Category Archives: Technology
An incident can be technically contained and still become a business crisis if communication fails. Executives may make decisions from stale information, customers may hear conflicting messages, regulators may receive incomplete notices, employees may use compromised communication channels, and responders may lose time answering the same questions repeatedly. The ISACA CISM perspective places communication inside […]
Organizations rarely depend only on the vendors they contract with directly. A cloud provider depends on data-center, identity, networking, software, and support suppliers. A SaaS platform may use subprocessors for hosting, analytics, support, payment processing, or AI services. Those indirect dependencies are fourth parties from the customer’s perspective. ISACA CISM places that exposure inside information-security […]
Incident management readiness is the condition in which an organization can move from an alert to coordinated action without inventing the process during the crisis. ISACA CISM treats incident management as a management capability built on authority, communications, evidence, recovery priorities, and continuous improvement—not merely as a technical response task. A response plan can look […]
A post-incident review should convert the experience of an incident into better decisions, controls, architecture, and operating behavior. In the ISACA CISM context, the review is not a retrospective storytelling exercise and it is not a search for someone to blame. It is a management mechanism for identifying why the organization produced the outcome it […]
Risk appetite and risk tolerance are related but not interchangeable. Risk appetite describes the broad amount and type of risk an organization is willing to pursue or retain in service of its objectives. Risk tolerance translates that direction into more specific boundaries, variation, or acceptable exposure. ISACA CISM expects security managers to translate that executive […]
Network and penetration testing sit on opposite sides of the same operational question: how a network is expected to behave, and what happens when someone deliberately searches for ways around those expectations. The strongest engineering practice understands both. Network teams build addressing, switching, routing, access, resilience, and observability; penetration testers challenge trust assumptions, authorization boundaries, […]
API authorization testing asks whether an identified caller can perform a particular action on a particular object, not simply whether a login succeeded. A network segment or gateway may authenticate a request while the application fails to verify that an invoice belongs to the caller’s tenant. CompTIA Network+ N10-009 provides the network segmentation and secure-service […]
Kerberos attack paths are easiest to understand by following trust relationships rather than memorizing attack names. In an Active Directory environment, Kerberos uses tickets so users and services can authenticate without sending a password to every resource. That design is strong when identities, service accounts, delegation, time, name resolution, and domain controllers are well managed, […]
NTLM relay is a credential-relay problem, not a password-cracking problem. An attacker who can influence where a Windows system authenticates may capture an NTLM authentication exchange and present it to another service that accepts the same form of authentication without sufficiently binding the exchange to the intended server or secure channel. The attacker does not […]
Human-in-the-loop design is most useful when it changes who has authority to create a consequence. In a low-risk assistant, a person may simply review generated text. In an agentic system, approval can stand between a model proposal and an action that sends money, changes access, publishes content, deletes data, contacts a customer, or modifies infrastructure. […]
A retrieval-augmented generation system can return polished prose while retrieving the wrong evidence. Good evaluation separates retrieval quality from generation quality, then measures citation support, safety, latency, and cost rather than collapsing them into one answer score. In the AWS-centered AIP-C01 objectives, RAG evaluation belongs with model/application testing and Amazon Bedrock Knowledge Bases. In Microsoft’s […]
Retrieval systems work best when they distinguish broad candidate discovery from precise final ranking. The first stage aims not to miss good evidence; the second stage spends more effort reordering eligible candidates for the actual question. In AIP-C01, Amazon Bedrock Knowledge Bases can use a reranker model during retrieval; in AI-103, Azure AI Search can […]
Model Context Protocol (MCP) makes it easier for AI clients to discover and use external tools, resources, and prompts through a shared protocol. That interoperability is valuable precisely because it reduces custom integration work. It also creates a governance question: when connecting a new server can expose new data and actions to an AI client, […]
Indirect prompt injection occurs when an AI application ingests attacker-controlled instructions through data rather than through the user’s direct message. A poisoned web page, document, email, support ticket, code comment, calendar entry, or tool response can contain text that is ordinary content to a person but looks like an instruction to a language model. Once […]
Security architecture is the discipline of turning risk decisions into durable system boundaries, identities, controls, evidence, and recovery paths. It begins before a firewall rule or cloud policy is configured. The architect first has to understand what the organization is trying to protect, which failures would materially harm the business, where trust is currently assumed, […]
