There used to be a fairly standard Security Organization paradigm. Infra/Cloud/Network team, Incident Response team, often an Architecture/consulting team, AppSec team, couple of TPMs, a Director or two that ran everything, some Managers to take care of the talent, a CISO that talked to the board. It no longer gets the job done. Let's panic for a moment. Take your time. OK so what now? Now we have…
I'm writing this on November 11th, 2024. In most of the world, this is when we celebrate the end of a war so terrible that everyone assumed it would never happen again. As the scorpion said, "lol. lmao." This is a post about leading during politics, but not a post about politics. Leadership has this responsibility regardless of how they happen to vote. If you're in leadership and don't believe…
Every so often it becomes popular for a certain type of thought leader to campaign against the existence of hierarchies in tech companies. Frequently, this is coming from founders or very early employee engineers. Basically, people with significant monetary interest in not sharing leadership responsibilities. In a slightly more informed, slower world, that would probably be enough to defeat the…
So this came up in a slack and then i had a long expansion and someone asked me to make it a post so they could link it to people and well ok fair enough It’s gonna be heck of low effort post though Technical positions can be thought of in the following model. That's not to say that they should be, or that this model is good. It is a model, don't mistake it for the reality. - Scientists are…
This is about something that I wasn't ever able to explain well until recently. I've been using the same approach for a long while, but making it understandable was difficult. I don't know if this achieves that. The key that unlocked the attempt was applying something I learned a while ago, and that I say a lot about my own processes, which is the next header line. While discussing what I was…
This is a slightly edited version of the norms document I sent out when I took over at my current role. This was not a corrective action: I work with great, talented, kind people, and was following behind previous strong, ethical leadership. This was taking that kindness and making it an explicit expectation of the group. Culture scales automatically until it doesn't, and if you're an executive,…
This was sent out to my part of the Google Security Engineering org by myself after consultation and input with my local-group management peers. If you’re at Google, it’s visible as a /2020stress short link. This version of course has some edits. I should preface this with my own perspective. My neighborhood in Security Engineering at Google has been hitting it’s goals very, very well this year.…
This is one of those "I made this post because I keep explaining the same small concept repeatedly" things. Both to save time repeating it, and (mostly) to try to clean up the concept. Companies, decide how secure they want to be twice * : The first time is when the exec team decides, in their own terms, just how much security they want to purchase. That purchase being made in people, software,…
Gatekeeping is for assholes and you shouldn't do it.
This was originally a poorly formatted word doc created when some management peers asked for tips at being effective at managing their reports. A little bit (but not much) tuning later, it's now this. I make no pretense that this is my own work, it's all received wisdom from a ton of different people and sources. You just realized you have no idea why your employees care what you think. Someone…
I have cleaned up the intro some. This is the (very) long form of a speech I've given to a few startups who have come calling. Sometimes they listen. My observation has been that the ones that don't listen end up repeating the process a while later. If you're working on a product where security or privacy is a feature, hopefully none of this applies to you because you're already making these…
For Muggles: Are you an Internet user bewildered by all this noise about "heartbleed" and "resets"? That's cool, ain't everyone gotta be a nerd. Buncha websites have probably been leaking passwords (and other security token type things) for a while. There's no good proof (YET) that anyone has really been attacking this though. Changing sensitive passwords after the sites fix themselves is probably…
Comments will never be enabled. If you feel that comments are necessary to tell me that I'm wrong about something - I refer you to the central premise of this site: the things I am saying here are wrong. If you feel this limits your free speech, you're wrong. Lots of things are doing that these days though, so you should probably get better informed on the specifics there. I direct you to…