Assurance

Research, Readiness and the Valley of Death

When people talk about "research" in cyber security, there is a tendency to reach for a fairly narrow set of examples: vulnerabili

Reduce, Reuse and please take your Annual Leave

Take your leave is the recycling of the workplace: the last tier, the cheapest fix, and the only one you can hand to one person. The tiers that would actually work, scoping and real cover, sit above it and belong to somebody else.

So What Even Is Threat Modelling? A Practitioner's Guide

Threat modelling is frequently discussed as if it were a singular, monolithic exercise. In reality, applying a one-size-fits-all methodology

So, You Now Have Crypto… Planning for Third-Party Security Assurance

When a supplier delivers a component implementing complex cryptographic functions, a standard black-box penetration test is entirely insuffi

Euro 7, Anti-Tampering, and the Expanding Cybersecurity Landscape

While the Euro 7 standard is widely discussed in the media as a final tightening of automotive tailpipe emissions, its implications for soft

Goal-based Regulation

I’ve written a new piece for NCC Group’s Research Blog on how goal-based regulation is changing the way we think about cybersecurity assuran