What DORA means for your DDoS resilience (part 2)
This post is about what DORA means for your DDoS resilience. It started, as most of our posts do, with an incident that did not go the way we expected.What we changedWe…
Compliance
GDPR and request logs: what we store and why
Here is a question we could not answer well a year ago: what really happens with gDPR and request logs: what we store and why? We can answer it now.What actually happens…
NIS2 and availability: a plain-language summary
Here is a question we could not answer well a year ago: what really happens with nIS2 and availability: a plain-language summary? We can answer it now.Protecting the originNone of this matters…
GDPR and request logs: what we store and why (part 3)
Here is a question we could not answer well a year ago: what really happens with gDPR and request logs: what we store and why? We can answer it now.Observability firstEvery mitigation…
Preparing evidence for an ISO 27001 audit after an incident (part 4)
This post is about preparing evidence for an ISO 27001 audit after an incident. It started, as most of our posts do, with an incident that did not go the way we…
NIS2 and availability: a plain-language summary (part 2)
Here is a question we could not answer well a year ago: what really happens with nIS2 and availability: a plain-language summary? We can answer it now.Testing in production, safelyEvery rule starts…
GDPR and request logs: what we store and why (part 2)
gDPR and request logs: what we store and why sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.The numbersAcross the…
NIS2 and availability: a plain-language summary (part 3)
We get asked about nIS2 and availability: a plain-language summary more than almost anything else, so here is the long answer.Protecting the originNone of this matters if the attacker can reach your…
Preparing evidence for an ISO 27001 audit after an incident (part 2)
Over the last few months we have spent a lot of time on preparing evidence for an ISO 27001 audit after an incident. This is what we learned.Observability firstEvery mitigation decision is…
Preparing evidence for an ISO 27001 audit after an incident
Over the last few months we have spent a lot of time on preparing evidence for an ISO 27001 audit after an incident. This is what we learned.Latency budgetOur budget for the…
What DORA means for your DDoS resilience (part 4)
Over the last few months we have spent a lot of time on what DORA means for your DDoS resilience. This is what we learned.Lessons for your own runbookKnow who can change…
What DORA means for your DDoS resilience (part 3)
Here is a question we could not answer well a year ago: what really happens with what DORA means for your DDoS resilience? We can answer it now.Latency budgetOur budget for the…