Independent judgement.
Down to the root cause.
Triage keeps the queue moving. Root causes wait.
Proper Tools is my independent consulting practice.
I am most useful when a question is clear enough to matter but not yet clear enough to answer. Usually that means the knowledge is scattered, the assumptions are unnamed, and reasonable accounts disagree.
I trace problems across the boundaries where they hide: between teams, vendors, standards, and decades. I distinguish what is known from what is inferred, make the important assumptions and dependencies visible, and help the people responsible decide what follows.
My work draws on more than twenty-five years across cybersecurity operations, infrastructure, standards, and policy.
Ways to work together¶
There are three ways to work together: a focused assignment with a clear scope, a continuing advisory relationship of a day or two a month, or sponsoring the public coordination work I lead on time security.
A focused assignment is usually the best place to start: a clear question, a defined deliverable, and a fee agreed in advance.
You might call when:
- a supplier says a critical dependency is safe, but nobody can explain the assumptions behind that assurance;
- a regulatory or product-security obligation crosses engineering, legal, security, and operations, and no single team owns the whole question;
- leadership needs to make a technical decision, but the experts disagree about what the evidence shows.
A straightforward first conversation
I would rather tell you plainly whether this is a fit than sell you something that is not.¶
Selected work¶
- National cyber defence. At the Centre for Cybersecurity Belgium, helped establish the national cyber threat-intelligence capability, and architected and led implementation of the Belgian Anti-Phishing Shield, an early national example of protective DNS.
- Threat-intelligence standards. Co-chaired the OASIS Cyber Threat Intelligence Technical Committee, and edited parts of STIX 2.0 and STIX 2.1.
- Helping institutions act together. Served an elected term on the board of FIRST, and co-founded and co-chairs its Standards SIG, connecting incident responders with ITU-T, OASIS, IETF, ETSI, and ISO.
Current work: time and timestamp resilience¶
A significant part of my current public-interest work concerns the 2036–2038 timestamp rollovers: known technical failure boundaries distributed across software, devices, infrastructure, and supply chains.
I am the primary drafter and a co-editor of ITU-T Technical Paper XSTP.epoch and co-chair the FIRST Time Security SIG. The work is one example of the broader Proper Tools pattern: understand the technical reality deeply enough to make it useful to the people who must plan, decide, and coordinate.
New in the Commons
calmoji: calendar rituals for people who drift off task¶
Ready-made calendar layers for protecting focus, finding humane meeting times across time zones, and making overloaded weeks more legible. Switch the layers on to plan and off to work. Claim a block by copying it into your own calendar.
Plain .ics files for the calendar you already use.
No app, no account, nothing to install. Free and open source. The
2038 calendars double as a small year-2038 test for calendar
software.
About calmoji → ∷ Why I built it → ∷ Download the calendars (.zip) →
Research and the Commons
Some of the work belongs to everyone.¶
Open frameworks, protocols, working papers, and civic texts, released for inspection, criticism, adaptation, and reuse.
Current work includes calmoji, The Hippocratic Oath of the Cybersecurity Practitioner, the Meridian Protocol for durable web preservation, and XSTP.epoch.
Proper Tools is being built so that paid consulting, standards participation, public-interest research, and work released into the Commons strengthen one another.
The public work keeps the practice close to emerging questions, makes the reasoning available for inspection, and improves the advice I give.
Latest Field Note
Start here
Bring me the question as it currently exists.¶
You do not need a finished brief or a neatly classified problem.
A useful first note says what is happening, who is involved, what decision or deadline is approaching, and what kind of help might be useful.
Introductions are welcome. So are half-formed questions.
Start a conversation →