More than most other engineering areas, information security is an elusive practice. Practitioners are called both geniuses and gurus, sometimes depicted as white coated lab scientists and sometimes as mavericks. Is it a science or a religion? Is it based on empirical evidence, common sense or preconditioned beliefs? Does the data even exist?
This blog attempts to discuss those and related issues by breaking out of the walls of information security, exploring comparative practices as well as relevant research fields such as cognitive psychology and philosophy of science. Some of the specific areas discussed are: risk management, incidents and vulnerabilities statistics, intellectual property, patents and the open source model and information security tools evaluation and categorization.
I submitted a talk about hacking electric cars charge stations to HackInTheBox in Amsterdam and was accepted. This is when the troubles started. Speaking in a hacker conference is a commitment. I could not just talk about the theoretical weaknesses but really needed to find some juicy stuff. 
In recent weeks I have met several companies focusing on innovating security intelligence. Those encounters brought up an interesting challenge facing such innovations: in most cases innovators have a good idea but find it too expensive to build the required infrastructure. There is no use for an icing for a cake you cannot bake after all. 
A recent thread labeled “vulnerability solution” on the SecurityFocus WebAppSec mailing list provides an insight into how much we know or care about information security. Mohamed Ali Ahmed asked about a vulnerability scanner that covers multiple use cases: applications, web applications, databases and platforms.
Great ideas are critical for innovation, however a common caveat often associated with an ideation process is the lack of systematic analysis of the idea following the initial ideation phase. As good and productive ideators are often also charismatic in selling the ideas, this critical step is often skipped. 
Two classic paradigm shifters from very different disciplines but only three years apart, offer us insight into the role that each and every one of us has in providing security. While those 60s classics focus on physical security, their lesson may apply to cyber security as well.
Within a day I read two very different and intriguing articles based on the same underlying assumption, namely, that there are problems that don’t have a solution because they are not really problems. 
