Derek Brink
- Vice President and Research Fellow, Information Security and IT GRC, Aberdeen Group
Boston
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Derek Brink
5 reasons cyber insurance can be a worthy investment for your small business
by-studio/iStock/Getty Images Plus via Getty Images Small businesses are prime targets for cybercriminals. Cyber insurance provides financial protection and means to assess and improve security. SMBs should compare insurance costs to the frequency and impact of incidents.
Connect Technical Activities to Business Value With a Threat Intelligence Strategy Map
You’re trying to make the business case for your organization’s threat intelligence initiative, but members of the senior leadership team remain puzzled about the value of their investments in cybersecurity. Should we really be surprised? Consider the cold, hard facts: Companies worldwide are investing tens of billions of dollars per year on security, with a forecast increase of more than 9 percent per year, according to IDC.
Automation for the People and Processes
Sign Up Get up-to-the-minute news and opinions, plus access to a wide assortment of Information Security resources that will keep you current and informed.
Your Phishing Attack Risk Assessment is Missing the Risk - Aberdeen Essentials
“What is our organization’s risk from phishing attacks, and how do we reduce that risk?” In their roles as subject-matter experts (SMEs), security professionals can easily explain the who, what, when, where, and how of phishing attacks — but those details don’t convey the business risk phishing attacks carry or the best next steps for reducing that risk. And the risk can be substantial: The median cost of a phishing attack is $260K. And the cost can be as high as $10M.
Are You Prepared for Omnichannel Fraud?
Over the past few years, many retailers have worked hard to offer an omnichannel shopping experience to their customers, allowing them to shop from wherever they are whenever they wish, and take advantage of myriad ways to purchase their goods. But with all the convenience and opportunities this new approach brings to retailers, it also introduces increased risks and opportunities for cybercriminals to capitalize on new technologies to defraud consumers.
Don't Get Hacked for the Holidays — Tips to Stay Secure | Security Intelligence
Don’t count on cybercriminals to take it easy during the holiday season. While you’re traveling to visit family and shopping for gifts, these malicious actors are trying to strike it rich by stealing valuable enterprise data and even physical possessions. Luckily, there are plenty of best practices you can use to stay safe and secure — not just during the holidays, but all year long.
Naughty or Nice? Why the Total Cost of E-Commerce Fraud Is Worse Than You Think
Heading into the holiday season, the National Retail Federation (NRF) predicted that retail sales would be up and that, for the first time, the internet would be the most popular consumer shopping destination. For online merchants, this is good news. At the same time, it highlights the corresponding Santa Claus problem that online retailers have to deal with: figuring out whether a given online transaction is naughty or nice (i.e., fraudulent or legitimate) quickly and effectively.
Security Monitoring and Analytics: From Tools to Platforms
This is the first installment in a three-part series. Be sure to read the second installment for more information. Janus, the ancient Roman god of beginnings and endings — from which we get the name for January, the first month of the calendar year — was depicted as having two faces: one looking backward and one looking forward. In the context of time, it can be argued that security monitoring and analytics initiatives are the Janus of contemporary cybersecurity.
Back to School: Endpoint Security 101
Get up-to-the-minute news and opinions, plus access to a wide assortment of Information Security resources that will keep you current and informed.
Thinking of Insurance Fraud as a "Cost of Doing Business" Needs to End - Aberdeen Essentials
Insurance fraud doesn’t just affect insurance companies. With fraud draining five to ten percent of annual revenue in the insurance industry, that lost profit trickles down to you, the consumer, in the form of higher bills and premiums.
A Strategy Map for Security Leaders: How CISOs Should Strive to Be Perceived by Key Stakeholders
This is Part 3 in our six-part series on creating a strategy map for security leaders. Be sure to read Part 1 and Part 2 for the full story. The second row of our strategy map for security leaders is about how CISOs should strive to be perceived by the organization’s key stakeholders in order to deliver on their strategic objective of managing risk.
Stronger User Authentication: A Case for Expanding Your Base
Back in the day, when I was the product line director for RSA SecurID, the dream was pretty simple: “a token in every pocket.” (A natural corollary to this dream, of course, was “death to passwords.”) By “token,” of course, we meant a small, specialized hardware device – in the abstract, comprised of a processor, a power source, a time source, a display, an algorithm for generating pseudo-random numbers, and a unique “seed record” for that particular device / user.
Can You Quantify the Value of Security Awareness Training?
Information security is a complex topic, and people who make their living in this space have their hands full keeping up with the rapidly changing landscape of threats, vulnerabilities, exploits, and technologies. Even so, I would suggest that there are just four basic questions about risk that all information security professionals should be capable of addressing, in their dual roles as subject matter experts and trusted advisors to the business decision-makers.
Quick: What’s Our Risk from a Phishing Attack?
Quick! Suppose that the C-level executives or board members in your organization ask you to answer the following question: What is our risk from a phishing attack? A question like this really shouldn’t come as a surprise.
A Strategy Map for Security Leaders: Critical Capabilities for the New-School CISO
This is Part 4 in our six-part series on creating a strategy map for security leaders. Read Part 1, Part 2 and Part 3 for the full story. The third row of our strategy map for security leaders is about the handful of critical capabilities that new school CISOs should have. They need these qualities in order to be perceived favorably by key stakeholders in the organization, which in turn will help them to deliver against their strategic objectives of managing security-related risks.
Breaking Down the Risk of Industrial Control Systems Security
One of the amazing – and at times, also challenging – things about extremely smart people is that they routinely pack a ton of wisdom and insight into just two or three sentences. The rest of us can receive it, and even think we understand it, but not necessarily to its full depth of meaning.
Ransomware and Cyber Extortion: What You Need to Know and Do
Ransom, which refers to some kind of payment that is demanded in exchange for the release of someone or something that has been taken, is a simple yet effective ploy that has been used by criminals for thousands of years. For example, on his way home from the Third Crusade in 1192, King Richard the Lionheart was captured and held for ransom by Duke Leopold of Austria.
Crackpot Rigor: When Making a Business Case for Security Goes Too Far
Fair warning – I’m about to do the unthinkable. I’m about to throw both content marketers and industry analysts under the proverbial bus. It’s “unthinkable”, because research, analysis, and content marketing is exactly what I do to provide for my family. Don’t shoot yourself in the foot, don’t saw off the branch you’re sitting on, don’t be your own worst enemy … there’s no shortage of practical wisdom that would advise against doing what I’m about to do.
Admitting I Was Wrong About Encryption
Editor’s Note: Also join us for a live webinar on Thursday, August 27, at 1 p.m. EDT, addressing this topic, “The Right Tools for the Job: Encryption for ‘Data-at-Rest’ in Back-End Systems.” The session will also be made available on-demand. They say it takes a big man to admit he was wrong – and for those who know me, I am a pretty big man. Specifically, I was wrong about some things I have been saying and writing about encryption.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Derek
Contact Derek, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack