Risk Management

Squinting at Security Drivers and Perspective-based Biases

28 October 2011 ~10 min By Dominic White
Auditors Metrics Risk Management Threat Modelling Vendors
While doing some thinking on threat modelling I started examining what the usual drivers of security spend and controls are in an organisation. I’ve spent some time on multiple fronts, security management (been audited, had CIOs push for priorities), security auditing (followed workpapers and audit plans), pentesting (broke in however we could) and security consulting (tried to help people fix stuff) and even dabbled with trying to sell some security…

Threat Modeling vs Information Classification

08 June 2011 ~3 min By Dominic White
Risk Management Threat Modelling
Over the last few years there has been a popular meme talking about information centric security as a new paradigm over vulnerability centric security. I’ve long struggled with the idea of information-centricity being successful, and in replying to a post by Rob Bainbridge, quickly jotted some of those problems down. In pre-summary, I’m still sceptical of information-classification approaches (or information-led control implementations) as I feel they target a theoretically sensible idea,…