Joan Goodchild
Verified
As seen in:
Business Insider,
Yahoo Canada,
Yahoo News,
Yahoo Sports Canada,
Computerworld,
GigaOM,
CIO,
Yahoo Style Canada,
CSO,
Dark Reading
and
Tech & security writer and content person. Proud Masshole, Gen Xer, and mom of two. Infrequent Twitter user. Introverted extrovert. She/Her.
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Joan Goodchild
Falsk sikkerhedssoftware er en god forretning
Såkaldt 'scareware' er ifølge Symantec den seneste lukrative tendens i kriminalitet på nettet. 21. oktober 2009 kl. 07.39 Det ser rimelig uskyldigt ud, når man ved hjælp af reklamer, popup-vinduer eller meddelelsesikoner får anbefalet sikkerhedssoftware, men faren lurer. Annonceindlæg tema Offentlig digitalisering Fra effektivisering til digital suverænitet. Hvordan skaber det offentlige en digital fremtid med AI, sikkerhed og kontrol i centrum?
Avancerede trusler er et stigende problem
En spørgeundersøgelse peger på, at it-sikkerhedschefer oplever flere avancerede trusler, mens kun få har den nødvendige support og teknologi til at håndtere dem. Annonceindlæg tema Offentlig digitalisering Fra effektivisering til digital suverænitet. Hvordan skaber det offentlige en digital fremtid med AI, sikkerhed og kontrol i centrum?
When Too Much Security Data Becomes the Risk
For years, conventional wisdom in security operations was simple: Collect everything. Logs were cheap. Storage was plentiful. And the more data a team had, the more confident it could feel about detection and forensics. That assumption quietly broke as organizations scaled. At Vensure Employer Solutions, a privately held HR services and payroll provider supporting more than 95,000 businesses, telemetry volume did not just grow — it exploded.
Cyber Means Business: Matt Hillary on Why Security Leaders Must Become the “Department of Know”
listing page or single post https://www.hellersearch.com/blog Heller Blog Today’s security leaders can no longer operate as gatekeepers focused solely on blocking risk, argues Matt Hillary, chief information security officer at Drata. Instead, CISOs must serve as strategic business advisors who help organizations innovate responsibly, and build trust at scale. Matt Hillary used to believe cybersecurity worked like engineering: if you built the system carefully enough, you could eliminate failure.
Cyber Means Business: Nick Kathmann on How CISOs Should Talk to the Board About Risk
In this edition of Cyber Means Business, Nick Kathmann, chief information security officer at governance, risk and compliance provider LogicGate, argues that the most effective CISOs frame cybersecurity in terms that boards already understand: risk, business strategy, and measurable outcomes. When cybersecurity leaders fail to connect their work to the strategic direction of the company, they risk being seen as technical specialists rather than business leaders.
Lies, Damned Lies, and Cybersecurity Metrics
Despite years of increased spending, investments in more tooling, and more talent flooding into the industry, cybersecurity outcomes seem to be getting worse. During a panel discussion in San Francisco last month, a group of cybersecurity leaders said the problem runs deeper than attackers or technology. The panel, titled "Hard Truths in Cybersecurity: Fear, Liability, and the Industry's Biggest Lies," focused on what's broken in cybersecurity.
Automaker Secures the Supply Chain With Developer-Friendly Platform
For teams responsible for delivering software into connected vehicles, software supply chain security carries significant consequences. A vulnerable update can pose real-world risks to both systems and drivers. With those stakes in mind, one large automotive manufacturer has reshaped its approach to platform engineering and security.
Cyber Means Business: Dr. Margaret Cunningham on How Human Behavior Shapes Security Practices - and Business Outcomes
In this edition of Cyber Means Business, Dr. Margaret Cunningham, vice president of security and AI strategy and field CISO at Darktrace, explains how human behavior, trust, and decision-making influence security practices. Drawing on her background in behavioral science, security research, and organizational dynamics, Cunningham argues that understanding how people interpret risk is essential to building resilient systems, accelerating innovation, and maintaining customer confidence.
CISO Succession Crisis Highlights How Turnover Amplifies Security Risks
The conversation was supposed to be about improving a human risk program. Instead, it became a window into just how much the role of chief information security officer has changed. Nicole Jiang, CEO and co-founder of Fable Security, was speaking with a customer in the insurance sector who oversaw security across multiple specialty businesses.
Why a 17-Year-Old Built an AI Model to Expose Deepfake Maps
When a deepfake targeted him personally, Vaishnav Anand panicked. But when everything settled down, he turned that panic into purpose. The California high-school junior was inspired by the incident to ask a different question than most: If people already doubt celebrity videos and viral images, what about the satellite maps that governments and corporations quietly trust every day?
Will AI undermine the cybersecurity talent pipeline?
By Joan Goodchild Artificial intelligence (AI) is doing exactly what security teams hoped it would do: eliminate the repetitive, low-value work that has long burned out junior analysts. But in solving this problem, it may be creating another one that could have a long-lasting impact. Log review. Alert triage. Drift detection. Basic investigation.
With AI Reshaping Entry-Level Cyber, What Happens to the Security Talent Pipeline?
Artificial intelligence (AI) is doing exactly what security teams hoped it would do: eliminate the repetitive, low-value work that has long burned out junior analysts. But in solving this problem, it may be creating another one that could have a long-lasting impact. Log review. Alert triage. Drift detection. Basic investigation.
AI Changing Entry-Level Work Can Impact Talent Pipeline
Artificial intelligence (AI) is doing exactly what security teams hoped it would do: eliminate the repetitive, low-value work that has long burned out junior analysts. But in solving this problem, it may be creating another one that could have a long-lasting impact. Log review. Alert triage. Drift detection. Basic investigation.
Cyber Means Business: Bob Maley on Why Third-Party Risk Is a Business Problem, Not a Technical One
listing page or single post https://www.hellersearch.com/blog Heller Blog In this edition of Cyber Means Business, we talk to Bob Maley, Chief Security Officer at Black Kite, to explore one of the most pressing and complex challenges in cybersecurity today: third-party risk.
Grandparents to C-Suite: Elder Fraud Reveals Gaps in Human-Centered Cybersecurity
A retiree answers the phone one afternoon and hears what sounds unmistakably like her grandson's voice. He says he was in an accident and needs money right away. The caller knows her name, her town, and details about the family. Panicked, she sends the funds — only later learning that the voice was generated by artificial intelligence (AI) and the personal information came from publicly available data online. Such scenarios have become increasingly common.
An 18-Year-Old Codebase Left Smart Buildings Wide Open
When security researcher Gjoko Krstic finally came up for air from his research, he hadn't slept for a week. "I was dizzy. I couldn't stop finding new bugs," he says. "That's why I called [this research] 'Project Brainfog.'" The name stuck — fitting for a research effort that uncovered more than 800 vulnerabilities, many of them zero-day, across building-automation systems operating in over 30 countries and 220 cities worldwide.
Inside the Data on Insider Threats: What 1,000 Real Cases Reveal About Hidden Risk
After 14 months, 15,000 legal cases, and countless late nights, security analyst Michael Robinson distilled insider threats down to 1,000 instances of misconduct — real-world cases where trusted employees turned their access into a weapon. "I gave up television, books, even exercise," he says. "For 14 months, I went through every case that touched an insider threat — computer abuse, trade secret theft, espionage — and pulled out the data.
Cyber Means Business: Gary Brickhouse on Framing the Cybersecurity Talent Shortage as a Business Risk
In this edition of Cyber Means Business, we sit down with Gary Brickhouse, CISO of cybersecurity firm GuidePoint Security, to talk about one of the most persistent challenges facing organizations today: the cybersecurity workforce gap.
Cyber Means Business: Veteran CISO Jim Routh on AI, Governance, and Why Resilience Beats a “Culture of Security”
listing page or single post https://www.hellersearch.com/blog Heller Blog In this edition of Cyber Means Business, veteran CISO Jim Routh urges security leaders to rethink their approach to AI governance—not as a risk barrier, but as a foundation for innovation.
Secure AI Use Without the Blind Spots
Trey Ford has seen it before: The engineering team is off to the races, exploring the latest artificial intelligence (AI) tools, while the security side is still trying to catch its breath. "Security teams are never overstaffed," says Ford, CISO, Americas, at Bugcrowd. "And out of nowhere, we have this new thing that is a game-changer.
Human Risk Roundup When the browser becomes the bait
In this edition of the Human Risk Roundup, we explore how attackers are adapting to hardened technical defenses by shifting their focus to human behavior. A new phishing technique dubbed FileFix 2.0 demonstrates how something as ordinary as saving a file in your browser can be manipulated to install malware—no exploit chain required. Also, ransomware operators are doubling down on high-value targets and sensitive personal data to maximize impact.
How to Break the Security Theater Illusion
While sitting in a board meeting for a healthcare service provider, veteran CISO John Rouffas was struck by a disconnect he said was impossible to ignore. The security update was familiar: Training metrics were high, patching was on schedule, and vendor relationships were in place. Board members walked away reassured about the provider's security program. They shouldn't have.
Experts Chart Path to Creating Safer Online Spaces for Women
In nearly 20 years as director of cybersecurity with the Electronic Frontier Foundation (EFF), Eva Galperin has received countless emails and calls from women who have been harassed online, found their images manipulated into humiliating media, had their private information spread across the Web, or fear their every digital move is being tracked. She has seen firsthand how quickly online harassment spirals from a virtual annoyance to a threat to real-life safety.
Human Risk Roundup
In the inaugural edition of the Human Risk Roundup, we delve into recent, real-world examples of how cybercriminals exploit human vulnerabilities to breach organizational defenses. Designed for CISOs and security leaders, this regular feature from Mimecast provides actionable insights into the evolving tactics and psychological strategies used by attackers, helping you stay ahead in safeguarding your organization’s most critical asset—its people.
Human Error at the Heart of Recent Ransomware Attacks on UK Retail Giants
Several recent ransomware attacks on UK retailers demonstrate that human error is a primary factor in cybersecurity breaches. Recent incidents involving Marks & Spencer (M&S), Harrods, and Co-op highlight how human risk plays a critical role in enabling these attacks. While technical vulnerabilities contribute to the problem, the underlying factor often remains human behavior, whether through compromised credentials or exploited helpdesk protocols.
Accounting Firms Can't Skimp on Cybersecurity
Early in 2024, an employee at UK engineering firm Arup joined a video call with the company's senior management. The call seemed routine — but it wasn’t. What the employee didn't realize was that the entire interaction was using deepfake technology. The faces and voices of the individuals on the call were fake, and by the time the call had ended, the criminals had $25 million. The only real part about the incident was the trust in thinking the people were who they claimed to be.
Bluetooth low energy Archives
The Home of the Security Bloggers Network
Signs Your Organization's Culture Is Hurting Your Cybersecurity
These days, the word "toxic" gets thrown around a lot in many contexts, but when used to describe organizational culture, it poses an actual threat. When employees are constantly overworked, undervalued, or forced to operate in high-stress, blame-heavy environments, mistakes are inevitable. Fatigue leads to oversight, disengagement breeds carelessness, and a lack of psychological safety prevents people from speaking up about vulnerabilities or potential risks.
7 Tips for Strategically Saying 'No' in Cybersecurity
Question: There are times when cybersecurity teams need to say, "No" to business stakeholders. What is the best way to go about it? Answer: Saying "yes" in business feels good, but, unfortunately, it's not always possible. And among security departments, saying no isn't happening often enough.
Security Needs to Start Saying 'No' Again Original
For years, cybersecurity was frequently (and derisively) referred to as the "Department of No." Business executives griped that in the face of innovation, cybersecurity teams would slap down ideas, list reasons why the project was insecure, and why what they wanted to do was not feasible. Then came a mindset change. As more security leaders were tasked with demonstrating a return on investment for security budgets, security departments started finding ways to say "yes" more often.
What Security Lessons Did We Learn in 2024? Original
From the growing sophistication of zero-day exploits to the entrenchment of nation-state and cybercriminal alliances, 2024 delivered more evidence of how quickly the threat landscape continues to evolve. The year reinforced hard truths about the persistence of attackers and the systemic challenges of defense. We look back on some of the events that defined 2024 and the tactical insights that security teams can apply to stay ahead in the ongoing battle in 2025.
Managing Threats When Most of the Security Team Is Out of the Office Original
Experienced security leaders know that attackers are patient. Attackers can infiltrate corporate chat systems like Slack or Microsoft Teams and just ... watch. For months, they monitor conversations, learn who the experienced staff are, and take notes on upcoming vacation plans and each team member's communication style. Then when the company shifts to a skeleton crew — perhaps during a major holiday or summer break — they strike.
Bridging the 'Keyboard-to-Chair' Gap With Identity Verification
Just about everyone is familiar with the annoying process of becoming locked out of an account and needing to reset a password. Whether it's forgetting a log-in after months of disuse or being forced to prove your identity to regain access, the experience can be frustrating, time-consuming, and — ironically — less secure than the original authentication process. "People lose their credentials all the time.
8 Tips for Hiring and Training Neurodivergent Talent Original
Hiring and retaining neurodivergent talent is a crucial step toward fostering a more inclusive and innovative cybersecurity workforce. But traditional hiring processes and standardized training programs can often create barriers for these individuals and lead companies to lose out on talent. Here are eight tips for ensuring that your hiring and training processes are more inclusive and that neurodivergent candidates can succeed and thrive within your organization once they are on the job. 1.
Making Cybersecurity Accessible For Neurodiverse Talent
Megan Roddie-Fonseca, co-author and instructor at SANS Institute, recalls a pivotal moment during her job interview that swayed her decision to join the company. "During the interview process, the manager asked me, 'How can I manage you? What's your ideal way of working?'" Roddie-Fonseca says.
CISOs' Privacy Responsibilities Keep Growing Original
Years ago, when Mark Eggleston was tasked with building a privacy program for a national healthcare provider, he saw firsthand the importance of cross-functional collaboration. "I needed legal experts to debate the HIPAA Privacy, NPRM [Notice of Proposed Rulemaking], final rule, and guidance and convert those requirements into internal policies," Eggleston recalls.
How AI Can Boost Your Cybersecurity Program
More security teams are incorporating AI to uplevel their defense strategies and boost productivity. With so much AI buzz, it may be overwhelming to decipher which tools to acquire and how they fit in a modern security strategy.
Six Ways to Boost Your Cybersecurity
More security teams are incorporating AI to uplevel their defense strategies and boost productivity. With so much AI buzz, it may be overwhelming to decipher which tools to acquire and how they fit in a modern security strategy.
Security leadership Archives
Iranian hackers Archives
Today the Birmingham InfraGard Chapter and the Alabama ISSA held a joint meeting featuring a presentation from the Cybersecurity & Infrastructure Security Agency, part of DHS that was formerly known as the ...
Shocked, Devastated, Stuck: Cybersecurity Pros Open Up About Their Layoffs
Tony Bradley, a seasoned communications professional in the cybersecurity industry, was blindsided when he was recently laid off from his role as a marketing director. "It really was a complete shock. I was not a founder, but I was part of the C-suite inner circle for planning and strategizing," he says. "I was definitely under the impression that we were all on the same page and we were a team working together.
Training at Black Hat to Focus on Equipping Cybersecurity Leaders With Soft Skills
While most people recognize that heading up a cybersecurity team requires a mix of both technical and so-called "soft skills," it's a reality that many security leaders struggle with the latter. Daniel Shore, Ph.D., a social-behavioral scientist and the co-founder of MultiTeam Solutions, is trying to change that through research-based training with a focus on the social science of leadership. He will lead a workshop titled "Hacking Cybersecurity Leadership" next month at Black Hat 2024.
Ensuring AI Safety While Balancing Innovation
As tools and technology that use artificial intelligence (AI) continue to emerge at a rapid pace, the rush to innovate often overshadows critical conversations about safety. At Black Hat 2024 — next month in Las Vegas — a panel of experts will explore the topic of AI safety. Organized by Nathan Hamiel, who leads the Fundamental and Applied Research team at Kudelski Security, the panel aims to dispel myths and highlight the responsibilities organizations have regarding AI safety.
Networking Without the Hangover
Jennifer VanAntwerp is a seasoned marketing professional who has worked in several industries, including automotive, healthcare, and now cybersecurity. While each sector has distinct elements, VanAntwerp noticed a a common thread when attending conferences and networking events: Alcohol was a constant, and that was an issue for sober people, like herself.
Is Defense Winning? A Look at Decades of Playing Catch-up
Defenders are perpetually playing catch-up to attackers. For every security innovation or new technology introduced, cybercriminals develop just as many tricks to bypass them. This ongoing struggle will be the focus of an upcoming presentation at Black Hat USA 2024, this August in Las Vegas, by Jason Healey, a senior research scholar at Columbia University. "For over 50 years, we've known that the red team always gets through," Healey says.
Federal Cyber Ipari Loom; Ikọkọ Chatbot Ewu
Kaabọ si igun CISO, kika kika Dudu osẹ ti awọn nkan ti a ṣe ni pataki si awọn oluka awọn iṣẹ aabo ati awọn oludari aabo. Ni gbogbo ọsẹ, a funni ni awọn nkan ti o ṣajọpọ lati gbogbo iṣẹ iroyin wa, Edge, Imọ-ẹrọ DR, DR Global, ati apakan Ọrọ asọye wa. A ti pinnu lati mu ọpọlọpọ awọn iwoye wa fun ọ lati ṣe atilẹyin iṣẹ ṣiṣe ṣiṣe awọn ilana aabo cyber, fun awọn oludari ni awọn ajọ ti gbogbo awọn nitobi ati titobi.
Cybersecurity Snapshot: 6 Best Practices for Implementing AI Securely and Ethically
Like many organizations, yours is likely using AI – or at least thinking about deploying it soon. But how can you ensure you use it securely, responsibly, ethically and in compliance with regulations? Check out best practices, guidelines and tips in this special edition of the Tenable Cybersecurity Snapshot! If your organization is using artificial intelligence (AI), chances are that the CISO and other security leaders have been enlisted to help create guardrails for its use.
Persistent Burnout Is Still a Crisis in Cybersecurity
Dr. Ryan Louie, a psychiatrist focused on the intersection of cybersecurity and mental health, recalls a valuable lesson from his medical student days that cybersecurity practitioners may find relevant: "During one of my clinical clerkships at the hospital, our team's attending physician on the first day of the rotation highlighted that we are a team and that everyone should feel free to say whenever they feel they have too much on their plate or if they need any help.
Cybersecurity Snapshot: CISA Warns Hospitals about Black Basta, as Tenable Study Finds Cloud-Related Breaches Pervasive
Find out why healthcare organizations must beware of the Black Basta ransomware group. Meanwhile, a Tenable study found that 95% of surveyed organizations suffered a cloud-related breach, and offers insights for boosting cloud security. Plus, a Cloud Security Alliance report delves into how AI systems can create risky gaps in your cloud environment. And much more! Dive into six things that are top of mind for the week ending May 17.
Facebook at 20: Contemplating the Cost of Privacy
In the 20 years since then-Harvard University student Mark Zuckerberg launched Facebook, there has been a profound shift in our understanding of privacy and security in the digital age. Facebook's path to becoming a digital town square has been fraught with challenges as the company — and the rest of the world — balanced the human desire to share information with the expectation of personal privacy.
Show More
loading
Actions
Get in touch with Joan
Contact Joan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack