Accidental CISO

What (or who) are your favorite sources of Cybersecurity news? Bonus points for news that is primarily relevant to small businesses leaders.

Some of the most unfortunate decisions people make are just fear dressed up as responsibility.

Any sufficiently large vendor risk questionnaire will inevitably ask some of the same questions more than once. 🤬

I'm working on reinventing the format of my podcast and shifting the focus from teaching business leaders about cyber to teaching cyber practitioners about business. If you listen already, would this make you stop? If you don't already listen, would this be interesting to you?

In case it’s hard to tell what I’m actually saying here: Slowing down vulnerability disclosure is to cybersecurity as drinking sea water is to dehydration. Might feel better if you’re desperate but it will greatly accelerate your doom. This isn’t a fix for vuln process saturation

If your CISO isn't interesting, you have the wrong person.

I recently joined the GRC Engineering Club and volunteered for a local leadership role to help build our chapter. If you are a GRC nerd and want to learn about GRC engineering, check it out.

My strategy is to make my living working on boring Cybersecurity problems.

Don't feel bad about reporting something that seems off. It isn't an inconvenience. It's our job to check it out.

Look, you pay me to be paranoid. If I'm not worried about this, you definitely shouldn't be.

I've been looking forward to Blue Team Con all year, and it's finally almost here! Hitting the road to Chicago in the morning!

You know you are doing something right when your client's HITRUST auditor says, "Thanks, that was the easiest audit I've done." 😎

I bet the Germans have a word for that feeling when it’s Friday morning and your to do list for the week actually only has a couple small items left.

I’ve been keeping my eye out for a used King 2B or 3B valve trombone in good condition. Just stumbled across one with both the valve and slide sections. It’s pristine and only an hour away from me. It is also twice what I was hoping to spend. 🎉😭

Potential channel partner requests a meeting. Great! Then reschedules. Ok? Then no shows. Sigh... Good to know you are serious, my dude.

Dynamic vendor risk questionnaires that get longer as you answer questions, but offer no way to save progress are evil. 🤬

Paying my daughter to break apart a couple thousand discount code cards for coffee from The Flaming Bean to give away at a conference soon. 😎 Podcast listeners get 10% off with code: TMBSS.

New episode of my podcast hits the feed tomorrow. This one is about organizational change and stakeholder mapping in AI implementation initiatives. Then we live stream the recording of next month’s episode about AI governance on Friday afternoon. Focivity dot com slash podcast.

This is another great episode! I highly recommend this podcast if you're looking for some creative inspiration or interested in becoming a creative professional.

Buying life insurance is weird. You're like, "I'll bet you $70/mo that I'm going to die, and if I'm right, you give my wife half a mil." And the insurance company is like "No dawg, not yet. We'll take that bet."

Tabletop exercises are so much fun when the client is fully engaged and excited to improve their capabilities.

Who am I going to see at Blue Team Con in Chicago next month?

Everyone keeps talking about AI harnesses, but nobody is talking about AI muzzles.

Just sat down to do some focus work, but yea, that’s not happening. 🤣😭

I kind of wish we could go back to BBSes and IRC.

My flight is delayed, but it’s OK. I bought some chocolate to feel better about it.

My defcon experience continued at the airport, chatting with another attendee at the bar in the terminal. 🤣🎉

"I'll just find a nice quiet spot at the Las Vegas airport to decompress before my flight." -No one. Ever.

I’ll be at defcon for another hour and a half or so. If we haven’t managed to connect yet and you want to say hello, I’ll be hanging out in the chill out lounge.

Just scored some little projects for my hacker daughter from RM Cyber. 🔥

Back at it again! If you see me wandering around defcon, I'm probably lost, so be sure to say hello!

I'm wearing my avatar like a name tag. If you see me wandering around, please say hello!

I'm going to hang out in the nook at the back corner of the Blue Team Village until about 11:15 or so. If you are nearby, come say hi!

I'm just strolling around defcon looking around for folks I know, and realizing that I don't know what any of y'all look like.

Wheels down in Vegas!! Defcon, here I come!

Finally in the air. Next stop, Vegas!

Southwest managed to find a crew. My flight is now only delayed an hour. 🎉

Aaaaand my flight to Vegas is delayed by about 4 hours. 🤬

I've left the house. It's official. My trip to defcon has begun!

So many SMB “conferences” are super spammy. I’m looking for a community conference event for SMBs focused on topics like business fundamentals, finance, operations, supply chain, etc… with an eye to efficiency, risk management, resilience, and cybersecurity. Does this exist?

Someone submitted an anonymous AMA question on my blog to get my thoughts on how they might package up their services for a new vCISO practice for their smaller SMB customers (25-100 employees), and how they might account for onboarding vs ongoing operational work. Here are my thoughts. 👇