Erick Rudiak - Erick Rudiak. Technology Executive. Human.

xkcd 1205 inverted (or, what if it wasn't so hard to be FAIR)

A thought experiment around process automation, monte carlo simulations, communicating uncertainty to executive audiences, and the utility of accuracy over precision.

Erick Rudiak

5 Jul 2022 · 6 min read

And now, for something completely different...

The role of the CISO is ultimately to own security culture of the organizations which we serve. Adopting the vocabulary and winning business methods of our companies and industries can create a profound linkage and demonstrate alignment that rises above the CISO's traditional role as defender.

Erick Rudiak

1 Mar 2020 · 11 min read

The "C" Matters or: How I Learned to Stop Worrying and Love the CISO Job

The job description of the Chief Information Security Officer (CISO) - with emphasis on "Chief" - and where it can effectively report may surprise you.

Erick Rudiak

31 Dec 2018 · 9 min read

The second biggest trap in information risk management.

A model CISOs can use to measure and report the level of assurance being delivered by their technical security products and controls as part of a robust cyber defense.

Erick Rudiak

7 Jun 2018 · 12 min read

I was wrong (or: five things I learned from Hubbard in 2016)

Unlike earthquakes and lightning strikes, for which unimpeachable data exists, information security trends suffer from underreporting, environmental factors and subjectivity that call into question any sort of estimate being done

Erick Rudiak

21 Dec 2016 · 9 min read

All* threats are insider threats

In the 1990s and early 2000s, the prevailing school of thought in information security was that there were two kinds of threats: insider and outsider. The insider was the "trusted

Erick Rudiak

1 Mar 2016 · 6 min read

A paean to the red team

...or "Erick rethinks his position on sports analogies" In "Defenders think in lists, attackers think in graphs, as long as this is true, attackers win", Microsoft's John Lambert summed up,

Erick Rudiak

31 Dec 2015 · 9 min read

Six presentation mistakes I have made (and learned from making)

One of the great joys of being a leader in a large company is watching protégés achieve their career objectives, sometimes eclipsing the mentor in the process[1]. With talented

Erick Rudiak

15 Nov 2015 · 10 min read

patch

Are you an IT anti-vaxxer?

After the congratulations and getting-to-know-you introductions are settled, one of the first formal "as your CISO..." conversations I have with any new IT leader deals with vulnerability management. How do

Erick Rudiak

16 Mar 2015 · 4 min read

budget

The Budget Trap

... or "Erick Hates Sports Analogies" In my Security Culture Manifesto, I hypothesized about a weak-at-best correlation between an organization's security spend and its desired security outcome, i.e. breach resistance.

Erick Rudiak

11 Jan 2015 · 7 min read

CISOs are in the assurance business

As the CISO's job has morphed from gatekeeper (no breaches!) to crisis manager (no outrageous breaches!), the questions boards and C*Os have learned to ask us have become more

Erick Rudiak

18 Dec 2014 · 3 min read

On Pace...

A couple years ago, I learned a lesson from my CIO that has stuck with me. Marching towards an aggressive deadline to deliver a client capability, the CIO gathered his

Erick Rudiak

14 Dec 2014 · 3 min read

Growing beyond the speed of HD Moore's Law

Joshua Corman is generally credited with coining "HD Moore's Law" to state: Casual attacker power grows at the rate of Metasploit I have recently come to believe that the widening

Erick Rudiak

7 Dec 2014 · 2 min read

The Security Culture Manifesto

Preparing for a Board of Directors meeting is one of the more intellectually stimulating aspects of a CISO's work. It's an entirely different conversation than the one I typically have

Erick Rudiak

1 Dec 2014 · 5 min read

wi-fi

The unintended consequences of corporate Wi-Fi

Between that title and the usual nature of this blog, you may be surprised that I'm not writing about all the ways companies can get their wireless network security wrong.

Erick Rudiak

28 Nov 2014 · 3 min read

My Favorite CISOs aren't CISOs

A recruiter recently asked me, "who are the best CISOs you know?" I'm convinced it was a trick question, and that I failed the test, but the interesting thing about

Erick Rudiak

24 Dec 2013 · 5 min read

navetta

Time to stop blaming the victim, part deux

It started a couple weeks ago with the almighty Bruce Schneier expressing a rather controversial opinion: ...[that] training users in security is generally a waste of time, and that the

Erick Rudiak

5 May 2013 · 5 min read

virtual machine

Deja Vu

![If Inception took place outside my office/cube](/img/vmware-inception.png) Every six months or so, I find myself having the same discussion with someone in the InfoSec community: Someone:

Erick Rudiak

18 Nov 2012 · 3 min read