Yemane Services LLC

The mantra of any good security engineer is: ‘Security is a not a product, but a process.’ It’s more than designing strong cryptography into a system; it’s designing the entire system such that all security measures, including cryptography, work together.

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

A breach alone is not a disaster, but mishandling it is.

What Would You Do Differently If You Knew You Were Going To Be Robbed?

Any CEO who really understands risk knows that cyber is possibly the most unpredictable risk there is. It’s more unpredictable than a flood or tornado.

If you’re not doing scans and penetration tests, then just know that someone else is and they don’t work for you.

It’s the not knowing that’s the worst…. After a breach, there are more questions than answers.

You would never dream of a CFO not coming to a board meeting. In addition, you would never see a CFO passing up using external audit or teams of external advisors. CFOs also wouldn’t be heard saying ‘Don’t worry; we’ve got a third party doing that.’ The same diligence has to be assigned to cybersecurity.

Thinking of cybersecurity solely as an IT issue is like believing that a company’s entire workforce, from the CEO down, is just one big HR issue.

With any large network, I will tell you that persistence and focus will get you in, will achieve that exploitation without the zero days. There’s so many more vectors that are easier, less risky and quite often more productive than going down that route.