Resilience on Hector Herrerahttps://www.hectorherrera.pro/en/tags/resilience/Recent content in Resilience on Hector HerreraHugoen-USFri, 07 Aug 2026 16:40:00 -0500Designing an email protection capability against phishing, fraud, and critical-process compromisehttps://www.hectorherrera.pro/en/work/designing-email-protection-capability-critical-business-processes/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/designing-email-protection-capability-critical-business-processes/Structuring an email protection capability focused on detecting phishing, fraud, impersonation, and other interactions capable of compromising critical business processes.Designing an operational model for cybersecurity incident managementhttps://www.hectorherrera.pro/en/work/designing-operational-model-cybersecurity-incident-management/Fri, 07 Aug 2026 00:00:00 +0000https://www.hectorherrera.pro/en/work/designing-operational-model-cybersecurity-incident-management/Structuring an incident management operating model that connects governance, roles, playbooks, evidence, communications, exercises, metrics, and continuous improvement.Incident response starts before the incidenthttps://www.hectorherrera.pro/en/ideas/incident-response-starts-before-the-incident/Fri, 07 Aug 2026 16:40:00 -0500https://www.hectorherrera.pro/en/ideas/incident-response-starts-before-the-incident/Response capability is built before the incident: by defining decisions, channels, scenarios, evidence, communications, and exercises that reduce unnecessary improvisation.An incident response plan nobody can execute is not really a planhttps://www.hectorherrera.pro/en/ideas/an-incident-response-plan-nobody-can-execute-is-not-really-a-plan/Fri, 07 Aug 2026 16:35:00 -0500https://www.hectorherrera.pro/en/ideas/an-incident-response-plan-nobody-can-execute-is-not-really-a-plan/A plan creates value when a team can activate it under pressure: people know who decides, what to record, what to preserve, how to escalate, and when to close.Email is not just a channel: it is an attack surface against critical business processeshttps://www.hectorherrera.pro/en/ideas/email-is-not-just-a-channel-attack-surface-critical-business-processes/Fri, 07 Aug 2026 15:20:00 -0500https://www.hectorherrera.pro/en/ideas/email-is-not-just-a-channel-attack-surface-critical-business-processes/A convincing email can alter a decision, capture credentials, or redirect a critical process without looking like a traditional attack.Prioritizing risk is not sorting vulnerabilitieshttps://www.hectorherrera.pro/en/ideas/prioritizing-risk-is-not-sorting-vulnerabilities/Fri, 07 Aug 2026 13:30:00 -0500https://www.hectorherrera.pro/en/ideas/prioritizing-risk-is-not-sorting-vulnerabilities/Good prioritization connects exposure, impact, context, and execution capacity; it is not just a technical ranking exercise.Resilience starts before the incidenthttps://www.hectorherrera.pro/en/ideas/resilience-starts-before-the-incident/Fri, 07 Aug 2026 13:20:00 -0500https://www.hectorherrera.pro/en/ideas/resilience-starts-before-the-incident/Responding well matters, but resilience depends on earlier decisions about capabilities, dependencies, recovery, and learning.