Blog Posts Tagged with "vendors"
Follow Up to the Out of Band Authentication Post
May 16, 2012 Added by:Brent Huston
Sadly, there are more than a few who are struggling to get OOBA right or done at all. As with most things, it helps to do a little research. Organizations should perform due diligence on their vendors and factor vendor risks into the equation of purchases and project planning...
Comments (0)
Where Will the Buck Stop in Cloud Security?
May 16, 2012 Added by:Jayson Wylie
I don’t want to see the main outcome of security and data breaches become lengthy litigation. If cloud security boils down to he who has the best law team, the direction of security will have an approach of least exposure to litigation versus Cyber threats. This does not settle with me as a valid security driver for improving security posture...
Comments (0)
The Patchwork Cloud: Portability of Security in Cloud Computing
May 15, 2012 Added by:Rafal Los
Portability is important not just across your various cloud providers but also internally. What are we talking about here? First is the acknowledgement that security isn't exclusively about the perimeter anymore. The move to cloud computing environments hastens this awareness...
Comments (0)
The Absurdity of Cloud Computing and Hosted Services
May 13, 2012 Added by:Dan Dieterle
Many companies are turning to online services to help cut costs and restore some level of IT support to their organizations. But what truly makes you think that these online services are not going through the same internal cutbacks and employee changes to cut costs of their own?
Comments (7)
Keeping Security Relevant: From Control to Governance in the Cloud
May 12, 2012 Added by:Rafal Los
When someone mentions public cloud, you quickly see the polarizing effects the topic has, generating a very negative reaction to the idea of putting anything corporate in the public cloud. What does that mean for the future of corporate information security and risk management?
Comments (0)
FedRAMP Releases Updated Security Assessment Templates
May 11, 2012 Added by:Kevin L. Jackson
FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and monitoring for Cloud Service Providers. This document has been designed for Third-Party Independent Assessors to use for planning security testing of CSPs...
Comments (0)
Financial Organizations Struggle with Out of Band Authentication
May 09, 2012 Added by:Brent Huston
Financial organizations have been working on implementing out of band authentication (OOBA) mechanisms for specific kinds of money transfers such as ACH and wires. While this authentication method does add some security to the process, it does not come without its challenges...
Comments (1)
Firewalls and Anti-Virus Aren't Dead - Should They Be?
May 05, 2012 Added by:Beau Woods
Decreasing the effectiveness of firewalls and antivirus in is the way they're used. Because of the massive number of connections in and out of a network, definitions of what is and is not allowed and exactly how to allow or deny network connections have become a sprawling mess...
Comments (4)
Five Conversations that will Shape Your Cloud Security Model
May 03, 2012 Added by:Rafal Los
We need to move away from the control model into a governance model and acknowledge we're not going to have control over all of our risk. Any notion that you have control is a delusion. Assuming that if you control the environment you have better security is a fallacy...
Comments (0)
Why We Still Need Firewalls and AV
May 02, 2012 Added by:Wendy Nather
It's become trendy to talk about how ineffective some commoditized security products are, classic firewalls and AV being the poster children. One of Josh Corman's favorite points is that "we never retire any security controls." As I am of Josh, I think he's wrong on this...
Comments (2)
Mobile Applications Shouldn’t Roll Their Own Security
May 01, 2012 Added by:Brent Huston
Many of the applications being designed are being done so by scrappy, product oriented developers. This is not a bad thing for innovation - in fact just the opposite - but it can be a bad thing for safety, privacy and security...
Comments (0)
Unmasking Agility: Cloud Reality or Myth of Marketing Hype?
May 01, 2012 Added by:Rafal Los
Agility is the ability of the IT department to provide services that adapt to the changing needs of your organization faster than before, with on-premise servers, systems and staff. Increasing your business' agility means that IT has done something to contribute to a business...
Comments (0)
Outsourcing SIEM and Log Analysis
April 30, 2012 Added by:Marc Quibell
What are the risks of MSSPs managing the detection and analysis of network activity data for your company? There are some events that, if detected early, may avert lawsuits, data breaches and other embarrassing or career-ending moments for a company...
Comments (2)
Are ICS Vendors Really to Blame for Insecure Systems?
April 27, 2012 Added by:Joe Weiss
The implication is that vendors aren’t interested in securing their legacy products. I do know that many ICS vendors supporting the electric industry are frustrated because the utilities may not be required to actually secure these systems to be NERC CIP compliant...
Comments (0)
AppSec Mistakes Companies Make and How to Fix Them
April 25, 2012 Added by:Fergal Glynn
We’re pleased to present responses from an array of security experts including Bill Brenner, Andrew Hay, Jack Daniel and Chris Wysopal. Common themes arose, including the idea of taking AppSec more seriously and committing to a programmatic approach vs. ad hoc manual testing...
Comments (0)
Tearing Away the Veil of Hype from Palo Alto Networks’ IPO
April 24, 2012 Added by:Richard Stiennon
At long last the much hyped Palo Alto Networks (PAN) has filed its S-1 in preparation for an IPO. Now that we have some visibility into PAN’s real finances it is time to address some of their claims, and perhaps throw cold water on the exuberance being expressed in some circles...
Comments (0)
- Follow Up to the Out of Band Authentication Post
- Skype Malware Campaign Spreading Poison Ivy Trojan
- I Hope Edo is Worth the Privacy Risk
- Dutch MoD Innovation Competition 2012: CYBER Operations 2.0
- NIST Workshop: The Technical Aspects of Botnets
- Security Automation by Hand - Batch/Bash/FOR
- Who Are You Preaching to Anyway?
- Some Observations on Klout Scores
- Where Will the Buck Stop in Cloud Security?
- How Does Your Bank Protect Your Data?