Security Is

This is a blog written by a technical security leader focused on problems facing security leadership and organizations (not strictly technical ones). I will release a new blog about every other week.

The hottest Substack posts of Security Is

And their main takeaways

Security Is Not a VPN Problem

59 implied HN points • 01 Aug 24
🕹 Technology Cybersecurity Internet Software Networking Privacy
  1. VPNs used to be essential for online security, especially on public WiFi, but that's changed with HTTPS being widely available. Now, most websites encrypt your connection by default.
  2. While VPNs can protect your IP address and DNS queries, for most everyday users, these aren't major issues anymore. Modern browsers and services help keep our connections safe.
  3. Using a VPN isn't a priority for everyone, and it might not be worth the investment, especially for regular people who just want basic online protection.

Security is Not an AI Problem

159 implied HN points • 02 May 24
🕹 Technology AI Cybersecurity Machine Learning Data science Digital Tools
  1. AI doesn't really fix security problems well. Many times, the technology just doesn't work in the tough, unpredictable environments that security deals with.
  2. The best results in security often come from simple, clear procedures, not from complex machine learning models. Basic rules can solve most problems effectively.
  3. Generative AI can help with minor tasks but isn't a magic solution for security. It might even confuse people about important issues, rather than clarify them.

Security Is A Useless Controls Problem

59 implied HN points • 29 May 24
🕹 Technology Cybersecurity Information Security Compliance Risk management
  1. Many security controls are useless, wasting resources and time. It's crucial to understand why you're implementing a control to avoid just following the crowd.
  2. If you can't explain why a security control is needed in a simple way, it's likely not very useful. Good controls should have clear reasons behind them.
  3. Wasting time on unnecessary controls can harm everyone in the industry. Focus on meaningful security measures to make better use of limited resources.

Making Sense of the Verizon Data Breach Investigation Report

39 implied HN points • 19 Jun 24
🕹 Technology Cybersecurity Data Breaches AI Phishing Information Security
  1. Most breaches are due to simple mistakes, like employees accidentally sending confidential info to the wrong place. Security teams need to focus on basic issues before tackling more complex problems.
  2. A large portion of breaches starts with phishing or stolen credentials. Companies should invest more in security measures like multi-factor authentication and employee training to lessen these risks.
  3. Generative AI hasn't impacted security breaches significantly yet. Most attackers are still using traditional methods, and no one seems to be targeting AI systems directly.

Security is Not an SBOM Problem

39 implied HN points • 15 May 24
🕹 Technology Cybersecurity Software Development Vulnerability Management Information Security
  1. A Software Bill of Materials (SBOM) lists all the components in software, which can help in understanding security risks but isn't a magic fix for vulnerabilities.
  2. The real issue with fixing vulnerabilities isn't about having information; it's about how hard and complicated it is to apply patches to software.
  3. While SBOMs are getting a lot of hype, they mostly offer a new format for existing information and may not change how organizations manage security vulnerabilities.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

Security Is Not An Encryption Problem

1 HN point • 17 Jul 24
🕹 Technology Cybersecurity Encryption Cloud Computing Data security Compliance
  1. Encryption is important, but it's often treated as a checkbox in cloud environments. Many people believe that encryption at rest and in transit fully secures their data, but this isn't always the case.
  2. In cloud settings, especially with services like AWS, anyone with the right permissions can access data regardless of whether it's encrypted at rest. This means encrypting data on the storage level may not offer as much protection as people think.
  3. Instead of focusing heavily on encryption, businesses should prioritize their access controls and permissions. Properly managing who can access what data is often a much more critical aspect of security.