The board appointment comes as the security expert supporting the chief executive, because around that table a voice with nothing to sell is almost always missing. Responsibility for information security now falls personally on the leadership: it is no longer reputation or money alone.
Before a transaction, somebody has to establish whether a technology company can genuinely do what it claims, and whether what it claims holds together. It is an examination of the documents and of the people, and it ends in a short document handed to the investment committee.
Living under scrutiny creates a problem walls do not solve. A photograph forwarded for convenience, images from a set in the wrong chat: an attack is rarely needed. What is needed is protection no commercial product provides, and someone reachable when something happens.
I am a co-founder and technical director of CyberGrant, and the patents in the record are mine: on technical direction I am not impartial, and I say so. On the vendor I am: when I advise, my own technology is not among the options.
Valerio Pastore
Do you know the one thing almost nobody can do?Keep a secret.
The best work is the work nobody ever heard about. These cases are real and told without the details that would identify anyone — which also means a reader cannot verify them, and it is fair to say so before reading.
Personal images, years old, had reappeared across dozens of sites copying from one another. No attack: they were simply there. Every time one came down, three more appeared elsewhere. It took patience, the right tools and careful coordination to secure removals, contain the spread and starve the material of oxygen until it stopped circulating.
A pirate site was publishing tracks stolen somewhere along the production chain, online before the official release, with enormous damage to people who had worked on them for months. The work was to find where the material was leaving, stop the spread and close the tap.
A wave that appeared to have a life of its own and showed no sign of stopping. Here the job is not to build barriers: it is to understand how the machinery works, put out the individual fires, and give the person back some control over something that detonated around them.
The same subject can also be taught. Two programmes for people who hold information that is not their own: a restricted one, by application, and a two-day seminar for a whole department or a whole organisation.
The two programmes