Blog
40 postsPositions on running security inside an enterprise: ownership, recovery, vendors, change control and the work nobody budgeted for.
| The post | Tags |
|---|---|
| Cyber Insurance Is Now Writing Your Security RequirementsUnderwriting questionnaires demand MFA, endpoint detection, and tested backups. Policies exclude some attacks, require insurer-approved response firms, and can be contested if the application overstated your controls. The insurer has become a security stakeholder with its own interests.By Jean-Luc Martel | cyber insurance compliance governance |
| Data You Deleted Can't Be StolenOver-retention expands every breach: more records to notify about, more regulators involved, more liability. Retention schedules are usually written for legal holds and forgotten by IT. Treating deletion as a security control and finding the copies in backups, exports, and test environments.By Jean-Luc Martel | data retention deletion backups governance |
| Passkeys Are Coming for Your Passwords. Is Your Recovery Ready?Passkeys resist phishing and make password databases useless to attackers. The hard part of a rollout isn't the cryptography; it's lost devices, shared accounts, legacy apps and recovery.By Jennifer Lin | passkeys authentication identity mfa |
| Phishing-Resistant MFA Stalls on the Applications That Can't Support ItEnrollment metrics hide the real work of phishing-resistant authentication: closing password paths, managing exceptions, and deciding what to do with systems that will never support it.By Jean-Luc Martel | mfa authentication legacy systems identity |
| Service Accounts Are the Keys Nobody RotatesThe quarterly access review for non-human identities follows a predictable script, and the actual security posture of the estate has not moved an inch.By Jean-Luc Martel | service accounts secrets credential rotation ownership |
| The Appliance in Your DMZ Is the Easiest Way InA decision framework for internet-facing appliances: when to retire, replace, segment, or patch them, and which structural conditions change the answer.By Jean-Luc Martel | edge appliances patching network security vulnerability management |
| The Green Address Bar Is Gone. The Confusion Isn'tA padlock only means the connection is encrypted; phishing pages have valid certificates too. Teach people to read the domain, not the lock.By Jennifer Lin | phishing tls certificates security awareness |
| The SSO Tax: When Security Features Cost ExtraVendors put SAML single sign-on, SCIM provisioning, and detailed audit logs behind enterprise tiers. The logs you need during an investigation are often the ones you chose not to pay for.By Jean-Luc Martel | sso saas procurement third party risk |
| Certificates Expire on WeekendsShorter certificate lifetimes, broken ownership records, and manual renewal processes make expired certificates a predictable operational failure.By Jean-Luc Martel | certificates pki ownership outages |
| The End-of-Life System You Can't RetireWhat actually happens when a critical system cannot be patched or replaced, and how the risk acceptance becomes the real deliverable.By Jean-Luc Martel | legacy systems compensating controls risk acceptance patching |
| Nobody Has Tested Restoring Active DirectoryMost disaster recovery plans assume identity is available. A full forest recovery is rarely rehearsed, and the runbook is often stored somewhere that requires the directory to open.By Jean-Luc Martel | active directory recovery identity resilience |
| Your Incident Response Plan Assumes Email Still WorksThe plan lives on a file share that is encrypted, the contact list is in the directory that is down, and the attacker may be reading the Teams channel where responders coordinate. Out-of-band communication, printed contacts, and rehearsing the response without the tools you normally use.By Jean-Luc Martel | incident response out of band communication resilience |
| MFA Is Not Optional AnymoreA stolen password shouldn't be a master key. MFA is the baseline, but coverage, method and recovery decide whether it works: SMS and push prompts leave gaps that security keys and passkeys close.By Jennifer Lin | mfa identity authentication privileged access help desk |
| Wipe the Printer Before It Leaves the BuildingMultifunction printers, network switches, and conference room systems store credentials and documents. Decommissioning procedures that cover laptops and servers usually skip the devices nobody thinks of as computers.By Jean-Luc Martel | decommissioning data sanitization asset management |
| Your Backups Are Now the First Ransomware TargetRansomware operators take the backup plane before they encrypt production. The controls that matter are compliance-mode immutability, separate-account cloud permissions, offline copies, and restore tests that measure full recovery time.By Jean-Luc Martel | ransomware backups privileged access recovery |
| The Pen Test Report That Changes NothingWhy annual penetration tests produce the same findings, and what changes when testing is scoped around attack paths, assigned to owners with budget, and run as purple-team exercises.By Jean-Luc Martel | penetration testing vulnerability management compliance remediation |
| Make It Easy to Report PhishingA suspicious email is intelligence if people feel safe reporting it, including after they clicked. Put the report button where they read mail, acknowledge every report, and never punish the reporter.By Jennifer Lin | phishing incident response security culture social engineering |
| Read the SOC 2 Report Past the Opinion LetterThe auditor's opinion is the least useful page. The value is in the scope, carve-outs, exceptions, period covered, and complementary user entity controls.By Jean-Luc Martel | soc 2 third party risk compliance assurance |
| Nobody Needs Admin Rights Just in CaseAdmin access granted for one task tends to stay forever, turning every phishing click or lost laptop into a bigger breach. Make elevation fast and temporary instead of permanent.By Jennifer Lin | privileged access identity access reviews least privilege |
| The Help Desk Is Your Most Exploited Authentication SystemAttackers call the service desk, claim to be an employee locked out of their account, and ask for a password reset or a new MFA enrollment. The help desk is measured on speed and satisfaction, which is the opposite of what verification needs.By Jean-Luc Martel | help desk social engineering authentication identity |
| Break-Glass Accounts and Recovery Keys: The Credentials You Need When Everything Else Is DownEmergency credentials fail when they depend on the systems they are meant to recover. How to keep break-glass accounts, recovery keys, and cloud root credentials available, protected, and tested.By Jean-Luc Martel | break glass identity recovery privileged access |
| The Vendor Security Questionnaire Is Theater. Ask Better Questions.The standard vendor security questionnaire produces yeses, not risk insight. The questions that matter are shorter: who can access production data, which sub-processors hold it, what happened in the last incident, and what happens when you leave.By Jean-Luc Martel | third party risk procurement compliance assurance |
| Network Segmentation Projects Die at the Application InventorySegmentation programs stall because nobody knows which systems talk to which, over what ports, and why. Discovery, monitoring mode, and coarse zones come before fine-grained policy.By Jean-Luc Martel | network segmentation application inventory firewalls |
| Zero Trust Is a Direction, Not a ProductZero trust deployments stall on identity cleanup, legacy applications, and organizational decisions—not on buying the next enforcement point.By Jean-Luc Martel | zero trust identity network segmentation |
| Security Awareness Is Not a PDFA polished policy on SharePoint and an annual slideshow change little when a payment-change email lands on a busy Tuesday. Short, role-specific guidance tied to real decisions does.By Jennifer Lin | security awareness security culture phishing governance |
| Backups Don't Count Until You've Tested the RestoreA green backup job says data was saved, not that you can recover. Test a full application restore, with credentials, keys and dependencies, and time it end to end.By Jennifer Lin | backups recovery ransomware resilience |
| Your Software Supply Chain Includes the Build ServerThe xz utils backdoor showed that the gap between reviewed source and deployed binary is where supply chain risk actually lives. SBOMs and scanners don't close it.By Jean-Luc Martel | supply chain ci cd secrets privileged access |
| Your Password Policy Is Stuck in the PastForced 90-day rotation and complexity rules train people into predictable passwords. Allow long passphrases, block breached passwords, drop routine expiry and pair it all with MFA.By Jennifer Lin | authentication identity mfa help desk |
| OT and IT Security Are Different Disciplines Sharing a NetworkHow to decide who owns OT security, how far to segment the plant network, and which security tools are safe to deploy when availability comes first.By Jean-Luc Martel | ot security network segmentation ownership |
| When You Buy a Company, You Buy Its BreachSecurity due diligence in M&A is usually a questionnaire. The real risk is the acquired network, its vendors, and the integration sequence that connects them to yours.By Jean-Luc Martel | mergers and acquisitions third party risk identity incident response |
| Every "Sign in with Microsoft" Button Is a Data GrantOAuth grants in Microsoft Entra ID outlive trials, employees, and contracts. The directory already holds the SaaS inventory IT never built.By Jean-Luc Martel | oauth saas identity third party risk |
| The Logs You Don't Keep Can't Tell You What HappenedBreaches are often discovered months after they start. Cloud audit logs are off by default or retained for weeks, and SIEM ingestion costs push teams to drop the noisy sources. Deciding what an investigator would need a year from now, and keeping that, even if nobody reads it until then.By Jean-Luc Martel | logging siem forensics data retention |
| Shadow IT Is a Symptom, Not the DiseasePeople adopt unapproved tools when the approved ones are too slow, too hard or missing features. Blocking the app hides the need; find it, and offer a sanctioned option quickly.By Jennifer Lin | shadow it saas governance procurement |
| Patch Tuesday Meets the Change Advisory BoardThe change process designed to prevent operational risk is now generating security risk. Tiered change authority, pre-authorized emergency paths, and peacetime decisions are the fix.By Jean-Luc Martel | patching change management vulnerability management |
| Who Makes the Ransom Decision, and When Do They Find Out?The delegation of authority matrix in most enterprises runs from office supplies to acquisitions. It rarely has a line for extortion. This post maps the three distinct decisions in a ransomware incident—negotiate, pay, disclose—and how to assign authority before the timer starts.By Jean-Luc Martel | ransomware incident response governance cyber insurance |
| JWTs vs Session Cookies Is the Wrong DebateA JWT can live in a cookie and a session ID can live in browser storage. What matters is where the credential lives, how long it works, and whether you can revoke it when an account is compromised.By Jennifer Lin | authentication session management web security application security |
| Should Your Corporate Internet Gateway Decrypt TLS Traffic?A practitioner's guide to deciding which TLS traffic to decrypt at the corporate gateway, which to bypass, and who owns the liability.By Jean-Luc Martel | tls inspection network security certificates privacy |
| The CrowdStrike Outage Was a Change-Management LessonA faulty security content update took down millions of Windows machines in July 2024. The failure was not an attack. It was a kernel-level agent receiving updates outside the customer's change control, followed by a recovery that needed hands on keyboards and recovery keys at scale.By Jean-Luc Martel | change management third party risk outages endpoint security |
| Offboarding Is a Security Control Most Companies Run by EmailThe termination ticket closes, but the access doesn't. A practitioner's look at the shadow estate that survives offboarding: SaaS outside SSO, shared accounts, vendor portals, OAuth grants, and contractors nobody owns.By Jean-Luc Martel | offboarding identity access reviews saas |
| What the Vercel Hack Taught Us About Chains of TrustThe Vercel compromise shows how third-party integrations with deployment platforms become unmanaged identity providers with production access.By Jean-Luc Martel | supply chain third party risk identity ci cd |
Review worksheet
Name the property, then the control.
One worksheet for taking an architecture claim apart: the property being asserted, the mechanism actually in place, the gap between them, and what the gap costs. Sent once.
One email. No list, no sequence.