I Am Security

Category: Opinion

  • Two Frameworks For Securing A Decentralized Enterprise

    —

    by

    iamit
    in

    This post was originally published on Forbes Many modern enterprises no longer operate in a highly centralized manner. Traditionally, cybersecurity in enterprise environments consisted of defining trust boundaries, placing controls over these boundaries, setting standards and policies for the safe and secure handling of data, enforcing said policies and scrutinizing any code/applications that were developed…

  • How to Vendor/Sales in the Security Industry

    —

    by

    iamit
    in

    I’ve been on the receiving end of sales pitches for years now. Ever since I took on senior leadership roles the constant trickle of various sales pitches just kept increasing. These vary from completely out of the blue “cold calls” that attempt to push some solution, through the slightly better informed ones that take into…

  • Basic is great

    —

    by

    iamit
    in

    Encouraged by the response to my last post (https://www.iamit.org/blog/2018/06/the-ian-amit-spectrum-of-pentesting-efficacy/ for those who missed it), and following up on a couple of recent Twitter/LinkedIn/WhatsApp conversations, I’d like to emphasize the importance of doing basic and simple work (in security, but it probably also applies to everything else). We are working in a weird industry. The industry…

  • The Ian Amit Spectrum of Pentesting Efficacy

    —

    by

    iamit
    in

    It’s been a while since I posted (duh), but recently I’ve had something brewing in my mind that appeared to not have been clearly discussed before, so here goes. I’ve been seeing some discussions and ambiguity around pentesting, vulnerability assessment, and red teaming (again – no huge shocker for those of us in the industry).…

  • When great ideas go to the wrong places

    —

    by

    iamit
    in ,

    Or: why attribution is not a technical problem. TL;DR: hacking is an art and a science, computer attacks (cyber these days) are only one manifestation of an aggressor, which has very limited traits that can trace it to its origin. Relying on technical evidence without additional aspects is not enough to apply attribution, and when done…