Jon Oltsik

Senior Principal Analyst

  • News
    May 20, 2015

    Businesses Remain Challenged by Collection, Analysis of Threat Data - eWeek

  • Blogs
    May 19, 2015

    Toward Omniscient Cybersecurity Systems

    Cybersecurity systems suffer from compartmentalization. Vulnerability management systems know which software revisions are installed on which systems, but have no idea how endpoints and servers are connected together. Similarly, an anti-malware gateway can perform static and dynamic analysis on a suspicious file but doesn’t know if a user downloaded analogous malware when she was connected to the Internet on a public network.

  • Blogs
    May 15, 2015

    Security Is a Prisoner of the Network

    I have a very distinct memory about a conversation I had with a colleague in the mid-to-late 1990s about how NetWare worked. I told him that file and print services resided “in the network” but he couldn’t get his arms around this concept. He continually pushed back by saying things like, “well the printers and file servers have to be plugged into the network so isn’t NetWare just running on these devices?”
  • News
    May 14, 2015

    Google Trusts Cloud Computing More Than Firewalls, Migrates Corporate Apps To Internet - TechFrag

  • Blogs
    May 13, 2015

    Google Network Security Sans Perimeter

    About a decade ago, I was first introduced to the Jericho Forum, an international group of cybersecurity executives committed to defining new infosec tools and architectures.

  • News
    May 11, 2015

    Google Moves Its Corporate Applications to the Internet - The Wall Street Journal - CIO Journal

  • Blogs
    May 7, 2015

    The Cloud Computing Cybersecurity Challenge

    A few years ago, cloud computing faced an infosec hurdle. Many CIOs appreciated the benefits of cloud computing but their concerns about cloud security outweighed all of its potential goodness. General cloud security trepidation thus precluded broader use of cloud computing.

  • Blogs
    May 5, 2015

    Valuable Federal Cybersecurity Training for Critical Infrastructure Organizations

    Last week I wrote two blogs about cybersecurity, critical infrastructure organizations, and the US government. Now I'll discuss valuable federal cybersecurity training for critical infrastructure organizations.

  • News
    May 5, 2015

    Spending More on Breach Prevention Isn't Fixing the Problem - Infosecurity Magazine

  • Blogs
    May 1, 2015

    Federal Cybersecurity Carrots and Sticks

    In my last blog, I highlighted a recent ESG research survey of cybersecurity professionals working at critical infrastructure organizations. As a review...

  • Blogs
    Apr 29, 2015

    Cybersecurity, Critical Infrastructure, and the Federal Government

    The term “critical infrastructure” is used by governments around the world to describe industries and physical assets deemed essential to their economies and national security. Critical infrastructure industries include agriculture, electricity generation, financial services, health care, telecommunications, and government services like law enforcement and the water supply (i.e., drinking water, waste water, dams, etc.).

  • briefs
    Apr 28, 2015

    Critical Infrastructure Organizations Want More Cybersecurity Help from Washington

    Since the administrations of George H.W. Bush and Bill Clinton, Washington politicians have pledged to address cyber-vulnerabilities within critical infrastructure industries. Has anything changed? Not really. The research conducted by ESG and presented in this brief reveals that critical infrastructure organizations continue to experience numerous security incidents and believe that the threat landscape is only getting worse. Furthermore, security professionals working at these organizations remain unclear about the U.S. government’s cybersecurity strategy. In spite of this confusion, critical infrastructure organizations believe that it’s time for Washington to get more involved in cybersecurity issues and create cybersecurity programs that offer real help.

  • Blogs
    Apr 27, 2015

    Take-aways from RSA

    As expected, the 2016 RSA Conference was bigger than ever—more attendees, presentations, exhibitors, etc. Since I live in the cybersecurity space, there were few surprises, but there were a few major highlights to this year’s show.
  • Blogs
    Apr 24, 2015

    Making Sense of Raytheon and Websense

    I was just getting on my flight to the RSA Security Conference in San Francisco on Monday morning when I received an e-mail announcing an intriguing cybersecurity deal.Defense contractor Raytheon announced its acquisition of security veteran Websense for approximately $1.6 billion. Vista Equity Partners, Websense’s previous owner, also contributed $335 million and will retain some skin in the game.

  • Blogs
    Apr 22, 2015

    Somber Message at the 2015 RSA Conference

    As the 2015 RSA Conference got underway this week, I attended a dinner hosted by Pacific Crest Securities. Our host began the dinner by asking former cyber czar Richard Clarke to say a few words. Now this was a rather festive dinner as the cybersecurity industry is in the midst of a robust boom. Nevertheless, Clarke’s brief talk was a reminder of where we’ve been and the state of cybersecurity today.

More Results:



Jon Oltsik is an ESG senior principal analyst and the founder of the firm’s information security service. With over 25 years of technology industry experience, Jon is widely recognized as an expert in all aspects of information security and is often called upon to help customers understand a CISO's perspective and strategies. Recently, Jon has been an active participant with cybersecurity issues, legislation, and technology within the U.S. federal government.

Full Biography