Joan Goodchild

2 months ago | darkreading.com | Joan Goodchild

These days, the word "toxic" gets thrown around a lot in many contexts, but when used to describe organizational culture, it poses an actual threat. When employees are constantly overworked, undervalued, or forced to operate in high-stress, blame-heavy environments, mistakes are inevitable. Fatigue leads to oversight, disengagement breeds carelessness, and a lack of psychological safety prevents people from speaking up about vulnerabilities or potential risks.

2 months ago | darkreading.com | Joan Goodchild

QUESTION: There are times when cybersecurity teams need to say, "No," to business stakeholders. What is the best way to go about it? Saying “Yes” in business feels good, but, unfortunately, it’s not always possible. And among security departments, saying “No” isn’t happening often enough.

Jan 23, 2025 | darkreading.com | Joan Goodchild

For years, cybersecurity was frequently (and derisively) referred to as "The Department of No." Business executives griped that in the face of innovation, cybersecurity teams would slap down ideas, list reasons why the project was insecure, and why what they wanted to do was not feasible. Then came a mindshift change. As more security leaders were tasked with demonstrating a return on investment for security budgets, security departments started finding ways to say "yes" more often.

Dec 30, 2024 | darkreading.com | Joan Goodchild

From the growing sophistication of zero-day exploits to the entrenchment of nation-state and cybercriminal alliances, 2024 delivered more evidence of how quickly the threat landscape continues to evolve. The year reinforced hard truths about the persistence of attackers and the systemic challenges of defense. We look back on some of the events that defined 2024 and the tactical insights that security teams can apply to stay ahead in the ongoing battle in 2025.

Dec 20, 2024 | darkreading.com | Joan Goodchild

Experienced security leaders know that attackers are patient. Attackers can infiltrate corporate chat systems like Slack or Microsoft Teams and just ... watch. For months, they monitor conversations, learn who the experienced staff are, and take notes on upcoming vacation plans and each team member's communication style. Then when the company shifts to a skeleton crew — perhaps during a major holiday or summer break — they strike.