Security Management Strategies for the CIO-
Account lockout policy: Addressing too many failed login attempts
Learn how to create account lockout policies that details how many failed login attempts should be allowed before a password lock out in order to prevent a password dictionary attack.
-
Can secure FTP services protect sensitive data from hackers?
Does secure FTP services protect against hackers and attacks? In this expert response, Michael Cobb explains why using a secure FTP service is vital for handling sensitive data transfers.
-
Best practices: Separation of duties for security administrators
In this Q&A, expert Michael Cobb explores separation of duties for security administrators with access to domain controllers and servers running Windows, UNIX and Linux.
-
How to grant local admin rights with Global Policy Objects
When granting local admin rights, it's important to do it securely. Learn how to use Global Policy Objects and global security groups to do it correctly.
-
Remote webcam security surveillance: Invasion of privacy?
Using remote webcam security surveillance to check the whereabouts of stolen laptops might seem like a good idea, but is it an invasion of privacy? In this expert response, Ernie Hayden discusses t...
-
Is a PCI DSS report on compliance confidential?
Learn about the confidentiality of a PCI report on compliance, and a compliance audit report in general in this expert response from Ernie Hayden.
-
Electronic access control system and biometrics authentication
Biometrics authentication and an electronic access control system can be closely related, but they're not the same thing. In this IAM expert response, Randall Gamby explains the difference.
-
Finding the most secure database for biometric security measures
Storing biometric data is different than storing other kinds of data, so what's the most secure database to use? Learn more about biometric data efficiency and database security features in this ex...
-
Security report template: How to write an executive report
Writing a security report for executives doesn't have to be difficult or extensive, but security management expert Ernie Hayden describes how to make it comprehensive and clear.
-
Tips for writing secure SQL database code
Writing secure code is always a challenge, but it is particularly necessary for SQL databases that would otherwise be vulnerable to SQL injection attacks. Get tips on how to write secure SQL databa...
-
Test a security architecture design without an IT security consultancy
While IT security consultancies can be helpful when trying to find flaws in an information security management framework, there are ways to do it without spending the money.
-
Creating a password-reset program with corporate text messaging
Learn how to use corporate text messaging as the cornerstone of an enterprise password-reset program in this expert response from Randall Gamby.
-
How to reduce PCI DSS security scope for an audit
PCI DSS audits can be a lot easier if the scope is narrow. Learn how to consolidate and store sensitive data in order to best reduce PCI DSS security scope.
-
Password security vaults: Is SSO authentication better?
Password security vaults may be able to aid users in remembering many different passwords, but are they the most secure solutions? IAM expert Randall Gamby gives his recommendations on setting pass...
-
How to talk to executives about an information security team hire
When hiring an information security team member, how important is a certification in information security? Learn how to talk to executives about making an uncertified hire.
-
Is it possible to crack the public key encryption algorithm?
Is it possible to create a PKI encryption key that is unbreakable? IAM expert Randall Gamby weighs in.
-
Creating a secure intranet with secure file access management
Is it possible to allow employees to access sensitive information via an intranet securely? In this expert response, Randall Gamby explains how Web access management software might help.
-
HIPAA and Social Security numbers in a hospital computer network
Learn when Social Security numbers can be used for patient identification without violating HIPAA patient confidentiality requirements.
-
Who is in charge of the Massachusetts data protection law audit?
Learn more about the process of data protection audits for the Massachusetts data protection law.
-
Using application quality control tools for auditing applications
For auditing applications, most enterprises will find application quality control and assurance tools helpful. In this expert response, Randall Gamby details what types of tools there are and how t...
-
Submit your questions about infosec threats
Nick Lewis is standing by to give you free, unbiased advice on information security threats.
-
Submit your questions about IAM
Randall Gamby is standing by to give you free, unbiased advice on identity and access management.
-
Submit your questions about application security
Michael Cobb is standing by to give you free, unbiased advice on application security.
Submit a question to our experts