Emma Zaman Strategic Advisor: Sovereign Identity & Compliance Biometric authentication is not the problem. The assumption that it can stand alone is. A fingerprint is permanent. A password can be changed. That single fact changes the entire calculus of what happens when a biometric authentication system is spoofed, compromised, or poorly implemented. This is Vol. 13 of Zero Assumptions — Pillar 3: Hardware Root of Trust. We are looking at where biometric authentication works, where the...
9 days ago • 2 min read
Emma Zaman Strategic Advisor: Sovereign Identity & Compliance Your vendor passed the audit. Their contractor didn't. And that's the door attackers walked through. Zero Assumptions · Vol. 12 of 25 · Pillar 3: Hardware Root of Trust Last week we talked about what's inside the chip. This week is about who carries it through your door. One in three security incidents doesn't start with a phishing email sent to your employees. It starts with a valid login — from a trusted third party whose...
19 days ago • 2 min read
Zero Assumptions · Week 11 of 25 · Pillar 3 begins: Hardware root of trust Your security key passed every test.So the chip inside it is trustworthy. Every control in Pillars 1 and 2 assumed a trustworthy hardware credential at the base of the identity stack. This week we examine what "trustworthy" actually means — at the chip level. The answer determines whether every other control in your architecture is standing on solid ground or shifting sand. Welcome to Pillar 3 — Hardware root of trust...
about 1 month ago • 8 min read
Zero Assumptions · Week 10 of 25 · Pillar 2 closes: Software stack & contextual risk Someone badged into your server room at 02:17.Your SOC knows about it. Your building access control system and your IT security stack are separate. The badge entry generated a log in one system. Your SOC monitors the other. The physical and logical access worlds have never shared a signal — and that gap is exactly where the most damaging insider threats and physical intrusions live. Pillar 2 closes this week...
about 1 month ago • 8 min read
Zero Assumptions · Week 9 of 25 · Pillar 2: Software stack & contextual risk Your SIEM fired an alert at 09:14.Your EDR caught the same attack at 09:24. Two tools. Same attacker. Ten minutes apart. Neither told the other. Your analyst saw two separate alerts in two separate consoles and triaged them as two separate incidents. The attacker had already moved. In weeks 6, 7, and 8 we covered the operational gaps between assessment cycles, session windows, and board oversight. This week we move...
about 2 months ago • 7 min read
Zero Assumptions · Week 8 of 25 · Pillar 2: Software stack & contextual risk Your board approved the security budget.That means they've fulfilled their NIS2 obligation. NIS2 Article 20 does not ask your board to approve a budget. It requires management bodies to oversee, be trained in, and be personally liable for your organisation's cybersecurity risk management. Most boards have done none of these things. Most CISOs have not told them. In every previous volume of this series, the assumption...
about 2 months ago • 5 min read
Zero Assumptions · Week 7 of 25 · Pillar 2: Software stack & contextual risk Your morning login was legitimate.So the session running at 17:00 must be too. Session tokens are hijacked, not phished. Once an attacker has your token, they don't need your password, your MFA, or your hardware key. They already passed authentication. The question is whether your SOC finds them before they find what they came for. Last week we covered identity drift — the entitlement state that diverges from policy...
2 months ago • 6 min read
Zero Assumptions · Week 6 of 25 · Pillar 2: Software stack & contextual risk Your annual pen test showed no critical findings.So your identity posture is under control. A penetration test is a point-in-time snapshot. Your identity risk changes daily — new users, new devices, drifting permissions, unchecked access accumulation. The gap between the snapshot and today is where most incidents begin. Welcome to Pillar 2 — Software stack & contextual risk Pillar 1 covered the adversary tactics...
3 months ago • 5 min read
Zero Assumptions · Week 5 of 25 Your cloud SSO is hardened.So your identity perimeter is secure. 92% of enterprise employees still authenticate via username and password — mostly against on-premises systems outside your cloud MFA scope. Attackers target the seam between the two environments, and it is almost never monitored. Cloud-first security programmes have driven significant investment into securing Microsoft 365, Okta, Azure AD, and the SaaS applications behind them. Conditional access...
3 months ago • 3 min read