Thomas Kranz

Thomas Kranz

Tom’s career has spanned over 25 years, as a consultant within Cyber Security and IT. After a successful career helping UK Government departments and private sector clients (including Betfair, Accenture, Sainsburys, Fidelity International, and Toyota), Tom now advises and supports organisations on their Cyber Security challenges.


Tom lives with his partner in Italy, where they rehabilitate their collection of rescue dogs and cats, as well as managing their many opinionated ducks.


Now available, Tom's new book - Making Sense of Cyber Security from Manning.

ITProPortal •

Why contact tracing apps don't work, and why the UK's NHSX app will fail

People are fed up of lockdown. Families want to get out, people need to earn money, and employers want their teams back at work. Contact tracing apps are being floated as the solution to easing the current lockdown - but will they work? NCSC (the partnership arm of GCHQ) has been busy reassuring people that the NHSX app is secure, useful, and that everyone should do their part and install it. But is that actually the case? The first problem is that the development team have decided to not use
ITPro Portal •

Why interception of WhatsApp and Facebook Messenger isn't just flawed, it's dangerous

There have been a number of articles in the press recently on how the UK government has agreed with social media platforms like Whatsapp and Facebook to share user's encrypted messages with police. While it's true that GCHQ and various civil servants have been trying to push for interception capabilities on these platforms for a while now, despite the headlines, nothing has actually been agreed. This is down to two main problems: that encryption doesn't work that way, and that the proposal is da
LinkedIn •

Building your career in Cyber Security: Certifications

"The long term benefits of sunscreen have been proved by scientists, whereas the rest of my advice has no basis more reliable than my own meandering experience. I will dispense this advice, now." Following on from my previous article about getting started in Cyber Security, I want to move on to certifications. I've interviewed a lot of people over the years. A lot. And then I've had to built out and lead teams for various clients with the people I interviewed and hired. Certifications are a rec
LinkedIn •

How do I get into Cyber Security?

Along with "You can't say that" and "Hey, how'd you get in here?", one of the things I've been hearing from people recently is "How do I get a career in Cyber Security?" I thought I'd throw my notes from those conversations in a sort of Liber Primus for those interested in moving into Cyber Security - either as a side hustle or a career. First: what is it you actually want? I need to be honest - if you're in it for the money, there's much better options out there. Work in finance. Become a pol
Medium •

Google do not care about the user.

Google had previously tried to break usability on the web by removing the “www.” and “http(s)://” parts of the URL displaying in Chrome. Facing a strong backlash from users, they quietly shelved the plans. Now they are trying again, with the same nonsense excuses for it: “ The Chrome team values the simplicity, usability, and security of UI surfaces. To make URLs easier to read and understand, and to remove distractions from the registrable domain, we will hide URL components that are irrelevan
Medium •

The ICO’s £183m GDPR fine for British Airways is the wrong thing to do

There’s lots of flag waving about how the ICO finally has some teeth, and how GDPR is going to keep companies on their toes from now on. Nothing will change. GDPR will have no impact on cyber security apart from employing a lot more auditors, with even more ineffectual checklists. The ICO’s “record breaking fine” will result in zero improvements in cyber security. Companies should be punished financially for having weak security when handling customer’s data — but it’s the executive team who s
Hiscox London Market •

All the gear and no idea

Support when you need it, where you need it. Even with high-tech security in place, many companies still suffer cyber attacks due to simple set-up blunders. Most companies that suffer a cyber attack believed it would never happen to them. What makes it even harder to understand is the costly, cutting-edge security they had in place to deter hackers. But, these strong defences turn out to be a cyber Maginot Line if they’re not activated or deployed properly – ineffective because they could be e
Professional Security Magazine •

Ways to close the digital skills gap in cyber

Tom Kranz, Director of Cyber Lab at 6point6, a technology consultancy, writes that the digital skills shortage is a permanent thorn in the cyber industry’s side that needs to be tackled now before it’s left to fester any longer and cause real long term damage. Despite being exaggerated by many as a full-blown crisis, the talent shortage is actually something that needs properly addressing, not hyperbole. With hackers ramping up attacks and developing increasingly sophisticated tools and methods
Computer Weekly •

Why cyber security needs to be prioritised at board level

There is growing evidence that cyber attacks are now deliberately targeting executives and board members – not businesses themselves – which shows that attackers believe this group is particularly vulnerable as well as valuable. More must be done to raise awareness of potential cyber threats at board level, as well as supporting businesses in developing a strategy that offers solutions to combat potential weaknesses in a company. Typically, hackers attack companies and their employees to steal
Computer Weekly •

Breaking the chains: How FUD is holding the cyber sector hostage

Fear, uncertainty and doubt (FUD) has become an ever-looming cloud over the cyber sector in recent years as companies and suppliers pounce on the opportunity to capitalise on this rhetoric and peddle their wares to fearful customers. To misquote the age-old advertising maxim: fear sells. Of course, the big problem with this is that customers and, businesses – people – become immune to the constant avalanche of outlandish claims and equally outlandish fears. “FUD fatigue” is something that, unfo
Compare the Cloud •

Being Successful in Cyber Security

Cybersecurity can often seem like a murky world of espionage and counter-espionage; where men in blacked out vans kidnap carefully chosen nerds from the streets of the country’s small towns to keep us safe from those pesky bad guys. However, to succeed in the world of cyber security you do not require a specific set of skills as the Liam Neeson of Taken 1, 2 and 3 will have you believe. This does beg the question of what do cybersecurity experts look for when hiring the next generation of keyboa
LinkedIn •

The Matryoshka Dolls of IT

I often get complaints from clients that their IT projects are always cumbersome, delivered late and over budget. They’ve had an impact on the business, certainly, but it’s far from a positive one. There’s a lot of blame to go round for this, and finger pointing can be fun, but what needs to be done is to get our C-level stakeholders and project sponsors to understand the implications of proposed work versus timelines. Building a solution as a green field implementation is easy - there’s nothin
LinkedIn •

The DAOO Loop

Everyone should be familiar with John Boyd’s OODA loop - Observe, Orient, Decide, Act. There are a number of variations (pick a favourite!) but the basic premise remains the same: you gather information before acting. Witnessing recent transformation projects that have run into difficulties, or foundered completely, I’ve seen people trying to use a twist on this - the DAOO loop. Transformation projects are complex, and as I’ve discussed before, they should never be driven by technology or impl
LinkedIn •

On the S3 outage and Agile Cloud Native Serverless failures

Our newsfeeds are filled with hundreds of articles about Amazon's S3 failure on Tuesday. Doom, gloom, S3 down in US-East-1 and cascading failure - dogs and cats, living together: mass hysteria! It's been covered on Forbes, Business Insider - even The Daily Mail and The Sun (hardly bastions of technology reporting, but "OMG Instagram is down!" cuts off their supply of click bait). The real story is not about S3 taking a nap, nor about the cascading failures across Amazon's services, nor about Am
Load More Articles