How to CISO

Tag: software supply chain

  • Zero Trust in Administration

    Zero Trust in Administration

    —

    by

    Andy Ellis
    in

    CrowdStrike, Windows domain administration, SolarWinds — our implicit trust in admin software is a recipe for repeated disasters. The most unsafe part of our technology ecosystem isn’t the number of unpatched systems we have. Nor is it shadow IT, whether it’s homegrown software or the burgeoning bring-your-own-SaaS ecosystem. The shared responsibility model, and the impossible complexity of safely configuring systems…

  • Why assessing third parties for security risk is still an unsolved problem

    Why assessing third parties for security risk is still an unsolved problem

    —

    by

    Andy Ellis
    in

    A recent ranking of the most cyber-secure companies reveals weaknesses in current third-party risk management practices. A Forbes article is making the rounds right now about America’s most cyber-secure companies, and I can already see the cybersecurity outrage machine up in arms. Full confession: I haven’t yet read the article, but I’m about to. I’m writing this…

  • Drop the SBOM

    Drop the SBOM

    —

    by

    Andy Ellis
    in

    Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis. There’s a big movement afoot to move to an SBOM-oriented world.  If you’re new to this acronym, an SBOM is a “Software Bill of Materials.”  The idea is that any…