DocDrew, LLC
Home of DocDrew Publishing and other services offered by DocDrew, LLC


About

Andrew Aken

DocDrew, LLC is a start-up consulting company & MSP providing Cybersecurity leadership, Enterprise IS Infrastructure, Database Design & Optimization, Data Analytics, and Training (including security awareness training). DocDrew was founded by Dr. Andrew Aken (LinkedIn address: linkedin.com/in/ajaken). Dr. Aken has over 20 years of experience in cyber security (as well as software engineering, network & systems architecture, and many other IT areas) while working at various roles and levels within different organizations. Dr. Aken also was a leader in the development of the Cyber Security degree program at an Oklahoma university and a leader in the development of the point of view & marketing strategy for Zero Trust at one of the big 4 consulting firms.


Additional projects that are being developed and administered by DocDrew, LLC include:



DocDrew Publishing

Andrew Aken

DocDrew Publishing is an independant publisher of works authored by Dr. Andrew Aken.

Dr. Aken is currently working on a series of security awareness books for children featuring Sandy, the Security Awareness Pixie. He will also be publishing additional books based upon his IT & Cybersecurity Leadership newsletter as well as a book on Imposter Syndrome.



The Security Awareness Pixie

The Security Awareness Pixie

The Security Awareness Pixie series of books use memorable poetry and captivating imagery where Sandy, the Security Awareness Pixie, takes children on an adventure teaching them about security and safety in the online world. Children between the ages of 3-12 are increasingly exposed to digital environments where risks abound. At this impressionable age, children are curious and may inadvertently share personal information or fall victim to online threats such as cyberbullying, inappropriate content, or scams.

By teaching them the basics of cybersecurity early on, we can instill safe online habits, helping them understand the importance of privacy, recognizing suspicious activity, and knowing how to respond to potential dangers. This foundational knowledge not only protects them in their formative years but also sets the stage for a lifetime of safe Internet use.


The books currently in the series include:

  • The Security Awareness Pixie: Why Security Awareness is important
    In this book, Sandy instructs children of the fundamentals of online safety and why security awareness is important. She covers interactions with strangers, playing games, dangerous links, password safety, sharing personal information & photos, and cyberbullying.

  • The Security Awareness Pixie: Too Much Screen Time
    This book emphasizes practical steps to reduce screen distractions, like silencing notifications, so children can fully engage in real-world interactions. It illustrates how reducing screen time not only enhances physical activities but also enriches imagination, as children notice the beauty of nature and create stories about their surroundings.

    This story encourages children to find a healthy balance between technology use and active play. Key moments like setting screens aside during family dinners and turning off devices before bedtime are highlighted to reinforce daily habits that promote better sleep and family bonding. Overall, the story aims to inspire children to explore the world around them, making the most of every day away from screens, filled with laughter, exploration, and adventure.

  • The Security Awareness Pixie: Fakers & Credibility
    In this book, Sandy teaches children the fundamentals of identifying deceitful behavior on the Internet. She covers critical thinking skills, misinformation, fake news stories, people posing as someone they're not, and deep fakes.

  • The Security Awareness Pixie: Social Networks
    In this book, Sandy teaches children essential online safety tips for navigating social networks. She advises young users to be cautious about what they share online and emphasizes the importance of keeping locations private, dealing carefully with strangers' friend requests, and maintaining a kind demeanor to avoid cyberbullying. Sandy also highlights the deceptive nature of online images, urging children not to compare themselves to the often unrealistic portrayals of body image they see on social media. The poem further addresses how to handle Internet trolls and the importance of setting up privacy settings.

    Sandy concludes by reminding children that what they post online stays there forever, urging them to think about the long-term implications of their posts. Overall, the poem encourages safe and responsible behavior on social networks while reinforcing the idea that real beauty and happiness are found beyond the screen.

  • The Security Awareness Pixie: Dealing With Cyberbullying
    In this book, Sandy the Pixie helps children understand and navigate the challenging world of cyberbullying. It uses engaging rhymes and illustrations to explain what cyberbullying is and how it can occur through texts, posts, or in games. Sandy emphasizes that hurtful words, whether online or offline, can sting, but encourages children to remember their strength and self-worth. She advises them to report any bullying incidents to a trusted adult, like a parent or teacher, and to keep evidence, such as screenshots, to help adults address the situation.

    The book also teaches children not to retaliate with harsh words, instead promoting kindness and calmness. Sandy stresses the importance of choosing friends wisely and the value of being kind online. She provides practical advice, like blocking and reporting bullies, and reassures children that they are not alone in facing these issues. Sandy's message is clear: be kind, be smart, and navigate the digital world securely. Through her guidance, children learn how to deal with cyberbullies and enjoy the internet safely.

  • The Security Awareness Pixie: Protecting Our Online World
    In this book, Sandy, the Security Awareness Pixie, introduces us to a team of cybersecurity heroes who work together to keep the digital world safe. Each character embodies a different role in cybersecurity: the Security Analyst monitors data to block threats, the Security Engineer builds strong defenses, the Security Architect designs secure systems, and the Pen Tester tests for vulnerabilities. Other roles include the Incident Responder who fixes issues quickly, the Forensic Analyst who uncovers the cause and scope of incidents, the Compliance Auditor who ensures rules are followed, the Security Awareness Trainer who educates others, the App Security Engineer who secures applications, the Cryptographer who protects data, the Consultant who guides organizations, and the CISO (pronounced `Sea-So`) who leads the team.

    Together, these heroes use their unique skills and teamwork to protect against dangers in the cyber world. The poem encourages readers to join Sandy and her friends in their mission to build a secure future filled with safety and kindness that lasts. It highlights the importance of collaboration, knowledge, and dedication in protecting our online world.



Zero Trust

About Zero Trust ZT logo

"Never implicitly trust, always and continuously verify"

Zero Trust is a relatively new security paradigm which goes beyond the traditional defense-in-depth perimeter-based strategy and treats all communications and resource requests as initially untrusted and requiring continuous verification before access to those resources is granted. One of the greatest benefits of Zero Trust is that it can eliminate lateral movement from a compromised system within a network.

The recent Executive Order on Improving the Nation's Cybersecurity defines "the term “Zero Trust Architecture” [to mean] a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgement that threats exist both inside and outside traditional network boundaries. The Zero Trust security model eliminates implicit trust in any one element, node, or service and instead requires continuous verification of the operational picture via real-time information from multiple sources to determine access and other system responses. In essence, a Zero Trust Architecture allows users full access but only to the bare minimum they need to perform their jobs. If a device is compromised, zero trust can ensure that the damage is contained. The Zero Trust Architecture security model assumes that a breach is inevitable or has likely already occurred, so it constantly limits access to only what is needed and looks for anomalous or malicious activity. Zero Trust Architecture embeds comprehensive security monitoring; granular risk-based access controls; and system security automation in a coordinated manner throughout all aspects of the infrastructure in order to focus on protecting data in real-time within a dynamic threat environment. This data-centric security model allows the concept of least-privileged access to be applied for every access decision, where the answers to the questions of who, what, when, where, and how are critical for appropriately allowing or denying access to resources based on the combination of sever[al criteria]."

The views of Zero Trust embodied in the Zero Trust Maturity Model which is assessed within this application adhere to the Executive Order's definition and are primarily derived from the Zero Trust eXtended (ZTX) model developed by Forrester. In this model of Zero Trust, the foundation is built upon a robust understanding of the environment that the organization operates in and that the organization is at least doing the basics as it relates to cybersecurity (e.g, the CIS top 18 (formerly the SANS top 20)). Then, the 7 domains of Zero Trust are built upon that foundation. Those domains are: Users (a/k/a people or identity), Endpoints (a/k/a devices), Data, Networks, Workloads (a/k/a applications), Visibility & Analytics, and Automation & Orchestration. The outcome of moving towards Zero Trust is increased Governance (as well as reduced risk, improved user experience, lower costs, speedier & more reliable software development, and a variety of other positive outcomes).

Zero Trust Architecture House Model

It is these 7 domains as well as The Basics that are the inspiration behind the assessment criteria in the Zero Trust Maturity Model utilized here.

Following are some links to various podcasts, presentations, and panel discussions which discuss this point of view on Zero Trust as well as the Zero Trust Maturity Model:



Contact

The Zero Trust Maturity Model (ZTMM)

For more information regarding this application contact Andrew Aken at andrew.aken@zerotrustmaturity.org