Search

A SECURITY MANAGER needs a philosophy about how to address security issues, and I find that many elements of mine can be reduced to a few words that almost amount [...]

Two security initiatives will languish if staffers have no incentive to work on them. Solution? Tie them to bonus pay. FOR SEVERAL MONTHS NOW, I have been proactively identifying risks [...]

SSO will bring several benefits, but our manager has to be prepared to address any security lapses that could accompany it. MY COMPANY, like most, has been letting go of [...]

IN THE PAST FEW WEEKS, I was able to dig deep into security issues (by attending the Black Hat security conference), and then concentrate on the basics (by getting our [...]

Traditional vulnerability management doesn't always catch security issues. That's why you need input from as many sources as possible. VULNERABILITIES can take many forms, and you can't expect to uncover [...]

ONE THING that we security managers can be sure of is this: There is no guarantee that we won't suffer a security breach. In fact, the odds are increasing all [...]

LOOKING AROUND at how things are done at my new company, it's pretty easy for me to find security problems lurking virtually everywhere. For example, the first thing I noticed [...]

Security managers who are responsible for managing corporate firewalls, virtual private network (VPN) gateways, routers and other devices will understand the headaches I'm facing this week. Prior to my arrival […]

One-time passwords, tokens, smart cards and public-key infrastructure are all excellent methods for creating access- control architectures. My company is in the process of implementing a token-based infrastructure for access […]

Two-factor authentication: This authentication method requires users to provide something that they have (a token) and something that they know (a PIN). The user creates the PIN when the token […]

www.cert.org/advisories/CA-2001-26.html: This is the original CERT advisory with details on the Nimda worm. www.treachery.net/~jdyson/earlybird/: Earlybird is a free, real-time worm reporting tool. It watches Web logs for suspicious activity and […]

The security infrastructure we have needs a lot of work. A year ago, we had fewer than 1,000 employees. Today, that number exceeds 7,000. We have no security policies, our […]

Mention the word virus to a seasoned information security professional, and he will likely cringe and pass it off as an IT problem. Until recently, I thought the same. I […]

Most antivirus software companies offer a range of products for content filtering, e-mail attachment stripping and desktop and file server virus protection. I have used and feel comfortable with the […]

You've just completed an extensive vulnerability assessment and have compiled the results. You give the report to the appropriate manager, who decides not to implement some of the corrective actions […]

Recently, I've been studying for the Certified Information Systems Security Professional (CISSP) certification. I took the exam a few weeks ago and just found out that I passed. I had […]

Triple Data Encryption Standard (Triple DES): This encryption technique, used in wide-area wireless networks, is based on the Data Encryption Standard, a 56-bit private-key algorithm developed by IBM for encrypting […]

This month, I'm going in two directions at once. I have had several tasks to complete in light of the Sept. 11 tragedy in order to reduce the impact of […]

The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, by Ronald L. Krutz, Russell Dean Vines and Edward M. Stroz (Wiley, 2001). This is the best book for […]

Since the tragedy on Sept. 11, I've thought about what I can do to prepare this company in the event that another terrorist act occurs and we are somehow victimized. […]

Digital steganography: This is the art of hiding documents, such as word processing files, spreadsheets or maps, inside other files. Practitioners commonly use graphics files to hide the information, but […]

In my last column \['Security Review Gets No Respect From Managers,' Aug. 27\], I talked about the problems I was having at my company trying to convince managers on the […]

My company is about to deploy a virtual private network (VPN). During a recent project meeting, the project manager asked each department representative to identify six tasks related to our […]

If you're in any way involved in information security, you owe it to yourself to make a trip to Def Con. The ninth annual conference was held in Las Vegas […]

To properly secure the IT infrastructure of my company, I need to determine how the systems are connected in relation to one another. Unfortunately, we have no network diagrams depicting […]

Until now, I've always worked at dot-coms and small start-ups. Now, I've taken a position at an established company that has been around for more than 40 years. You'd think […]

You might think that with all the excitement at my company during the past month, job security wouldn't be an issue for this security manager. After all, I'm responsible for […]

Interrupt mode: You've gotta love it. My day was going just fine, and I was even thinking of leaving early and driving down to the beach for the afternoon when […]

I'd just sat down with a fresh cup of coffee when an e-mail popped up on my screen with a subject line that read: "Engineering Oracle database has been hacked." […]

This has been a rough week. It all started when I decided that I needed to lock down administrative access to our production network. Unfortunately, all didn't go according to […]

Conducting 'fire drills' is an important part of my job. I conduct various drills throughout the year to test our company's ability to react to different types of security-related events. […]

It's funny how even the mere whisper of the word security causes the masses to flock to the security manager's cube. I often get pulled into situations, meetings or projects […]

I configured our intrusion-detection system (IDS) network sensors this week. For the software, I decided to go with Atlanta-based Internet Security Systems Inc.'s RealSecure. I'm familiar with the product, and […]

I'm sitting at my desk, having a cup of coffee and a toasted bagel when I notice this young, blond, pimply-faced kid standing outside my cube with this smirk on […]

Editor's note: Last week, Security Manager's Journal contributor Jude Thaddeus decided to pass the baton, but our new author, 'Mathias Thurman,' is ready to take the next lap. New to […]

THE RESOURCES on our network have been given too much access to the Internet, and we need to curb that. One of my primary security philosophies is the rule of [...]

WHEN IT WAS TIME to write this column, the only thing on my mind was the OpenSSL Heartbleed vulnerability. If you have anything to do with infosec, it was probably [...]

MY COMPANY is always looking for ways to save money. One maneuver--outsourcing the development of a module of one of our software products--almost cost us big time. We had chosen [...]

IT STARTED OUT as a simple call to the help desk from an engineer at one of our major development centers: Phone calls were being dropped. Soon, similar complaints were [...]

THANK YOU, Target! It's a pity that security managers have to capitalize on other organizations' misfortunes to broker change within their own enterprises, but the notorious Target breach of late [...]

As a security manager. I expect my company to be hit by ma I ware infestations, data theft, denial-of-service attacks and attempts at unauthorized access. 1 deal with them all [...]

IMPLEMENTING TECHNOLOGY to monitor user and network activity can be an eye-opener. Our security incident and event management tool made us suddenly aware of the magnitude of infestation on our [...]

WE LOOKED into mobile device management (MDM) in 2012, but the time didn't seem right. Now, some 18 months later, things have changed, and MDM is looking more like a [...]

SECURITY INCIDENTS are a complete disruption of my normal day-to-day activities. I love them. I especially like it when they uncover systemic problems we might not otherwise have found out [...]

EVERY FALL, I conduct a policy review. I think it's a good idea to have this on my calendar, because no policy, no matter how well crafted, is meant to [...]

WE JUST found 30 servers that can't be accounted for. Thirty Internet-facing servers with no malware protection and patchy patch histories. I need to take a deep breath and figure [...]

I LOVE DLP! That's not a statement that would sell a chief financial officer on data leak prevention, but I can show real ROI from our deployment as well. Our [...]

I TOOK SOMEBODY'S WORD for something, and I didn't subsequently check it out to my own satisfaction. Result: big trouble. Lesson: always verify. I learned that lesson last week, when [...]

IT'S BUDGET SEASON, which means I get to create a wish list of security goodies I'd like to buy. I prefer to have a theme for my wish list. A [...]