OpinionBy Ashley AdkinsPublished when there’s something worth saying
Notes from IT.
What I think, and why it matters to your business.
Longer pieces by Ashley Adkins on the habits, myths and headlines in cyber security worth a second look. Each one makes a case, then ends with what your business can do about it.
Want the short version? The news explains each story the week it happens.
01
Latest pieces
Newest first
-
Your staff aren’t the weakest link. Stop telling them they are.
Why blaming the person who clicked is wrong, where attacks really get in, and what to do instead.“If one click can sink your business, the problem was never the person who clicked.”Read the piece -
Keeping a cyber attack quiet makes the next one easier. Yours, and everyone else’s.
Why businesses stay silent after an attack, what that costs them and everyone else, and the short list of who to tell.“Attackers share what works. If the businesses they hit never do, the criminals are the only ones learning.”Read the piece -
Cyber Essentials is where security starts. Don’t let it be where yours stops.
What the certificate proves, what it was never meant to cover, and seven low-cost things to add on top.“The certificate tells you the five basics were in place on one day. Staying secure is about the other 364.”Read the piece -
Three questions about cyber every director should ask. No tech knowledge needed.
The three plain questions that tell a board most of what it needs to know, with what good and worrying answers sound like.“You don’t have to understand how the backup works. You do have to know when somebody last proved it did.”Read the piece -
You are someone else’s supply chain. Their attackers know it.
Why attackers go through smaller suppliers to reach bigger customers, and seven ways to make sure the route isn’t you.“An attacker may have no interest in your business at all. They’re interested in who trusts you.”Read the piece -
“It still works” is the most expensive sentence in IT.
Why working and safe are different things, what Windows 10’s end of support means, and a six-step plan for ageing kit.“Nobody budgets for the server in the cupboard until the day it becomes the most expensive thing the business owns.”Read the piece -
Banning AI at work just hides it. Give your team three rules instead.
Why an AI ban only changes what people admit to, where the real risks are, and a three-rule policy that fits on one page.“A ban doesn’t stop people using AI. It stops them telling you.”Read the piece -
AI found the bug. Volunteers had to fix it.
What PHP2Shell tells us about AI, the people who keep the web running, and five ways to be ready for the next one.“Finding a bug now costs a few prompts. Fixing it still costs a person’s evening.”Read the piece -
Stop scaring people into security. Fear makes them freeze.
Why scare tactics make owners freeze and staff hide mistakes, what the research says, and six things that work better.“Scare someone without showing them what to do and you haven’t made them safer. You’ve made them stop listening.”Read the piece -
Cyber insurance pays out on the answers you gave. Make sure they’re true.
Why the proposal form is the most important security document many businesses sign, and six checks to make before the next renewal.“The proposal form is the most important security document many businesses ever sign, and it’s usually filled in by someone guessing.”Read the piece -
Your IT contract probably doesn’t say who looks after security. Ask before you need to know.
Why “our IT company does that” is rarely written down anywhere, and the seven questions to ask your provider this month.“You can hand over the work. You can’t hand over the responsibility, and the law, your customers and your insurer all agree on that.”Read the piece -
If the boss can’t follow the security advice, the advice is the problem.
Why security jargon leads to bad decisions and unasked questions, with a plain English translation of the terms you’ll hear most.“If the person who signs it off couldn’t explain it to someone else, the business hasn’t made a decision. It has made a guess.”Read the piece
02
Where I stand
In my own words
If your whole defence depends on a busy person never making a mistake, the weak part is the design.
- 02
I would much rather a team reported ten false alarms a week than had a perfect phishing test score and a habit of saying nothing.
From “Your staff aren’t the weakest link” - 03
If you’re the owner or the director, you set what gets time and money. Your team can only be as careful as the setup you give them allows.
From “Your staff aren’t the weakest link” - 04
Finding a bug now costs a few prompts. Fixing it still costs a person’s evening.
From “AI found the bug. Volunteers had to fix it.”
Every line is lifted straight from a piece I’ve published. Read the full argument, then tell me where I’m wrong.
03
Who’s writing
Cyber security specialist
Ashley Adkins
I’ve worked in IT for over 20 years, with security at the centre of it. I run fromIT, where I help businesses across the UK deal with cyber incidents and get certified to Cyber Essentials and ISO 27001.
These pieces are my own view, built on what turns up in real incidents and audits. More about me.
- 20+ yearsworking in IT, with security at the centre
- ISO 27001certified implementation practitioner
- Defence and governmentworked in UK defence, presented to government audiences
Follow on LinkedInFollow on BlueskyGet fromIT Monthly
Writing a story or planning an event? I’m happy to give a comment or a talk. Email ashley@fromit.co.uk.
Got a view on any of this?
Happy to talk it through, agree or not.