https://securitynotes.co.ukIndependent commentary by Chun Wonghttps://securitynotes.co.uk/articles/does-your-business-actually-need-a-full-time-ciso/https://securitynotes.co.uk/articles/does-your-business-actually-need-a-full-time-ciso/It's a question I suspect more organisations should be asking, preferably before advertising the vacancy.Thu, 22 Oct 2026 00:00:00 +0000https://securitynotes.co.uk/articles/cross-border-data-the-transfer-mechanism-is-only-the-beginning/https://securitynotes.co.uk/articles/cross-border-data-the-transfer-mechanism-is-only-the-beginning/The problem doesn't end at the contract boundaryMon, 19 Oct 2026 00:00:00 +0000https://securitynotes.co.uk/articles/privacy-is-where-law-governance-and-architecture-collide/https://securitynotes.co.uk/articles/privacy-is-where-law-governance-and-architecture-collide/Privacy is often treated as a Legal or compliance problem. Understandable, given the legislation, contractual obligations and potential penalties involved. But having worked across information security,…Fri, 16 Oct 2026 09:36:00 +0000https://securitynotes.co.uk/articles/the-real-success-of-a-transformation-programme-starts-after-it-ends/https://securitynotes.co.uk/articles/the-real-success-of-a-transformation-programme-starts-after-it-ends/Transformation programmes tend to have very visible beginnings and endings. That is inherent in the idea of a programme. There is a business case, a sponsor, a programme team, consultants, workshops, steering…Wed, 30 Sep 2026 07:19:00 +0000https://securitynotes.co.uk/articles/the-eu-ai-act-stop-reading-it-as-only-a-legal-document/https://securitynotes.co.uk/articles/the-eu-ai-act-stop-reading-it-as-only-a-legal-document/The EU AI Act is obviously a legal document. Lawyers should read it as one. The problem starts when everybody else does too. We have been here before. When GDPR arrived, an enormous amount of organisational…Tue, 22 Sep 2026 06:02:00 +0000https://securitynotes.co.uk/articles/security-pragmatism-accepting-risk/https://securitynotes.co.uk/articles/security-pragmatism-accepting-risk/Security people are trained to find problems. It is, after all, their raison d'être. Good security leaders also need to know when not to fix them. That may sound counter-intuitive. If there is a security risk,…Tue, 15 Sep 2026 06:00:00 +0000https://securitynotes.co.uk/articles/payment-risks-have-changed-the-security-fundamentals-haven-t/https://securitynotes.co.uk/articles/payment-risks-have-changed-the-security-fundamentals-haven-t/I’ve been around payments for more than two decades, since Cybersource days. Long enough to remember when internet payments themselves felt new, payment gateways were interesting pieces of technology, and…Tue, 08 Sep 2026 06:01:00 +0000https://securitynotes.co.uk/articles/the-modern-ciso-s-role-in-ai-governance-where-to-lead-enable-and-challenge/https://securitynotes.co.uk/articles/the-modern-ciso-s-role-in-ai-governance-where-to-lead-enable-and-challenge/The Core Point In the first six articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler, operational resilience, the operating…Tue, 01 Sep 2026 06:00:00 +0000https://securitynotes.co.uk/articles/when-ai-acts-on-your-behalf-who-is-in-control/https://securitynotes.co.uk/articles/when-ai-acts-on-your-behalf-who-is-in-control/Governing Agentic Systems in Practice The Core Point In the first six articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler,…Wed, 26 Aug 2026 06:00:00 +0000https://securitynotes.co.uk/articles/ai-governance-assurance-how-do-you-know-it-is-working/https://securitynotes.co.uk/articles/ai-governance-assurance-how-do-you-know-it-is-working/The Core Point In the first five articles in this series, I examined AI governance as a board-level issue, consequence-led risk tiering, security as a commercial enabler, operational resilience and the…Tue, 18 Aug 2026 06:00:00 +0000https://securitynotes.co.uk/articles/ai-governance-in-practice-why-policies-fail-and-what-works-instead/https://securitynotes.co.uk/articles/ai-governance-in-practice-why-policies-fail-and-what-works-instead/The Core Point In the first four articles in this series, I examined AI governance as a board-level imperative, consequence-led risk tiering, security as a commercial enabler and operational resilience when…Tue, 11 Aug 2026 07:02:00 +0000https://securitynotes.co.uk/articles/ai-and-operational-resilience-what-happens-when-the-model-fails-4-of-6/https://securitynotes.co.uk/articles/ai-and-operational-resilience-what-happens-when-the-model-fails-4-of-6/The Core Point In the first three articles in this series, I considered why AI governance has become a board-level issue, why risk should be assessed by consequence rather than technology and how security can…Tue, 04 Aug 2026 07:02:00 +0000https://securitynotes.co.uk/articles/security-as-a-commercial-enabler-turning-trust-into-business-value-3-of-6/https://securitynotes.co.uk/articles/security-as-a-commercial-enabler-turning-trust-into-business-value-3-of-6/In the first article in this series, I argued that AI governance is becoming a board-level security issue. In the second, I proposed starting with the consequence of an AI use case rather than the model or…Thu, 23 Jul 2026 08:45:00 +0000https://securitynotes.co.uk/articles/ai-governance-in-practice-start-with-the-consequence-not-the-technology-part-2-of-6/https://securitynotes.co.uk/articles/ai-governance-in-practice-start-with-the-consequence-not-the-technology-part-2-of-6/In the first article in this series, AI Governance: The Board-Level Security Imperative , I argued that AI governance is no longer simply a technology, legal or policy issue. It is now a board-level concern…Fri, 17 Jul 2026 12:52:00 +0000https://securitynotes.co.uk/articles/ai-governance-the-board-level-security-imperative-1-of-6/https://securitynotes.co.uk/articles/ai-governance-the-board-level-security-imperative-1-of-6/Executive Summary AI governance is evolving into a board-level security issue because AI now influences data use, decision-making, operational resilience, regulatory exposure and client trust. The fundamental…Tue, 14 Jul 2026 09:04:00 +0000https://securitynotes.co.uk/articles/the-hidden-difficulty-of-using-ai-platforms-in-business/https://securitynotes.co.uk/articles/the-hidden-difficulty-of-using-ai-platforms-in-business/AI tools are becoming increasingly useful for security, risk, governance, policy drafting, document review and general business productivity. A significant part of my work is in GRC. That has been the centre…Mon, 08 Jun 2026 07:00:00 +0000https://securitynotes.co.uk/articles/obsolete-by-design-right-to-keep-things-working/https://securitynotes.co.uk/articles/obsolete-by-design-right-to-keep-things-working/Right to Repair is often framed around physical repair: batteries, screens, components, spare parts, tools and manuals. That is still important. But I think the bigger issue is now wider than repair. It is…Sat, 06 Jun 2026 14:23:00 +0000https://securitynotes.co.uk/articles/post-brexit-gdpr-and-uk-data-protection/https://securitynotes.co.uk/articles/post-brexit-gdpr-and-uk-data-protection/Brexit and Data Transfers Updated 28th Jun 2021 European Commission (EC) has granted the UK Data Protection Act (2018) adequacy with GDPR (2016) with a clause to revoke this if the EC decides that the UK does…Tue, 05 Jan 2021 17:09:00 +0000https://securitynotes.co.uk/articles/what-s-on-your-infosec-and-data-privacy-related-bookshelf/https://securitynotes.co.uk/articles/what-s-on-your-infosec-and-data-privacy-related-bookshelf/We all read books, articles, white papers and posts. From "ABC" to "Zen and the Art of Motorcycle Maintenance". I've picked three to kickstart this. I'll start off with an old time favourite of mine, "The…Tue, 09 Jun 2020 09:47:00 +0000https://securitynotes.co.uk/articles/uk-plans-for-contact-tracing-app-civil-liberties/https://securitynotes.co.uk/articles/uk-plans-for-contact-tracing-app-civil-liberties/Part 3 in a series Dedicated Data privacy and COVID-19 posts and articles Part 2 -Apps providing COVID-19 diagnosis from your voice - Privacy and ethical concerns. -…Sun, 12 Apr 2020 17:53:00 +0000https://securitynotes.co.uk/articles/privacy-ethics-and-covid-19/https://securitynotes.co.uk/articles/privacy-ethics-and-covid-19/Part 2 - Explores two applications developed to help track COVID-19 Part 1 - Is a high-level, nation approach to COVID-19 Test, Track and Trace efforts I update my articles as more information comes to light…Wed, 08 Apr 2020 14:30:00 +0000https://securitynotes.co.uk/articles/data-protection-and-the-use-of-personal-data-during-the-covid-19-pandemic/https://securitynotes.co.uk/articles/data-protection-and-the-use-of-personal-data-during-the-covid-19-pandemic/The Corona Virus I doubt it has escaped any ones' attention that we're in the middle of a health and economic emergency. Many people have succumbed to viral pneumonia since November 2019 and has become a…Wed, 01 Apr 2020 23:37:00 +0000https://securitynotes.co.uk/articles/pretty-face-ruse-clickbait/https://securitynotes.co.uk/articles/pretty-face-ruse-clickbait/I've decided to expand on the Scamology article I wrote a few days ago, with more in-depth and real, live examples. Clickbait - what is it? Clickbait, usually a combination of a photograph and an extreme,…Mon, 17 Feb 2020 16:00:00 +0000https://securitynotes.co.uk/articles/scamology/https://securitynotes.co.uk/articles/scamology/Time for an update on the various techniques which ensnare the unwary and a few that even seasoned professionals may be unsure of. If you haven't read my previous musings on this subject, do take a look at…Thu, 13 Feb 2020 22:09:00 +0000https://securitynotes.co.uk/articles/data-the-new-oil-cleaning-up-the-mess/https://securitynotes.co.uk/articles/data-the-new-oil-cleaning-up-the-mess/Cleaning up the mess Some have said “Data is the new oil”. The analogy does work for certain aspects and characteristics, namely it is valuable and creates a huge mess when you have a leak (data breach). Oil…Tue, 03 Sep 2019 10:38:00 +0000https://securitynotes.co.uk/articles/you-ve-been-stuffed-password-redux-credential-stuffing-account-takeovers/https://securitynotes.co.uk/articles/you-ve-been-stuffed-password-redux-credential-stuffing-account-takeovers/Evolution I wrote a piece on passwords more than 3 years ago and it generated many comments from industry players. I’ve also written articles on data breaches regularly. This time round I've combined the two.…Wed, 31 Jul 2019 10:04:00 +0000https://securitynotes.co.uk/articles/stealing-your-house-diverting-your-money/https://securitynotes.co.uk/articles/stealing-your-house-diverting-your-money/Authorised Push Payment fraud Authorised Push Payment fraud - convincing you to authorise a bank transfer to scammers. It's a form of social engineering and can be devastating to the victim. According to…Sun, 21 Jul 2019 20:49:00 +0000https://securitynotes.co.uk/articles/gdpr-one-year-on-and-the-big-fines-have-started/https://securitynotes.co.uk/articles/gdpr-one-year-on-and-the-big-fines-have-started/25th May 2018 has passed, the F.U.D. (Fear, Uncertainty and Doubt) pedalled by consultancies, software companies and (some) certified data protection experts has mainly dissipated into the ether. For some, it…Wed, 10 Jul 2019 00:55:00 +0000https://securitynotes.co.uk/articles/how-to-steal-172m-usd-or-more-invoice-scams/https://securitynotes.co.uk/articles/how-to-steal-172m-usd-or-more-invoice-scams/Invoice Scams – Business Email Compromise For two years, between 2013 and 2015 Evaldas Rimasauskas, sent out a slew of invoices to Google and Facebook with which he managed to extract 172M USD. He did get…Sat, 06 Jul 2019 21:37:00 +0000https://securitynotes.co.uk/articles/how-to-ruin-the-reputation-of-your-118-year-old-company-lose-your-job-and-your-liberty/https://securitynotes.co.uk/articles/how-to-ruin-the-reputation-of-your-118-year-old-company-lose-your-job-and-your-liberty/Unfortunately there are so many cases I can use to illustrate this. Most topical at this time at the start of autumn (fall) 2017 is Equifax. They provide credit scoring services to the public and businesses in…Thu, 04 Jul 2019 19:44:34 +0000https://securitynotes.co.uk/articles/gdpr-how-do-we-go-about-it/https://securitynotes.co.uk/articles/gdpr-how-do-we-go-about-it/Think I'm on a roll, this is my 5th GDPR themed post. Here's a more practical article that'll help you towards alignment with GDPR. Content for this web log. Essentials for success. Information Security…Sun, 08 Oct 2017 22:19:49 +0000https://securitynotes.co.uk/articles/the-value-of-patching-the-cost-of-not-patching/https://securitynotes.co.uk/articles/the-value-of-patching-the-cost-of-not-patching/(One) Major cause of data breaches Over 50% of data breaches are due to published exploits where fixes or patches are available. The actual percentage varies to which study you refer to. The vulnerabilities…Tue, 03 Oct 2017 22:42:16 +0000https://securitynotes.co.uk/articles/do-you-know-what-you-have-do-you-know-what-you-doing/https://securitynotes.co.uk/articles/do-you-know-what-you-have-do-you-know-what-you-doing/My 4th GDPR themed article. It's designed to encourage debate and discussion, hopefully help you on the journey to GDPR compliance Do you know what you have ? Do you know what you doing with it ? Two very…Wed, 05 Jul 2017 23:52:44 +0000https://securitynotes.co.uk/articles/effective-cyber-security-for-the-work-place-and-home/https://securitynotes.co.uk/articles/effective-cyber-security-for-the-work-place-and-home/I have summarised a few tips that'll help you along that route. It isn't set and forget, it's a continual process. Business Essentials for successful Cyber Defence Simple to say ... Top-level commitment to…Wed, 05 Jul 2017 10:55:35 +0000https://securitynotes.co.uk/articles/massive-attack/https://securitynotes.co.uk/articles/massive-attack/There have been very public examples of cyber attacks, affecting organisations on a global scale. Despite prominence given to recent outbreaks, such as Wannacry in May 2017 and NotPetya in June 2017, the first…Fri, 30 Jun 2017 13:41:54 +0000https://securitynotes.co.uk/articles/uk-gdpr-flies-in-the-ointment-and-devils-in-the-detail/https://securitynotes.co.uk/articles/uk-gdpr-flies-in-the-ointment-and-devils-in-the-detail/This is the third article on GDPR, the first dealt with Brexit and GDPR, the second confirmation that UK will be implementing stronger Data Protection. Complications There may be some "gotchas", possible…Wed, 28 Jun 2017 21:16:38 +0000https://securitynotes.co.uk/articles/the-queen-s-speech-gdpr-post-brexit/https://securitynotes.co.uk/articles/the-queen-s-speech-gdpr-post-brexit/Following on from my initial article on GDPR and Brexit in September last year, there is no doubt that the UK will continue with strong data protection laws when the UK leaves the European Union (Brexit), this…Sun, 25 Jun 2017 22:47:33 +0000https://securitynotes.co.uk/articles/a-for-availability-bcp-and-dr-failures/https://securitynotes.co.uk/articles/a-for-availability-bcp-and-dr-failures/DR/ BCP effectiveness A look into the A part of C I A. Namely A for Availability. Often overlooked and not always tested with rigour. Closely coupled with Change management, Resource management and long term…Thu, 01 Jun 2017 22:41:25 +0000https://securitynotes.co.uk/articles/gdpr-nothing-to-do-with-us-uk-is-leaving-the-european-union-so-we-don-t-need-to-do-anything/https://securitynotes.co.uk/articles/gdpr-nothing-to-do-with-us-uk-is-leaving-the-european-union-so-we-don-t-need-to-do-anything/(GDPR - General Data Protection Regulations 2016) Bit of history to put things into perspective, in 1950, the Council of Europe created an international treaty to protect human rights and fundamental freedoms…Tue, 13 Sep 2016 10:49:02 +0000https://securitynotes.co.uk/articles/passwords-not-fit-for-purpose-misused-and-ugly/https://securitynotes.co.uk/articles/passwords-not-fit-for-purpose-misused-and-ugly/It’s a perennial subject, but one worth reiterating, as old habits die hard. “Popular Passwords”, from the numerous loss and publication of unencrypted password lists, a league table has been created. The data…Fri, 15 Jan 2016 15:58:38 +0000https://securitynotes.co.uk/articles/another-day-another-data-breach-opm-us-government-s-office-of-personnel-management/https://securitynotes.co.uk/articles/another-day-another-data-breach-opm-us-government-s-office-of-personnel-management/I'm sure you've seen this one in the news already. I have resisted commenting immediately, so that we can all take a step back and avoid knee-jerk, reactive comments. 21.5m USA federal employees and associates…Tue, 14 Jul 2015 11:56:11 +0000https://securitynotes.co.uk/articles/comments-disabled/https://securitynotes.co.uk/articles/comments-disabled/I've disabled comments as I've been getting too many unwanted messages. Do please contact me via LinkedIn…Sat, 30 May 2015 09:31:51 +0000https://securitynotes.co.uk/articles/ponemon-institute-2015-cost-of-data-breach-study-united-states/https://securitynotes.co.uk/articles/ponemon-institute-2015-cost-of-data-breach-study-united-states/US study at a glance $6.5 million is the average total cost of data breach 11% increase in total cost of data breach $217 is the average cost per lost or stolen record 8% increase in cost per lost or stolen…Fri, 29 May 2015 17:47:21 +0000https://securitynotes.co.uk/articles/uk-healthcare-sector-accounted-for-40-of-data-breaches/https://securitynotes.co.uk/articles/uk-healthcare-sector-accounted-for-40-of-data-breaches/2014 Q4 figures released by the ICO (Information Commissioner’s Office) reveals that of the data breaches reported to them, over 40% originated from the healthcare sector. Local government and education are a…Fri, 29 May 2015 16:56:54 +0000https://securitynotes.co.uk/articles/world-leader-s-pi-leaked/https://securitynotes.co.uk/articles/world-leader-s-pi-leaked/The personal details of all 31 leaders at the recent G20 summit in Australia have been accidentally leaked by the Australian immigration department. Despite being notified of the high-profile breach four…Mon, 30 Mar 2015 21:53:11 +0000https://securitynotes.co.uk/articles/2014-the-year-of-1-billion-data-record-losses/https://securitynotes.co.uk/articles/2014-the-year-of-1-billion-data-record-losses/Gemalto the digital security services company and Safenet have released a report titled "2014 - Year of Mega Breaches & Identity Theft" [caption id="" align="alignnone" width="1500"] 2014 Data Breaches Gemalto…Fri, 06 Mar 2015 23:47:08 +0000https://securitynotes.co.uk/articles/data-loss-visualisation/https://securitynotes.co.uk/articles/data-loss-visualisation/Came across a very useful tool for visualising data loss incidents (at least the ones we know about...). The figure above links to the original site. Well worth a…Wed, 18 Feb 2015 23:08:30 +0000https://securitynotes.co.uk/articles/significant-data-theft-from-anthem-one-of-usa-largest-health-insurers/https://securitynotes.co.uk/articles/significant-data-theft-from-anthem-one-of-usa-largest-health-insurers/Anthem, the US's second biggest health insurer with about 70 million people on its books across the country, admitted late on 4th February 2015, that it was the target of an external cyber attack. These…Mon, 09 Feb 2015 23:49:28 +0000https://securitynotes.co.uk/articles/first-post-of-2015-insider-threat-data-theft-from-350000-morgan-stanley-s-clients/https://securitynotes.co.uk/articles/first-post-of-2015-insider-threat-data-theft-from-350000-morgan-stanley-s-clients/A Morgan Stanley employee, Galen Marsh stole sensitive information from 350000 wealth management clients in December 2014, of which 900 client's data was posted on Pastebin, an internet expose site with a link…Wed, 07 Jan 2015 00:20:23 +0000https://securitynotes.co.uk/articles/my-predictions-for-security-breaches-data-loss-in-2015-and-beyond/https://securitynotes.co.uk/articles/my-predictions-for-security-breaches-data-loss-in-2015-and-beyond/Top of the list is existing vulnerabilities; the ones that have been published, the ones with patches issued 6 months ago. Coming joint first will be ingress aided by social engineering, the "click here for…Thu, 11 Dec 2014 00:32:35 +0000https://securitynotes.co.uk/articles/sony/https://securitynotes.co.uk/articles/sony/Sony has been on the spotlight recently, all for the wrong reasons. In April 2011, Sony's Playstation Network was taken offline by a massive DDOS attack for 23 days. During this time Anonymous stole the…Wed, 10 Dec 2014 23:51:11 +0000https://securitynotes.co.uk/articles/target/https://securitynotes.co.uk/articles/target/Target data loss woes Even though the hack occurred in 2013, it wasn't till the next year that the full extent and the ramifications were known to the wider public. So far the figures are, the CIO and CEO,…Wed, 10 Dec 2014 17:30:36 +0000https://securitynotes.co.uk/articles/solarwinds-last-week-mimecast-this-week-who-to-trust/https://securitynotes.co.uk/articles/solarwinds-last-week-mimecast-this-week-who-to-trust/Solarwinds , a network and security tools supplier announced in mid-December 2020 that their Orion software tools was compromised by malware and made into a trojan. The original breach has been confirmed by…https://securitynotes.co.uk/articles/brexit-what-happens-to-financial-services/https://securitynotes.co.uk/articles/brexit-what-happens-to-financial-services/The EU-UK Trade and Cooperation Agreement (TCA 2020) concluded between the EU and the UK on December 24th 2020 sets out preferential arrangements in areas such as trade in goods and services. UK becomes a…