Principles of Evidence-Based Cybersecurity Management

Panel framing

AttackIQ director Keith Wilson hosts CSOs Vicente Canal of Lottoland and Chris Frantz of Mount Sinai South Nassau at Purple Hats to define evidence-based cybersecurity management as an alternative to traditional, checklist-driven practice.

Core philosophy

Canal wants fewer severe incidents and fewer but better frameworks, arguing incidents should reflect misapplied proven methods rather than ad hoc art. Frantz says security must become measurable science: define success criteria before testing controls, validate efficacy, and move beyond compliance theater such as owning a firewall without proper egress and DNS policies.

Testing accepted risk

Using NIST password guidance as an example, they note empirical review overturned periodic rotation. Frantz shares a 2015 hospital breach-and-attack simulation copying an EICAR test string department-wide: segmentation worked yet losing an entire department would still be catastrophic, revealing accepted risk was finer-grained zero trust than compliance alone showed.