Information security & GRC. I write and think about why security decisions get made the way they do, incentives, power, accountability.