GDPR Day One
Two years of programme work, six weeks of final-stretch operations, and as of midnight last night the regulation is live. The customer portfolio is in attestable position and the actual operational regime begins now.
GDPR run-up: the operational picture
Six weeks to enforcement. The customer-portfolio readiness picture, the operational gotchas surfacing in the final stretch, and the things I am not seeing customers prepare for.
Opening 2018
First Monday back, and the year ahead is unusually well-defined. GDPR May 25, EmilyAI to production in Q2, the longer-form essay file finally moving into actual prose.
WannaCry, ten days on: NHS, BSI, the structural picture
The NHS impact picture has firmed up. The structural causes are well-understood and predictable. The political response is going to drive substantial change in UK public-sector security posture.
Opening 2017
First Monday back. The shape of the year ahead — GDPR run-up enters its operational phase, Emily moves from shadow to assist, and the post-DNC threat landscape is the new normal.
SWIFT, six months on
Bangladesh Bank was the first. Banco del Austro, Tien Phong, the Vietnam case, and now several more in confidential disclosure. The pattern is a campaign, not an incident.
Opening 2016
First Monday of the year, kettle on, pad open. The shape of the work ahead — GDPR run-up, the Privacy Shield negotiation, Stagefright tail, and a small experiment with machine learning on SOC alerts.
Schrems and Safe Harbour
The European Court of Justice has invalidated Safe Harbour. The legal basis for fifteen years of US-EU data flows is gone. The vCISO inbox is, predictably, on fire.
Opening the year
First Monday back at the desk. The shape of the year ahead and the four engagements already on the books.
News International
Three weeks into a virtual-CISO engagement at the Wapping end of News International. Archive, retention, source-protection, and the question of how a major newsroom reorganises its information-security posture under acute external pressure.