Search

A SECURITY MANAGER needs a philosophy about how to address security issues, and I find that many elements of mine can be reduced to a few words that almost amount [...]

Two security initiatives will languish if staffers have no incentive to work on them. Solution? Tie them to bonus pay. FOR SEVERAL MONTHS NOW, I have been proactively identifying risks [...]

SSO will bring several benefits, but our manager has to be prepared to address any security lapses that could accompany it. MY COMPANY, like most, has been letting go of [...]

IN THE PAST FEW WEEKS, I was able to dig deep into security issues (by attending the Black Hat security conference), and then concentrate on the basics (by getting our [...]

Traditional vulnerability management doesn't always catch security issues. That's why you need input from as many sources as possible. VULNERABILITIES can take many forms, and you can't expect to uncover [...]

ONE THING that we security managers can be sure of is this: There is no guarantee that we won't suffer a security breach. In fact, the odds are increasing all [...]

LOOKING AROUND at how things are done at my new company, it's pretty easy for me to find security problems lurking virtually everywhere. For example, the first thing I noticed [...]

One-time passwords, tokens, smart cards and public-key infrastructure are all excellent methods for creating access- control architectures. My company is in the process of implementing a token-based infrastructure for access […]

Two-factor authentication: This authentication method requires users to provide something that they have (a token) and something that they know (a PIN). The user creates the PIN when the token […]

The security infrastructure we have needs a lot of work. A year ago, we had fewer than 1,000 employees. Today, that number exceeds 7,000. We have no security policies, our […]

Mention the word virus to a seasoned information security professional, and he will likely cringe and pass it off as an IT problem. Until recently, I thought the same. I […]

You've just completed an extensive vulnerability assessment and have compiled the results. You give the report to the appropriate manager, who decides not to implement some of the corrective actions […]

Recently, I've been studying for the Certified Information Systems Security Professional (CISSP) certification. I took the exam a few weeks ago and just found out that I passed. I had […]

Since the tragedy on Sept. 11, I've thought about what I can do to prepare this company in the event that another terrorist act occurs and we are somehow victimized. […]

Digital steganography: This is the art of hiding documents, such as word processing files, spreadsheets or maps, inside other files. Practitioners commonly use graphics files to hide the information, but […]

My company is about to deploy a virtual private network (VPN). During a recent project meeting, the project manager asked each department representative to identify six tasks related to our […]

Until now, I've always worked at dot-coms and small start-ups. Now, I've taken a position at an established company that has been around for more than 40 years. You'd think […]

You might think that with all the excitement at my company during the past month, job security wouldn't be an issue for this security manager. After all, I'm responsible for […]

I'd just sat down with a fresh cup of coffee when an e-mail popped up on my screen with a subject line that read: "Engineering Oracle database has been hacked." […]

This has been a rough week. It all started when I decided that I needed to lock down administrative access to our production network. Unfortunately, all didn't go according to […]

It's funny how even the mere whisper of the word security causes the masses to flock to the security manager's cube. I often get pulled into situations, meetings or projects […]

I configured our intrusion-detection system (IDS) network sensors this week. For the software, I decided to go with Atlanta-based Internet Security Systems Inc.'s RealSecure. I'm familiar with the product, and […]

http://secinf.net/iidse.html: Readers interested in learning more about network security and intrusion detection should check out the Network Security Library Web site. The site, which acts as an information repository for […]

I'm sitting at my desk, having a cup of coffee and a toasted bagel when I notice this young, blond, pimply-faced kid standing outside my cube with this smirk on […]

Editor's note: Last week, Security Manager's Journal contributor Jude Thaddeus decided to pass the baton, but our new author, 'Mathias Thurman,' is ready to take the next lap. New to […]

WHEN IT WAS TIME to write this column, the only thing on my mind was the OpenSSL Heartbleed vulnerability. If you have anything to do with infosec, it was probably [...]

THANK YOU, Target! It's a pity that security managers have to capitalize on other organizations' misfortunes to broker change within their own enterprises, but the notorious Target breach of late [...]

IMPLEMENTING TECHNOLOGY to monitor user and network activity can be an eye-opener. Our security incident and event management tool made us suddenly aware of the magnitude of infestation on our [...]

WE LOOKED into mobile device management (MDM) in 2012, but the time didn't seem right. Now, some 18 months later, things have changed, and MDM is looking more like a [...]

SECURITY INCIDENTS are a complete disruption of my normal day-to-day activities. I love them. I especially like it when they uncover systemic problems we might not otherwise have found out [...]

EVERY FALL, I conduct a policy review. I think it's a good idea to have this on my calendar, because no policy, no matter how well crafted, is meant to [...]

WE JUST found 30 servers that can't be accounted for. Thirty Internet-facing servers with no malware protection and patchy patch histories. I need to take a deep breath and figure [...]

I LOVE DLP! That's not a statement that would sell a chief financial officer on data leak prevention, but I can show real ROI from our deployment as well. Our [...]

I TOOK SOMEBODY'S WORD for something, and I didn't subsequently check it out to my own satisfaction. Result: big trouble. Lesson: always verify. I learned that lesson last week, when [...]

IT'S BUDGET SEASON, which means I get to create a wish list of security goodies I'd like to buy. I prefer to have a theme for my wish list. A [...]

THE DATA CLASSIFICATION policy that I introduced a couple of years ago has served the company well, but now the global architecture team has pointed out its limits. We have [...]

I HAVE SHUNNED OFFSHORING and have written about my concerns in the past. But I worked for a different company when I shared those thoughts, and years have passed since [...]

A COMPREHENSIVE AUDIT of our firewalls just moved up on my list of priorities. The urgency arises from a recent incident that, fortunately, wasn't as bad as it could have [...]

WE SECURITY MANAGERS are always documenting processes and plans. It's a task without end, because you have to dust off those documents every once in a while and think about [...]

I AM NEVER WANTING for risks and vulnerabilities to address. These are things that can get pushed aside by the emergency of the day, budget constraints or the internal politics [...]

IT'S A GREAT THING when a security manager doesn't have to go into battle mode every time a new corporate initiative emerges. When other departments show signs that they aren't [...]

HOW COULD SPAM be an issue for a security manager in 2013? It's been years now since we all started subscribing to services that do a phenomenal job of filtering [...]

THE PLAIN VIEW DOCTRINE allows law enforcement officials to seize, without a search warrant, evidence or contraband perceptible during a lawful observation. As an example, if a police officer who [...]

MY EFFORTS to protect sensitive company data recently got a boost when we introduced encryption for files and emails to several key groups, including the human resources, finance, sales and [...]

SOME CALL IT 'shadow IT,' but I am among those who call it 'rogue IT.' Both terms refer to information technology that has made its way into an organization without [...]

I THOUGHT I was a security adolescent, but I'm really just a toddler. Many IT managers can probably tell from that statement that I have been looking into maturity models. [...]

AVERY IMPORTANT piece of my budget is the quarterly allotment for security assessments. I usually focus on physical penetration testing of our major facilities or assessments of critical applications or [...]

WE HAD been making good progress in demonstrating the value of our still limited deployment of data leak prevention (DLP) technology until a setback a couple of weeks ago. Ironically, [...]

IT'S BUDGET TIME AGAIN, which is a good chance to assess our information security defenses and decide which areas we can best afford to beef up. Here's a look at [...]

WHEN EMPLOYEES have easy access to data, you have to trust them to do the right thing, but you also need ways to verify that they are doing the right [...]