More Dr. Ann Cavoukian: GDPR and Access Control


We continue our discussion with Dr. Ann Cavoukian. She is currently Executive Director of Ryerson University’s Privacy and Big Data Institute and is best known for her leadership in the development of Privacy by Design (PbD). In this segment, Cavoukian tells us that once you’ve involved your customers in the decision making process, “You won’t believe the buy-in […]

Continue Reading →

Pen Testing Active Directory, V: Admins and Graphs


If you’ve survived my last blog post, you know that Active Directory group structures can be used as powerful weapons by hackers. Our job as pen testers is to borrow these same techniques — in the form of PowerView — that hackers have known about for years, and then show management where the vulnerabilities live […]

Continue Reading →



Next month, the world will be talking security at the annual RSA Conference, which will be held in San Francisco on February 13th to the 17th. When it comes to discussing security matters, experts often tell us to take stock of our risks or to complete a risk assessment. However, perhaps before understanding where we […]

Continue Reading →

How to setup a SPF record to prevent spam and spear phishing


Some things go together like peanut butter and jelly: delicious, delightful and a good alternative to my dad’s “Thai-Italian Fusion” dinner experiments as a kid. When other things are combined it can be terrifying: like SPF records and spear-phishing. While the nuances of something seemingly mundane as SPF DNS records can seem like a dry […]

Continue Reading →

EU GDPR Spotlight: Do You Have to Hire a DPO?


I suspect right about now that EU (and US) companies affected by the General Data Protection Regulation (GDPR) are starting to look more closely at their compliance project schedules. With enforcement set to begin in May 2018, the GDPR-era will shortly be upon us. One of the many questions that have not been full answered […]

Continue Reading →

Dr. Ann Cavoukian on Privacy By Design


I recently had the chance to speak with former Ontario Information and Privacy Commissioner Dr. Ann Cavoukian about big data and privacy. Dr. Cavoukian is currently Executive Director of Ryerson University’s Privacy and Big Data Institute and is best known for her leadership in the development of Privacy by Design (PbD). What’s more, she came up with PbD […]

Continue Reading →

Pen Testing Active Directory Environments, Part IV: Graph Fun


If we haven’t already learned from playing six degrees of Kevin Bacon, then certainly Facebook and Linkedin have taught us we’re all connected. Many of the same ideas of connectedness also play out in Active Directory environments. In this post, we’ll start out where we left off last time in thinking about the big picture […]

Continue Reading →

What We Learned From Talking to Data Security Experts


Since we’ve been working on the blog, Cindy and I have chatted with security professionals across many different areas — pen testers, attorneys, CDOs, privacy advocates, computer scientists, and even a guru. With 2016 coming to an end and the state of security looking more unsettled than ever, we decided it was a good time […]

Continue Reading →

Fireside Chat with the Future


Over the past few weeks, we started seeing a few new security trends that we think haven’t yet had their defining moment and will likely see more of next year. And so we reflected on the predictions we made last year and shared our annual cybersecurity predictions for 2017. Meanwhile the Inside Out Security Show […]

Continue Reading →

I’m Alan Cizenski, Corporate Systems Engineer at Varonis, and This is How I Work


Alan Cizenski is a Corporate Systems Engineer at Varonis. Based in our New York City office, he is responsible for making sure Varonis solutions work smoothly for our prospective customers. Alan helps them realize the value we can provide within their environment and maintain these relationships as they become customers. He’s also a regular panelist […]

Continue Reading →

Ransomware: Legal Cheat Sheet for Breach Notification


You respond to a ransomware attack in many of the same ways you would to any other cyber attack. In short: have plans in place to analyze the malware, contain the damage, restore operations if need be, and notify any regulatory or enforcement authorities. And your legal, IT, and communications team should be working together […]

Continue Reading →