Eric Alexander

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment

Check out Madeline Lake's latest blog! She's done a fantastic job using GitLab's core features to automate compliance observation management for our team - enabling us to focus more directly on collaboration with our internal stakeholders and drive remediation efforts.

10

If your team dreads getting paged, you don’t have an IR problem. You have a leadership one. Fear-based response looks like this: – Analysts over-document because they’re afraid to miss something. – Engineers and other staff outside your team stay quiet or avoid your process entirely because they’re afraid to be blamed. – Leaders hesitate because they’re afraid to make the wrong call. That’s not control. That’s paralysis. Great incident response isn’t built on fear — it’s built on trust and clarity. When people know the “why” and feel safe asking for help, they respond faster, communicate better, and recover stronger. Fear slows the signal. Trust speeds it up. If your IR team is tense, you don’t need a new process. You need a new atmosphere. What’s one thing your team does to keep fear out of incident response? #CyberSecurity #IncidentResponse #Leadership #TeamCulture #PsychologicalSafety #SecOps #Resilience

18

11 Comments

Want to be a great penetration tester that can be trusted with an engagement? Take notes. Meticulous, timestamped, operational notes. If you’re in penetration testing, or really any cybersecurity or IT discipline that involves interacting with systems, this habit will save your reputation more times than you can count. Not just for reports, or your memory lapses, but for accountability. I’ve heard things like: “Your team caused our production XYZ server to go haywire today.” But we were able to check our operational logs and show we hadn’t even touched that environment for over a week. Or: “You renamed our server after exploitation and now our lookups are failing.” Only to find in our system inventory from initial recon that was the hostname when we first saw it two weeks ago on day 1 of the engagement. You need to be able to positively identify or deny actions with precision. Your word won’t always be enough, especially when things break and fingers point. In an industry built on trust, documentation is part of your defense. So: - Keep detailed logs with timestamps of your actions. - Take lots of screenshots Take notes. One day you might just need them. #Cybersecurity #PenetrationTesting #RedTeam #BlueTeam #LessonsLearned

35

3 Comments

I constantly get asked about how to prioritize security projects. Here's the framework I use: 1. Impact: What's the business risk if unaddressed and/or how much money does this save the business? Security initiatives rarely fall outside these two categories. 2. Effort: How much time/money/people does this need? 3. Dependencies: What has to happen first? 4. Stakeholders: Who needs to care for this to succeed? Pro tip: If you can't explain the business impact in one sentence, it's not ready to be prioritized. Using this framework, projects are rated P0-P4. Feel free to add specific thresholds (e.g., impact >$1M = P1). High impact, medium/low effort projects naturally rise to the top, great for demonstrating value. Edge cases exist, but this approach helps tackle what's most important when you have a backlog of competing projects. Hope this helps!

42

1 Comment