Welcome to G360 Information Security
Sharing Experience. Exploring Ideas. Advancing Information Security.
Information security is a field where experience matters. Some of the most valuable lessons come not from textbooks, standards, or established frameworks, but from confronting real problems, testing assumptions, making difficult decisions, and discovering what actually works in business and production environments.
G360 Information Security exists to share knowledge, observations, methodologies, and perspectives developed through many years of practical experience.
This website is intended for fellow information security professionals, technology practitioners, organizational leaders, and those beginning their careers. The materials are freely offered to anyone interested in exploring the challenges, complexities, and opportunities of information security.
Some contributions describe approaches that have proven useful in practice. Others explore developing ideas, question conventional thinking, or offer perspectives that may invite disagreement.
The objective is not to present universal answers. It is to contribute to the ongoing exchange of knowledge, experience, and ideas that helps our profession develop and improve.
Knowledge becomes more valuable when it is shared.
Explore Topics & Materials
G360 brings together original writings, professional observations, practical methodologies, and supporting materials covering a broad range of information security subjects.
Visitors are encouraged to explore these resources according to their own interests and needs. Some materials provide structured methods and practical guidance; others examine complex organizational challenges, question prevailing practices, or introduce ideas for further consideration.
Materials are made available for reading, learning, discussion, and practical adaptation. They reflect experience and professional judgment rather than a claim that any single approach is universally applicable.
Explore the Knowledge Library →
Topics available for exploration and further development include:
- Information Security Governance: Policies, Standards & Governance Instruments (PSGI), governance structures, and ongoing oversight.
- Entity Management: Relationships, responsibilities, and accountability across parent companies, subsidiaries, and complex enterprises.
- Information Security Methodologies: Original models, structured approaches, and decision-making frameworks.
- Security Tools & Technologies: Selection, effectiveness, optimization, utilization, and lifecycle considerations.
- Professional Observations: Experiences, lessons learned, and perspectives on information security practices and organizational challenges.
Methodologies & Practical Resources
Over the years, practical experience has contributed to the development of methodologies, models, organizational approaches, and supporting materials intended to help address recurring information security challenges.
Many of these approaches emerged from situations where established frameworks provided useful direction but did not fully address the complexities of implementation in real organizations.
The materials presented here attempt to bridge that gap between theory and practice. They describe not only what an organization might seek to accomplish, but also ways of approaching the decisions, relationships, responsibilities, and activities involved.
These methodologies are shared openly, including their underlying concepts, implementation considerations, and supporting materials. Visitors are welcome to study them, question their assumptions, and adapt useful elements to their own circumstances.
Explore the Methodologies
Policies, Standards & Governance Instruments (PSGI)
An approach to organizing, establishing, implementing, and maintaining information security governance across complex organizations. Includes a structured governance hierarchy, supporting governance instruments, applicability considerations, and methods for maintaining alignment across organizational entities.
The Discipline Diamond Methodology
A framework for examining information security as an organizational discipline, including the relationships among its constituent elements and the practical considerations involved in making them work together.
Entity Management
Perspectives and practical approaches for managing information security governance, responsibility, accountability, and oversight across parent companies, subsidiaries, and other organizational entities.
Additional Models & Resources
Supporting materials, diagrams, implementation guidance, and other approaches developed or refined through practical experience will be added as they become available.
The intention is to share useful work, not prescribe a single correct way of working.
Articles, Observations & Perspectives
Not everything learned through years of working in information security fits neatly into a methodology, framework, or formal publication.
Some lessons emerge from unexpected circumstances. Others arise from questioning established practices, observing organizational behavior, encountering technological limitations, or recognizing patterns across otherwise unrelated experiences.
This section brings together writings, observations, and personal perspectives on information security, technology, organizations, and the people involved in making them work.
The subjects may be technical, organizational, historical, philosophical, or occasionally unconventional. Some articles explore practical problems and potential solutions. Others examine assumptions, raise questions, or consider connections between subjects that may not initially appear related.
These writings reflect the author’s experiences, interpretations, and opinions. They are offered to encourage curiosity, thoughtful discussion, constructive disagreement, and the exchange of ideas.
Readers are welcome to draw their own conclusions.
The Bricks and Mortar Philosophy
Building an effective information security program involves far more than assembling policies, standards, procedures, technologies, and organizational structures.
These elements are important building blocks—the bricks from which a program can be constructed. Many are well documented, widely available, and adaptable to organizations of different sizes, structures, and circumstances.
But bricks alone do not create a sound structure.
What connects them is the understanding of how they relate, why they are needed, where they belong, and how they should work together within a particular organization.
That is the mortar.
At G360 Information Security, the Bricks and Mortar philosophy reflects the belief that knowledge, methodologies, models, and practical resources should be openly shared. Individuals and organizations should be able to examine these materials, develop their own approaches, and construct programs suited to their needs.
The mortar represents something less easily captured in a document: experience, perspective, professional judgment, collaboration, and the ability to recognize connections between organizational objectives, risks, responsibilities, and practical realities.
Sharing the bricks is one way to help others build. Discussing how they fit together is an opportunity to learn from one another.
The objective is not to prescribe identical structures, but to help others build structures that work for them.
About the Author
G360 Information Security reflects the professional experiences, observations, and perspectives of Alan Cochran, whose work in information security, technology risk management, and mission-critical IT operations has involved navigating the challenges of technology, organizational governance, risk management, and the practical realities of business operations.
Over the course of his career, Alan has encountered the complexities of establishing and maintaining information security programs, working across organizational boundaries, addressing competing priorities, and translating security objectives into practical approaches that people and organizations can implement.
Those experiences have shaped his belief that effective information security requires more than technical knowledge or adherence to established frameworks. It also requires an understanding of people, organizations, responsibilities, and the circumstances in which decisions are made.
The writings and materials presented through G360 reflect lessons learned, ideas developed, and perspectives refined through experience—including approaches that succeeded, assumptions that were challenged, and lessons drawn from efforts that did not work as expected.
Alan offers these contributions in the spirit of professional knowledge sharing, recognizing that experience provides perspective rather than infallibility, and that valuable insights often emerge through conversation, questioning, and disagreement.
G360 is an invitation to explore those experiences and ideas, and to contribute to the conversation.
Contact & Conversations
Ideas are worth sharing. Conversations help them grow.
G360 Information Security welcomes questions, observations, suggestions, and differing perspectives from visitors who have explored the materials presented here.
Whether you are beginning your information security career, have spent decades working in the profession, or are approaching these subjects from another discipline, your experiences and ideas are welcome.
The articles, methodologies, and other resources shared through G360 are intended to encourage learning, exploration, and thoughtful discussion. They are not presented as the final word on any subject.
Perhaps you have encountered a similar challenge and approached it differently. Perhaps an observation raises a question, or a methodology suggests an application that has not been considered. These are precisely the kinds of conversations that can make shared knowledge more useful.
Visitors interested in discussing a particular topic, offering constructive feedback, suggesting additional subjects, or exploring opportunities for professional collaboration are invited to make contact.
G360 also welcomes inquiries about advisory and consulting assistance, when experience and perspective may be helpful in addressing particular organizational challenges.