When I first heard about ‘shift left’ a few years ago, I had hoped that after only 20ish years, my assembly programming module at university might finally prove to be useful. That’s a bit of an ‘in joke’ because only those with exposure to low level programming will know
I’ve concluded that we in the GRC (governance, risk & compliance) community don’t typically work in GRC; more often than not we appear to work in RC or perhaps gRC. Today we talk about ‘GRC’ as if it’s always been the standard term to encompass all aspects
“How many servers?!” I asked, and the Linux admin again confidently replied “300”. To be honest, the exact number escapes me now, but it was hundreds, and I absolutely remember the sinking feeling upon realising I had two hours to assess the security of a sizeable Linux server estate for
Why is risk management so unfair or should I say not FAIR? No this is not a childish protestation; I want to talk about FAIR (Factor Analysis of Information risk) and why it isn’t more widely adopted. Other risk analysis methods commonly used are ISO 27005, OCTAVE and NIST