Showing 1–12 of 12 articles
How to write a security note people can trust
A useful security note makes its claims checkable and its next step clear. State what is known, identify the source, label uncertainty, and tell the reader who needs to do what.
Read the visual guide
Re-check a payment limit at the moment you pay
A limit checked before a payment can become stale while other requests are processed. Enforce the business rule at the transaction boundary, including concurrent actions and retries.
Read the visual guide
Security numbers that tell you whether the work is happening
A meaningful metric has a defined population, a clear calculation, and evidence behind it. Choose measures that help someone decide whether an important control is working.
Read the visual guide
How to show that you deleted someone’s data
A completed deletion ticket is not proof that every copy was removed. Record the systems searched, actions taken, justified retention, and how backups or restoration affect the result.
Read the visual guide
Ransomware is a decision for leadership, not only for IT
A ransomware incident can force decisions about operations, disclosure, external support, and recovery priorities. Establish the authority and contact routes before the team is under pressure.
Read the visual guide
How long to keep security logs
Retention is an operational decision about which events must remain available, for how long, and at what cost and sensitivity. Connect the window to incident questions and real search capability.
Read the visual guide
How to judge a supplier without a giant spreadsheet
A supplier with little stored data can still have powerful access or support a critical workflow. Match your review to the service boundary, permissions, and consequences of disruption.
Read the visual guide
How to threat-model a small product in one sitting
Start with one important journey through your product. Follow the data, identities, and trust boundaries, then ask what misuse could cause a meaningful consequence.
Read the visual guide
How to handle a security report from someone you do not know
A report from an unfamiliar person may identify a real issue. Provide a controlled route to receive it, assess the evidence, and decide the next step without encouraging unnecessary testing.
Read the visual guide
How to write a security note a board can use
A board needs to understand the decision, its consequence, and the uncertainty around it. Replace a long list of tools with a concise account of risk, options, ownership, and evidence.
Read the visual guide
Questions to ask before you buy cyber insurance
An insurance policy needs to match your organization’s systems and likely losses. Resolve important definitions, exclusions, control requirements, and approved response arrangements before relying on cover.
Read the visual guide
Brute force or password spraying? Read the sign-in pattern
Repeated guesses against one account and a few guesses across many accounts create different patterns. Review events across identities and time, rather than looking only for one noisy username.
Read the visual guide