Author Archives: Daniel Blander

I recently received a message in my inbox from a vendor (note the use of the word “mandatory”): Is it really mandatory? Too often people confuse the guidance that standards provide with what is mandatory. Too often vendors use a … Continue reading →

Recently I encountered a bug in one of my second factor authentication apps that caused me to lose all the registered tokens for multiple sites. As you can imagine, losing (or having destroyed) the second factor for important sites can … Continue reading →

“APT is your biggest risk.” “Public cloud cannot be secure, just look at CapitalOne.” “Insiders are your biggest threat.” “You must have a SIEM if you are going to pass your SOX audits!” Bah, humbug. Fear, Uncertainty, and Doubt (or … Continue reading →

Author’s Note, this blog was written back in 2013, but never made it this far. Forgive the delay and references to old presentations that may not be accessible. It’s been a while since my last post, and I’ll blame it … Continue reading →

After too many years witnessing the sham that are “security standards” and regulations, I feel like I have to be a bit of a grumpy old man. I’m not usually this way…well, I am old, but usually not terribly grumpy. … Continue reading →

I’m sure Daniel Kahneman has defined this fallacy in better terms, but it is a good story to show one of the potential reasons why the concept of DevOps and Lean are so valuable. And also why certain types of … Continue reading →

I love it not because it is wrapped in complexity, but for quite the opposite reason; it is (and should be) a perfect case of simplicity. Let me explain why with a quick story of bad change control. I watched … Continue reading →

I had the opportunity to read Gene’s new book The Unicorn Project last month. Like the Phoenix Project, I was riveted – nearly missing my tube stops on the way to work. My distractions came from usually as a result … Continue reading →

I was recently asked the question, “Where does Security belong in an organization?” It is an intriguing question, and one that I think about quite often.  Currently most CSOs report to the CIO or CTO.  In a few, rare cases, … Continue reading →