Sign in Subscribe

Brian Weidner

Brian Weidner

Turning a Gemba Board Into Real, Weekly Security Improvement

In the world of security operations, we often talk about metrics — detection times, vulnerability remediation, incident counts, backlog ages. The Driving Real Security Improvement with a Gemba Board post does a great job of outlining how a Gemba board makes these metrics visible to the team and shifts ownership of

Driving Real Security Improvement with a Gemba Board

Driving Real Security Improvement with a Gemba Board

In information security, we talk a lot about metrics. Mean time to detect, vulnerabilities closed, incidents resolved, backlog aging, control coverage—the list goes on. But too often, those metrics live in dashboards that few people check, or in reports reviewed once a month and quickly forgotten. A Gemba board

When Leadership Says “Keep Us Safe”: Finding Cyber Risk Tolerance in the 10-K

One of the most common questions cybersecurity professionals ask executive leadership is: “What is the organization’s risk tolerance when it comes to cyber risk?” And one of the most common answers they get back is: “Keep us safe.” “Don’t let a breach happen.” While well-intended, these answers

Asset Management - Physical Devices - What do you have? Do you know?

Asset Management - Physical Devices - What do you have? Do you know?

Asset management and inventorying your physical systems, we all know we should do it, and I am sure most try. I am not going to talk about the should have, would have or could have. Instead, I am going to focus on the risks associated with the NIST CSF control

Vulnerability Management… It’s easy - Planning

I am sure you have had either consultants, vendors, or heard at a conference that vulnerability management is foundational security control. While I agree that it is an essential control, I also understand that it is challenging to implement. Vulnerability management is not just to pick a tool, scan, and