You may have been around for the bicentennial...maybe you'll be here for the tercentennial...but seize the semiquincentennial while you have it! (image credit: After Jasper Johns, Public domain, via Wikimedia Commons)

I love the phrase "more art than science" because I feel that only pure science is "science" in the popular sense of "following clearly defined rules and therefore providing clear, reliable answers." There is a similar issue with logic and mathematics; if you can somehow cram a topic into either one of these containers then whatever ridiculously wrong conclusions you come to are given instant credibility. For example, this old chestnut: All apes are hairy. All men are hairy. Therefor all men are apes. This seems logical, but it isn't logical and it certainly isn't true. So it is with cybersecurity: Cybersecurity is about access to computer technology. Technology is science. Therefore cybersecurity is a science. Cybersecurity is about human beings interacting with computer technology. Human beings are inconsistent and capable of ignoring reason and of using terrible judgement. Therefore cybersecurity is most definitely not purely a science. If you p...

With so many people spending so much time and money and attention on AI, let's consider what happens if all the hype is justified and AI suddenly can do almost any job. Uh, I mean, can be used to boost almost anyone's productivity. Applying AI to the workplace the choice is enhancement versus replacement. By "enhancement" I mean that employers will ride the productivity gains to provide better service at a better price. By "replacement" I mean that employers will ride the productivity curve to fire people and increase profits by delivering worse service at the same price for higher profit. Which option is best? Which is most likely? What happened the last time this option arose? The answer is "it depends." As is so often the case, the follow-up question is "what is the right question?" I was working in "business process engineering" through the 1980s and 1990s when "computerize" was a verb. It meant "to apply a co...

The litany of the hacked is our listing for each known/reported hack in the previous month. The point of the litany is not shame but awareness-raising that, well, these sorts of things happen. Apparently, hackers went for the lay-up while the NY Knicks wrapped up a WORLD CHAMPIONSHIP to attack MSG. Thanks -- not -- a lot, MSG. And so, the litany of the hacked, which for June 2026 now includes: Madison Square Garden Sports Corp...Station Casinos… Israel Holocaust Support Center…Dashlane…Meta’s AI support bot…Anthropic's Claude platform...MyPillow…Fortinet...California Water Service...NAIC...Sacramento Fire Department...University of Nottingham...Texas Department of Fish and Wildlife...Alamo Heights ISD...Prince George's County (MD)... Other than the MSG hack, the one that catches our attention is the attack on Anthropic. In this attack, Anthropic accused a Chinese commerce company that shall not be named in setting up a flood -- almost 25000 -- of fake accounts to steal informat...

AI & Cybersecurity What role should AI play in cybersecurity? Driven by the quick and effective adoption of AI by cyber criminals cybersecurity professionals are under pressure to react somehow, as Ted has already discussed in this post . In that post Ted points out that the business side of the house and the Cybersecurity group (C/S) have very different wants and needs from AI, and that C/S will allow the business side to dictate strategy at their peril. This post is about how C/S can frame that discussion so as to be productive rather than combative. You can't do whatever they are doing because AI means different things to C/S than it does to them. The Business Side Let us consider how AI looks to the business side of the house so that we can define some of those differences and better communicate those differences. Utopian View AI will usher in a new era of workplace productivity and satisfaction because it will handle all the white collar drudgery that plagues our workdays....

And eventually -- it stops. They move on. You are victorious, but frazzled. Now is the time to take stock, rebuild relationships, and prepare for the next engagement. Time for the final NIST CSF pillar, Recover. Let's let Brendan discuss it : Recover is the step you take to undo the damage or restore the service. Recover is a bit more deliberate and thoughtful than Respond. You have time pressure, almost always, but there is rather less of it. The cybersecurity crisis is over, but if you need to keep your systems down for the recovery, then the operations crisis has just begun: how long can the downtime continue, in the name of preventing future problems and gathering evidence? The answer depends on your situation. Your ability to arrive at that answer often depends on how well thought-out your IRP is. Recover should always end with a review that considers how to be better in the future. This is a crucial step to making you safer than you were before. It is very common to just want...