Andy Ellis is the Advisory CISO at Orca Security, and 2021 Inductee into the CSO Hall of Fame. He is an Operating Partner at YL Ventures, and was formerly a US Air Force officer and the CSO at Akamai Technologies. You can find him on Twitter at @csoandy.
“Shared responsibility” usually means that no one is responsible for minding the gap. Don’t fall in.
Security processes that treat the very users we protect as unwanted burdens and alienate them in the process are a path to failure.
If you’re not in the meeting where decisions are made, then you’re not part of the C-Suite—whatever your title may be.
Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis.
No one outside the IT department cares about your vulnerability metrics (or they shouldn’t, anyway). They care about efficacy. And traditional stats don’t show that.