Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
The Target breach and the end of perimeter security
What the largest retail data breach on record says about why protecting the perimeter is no longer a viable security strategy.
Multitenancy and trust boundaries in SaaS
Where the convenience of a shared platform ends and the noisy-neighbour risk begins.
Personal data compliance is not just a legal problem
Data architecture and access controls directly shape legal risk. Technical decisions made today will become legal problems tomorrow.
FSTEC Order 21: what it changes in the practical protection of personal data
The Russian market gets a more concrete language for protection measures, security levels, and threat classes. What this means for companies that process personal data.
Incident communication: who says what while the technical team still has no answers
Reputational damage from an incident begins before the technical answer arrives. The communication plan needs to exist before it is needed.
Payment infrastructure as a target: what retail teaches us
The real lesson from payment data incidents is about segmentation, logs, and response time - not just protecting card numbers.
Supply chain risk before the SBOM era: why dependencies need to be tracked systematically now
Opaque transitive dependencies are not an academic problem. They are already an active attack vector.
Touch ID and corporate identity: what biometrics is actually useful for, and what to avoid overstating
Biometrics is a convenient authentication factor - not a substitute for a proper identity architecture.
Least privilege in practice: why access needs to shrink, not just grow faster
Granting access without managing its lifecycle is convenient right up until the moment it becomes a real business risk.
The Adobe breach as a lesson in password storage and the cost of old schemes
What the large-scale 2013 breach tells us about the price of outdated secrets storage and how companies respond to incidents.
Questions the board should ask after the surveillance disclosures
Backup, jurisdiction, logging, contracts, operator access - what leadership needs to verify after the PRISM story.
After PRISM: the cloud is no longer just a cost question
The NSA surveillance disclosure turned trust in cloud providers from a technical question into a political and legal one.