Sign in Subscribe

Security Leadership

Security Leadership

Strategic frameworks, program-building playbooks, and board-level communication guidance for practitioners moving into management and CISOs early in their tenure.

IAM Metrics That Actually Matter: Proving Risk Reduction and Value to Every Level of the Organization

IAM Metrics That Actually Matter: Proving Risk Reduction and Value to Every Level of the Organization

I have been in information security for more than twenty years, and one of the conversations I have had more times than I can count goes something like this: the security team has spent eighteen months building out an identity and access management program. They have deployed a new IGA

IAM for AI Agents: Why Your Identity Program Isn't Ready

IAM for AI Agents: Why Your Identity Program Isn't Ready

AI agents are multiplying inside enterprise environments faster than identity governance programs can track them. They are being deployed by developers, operations teams, and business analysts — often without security involvement, without formal registration, and without the kind of access scoping discipline that any human identity would require. The service accounts

NCSC Secure Connectivity Principle 8: Establish an Isolation Plan

NCSC Secure Connectivity Principle 8: Establish an Isolation Plan

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series The plan you hope you never need — and why having it ready is non-negotiable in OT security Every other principle in this series has focused on preventing compromise, detecting threats, and limiting the spread of attacks that do occur. Principle

NCSC Secure Connectivity Principle 7: Ensure All Connectivity is Logged and Monitored

NCSC Secure Connectivity Principle 7: Ensure All Connectivity is Logged and Monitored

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why logging and monitoring is your last line of defense in OT — and what effective OT visibility actually requires All security controls, however well-designed, carry the possibility of failure. Boundaries can be breached. Segmentation controls can be circumvented. Authentication mechanisms

NCSC Secure Connectivity Principle 6: Limit the Impact of Compromise

NCSC Secure Connectivity Principle 6: Limit the Impact of Compromise

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Assume breach, contain the blast radius — designing OT environments to survive compromise There is a maturity progression in how organizations think about security. The first stage is prevention — the belief that with enough controls, attacks can be stopped at the perimeter.

NCSC Secure Connectivity Principle 5: Harden Your OT Boundary

NCSC Secure Connectivity Principle 5: Harden Your OT Boundary

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why the OT boundary is your primary defensive line — and what it takes to make it hold In most OT environments, the devices and systems inside the network were not designed to defend themselves. Legacy PLCs, older SCADA components, and even

NCSC Secure Connectivity Principle 4: Use Standardised and Secure Protocols

NCSC Secure Connectivity Principle 4: Use Standardised and Secure Protocols

InfoSec Made Easy OT Security Leadership | NCSC Guidance Series Why the protocols your OT systems use to communicate are as important as the networks they run on Most cybersecurity professionals spend a great deal of time thinking about network architecture — firewalls, segmentation, DMZs, access controls. These are important, and the