friction

Attackers' cost of winning... or your control plane is like water (whether you like it or not)

Thinking about information security's role as manager of friction for both attackers and good-actors alike, and how a healthy control plane acts like water: smooth gliding for everyday use with increasing resistance the more aggressively it is approached.

• 

Erick Rudiak

3 Apr 2025 · 11 min read

poll

It's a poll ✅, not a vote 🗳️🚫

Quick things to consider before having a vote of consequence in a meeting... and why a poll could be just as good, or better.

• 

Erick Rudiak

3 Apr 2025 · 2 min read

monte carlo

xkcd 1205 inverted (or, what if it wasn't so hard to be FAIR)

A thought experiment around process automation, monte carlo simulations, communicating uncertainty to executive audiences, and the utility of accuracy over precision.

• 

Erick Rudiak

5 Jul 2022 · 6 min read

healthcare

And now, for something completely different...

The role of the CISO is ultimately to own security culture of the organizations which we serve. Adopting the vocabulary and winning business methods of our companies and industries can create a profound linkage and demonstrate alignment that rises above the CISO's traditional role as defender.

• 

Erick Rudiak

1 Mar 2020 · 11 min read

Kofman

The "C" Matters or: How I Learned to Stop Worrying and Love the CISO Job

The job description of the Chief Information Security Officer (CISO) - with emphasis on "Chief" - and where it can effectively report may surprise you.

• 

Erick Rudiak

31 Dec 2018 · 9 min read

threat model

The second biggest trap in information risk management.

A model CISOs can use to measure and report the level of assurance being delivered by their technical security products and controls as part of a robust cyber defense.

• 

Erick Rudiak

7 Jun 2018 · 12 min read

HTMA

I was wrong (or: five things I learned from Hubbard in 2016)

Unlike earthquakes and lightning strikes, for which unimpeachable data exists, information security trends suffer from underreporting, environmental factors and subjectivity that call into question any sort of estimate being done

• 

Erick Rudiak

21 Dec 2016 · 9 min read

threat model

All* threats are insider threats

In the 1990s and early 2000s, the prevailing school of thought in information security was that there were two kinds of threats: insider and outsider. The insider was the "

• 

Erick Rudiak

1 Mar 2016 · 6 min read

red team

A paean to the red team

...or "Erick rethinks his position on sports analogies"   In "Defenders think in lists, attackers think in graphs, as long as this is true, attackers win", Microsoft&

• 

Erick Rudiak

31 Dec 2015 · 9 min read

Tufte

Six presentation mistakes I have made (and learned from making)

One of the great joys of being a leader in a large company is watching protégés achieve their career objectives, sometimes eclipsing the mentor in the process[1]. With talented

• 

Erick Rudiak

15 Nov 2015 · 10 min read

patch

Are you an IT anti-vaxxer?

After the congratulations and getting-to-know-you introductions are settled, one of the first formal "as your CISO..." conversations I have with any new IT leader deals with vulnerability management.

• 

Erick Rudiak

16 Mar 2015 · 4 min read

budget

The Budget Trap

... or "Erick Hates Sports Analogies"   In my Security Culture Manifesto, I hypothesized about a weak-at-best correlation between an organization's security spend and its desired security outcome,

• 

Erick Rudiak

11 Jan 2015 · 7 min read

level of assurance

CISOs are in the assurance business

As the CISO's job has morphed from gatekeeper (no breaches!) to crisis manager (no outrageous breaches!), the questions boards and C*Os have learned to ask us have

• 

Erick Rudiak

18 Dec 2014 · 3 min read

threat model

On Pace...

A couple years ago, I learned a lesson from my CIO that has stuck with me. Marching towards an aggressive deadline to deliver a client capability, the CIO gathered his

• 

Erick Rudiak

14 Dec 2014 · 3 min read

threat model

Growing beyond the speed of HD Moore's Law

Joshua Corman is generally credited with coining "HD Moore's Law" to state: Casual attacker power grows at the rate of Metasploit I have recently come to

• 

Erick Rudiak

7 Dec 2014 · 2 min read

ciso

The Security Culture Manifesto

Preparing for a Board of Directors meeting is one of the more intellectually stimulating aspects of a CISO's work. It's an entirely different conversation than the

• 

Erick Rudiak

1 Dec 2014 · 5 min read

wi-fi

The unintended consequences of corporate Wi-Fi

Between that title and the usual nature of this blog, you may be surprised that I'm not writing about all the ways companies can get their wireless network

• 

Erick Rudiak

28 Nov 2014 · 3 min read

sandman

My Favorite CISOs aren't CISOs

A recruiter recently asked me, "who are the best CISOs you know?" I'm convinced it was a trick question, and that I failed the test, but

• 

Erick Rudiak

24 Dec 2013 · 5 min read