Articles by 'Steve Gold'

By Steve Gold, Posted in Security

In Stranger Things, the Upside Down exists right alongside the real world. It is connected to everything, it influences everything, and for years nobody knew it was there. The danger was not some distant external threat. It was underneath Hawkins the entire time, finding its way in through cracks nobody thought to check. Third-party software components you have not inventoried work exactly the same way: hidden dependencies running under the surface of your applications, quietly doing their job until one day... read more.

• November 10, 2026

By Steve Gold, Posted in Security

In the Fallout series on Prime Video, nothing in the wasteland is random. Every mutant, every ruined city, every ideological conflict traces back to decisions made by Vault-Tec executives and government officials decades before the bombs fell. The show is not really about survival. It is an archaeology of consequence, and a long, unbroken chain connecting a bad decision to a catastrophic outcome. Root cause analysis in software security works the same way. A vulnerability is never just a vulnerability. It i... read more.

• November 03, 2026

By Steve Gold, Posted in Security

Watch one episode of The Bear and you will notice something. The best kitchens do not just run on skill. They run on a culture where anyone can call out a problem, and that problem gets addressed instead of buried. Chef Carmen Berzatto does not want a kitchen where bad news hides. He wants a kitchen where bad news gets surfaced fast, because surfacing it is how you fix it. If your organization has no structured way to receive and act on software vulnerability reports, you are running the equivalent of a ki... read more.

• October 27, 2026

By Steve Gold, Posted in Security

Watch Andor on Disney+ and pay close attention to how Luthen Rael runs the Rebellion. He does not wing it. Every cell has defined procedures, defined limits, and defined checks. Security is not something he layers on after the operation is planned. It is built into how every mission runs from the first conversation. Your software development process should work exactly the same way. What Is Establish and Maintain a Secure Application Development Process? It means security is part of how you build software... read more.

• October 20, 2026

By Steve Gold, Posted in Security

In John Wick: Chapter 4 (2023), the High Table does not operate on goodwill. Every obligation is written, formalized, and binding. The marker system works because the terms are explicit and non-negotiable. Nobody at the High Table closes a deal with a handshake and a smile, because a vague agreement in that world gets you killed. Your vendor contracts work the same way: if security requirements are not in writing, they do not exist. What Is Ensure Service Provider Contracts Include Security Requirements? ... read more.

• October 13, 2026

By Steve Gold, Posted in Security

In Dune: Part Two, Paul Atreides does not treat every alliance the same way. The Fremen are strategic partners with deep access to his plans and survival. The Spacing Guild controls critical infrastructure that nothing in the known universe moves without. House Corrino is a threat dressed up as diplomacy. Paul classifies each relationship by what it controls and what risk it carries, because treating them equally would get him killed. Your vendor ecosystem works exactly the same way. What Is Classify Servi... read more.

• October 06, 2026

By Steve Gold, Posted in Security

In Netflix's The Diplomat (2023), Ambassador Kate Wyler does not wing her relationships with foreign governments. She operates inside a framework of protocols, obligations, and documented agreements. When a crisis hits, she knows exactly what her options are and what the rules of engagement require. Without that framework, every new incident becomes a scramble. Your vendor relationships work the same way. When something goes sideways with a service provider, a documented policy tells you exactly what to do... read more.

• September 29, 2026

By Steve Gold, Posted in Security

You’re running late for an appointment. No coffee, no breakfast, the outfit is not, exactly, what you were hoping for.  You need to make up time, so you start looking for it wherever you can find it. You approach an intersection with a stop sign, glance both ways, and roll right through without fully stopping. Congratulations. You are now a GRC expert. You knew the rule. You know how to be compliant. You made a calculated decision to accept the risk anyway because the odds felt good and the pay... read more.

• September 22, 2026

By Steve Gold, Posted in Security

In The Bear, every station in the kitchen has a different job, a different set of skills, and a completely different set of things that can go wrong. You do not train the pastry chef the same way you train the expeditor. You do not pull the sous chef aside to explain how to plate a salad. Everyone needs to know the basics, but the role-specific skills are what keep the kitchen from catching fire. Your security training program works the same way. What Is Conduct Role-Specific Security Awareness and Skills... read more.

• September 15, 2026

By Steve Gold, Posted in Security

In Succession, every power move and every backstab eventually came back to one question: what's on the record? When things went sideways for the Roys, the only way to reconstruct the truth was to go back to the tape. Someone, somewhere, had kept a log of what happened. CIS Safeguard 13.6 is your network's version of that tape. What Is CIS Safeguard 13.6? Network traffic flow logs are records of every connection that crosses your network. Source IP, destination IP, port, protocol, bytes transferred, timest... read more.

• September 08, 2026