Get started

Get started

Bring yourself up to speed with our introductory content.

• web server security

  Web server security is the protection of information assets that can be accessed from a Web server. Continue Reading

• BSA updates: What's new in the Bank Secrecy Act?

  The Bank Secrecy Act (BSA) updates will help firms prepare for the 2015 bank examinations. Here are some of the basics from this lengthy guidance. Continue Reading

• User behavioral analytics tools can thwart security attacks

  This guide to user behavioral analytics tools helps InfoSec pros determine what features they should consider before making a purchase and reviews both deployment strategies and reasonable performance expectations. Continue Reading

• Can the Wyvern programming language improve Web app security?

  A new programming language called Wyvern is helping developers use multiple languages in one app securely. Application security expert Michael Cobb discusses. Continue Reading

• Can public key pinning improve Mozilla Firefox security?

  Public key pinning aims to reduce the lack of trust associated with digital certificates and certificate authorities. Expert Michael Cobb explains how it works and its benefits. Continue Reading

• Definitions to Get Started

  • security
  • threat modeling
  • social engineering
  • distributed denial-of-service (DDoS) attack

  • password cracking
  • National Security Agency (NSA)
  • firewall
  • Cryptography quiz questions and answers: Test your smarts

  View All Definitions

• The moving target defense: Turning the tables on polymorphic malware

  Security startups are using the techniques of polymorphic malware to better protect enterprises. Expert David Strom explores the moving target defense.Continue Reading

• When is a breach detection system better than an IDS or NGFW?

  Breach detection systems are gaining steam, but when would they be more appropriate to use than an IDS or NGFW? Expert Kevin Beaver explains.Continue Reading

• Introduction to unified threat management appliances

  Expert Ed Tittel describes unified threat management (UTM) appliances and features, and explains its advantages to organizations of all sizes.Continue Reading

• PHP security tips to ensure enterprise Web safety

  Research shows more than three-quarters of PHP installations run with at least one vulnerability. Learn the steps for ensuring PHP security in the enterprise workplace.Continue Reading

• Breaking bad password habits in the enterprise

  A bad password brings unnecessary risk into organizations, but how bad are they really? Expert Randall Gamby assesses just how dire the situation is.Continue Reading

• What are the benefits of a having a CISO title in an organization?

  Is a CISO title really necessary in an organization? Expert Mike O. Villegas explains why the title matters, as well as the qualities CISOs need to have to assert their importance.Continue Reading

• The optional PCI DSS 3.0 requirements are about to become mandatory

  Organizations need to review the PCI DSS 3.0 requirements and prepare for the mandatory changes coming in June 2015. Expert Mike Chapple explains how to prepare for the deadline.Continue Reading

• Common Vulnerabilities and Exposures (CVE)

  Common Vulnerabilities and Exposures (CVE) provides unique identifiers for publicly known security threats.Continue Reading

• Four criteria for selecting the right SSL VPN products

  SSL VPNs can offer critical protection for enterprise network communications. Expert Karen Scarfone examines the most important criteria for evaluating SSL VPN products.Continue Reading

• ISSA (Information Systems Security Association)

  The Information Systems Security Association, commonly known as ISSA, is an international, nonprofit organization for information security professionals.Continue Reading

• The three enterprise benefits of SSL VPN products

  Expert Karen Scarfone outlines the ways SSL VPN products can secure network connections and communications for organizations.Continue Reading

• Microsoft Schannel (Microsoft Secure Channel)

  The Microsoft Secure Channel or Schannel is a security package that facilitates the use of Secure Sockets Layer (SSL) and/or Transport Layer Security (TLS) encryption on Windows platforms.Continue Reading

• card-not-present fraud (card-not-present transaction)

  Card-not-present (CNP) fraud is the unauthorized use of a payment card to conduct a card-not-present transaction when the cardholder cannot or does not physically present the card at the time of the transaction.Continue Reading

• What is the best VPN traffic monitoring tool for enterprises?

  Monitoring VPN traffic is a critical task. Expert Kevin Beaver explains what to look for in a VPN traffic monitoring tool and offers a few free and open source options for enterprises to consider.Continue Reading

• Introduction to SSL VPN products in the enterprise

  Virtual private networks secure the confidentiality and integrity of network communications. Expert Karen Scarfone explains how SSL VPN products work.Continue Reading

• Regin malware

  Regin is a complex strain of back-door Trojan malware that uses a multi-staged, modular approach to infect its targets for the purpose of monitoring user activity and stealing data.Continue Reading

• Google Project Zero

  Google Project Zero is a security research unit within Google Inc.Continue Reading

• Android WebView

  Android WebView is a component that allows Web developers to render a web page within an Android app.Continue Reading

• evil twin

  An evil twin, in security, is a rogue wireless access point that masquerades as a legitimate hot spot.Continue Reading

• What is the best super-sized cookie denial-of-service attack defense?

  Super-sized cookies are behind an innovative new denial-of-service attack. Enterprise threats expert Nick Lewis discusses how to prevent these cookies from getting onto your network.Continue Reading

• Bring Your Own Authentication (BYOA)

  Bring Your Own Authentication (BYOA) is a computing concept in which employee-owned devices are used as authentication credentials within the enterprise.Continue Reading

• Creating an end-of-life policy for mobile products in the enterprise

  When mobile vendors stop maintaining security on their devices, enterprise data is at risk. Expert Michael Cobb discusses how to assess mobile product end of life and how to create end-of-life policies and controls to maintain BYOD safety.Continue Reading

• Ways to secure Web apps: WAFs, RASP and more

  Protecting a Web application increasingly means tuning your protections to the individual characteristics of your applications. There’s more than one way to go about this, though. In this three-part guide we review best practices for taking your Web...Continue Reading

• RASP is latest grasp at secure software delivery

  Runtime application self-protection could provide more secure software applications after delivery, but you need to recognize its limitations.Continue Reading

• The top full disk encryption products on the market today

  Full disk encryption can be a key component of an enterprise's desktop and laptop security strategy. Here's a look at some of the top FDE products in the industry.Continue Reading

• How will Android encryption by default affect enterprise BYOD?

  Google is beginning to encrypt data by default on its Android devices. Expert Michael Cobb explains how this change will affect enterprise BYOD security.Continue Reading

• How does the Melbourne Shuffle prevent data access pattern recognition?

  Access pattern recognition in the cloud is becoming an enterprise risk. Expert Michael Cobb explains how the Melbourne Shuffle can improve access pattern security.Continue Reading

• How to bake security into your Wi-Fi deployment

  A Wi-Fi deployment is the preferred method for network access for most enterprises; it’s the InfoSec’s job to make that Wi-Fi secure.Continue Reading

• The secrets of proper firewall maintenance and security testing techniques

  The Verizon 2015 PCI Compliance Report cited a lack of firewall maintenance and security testing as major causes for compliances breaches. Expert Kevin Beaver offers tips to successfully manage these tasks.Continue Reading

• How can organizations prepare for a HIPAA audit?

  HIPAA audits are finally on the way, and organizations need to be ready. Expert Mike Chapple reveals the best way to prepare your company for a HIPAA audit.Continue Reading

• Login credential security: How to defend against tabnapping

  Tabnapping can be used to capture user login credentials. Enterprise threats expert Nick Lewis explains how to defend against the risk.Continue Reading

• The benefits of open source identity management software

  Organizations are often looking to minimize costs without compromising on security. Expert Randall Gamby examines the benefits of open source identity management software.Continue Reading

• What are the secrets to SIEM deployment success?

  Many organizations deploy security information and event management systems without the proper planning and therefore can't reap the proper rewards. Expert Kevin Beaver offers tips for a successful implementation.Continue Reading

• Beyond PCI: Out-of-band security tips for credit card data protection

  Securing credit card data -- both online and at brick-and-mortar stores -- requires security measures beyond those mandated by PCI DSS. Expert Philip Alexander outlines six out-of-band security controls to consider.Continue Reading

• Introduction to security analytics tools in the enterprise

  Expert Dan Sullivan explains how security analysis and analytics tools work, and how they provide enterprises with valuable information about impending attacks or threats.Continue Reading

• How should agencies prepare for federal security scanning?

  What do agencies need to consider before going through the Department of Homeland Security's network security scanning? Expert Mike Chapple answers.Continue Reading

• International Information Systems Security Certification Consortium (ISC)2

  The International Information Systems Security Certification Consortium -- (ISC)2 -- is a non-profit organization that provides security training and certificates.Continue Reading

• Four questions to ask before buying a Web application firewall

  Web application firewalls are complex products. Expert Brad Causey explains the key criteria enterprises need to consider before investing in a WAF product.Continue Reading

• Five network security lessons learned from the Sony Pictures hack

  Following the Sony Pictures hack, several of the company's network security shortcomings were revealed. Expert Kevin Beaver explains how better network security may have prevented the extent of the breach.Continue Reading

• What to look for in secure file transfer products

  As the prospect of significant breaches grows, the argument for secure file transfer becomes more compelling—but what exactly are you buying?
  
  At its most basic, file transfer technology is simply a mechanism to transport a file from one ...Continue Reading

• Six ways to use wireless intrusion prevention systems in the enterprise

  Expert George V. Hulme presents six real-world use cases for the deployment of WIPS to beef up wireless network security in the enterprise.Continue Reading

• single-factor authentication (SFA)

  Single-factor authentication (SFA) is the traditional security process that requires a user name and password before granting access to the user.Continue Reading

• Can Vawtrak malware block enterprise security software?

  Emerging malware, like the Vawtrak banking malware, has the ability to block enterprise antimalware measures. Expert Nick Lewis explains how to mitigate the risk.Continue Reading

• Intrusion detection project design and rollout

  Evaluating intrusion detection technology requires an understanding of its capabilities. Get help with getting started on an intrusion system program design and uncover technical considerations your enterprise needs to know.Continue Reading

• Introduction to intrusion detection and prevention technologies

  Intrusion detection and preventions systems can be critical components to an enterprise's threat management strategy. Learn the history behind the technologies and why they are so important.Continue Reading

• Emotet: How can traffic-sniffing banking malware be thwarted?

  A new variety of banking malware can sniff traffic from APIs. Enterprise threats expert Nick Lewis outlines how to mitigate the risk.Continue Reading

• Types of intrusion detection products: Suite vs. best-of-breed

  When evaluating types of intrusion detection products, it is important to distinguish whether a best-of-breed or suite-based product is the right match for your enterprise. Expert Bill Hayes offers guidance to help you decide.Continue Reading

• Evaluating intrusion detection and prevention systems and vendors

  Protecting the corporate network from intruders is a difficult task. Learn how intrusion systems help prevent, identify and minimize the effects of a breach.Continue Reading

• Oracle Critical Patch Update (Oracle CPU)

  The Oracle Critical Patch Update (CPU) is an ongoing series of regularly issued fixes for security flaws in products made by or maintained by software giant Oracle Corp.Continue Reading

• Business-use scenarios for a Web application firewall deployment

  Web application firewalls can be a critical security layer for many companies. Expert Brad Causey explains when and how to deploy a WAF in the enterprise.Continue Reading

• How can jailbroken devices be detected within the enterprise?

  Jailbroken devices pose significant enterprise risks in BYOD environments. Security expert Michael Cobb discusses how to detect and mitigate the risks of jailbroken BYODs.Continue Reading

• knowledge-based authentication (KBA)

  In a KBA scheme, the user is asked to answer at least one "secret" question before being allowed to change account settings or reset a password.Continue Reading

• Why is the Certified Ethical Hacker certification suddenly popular?

  The Certified Ethical Hacker certification gained in popularity recently. Expert Joseph Granneman explains the CEH and why it's relevant again.Continue Reading

• Getting to know the new GIAC certification: GCCC

  The new GIAC certification, GCCC, is not a very specific certification, but it could prove useful in organizations. Expert Joseph Granneman explains why.Continue Reading

• How to evaluate IPv6 network security with SI6 Networks IPv6 Toolkit

  Some security pros underestimate the importance of IPv6 network security assessment tools. Expert Fernando Gont offers an illustrated guide on how to use SI6 Networks' free IPv6 toolkit.Continue Reading

• Defend against APTs with big data security analytics

  Without a trace: Cybersecurity incident response teams must follow the thread of security events through volumes of log data from increasingly diverse sources.Continue Reading

• Mini risk assessments: Simplifying protection of critical assets

  Expert Eric Cole explains how his simplified, risk-based approach to security will help enterprises better identify -- and prevent -- the most dangerous threats.Continue Reading

• What's the best way to find enterprise compliance tools?

  Looking for compliance tools? Expert Mike Chapple explains why the best place to start the search is within your own information security infrastructure.Continue Reading

• Understanding endpoint security products, features and vendors

  Securing a plethora of enterprise endpoints is challenging. This guide will help you evaluate endpoint security capabilities, products and vendors.Continue Reading

• How to increase the importance of information security in enterprises

  Expert Mike Villegas explains how to use the Three C's to emphasize the importance of information security within an organization.Continue Reading

• What is endpoint security? What benefits does it offer?

  The increased number of smartphones, laptops and other endpoints in the enterprise is a major security concern. Learn what endpoint security is and how it can help combat your enterprise security woes.Continue Reading

• Endpoint protection software features and functionality

  Learn about the different capabilities endpoint protection software often includes and the security benefits each of these capabilities have to offer.Continue Reading

• Detecting backdoors: The Apple backdoor that never was?

  The debate over the purported Apple backdoor leaves enterprises asking, "When is a backdoor not a backdoor?" Application security expert Michael Cobb explains the difference.Continue Reading

• A first look at Windows 10 security features

  In a preview of Windows 10 security features, expert Michael Cobb discusses three improvements that will boost enterprise security.Continue Reading

• single-factor token

  A single-factor token is a small hardware device that produces one confirming credential for user authentication; the devices may be used in conjunction with other types of credentials for multifactor authentication.Continue Reading

• multifactor token

  Multifactor tokens are security tokens that use more than one category of credential to confirm user authentication. The standard categories of authentication credentials are knowledge factors things that the user knows) inherence factors (things ...Continue Reading

• mobile authentication

  Mobile authentication is the verification of a user’s identity through the use a mobile device and one or more authentication methods for secure access.Continue Reading

• shared secret

  A shared secret is data known to only the two entities involved in a communication so that either party's possession of that data can be provided as proof of identity for authentication.Continue Reading

• grid authentication

  Grid authentication is a method of ensuring that an end user is who he claims to be by requiring him to enter values from specific cells in a grid whose content should be only accessible to him and the service provider. Because the grid consists of ...Continue Reading

• soft token

  A soft token is a software-based security token that generates a single-use login PIN. Traditionally, a security token has been a hardware device that produces a new, secure and individual PIN for each use and displays it on a built-in LCD display.Continue Reading

• out-of-band authentication

  Out-of-band authentication is a type of two-factor authentication that requires a secondary verification method through a separate communication channel along with the typical ID and password. Out-of-band authentication is often used in financial ...Continue Reading

• inherence factor

  The inherence factor, in a security context, is a category of user authentication credentials consisting of elements that are integral to the individual in question, in the form of biometric data.Continue Reading

• possession factor

  The possession factor, in a security context, is a category of user authentication credentials based on items that the user has with them, typically a hardware device such as a security token or a mobile phone used in conjunction with a software ...Continue Reading

• knowledge factor

  The knowledge factor, in a security context, is a category of authentication credentials consisting of information that the user possesses, such as a personal identification number (PIN), a user name, a password or the answer to a secret question.Continue Reading

• Can OAuth 2.0 strengthen authentication?

  Security expert Michael Cobb explains what Open Authorization or OAuth 2.0 is, its pros and cons, and how it is different from bring your own identity.Continue Reading

• Social Engineering Penetration Testing

  In this excerpt of Social Engineering Penetration Testing, the authors outline what phishing attacks are and outline how these attacks work using multiple real-world examples.Continue Reading

• Python Forensics: A Workbench for Inventing and Sharing Digital Forensic Technology

  In this excerpt of Python Forensics, author Chet Hosmer offers some ground rules for using the Python programming language in forensic applications.Continue Reading

• How can forged certificates from trusted vendors be stopped?

  Unauthorized certificates from trusted vendors have become a big Internet security concern. Expert Michael Cobb discusses how to stay protected against this threat.Continue Reading

• four-factor authentication (4FA)

  Four-factor authentication (4FA) is the use of four types of identity-confirming credentials, typically categorized as knowledge, possession, inherence and location factors.Continue Reading

• three-factor authentication (3FA)

  Three-factor authentication (3FA) is the use of identity-confirming credentials from three separate categories of authentication factors – typically, the knowledge, possession and inherence categories.Continue Reading

• one-time password token (OTP token)

  A one-time password token (OTP token) is a security hardware device or software program that is capable of producing a single-use password or PIN passcode.Continue Reading

• Finding an enterprise SIEM: What problems are you trying to solve?

  Purchasing a SIEM system isn't as easy as picking a product off of the shelf. Expert Adrian Lane explains how your enterprise can figure out exactly what it needs from a SIEM, making the evaluating process a lot simpler.Continue Reading

• Google Authenticator

  Google Authenticator is a security application used to verify user identities before granting access to websites and services. The application uses a two-step verification process involving two-factor authentication to make it less likely that an ...Continue Reading

• two-step verification

  Two-step verification requires the sequential use of two authentication methods to verify that someone or something is who or what they are declared to be. In contrast with two-factor authentication processes, the methods in two-step verification ...Continue Reading

• Duo Security

  Duo Security is a vendor of cloud-based two-factor authentication products.Continue Reading

• Shellshock

  Shellshock is the common name for a coding vulnerability found in the Bash shell user interface that affects Unix-based operating systems, including Linux and Mac OS X, and allows attackers to remotely gain complete control of a system.Continue Reading

• Understanding security flaws in IPv6 addressing schemes

  Expert Fernando Gont explains why underlying characteristics of IPv6 address-generation schemes may enable nodes to be targeted in IPv6 address-scanning attacks.Continue Reading

• authentication factor

  An authentication factor is a category of credential used for identity verification. The three most common categories are often described as something you know (the knowledge factor), something you have (the possession factor) and something you are ...Continue Reading

• Pretty Good Privacy (PGP)

  Pretty Good Privacy or PGP is a popular program used to encrypt and decrypt email over the Internet, as well as authenticate messages with digital signatures and encrypted stored files.Continue Reading

• Data Encryption Standard (DES)

  The Data Encryption Standard (DES) is an outdated symmetric-key method of data encryption.Continue Reading

• The fundamentals of FDE: Full disk encryption in the enterprise

  Expert Karen Scarfone examines full disk encryption, or FDE, tools and describes how the security technology protects data at rest on a laptop or desktop computer.Continue Reading

• 2014 Information Security Readers' Choice Winners

  The votes are tallied. The readers have spoken. Information Security is honoring readers’ picks for the best security hardware, appliances and services in our ninth-annual Readers’ Choice Awards.Continue Reading

• Inside DLP: Full-suite products, DLP lite, content analysis

  Data loss prevention (DLP) can be a confusing technology. Security expert Rich Mogull discusses the difference between DLP and DLP lite, as well as the ins and outs of content analysis.Continue Reading

• The three stages of the ISO 31000 risk management process

  The ISO 31000 risk management process proposes three stages. Expert Mike Chapple reviews this alternative to the ISO 27001 framework.Continue Reading

• An intro to automated penetration testing

  In this exploratory article, expert Mike Chapple explains what automated penetration testing is, why it is useful and how to start building an enterprise penetration tester toolkit.Continue Reading