Most security policies sit in a drawer ignored. These articles cover what makes one actually work: naming who owns each step by title, and connecting it to the frameworks it satisfies, from someone who wrote them against federal standards.
AuditsOur PCI auditor looked at a legacy database connection we could not afford to rebuild and said: wrap it in a VPN. That sentence introduced us to mitigating controls, turned a six-figure project into a configuration change, and taught me…
ComplianceFour to five months of interviews, C-suite down, mapping every policy to a named role. The project revealed something no framework document warns you about: the CFO did not know what segregation of duties was, and once he understood it,…
AuditsThe PCI scan found L0phtCrack, a password cracker, sitting on one of our servers. We hunted it down expecting an intruder. We found our own consultant, who needed passwords to do his job and decided cracking them was faster than…
Attack SurfaceI was never a CISO by title; my networking partner and I were both directors who, with a boss who was not security savvy, functioned as a de facto CISO together, setting the rules and getting them approved. The job…
Access ControlMost security tools are theater. I sat through endless vendor pitches for products with giant dashboards full of blinking widgets that looked impressive and did almost nothing. The attack surface is enormous, phones, laptops, servers, cloud, even charging cables, and…
CybersecurityThe human layer is the biggest security weakness and the one people are least prepared for, because they do not expect the guy in the uniform, or the friendly caller, to be the attacker. You can harden every server and…
CompliancePassing an audit and being secure are not the same thing; companies that treat compliance as a checklist get breached at the same rate as those that ignore it. Real protection comes from documentation that reflects how the business actually…
BackupsCoffee in hand, you open an email demanding $500 in Bitcoin to unlock your photos, tax records, and three-year novel, and yesterday's urgent delivery notice was the invitation. It happens thousands of times a day, and the habits that stop…
ComplianceThe regulatory documents are the standards your security program has to satisfy, and most teams never realize they are working from a version that expired. Finding and reading the right ones is half the compliance battle. Here is how to…
Access ControlSecurity is mostly dull work nobody wants to do, patching, access reviews, backups, and it is also the entire job. Two decades in, the one time everything broke, it was backups that saved us, barely: a triple failure, snapped tapes,…
BackupsAttackers rarely come through the firewall; if they do, you were sloppy, because the firewall is the easy part. The real vectors are social engineering and the insider, and the insider is the most common and most overlooked. Two decades…
CISOI wrote a company's security policies against NIST CSF and 800-53, and now I ghostwrite books for the leaders who do this work. Most policy documents fail for two reasons: nobody knows who owns each step, and nobody knows which…
Professional ghostwriting for executives, founders, coaches, and authors who want to get the book done right. 113+ books authored. 54+ ghostwritten for clients.
Ready to discuss your book?
BOOK YOUR PRIVATE CONSULTATIONNo pitch. No pressure.
Four short, practical guides on writing, publishing, and selling your book, plus the occasional note when there's something worth your time. No fluff, no daily inbox clutter. Drop your email and they're yours.
We use MailerLite to manage our list and send these emails. Your address is used only to send you what you signed up for. We will not sell it, share it, or use it for anything else, and you can unsubscribe anytime.
