January 24, 2013 Added by:Rafal Los
In order to not incur additional risk to the business, the organization being outsourced to must be heavily vetted and contractually obligated to maintain secrecy and integrity. It can be done, but it's tricky, and requires work in due-diligence to ensure the result isn't a train wreck during a worst-case scenario...
January 22, 2013 Added by:Ben Kepes
As we move into the cloud-dominated world, the issue of integration is more prominent as enterprises realize how many different systems are being used throughout their organizations. While one of the best things about cloud is the democratization of technology, this is also one of the most problematic areas...
January 21, 2013 Added by:Rafal Los
Change control, application security reviews, incident response, policy review, audit preparation, acquisition due-diligence... all of these require people, money and time - but you've got it all in short supply. Here's one way of looking at making the decision of what to build, and what to outsource...
January 17, 2013 Added by:Mikko Jakonen
The set of TTP:s involved with cyber capabilities shall require, for time being, a vast amount of information exploitation, intelligence, development and co-ordination capabilities that enters step-by-step within the theater of operations.
January 13, 2013 Added by:Larry Karisny
We start with one big problem. Internet architecture was never made for security. One of my earliest articles quoted the father of the Internet Vint Cerf by saying, "One of things incumbent on all of us is to introduce strong authentication into the fabric of the smart grid. We did not do that with the Internet."
January 07, 2013 Added by:Ben Kepes
I’ve been a part of, or at least a witness to, a huge number of battles about what constitutes the “real cloud.” These battles seem to generally be fought on a Sunday afternoon U.S. time – that kind of suits me fine because it means the Monday mornings in my time zone have enough entertainment value to get me up and going.
January 02, 2013 Added by:Ben Kepes
One of my regular themes when talking about the cloud are the barriers to adoption or, to put it more coarsely, how we can remove the friction and allow more organizations to enjoy the benefits that the cloud can bring. It’s an area that a number of my colleagues talk about also – we pundits have the advantage of time to explore and enjoy the benefits that cloud brings, but we remain aware of ...
December 26, 2012 Added by:Simon Moffatt
Technology evolves so quickly that 12 weeks is an age when it comes to new ideas and market changes - and security is no different. However, the main areas I will personally be following with interest though, will be the BYOD/BYOA, personnel, preemptive security and social intelligence...
December 13, 2012 Added by:Michelle Drolet
In order to detect security breaches and guarantee compliance, tamper “proofing” has not been sufficient. When it comes time for a forensic audit, the ability to detect unauthorized changes to digital files becomes invaluable in an investigation...
December 13, 2012 Added by:Ben Kepes
It’s something I’m actually quite passionate about – not using management tools that force business units to adopt a particular solution that may or may not really meet their needs. It makes no sense and actually hampers the ability for cloud to deliver the benefits it promises...
December 11, 2012 Added by:Rafal Los
People are still stuck on authentication, mainly passwords. We as an industry or customer base haven't been very good at figuring out how to manage identities, without sticking our customers with a million different sites which don't share common identities...
December 10, 2012 Added by:Hani Banayoti
Another year coming to a close and I am full of hope for new thinking on security for the road ahead. One particular aspect in our profession that I would like to see change in the very near future is the typical approach to incorporating security in contracts with IT Service Providers...
December 06, 2012 Added by:Rafal Los
It would seem that in the IaaS cloud service delivery model unless you know what you're getting into it may be quite tough to deploy a solid, risk-averse cloud-based application. Now, PaaS is different than the other two in that it is a compromise between extensibility and built-in security features...
November 29, 2012
A few months ago, I was invited to present at a summit organized by the New Zealand Privacy Commission, a government organization that is tasked with setting policies to ensure citizens of New Zealand remain secure when it comes to the use of their private information...
November 25, 2012 Added by:Ben Kepes
TOS;DR aims to help with what is possibly the biggest lie on the internet, that which users make when they click that they have read, understood and accepted the terms of service of their provider. The fact is that no one reads them but rather vaguely hopes for the best...
PoS Malware Kits Rose in Underground in 2014... on 03-17-2015
New PCI Compliance Study... on 03-17-2015
PCI Security Standards Council Statement on ... on 03-17-2015