Insight #1
"I recently attended a conference and overheard a conversation where someone said, “Security by obscurity is not security, but it works.” It may help prevent your everyday script kiddie but a determined malicious actor would barely blink. Please, before you start using obscurity for your controls, make sure you completely understand your threat model and who your threat actors may be. You will quickly realize why obscurity does in fact NOT work."
Insight #2
"NIST recently posted a request for information (RFI) to enhance their Cyber Security Framework (
NIST CSF). One of the most commented additions was that NIST CSF lacked metrics. As security becomes more of a business enabler, it is imperative we start measuring more, and building metrics into the NIST CSF is a no-brainer."
Insight #3
"As security pushed more and more left, and requirements lie on developers to create secure code out of the gate, open-source tooling for security will become more important. There are lots of great commercial products available, but not everyone can afford all the products they may need to fully support a secure development process. Purchase the tools you can, and look for open source products to help supplement or cover gaps you may have."