Blog on Rishipal Yadav · not your CISO

The Audit Room Has Two Stories And Neither Is the Full Truth

Thu, 24 Apr 2025 00:00:00 +0000

Every audit room has two stories playing simultaneously. The auditor walks in with a checklist, a mandate, and the quiet authority of an independent assessor. The auditee walks in with months of prep, a defensive posture, and the knowledge that something will be found — the only question is what.

The problem is neither side is telling their story particularly well. And that communication gap is where audits go from being useful to being theatre.

Security Awareness Training: A Design Thinking Project

Sat, 27 Apr 2024 00:00:00 +0000

During the last semester (Spring 2024) of my Master of Engineering in Cybersecurity at the University of Maryland, College Park, I joined the Innovation Fellowship cohort at the Academy for Innovation and Entrepreneurship. The project: apply design thinking to security awareness training.

Security awareness training has a reputation problem. Compliance teams love it. Employees hate it. And the data on whether it actually changes behaviour is, at best, mixed. The question I started with was: what would security awareness training look like if you designed it the way a product designer would — starting with the user, not the policy?

LinkedIn OSINT for a Quick Background Check: A Guide for HR

Thu, 27 Apr 2023 00:00:00 +0000

Most organisations run background checks before someone joins. But the standard checks - employment verification, criminal records — often miss what’s hiding in plain sight on LinkedIn. Open source intelligence (OSINT) techniques, applied to a public professional profile, can surface inconsistencies, red flags, and gaps that formal checks don’t catch.

This guide is for HR professionals and hiring managers who want to use LinkedIn more systematically as part of due diligence — without crossing into surveillance.

ChatGPT Policy for Your Organisation: The CISO's Concern

Sun, 09 Apr 2023 00:00:00 +0000

ChatGPT has been a buzzword for some time now. Be it a new product built on top of it or another capability announcement, just when you think the hype has peaked, something new drops. And through all of it, security teams have been quietly scrambling to figure out what their policy actually is.

This is not a technical breakdown of how large language models work. This is a practitioner’s take on the questions a CISO — or anyone responsible for security — needs to answer before their organisation gets too comfortable with ChatGPT in the workflow.

You Must Remove Text Message Two-Factor Authentication

Sat, 18 Feb 2023 00:00:00 +0000

Last night, just before I went to sleep, I decided to check Twitter. The first thing I saw was the announcement that Twitter was removing SMS-based two-factor authentication for non-Twitter Blue users. The reaction was predictably split — some celebrated, some panicked.

Both reactions missed the point.

SMS-based 2FA is not secure. It is better than a password alone, but SIM-swapping attacks have made it a weak link that sophisticated attackers exploit routinely. The Twitter decision — however poorly communicated — is directionally correct. The question for security teams and individuals alike is: what replaces it?

Bridging the Skill Gap in Cybersecurity — Hire Generalists, Create Specialists!

Fri, 20 Jan 2023 00:00:00 +0000

I have seen a lot of posts about the skill gap, unrealistic hiring expectations, and the number of open security roles. Most of them circle the same frustration: organisations want five years of experience in a technology that has existed for two, and then complain they can’t hire.

But I think the framing is wrong. The skill gap isn’t primarily a supply problem — it’s a hiring and development problem. Organisations have been optimising for the role they need filled today, not the practitioner they need in three years.

Cybersecurity Roadmap 2023: How Do I Start in Cybersecurity?

Fri, 13 Jan 2023 00:00:00 +0000

How do I start in cybersecurity? What basic skills do I need to get into cybersecurity?

These are the questions I get most often — from students, from software engineers eyeing a pivot, from IT professionals who want to move into security. There is no single right answer, but there are a lot of wrong approaches, and this guide is my attempt to cut through the noise.

Operational Security 101

Wed, 04 Jan 2023 00:00:00 +0000

Last week, Andrew Tate got into a Twitter fight with Greta Thunberg, both taking jibes at each other. It got ugly — and the next day, Romanian authorities used a pizza box visible in his response video to confirm his location and arrest him.

You genuinely could not write a better operational security case study.

Operational security, or OPSEC, started as a military concept — protecting information about your own operations from an adversary who might use it against you. In the digital age, it applies to everyone: activists, executives, journalists, and apparently influencers who pick fights on Twitter.

So You Do Not Want to Become a CISO Anymore?

Sun, 09 Oct 2022 00:00:00 +0000

There has been quite a chatter in the security community for the last couple of weeks. It is always some discussion — be it a new breach, a new framework, or a regulatory shift — but this one felt different.

The conversation: is the CISO role broken? Between the SolarWinds aftermath, the SEC charging CISOs personally, the expectation of omniscience with the authority of a middle manager, and the burnout rates — a lot of security professionals who once had the CISO job as their north star are quietly reconsidering.

Educate Your Team — Do Not Chase When It Comes to Security

Mon, 05 Sep 2022 00:00:00 +0000

“Hey, could you please complete the security training, it was due two days ago?”

If that message sounds familiar — either as the person sending it or the one ignoring it — your security awareness program has a problem. And the problem isn’t that people are lazy or don’t care about security. The problem is that you’ve built a compliance exercise and called it a culture.

Back to Office: But What About Security?

Thu, 28 Jul 2022 00:00:00 +0000

Things are back to normal, and everyone is returning to their offices. Some are ecstatic about free food, coffee, and office gossip. Others are dragging their feet. And most security teams are somewhere in between — quietly aware that two years of remote-first work has created some habits that don’t translate well to shared physical spaces.

My Cybersecurity Journey

Wed, 25 May 2022 00:00:00 +0000

I found my first position at a college placement fair. I began working as a software engineer building a digital security platform at HSBC — designing the backend for secure authentication and authorisation for mobile banking apps. It was more of a software development job, but I had to learn a lot about security concepts to actually do it well.