculating electrical conductivity of aluminum at low temperatures and due […]
Data security and the sin of hubris
Hayek wrote in his Nobel lecture – “I confess that I prefer true but imperfect knowledge. . . to a pretence of exact knowledge that is likely to be false.” One of the biggest sins of man is hubris. The Obama administration is guilty of hubris. As an American living outside the US in the […]
Data loss prevention for SME
Is a SME like the old German expression – Kleine Kinder kleine Sorgen, große Kinder große Sorgen? “Small children, small problems, big children, big problems”? I wanted to call this post “The need to understand operational risk of information security” – but I realised that op risk is a concept used by big banks and […]
Ethics and data loss prevention
Are we loving the attackers and prosecuting the victims? In data security – I don’t subscribe to utilitarian ethics (which attempts to balance the benefit versus the damage of an act) and can lead to the ends justifying the means. For data security and compliance – I personally implement the “Ten commandments” approach – if […]
Imperfect knowledge security
Keeping the organization robust in a highly dynamic threat environment Our capacity to predict will be confined to . . . general characteristics of the events to be expected and not include the capacity for predicting particular individual events. . .Yet the danger of which I want to warn is precisely the belief that in […]
