Greg Wiley

Advice For CISOs: Both last week and this, I have been at security events. I have more booked for next week and the week after. Whilst I listen to the same keynotes and see the same vendor stands all touting the rise of AI either as a threat or a saviour, I occasionally flip to the news on my phone where airports, manufacturers and supermarkets are being breached almost daily. So I thought I would provide some simple, distilled advice for overworked under supported CISOs: 1.        If Procurement is dictating which security tools and services you can and can’t have then they are taking responsibility for securiting the enterprise. Let them and your board know that. 2.        All security controls fail. Despite what vendors promise you. Plan for failure. 3.        Bad security controls deployed well are more effective than great security controls deployed badly. You will never get to 100% coverage though.  4.        Your risk assessment is wrong. 5.        Pen-Testing and Red Teaming is a great test of how good that pen-testing team is, not necessarily how good your security is. 6.        When you change your security tools change your workflows to suit your new tooling, or you won’t get value from it. 7.        When you are breached you will wish you had more security logs saved in your SIEM than you do. 8.        When you are breached every vendor will have the one product which could have protected you. They will call you to tell you that. 9.        You can’t be sure of your supply chain security because they aren’t sure about it either. 10.  Any security report you send to the board will be less Red and more Green by the time they read it. It gets less Red every layer of management it goes through. 11.  The more security controls inconvenience people the more they will work around them. People are at their most ingenious when getting around your controls. 12.  Any control that generates noise is going to get ignored at some stage, and so is worthless. Fix it or stop paying for it. 13.  You are most likely to get more budget if you can show it is for compliance rather than risk reduction. 14.  There is nothing in GDPR or any other legislation which gives employees the right to have their logs removed for a SIEM. 15.  Shadow IT is going to get you fired. 16.  No one is going to brute force your encryption when they can just find the keys in that text file the dev created. Don’t wait – Add to the list…

1,086

156 Comments

Great news for Azure government cloud customers today - Defender for Cloud CSPM is now GA in government clouds. All of MDC P2 is now available in government clouds, bringing it in line with our commercial clouds. https://lnkd.in/dHnHkNnr

95

2 Comments

OCI recently released an amazing new capability as part of its IAM platform, Workload Identity Federation. It simplifies and improves the security, governance, and management for accessing OCI APIs from outside of OCI. Kiran T. just dropped an amazingly comprehensive article and tutorial on this great new feature. Check it out! https://lnkd.in/eSxS8pjx Oracle Oracle Cloud Oracle Security Chris Johnson Manasi Vaishampayan Deepthi Shetty Kam Agahian Atul Goyal Apurv Awasthi #cloudsecurity #cloudiam #zerotrust #zerotrustsecurity #oci #oraclecloudinfrastructure #sso #federation #iam #identity

26

2 Comments

🚀 Azure SRE Agent billing is now live! What's new since Build 2025: 🛡️ Granular governance to ensure secure, auditable operations 🔍 Expanded diagnostics across App Service, AKS, PostgreSQL; Azure CLI and kubectl integration 🧑‍💻 Faster remediation through Azure DevOps and GitHub coding agents 📖 Read the full update: https://lnkd.in/gTShpVuc

31