Phil Venables

Decoding Cybercrime's True Scope: Beyond the Trillion-Dollar Hype

A new NASEM report reveals the truth about #cybercrime stats: our data is fragmented, inconsistent, & underreported. We can't fight what we can't accurately measure.

www.philvenables.com/post/decodin...

The Don't Fire Me Chart

A lot of premature CISO turnover is caused by the security program uncovering previously unknown risks and issues. So, paradoxically, the best CISOs make the situation *seem* worse before it then *actually* gets better.

www.philvenables.com/post/career-...

Cyber Insights Needed & Delivered

My analysis of the recent Cyentia Institute report. Things are getting worse in absolute terms but it’s not clear (my take) they are getting worse relative to what the situation might be.

www.philvenables.com/post/cyber-i...

Segmentation Technologies / Zero Trust

Thinking about doctrine vs. structure is a useful mental model to validate a technology’s adequacy for a particular task. In short, to know whether we are jamming a square peg into a round hole.

www.philvenables.com/post/segment...

A different taken on the CISO / Cybersecurity Leader Job Description.

www.philvenables.com/post/ciso---...

Starting a Security Program from Scratch (or re-starting).

www.philvenables.com/post/startin...

Security Leaders’ Reading List

Not many security books. Security leader challenges are mostly, well, leadership along with a healthy dose of program mgmt, culture, attention to detail, risk mgmt and more.

www.philvenables.com/post/leaders...

Turning the Security Flywheel

This post explores the "flywheel" concept and its application to security, demonstrating how to create self-reinforcing cycles that improve effectiveness.

www.philvenables.com/post/turning...

Cryptanalytically Relevant Quantum Computers (CRQCs) are coming. Perhaps sooner than we think, but we can conservatively (and usefully) assume in the 2032 - 2040 time frame. Beware the snake-oil of non-standard solutions.

www.philvenables.com/post/post-qu...

Keys to Career Success

www.philvenables.com/post/keys-to...

Top Ideas and Posts from 2024

In closing the year let’s take a look at the top 10 posts of 2024 in order of most read.

www.philvenables.com/post/top-ide...

Want to know more about cyber-physical resilience & why leading indicators like software reproducibility & cold-restart time are more effective than just focusing on lagging indicators?

Then take a listen to the 2024 season finale of the cloud security podcast.

cloud.withgoogle.com/cloudsecurit...

Cloud CISO Perspectives: From gen AI to threat intelligence: 2024 in review | Google Cloud Blog To close out the year, our CISO Phil Venables shares the top Google Cloud security updates in 2024. There’s a lot of AI, of course, and a few surprises.

Cloud CISO Perspectives for end of Dec ’24 is up covering:

- Year end review from AI to Threats
- Forecast for 2025
- AI ISO certifications
- NIS2 compliance
- Threat intel. program development
- Detection as code
- and much more….

cloud.google.com/blog/product...

Remember, as security professionals we are defending the free flow of ideas and capital that are essential for human progress. Defending lives and livelihoods. That's the mission. Happy Holidays.

sketchplanations.com/the-three-br...

The Maintenance Paradox Maintenance never makes sense in the short term, yet it is indispensable in the long term.

The Maintenance Paradox.

luca-dellanna.com/posts/mainte...

Leadership: One Day at a Time, One Step at a Time.

www.philvenables.com/post/leaders...

Google Cloud first CSP to join BRC, MFG-ISAC, and affiliates to advance security | Google Cloud Blog Google Cloud is proud to be the first cloud service provider to partner with the GRF Business Resilience Council and its affiliates. Here’s why.

Proud to see @googlecloud as the first cloud service provider to partner with the @GRFederation and its affiliates to help further strengthen the manufacturing industry's cyber resilience.

Read more on what this means here:

cloud.google.com/blog/product...

Cloud CISO Perspectives: Our 2025 Cybersecurity Forecast report | Google Cloud Blog Google Cloud security experts don their forecasting hats to gauge what’s coming in 2025, in our newest CISO newsletter.

Cloud CISO Perspectives for early Dec '24 is up covering:

- Forecasting 2025: Notes from the Field
- Open source security patch validation
- C2 in browser isolation environments
- Every CTO should be a CTSO
- and more......

cloud.google.com/blog/product...

Oops! 5 serious gen AI security mistakes to avoid | Google Cloud Blog Pitfalls are inevitable as gen AI becomes more widespread. In highlighting the most common of these mistakes, we hope to help you avoid them.

Oops! 5 serious gen AI security mistakes to avoid

cloud.google.com/transform/oo...

The “Eureka!” Moment We asked 20 scientists and thought leaders to recall when they realized AI had the potential to change the world.

How has the development and adoption of AI changed over the last year? Dive into the current landscape in this issue of the Dialogues magazine, from @Google and @atlanticrethink for insightful perspectives on the transformative power of AI.

Read here: www.theatlantic.com/sponsored/go...

Regulatory Harmonization - Let’s Get Real Every few months some association or other learned group of professionals makes a fresh call to action for cybersecurity regulatory harmonization. The logic being that cybersecurity professionals are spending more time showing adherence to compliance obligations or dealing with the toil due to differences in regulation than they are actually mitigating risk.I do have some sympathy with this sentiment but I would push back on this being as big a problem as people generally assert. However, as we

Regulatory Harmonization - Let’s Get Real

Most cyber controls are relatively aligned. Calls for action on harmonization are really induced by obligations from other technology risk domains or broader. Focusing on reducing compliance toil is the right approach.

www.philvenables.com/post/regulat...

Presentations — Benedict Evans Every year, I produce a big presentation exploring macro and strategic trends in the tech industry. For 2024, ‘AI, and everything else’.

It's here. Benedict Evan's annual presentation. Predictably it's all about AI. Well worth a read.

www.ben-evans.com/presentations

Cloud CISO Perspectives: Ending ransomware starts with more reporting | Google Cloud Blog Cyber-insurance can play a big role in stopping ransomware — if we let it, say this month’s guest columnists Monica Shokrai and Kimberly Goody.

Cloud CISO Perspectives Blog for end of Nov '24 is up, covering:

- Ransomware and cyber insurance
- Workload identity federation
- Reducing toil of audit compliance
- Gemini AI for malware analysis
- and much more....

cloud.google.com/blog/product...

Lessons in Crisis Management - Top 10 Disaster Movies

Which ones am I missing?

www.philvenables.com/post/lessons...

Risk Appetite & Tolerance - A Practical Approach

Defining risk appetite should support business decision making - ensuring risk taking is for strategic objectives while capping downside. Risk tolerance expression should permit choices and measurement.

www.philvenables.com/post/risk-ap...

The Top 10 Attributes of Great Security Leaders

1. Curiosity
2. Influence
3. Moral Courage
4. Persistence
5. Collaboration
6. Critical and Logical Thinking
7. Broad Technical Understanding
8. Culture Alignment
9. Strategic Mindset
10. Team Building

www.philvenables.com/post/job-int...

6 Truths of Cyber Risk Quantification

1. Risk Quant vs. Risk Comms
2. Risk = Hazard + Outrage
3. Experience and Judgement Eats Data for Breakfast
4. A Tree Falls in the Forest
5. All Risk Quantification is Wrong
6. Multi-Disciplinary or Nothing

www.philvenables.com/post/6-truth...

Ethics and Computer Security Research

- Stakeholder Perspectives and Considerations
- Respect for Persons and Informed Consent
- Beneficence
- Justice
- Respect for Law and Public Interest

www.philvenables.com/post/ethics-...

33 'Computer Programs' That Changed the World

- OS/360
- Multics
- VAX/VMS
- Linux
- Python
- Git
- IBM VTAM (in SNA)
- Netscape Navigator
- RSA BSAFE
- Borg
- SecDB
- and more........
www.philvenables.com/post/33-comp...

Why Good Security Fails: The Asymmetry of InfoSec Investment.

www.philvenables.com/post/why-goo...