Search

A SECURITY MANAGER needs a philosophy about how to address security issues, and I find that many elements of mine can be reduced to a few words that almost amount [...]

Two security initiatives will languish if staffers have no incentive to work on them. Solution? Tie them to bonus pay. FOR SEVERAL MONTHS NOW, I have been proactively identifying risks [...]

SSO will bring several benefits, but our manager has to be prepared to address any security lapses that could accompany it. MY COMPANY, like most, has been letting go of [...]

IN THE PAST FEW WEEKS, I was able to dig deep into security issues (by attending the Black Hat security conference), and then concentrate on the basics (by getting our [...]

Traditional vulnerability management doesn't always catch security issues. That's why you need input from as many sources as possible. VULNERABILITIES can take many forms, and you can't expect to uncover [...]

ONE THING that we security managers can be sure of is this: There is no guarantee that we won't suffer a security breach. In fact, the odds are increasing all [...]

LOOKING AROUND at how things are done at my new company, it's pretty easy for me to find security problems lurking virtually everywhere. For example, the first thing I noticed [...]

THE RESOURCES on our network have been given too much access to the Internet, and we need to curb that. One of my primary security philosophies is the rule of [...]

WHEN IT WAS TIME to write this column, the only thing on my mind was the OpenSSL Heartbleed vulnerability. If you have anything to do with infosec, it was probably [...]

MY COMPANY is always looking for ways to save money. One maneuver--outsourcing the development of a module of one of our software products--almost cost us big time. We had chosen [...]

IT STARTED OUT as a simple call to the help desk from an engineer at one of our major development centers: Phone calls were being dropped. Soon, similar complaints were [...]

THANK YOU, Target! It's a pity that security managers have to capitalize on other organizations' misfortunes to broker change within their own enterprises, but the notorious Target breach of late [...]

As a security manager. I expect my company to be hit by ma I ware infestations, data theft, denial-of-service attacks and attempts at unauthorized access. 1 deal with them all [...]

IMPLEMENTING TECHNOLOGY to monitor user and network activity can be an eye-opener. Our security incident and event management tool made us suddenly aware of the magnitude of infestation on our [...]

WE LOOKED into mobile device management (MDM) in 2012, but the time didn't seem right. Now, some 18 months later, things have changed, and MDM is looking more like a [...]

SECURITY INCIDENTS are a complete disruption of my normal day-to-day activities. I love them. I especially like it when they uncover systemic problems we might not otherwise have found out [...]

EVERY FALL, I conduct a policy review. I think it's a good idea to have this on my calendar, because no policy, no matter how well crafted, is meant to [...]

WE JUST found 30 servers that can't be accounted for. Thirty Internet-facing servers with no malware protection and patchy patch histories. I need to take a deep breath and figure [...]

I LOVE DLP! That's not a statement that would sell a chief financial officer on data leak prevention, but I can show real ROI from our deployment as well. Our [...]

I TOOK SOMEBODY'S WORD for something, and I didn't subsequently check it out to my own satisfaction. Result: big trouble. Lesson: always verify. I learned that lesson last week, when [...]

IT'S BUDGET SEASON, which means I get to create a wish list of security goodies I'd like to buy. I prefer to have a theme for my wish list. A [...]

THE DATA CLASSIFICATION policy that I introduced a couple of years ago has served the company well, but now the global architecture team has pointed out its limits. We have [...]

I HAVE SHUNNED OFFSHORING and have written about my concerns in the past. But I worked for a different company when I shared those thoughts, and years have passed since [...]

A COMPREHENSIVE AUDIT of our firewalls just moved up on my list of priorities. The urgency arises from a recent incident that, fortunately, wasn't as bad as it could have [...]

MAYBE I'M AN ODDBALL, but I like the action that surrounds a merger or acquisition. I guess I need a little unplanned activity every now and then to distract me [...]

ANOTHER STEP in our relentless march toward better security: A couple of weeks ago, our network access control (NAC) initiative moved to initial deployment. Our main goal with NAC is [...]

WE SECURITY MANAGERS are always documenting processes and plans. It's a task without end, because you have to dust off those documents every once in a while and think about [...]

I AM NEVER WANTING for risks and vulnerabilities to address. These are things that can get pushed aside by the emergency of the day, budget constraints or the internal politics [...]

IT'S A GREAT THING when a security manager doesn't have to go into battle mode every time a new corporate initiative emerges. When other departments show signs that they aren't [...]

HOW COULD SPAM be an issue for a security manager in 2013? It's been years now since we all started subscribing to services that do a phenomenal job of filtering [...]

THE PLAIN VIEW DOCTRINE allows law enforcement officials to seize, without a search warrant, evidence or contraband perceptible during a lawful observation. As an example, if a police officer who [...]

MY EFFORTS to protect sensitive company data recently got a boost when we introduced encryption for files and emails to several key groups, including the human resources, finance, sales and [...]

SOME CALL IT 'shadow IT,' but I am among those who call it 'rogue IT.' Both terms refer to information technology that has made its way into an organization without [...]

IS EVERYTHING a potential security vulnerability? Is there nothing that a security manager shouldn't look at with suspicion? What, for example, could seem more innocent than an email distribution list? [...]

I THOUGHT I was a security adolescent, but I'm really just a toddler. Many IT managers can probably tell from that statement that I have been looking into maturity models. [...]

NO BUSINESS wants a customer complaining about security weaknesses in its products. If that had been the extent of what happened to my company last week, it would have been [...]

AVERY IMPORTANT piece of my budget is the quarterly allotment for security assessments. I usually focus on physical penetration testing of our major facilities or assessments of critical applications or [...]

WE HAD been making good progress in demonstrating the value of our still limited deployment of data leak prevention (DLP) technology until a setback a couple of weeks ago. Ironically, [...]

IN MY YEAR AND A HALF or so at my current company, I have slowly built a real security program where none had existed. I've introduced event management and data [...]

IT'S BUDGET TIME AGAIN, which is a good chance to assess our information security defenses and decide which areas we can best afford to beef up. Here's a look at [...]

WHEN EMPLOYEES have easy access to data, you have to trust them to do the right thing, but you also need ways to verify that they are doing the right [...]

IN THE AGE of software as a service, when just about anyone in a company can spin up an enterprise application with just a credit card and an email address, [...]

WHEN YOU WORK in any kind of security field, you are always coming up against the uglier aspects of mankind. Let's face it: There wouldn't be any malware, unauthorized access [...]

MY COMPANY has outgrown its offices and will be moving to a new facility next year. While the company as a whole will have more space, the data center will [...]

Who's Got Your Mail? When a chance discovery reveals that anyone can access an executive's email, the brainstorming begins. I'M ALWAYS AMAZED by the various ways that security deficiencies find [...]

MY MECCA is the RSA Conference, which this year was held the last week of February in San Francisco. Every year, this conference lets me meet up with past bosses, [...]

We have a lot of sensitive data on salesforce.com servers, and until now, you could access it from any device THE ACCESS POLICE have struck again. That would be me, [...]

IT'S BEEN A WHILE since we've had a security breach worth mentioning (that we know of). Last week we had one, and it was an eye-opener. A small development office [...]

WE RECENTLY deployed RSA SecurlD software authentication tokens to replace the hardware tokens we had been using to provide strong authentication for remote access via a VPN client. Hardware tokens [...]

WE'RE MAKING big strides toward our CIO's goal of enabling a 'bring your own device' (BYOD) policy. For me, it's none too soon. That's because employees are increasingly finding ways [...]