Manage

Cloud Data Storage Encryption and Data Protection Best Practices

• Wireless access point security: Defending against Chameleon malware

  Chameleon malware targets insecure wireless access points. Enterprise threats expert Nick Lewis explains how to defend against the malware. Continue Reading

• CISSP quiz: Access control models and components

  Test your knowledge of the CISSP exam's Access Control Domain by taking this practice quiz, which covers topics including access control models, one-time passwords, IPS/IDS and more. Continue Reading

• The importance of an IT security governance body

  An IT security governance board is a key feature in security budgeting, but who makes up this body? Expert Joseph Granneman outlines the best structure for security governance boards. Continue Reading

• CISSP training video: Access control models, administration, IPS/IDS

  In this CISSP Essentials Security School presentation, expert instructor Shon Harris explains different types of access control models, access control administration and IPS/IDS technologies. Continue Reading

• How to conduct a next-generation firewall evaluation

  Before buying a next-generation firewall, read this essential guide that will walk your business through the process, from evaluation to purchase. Continue Reading

• CISSP online training: Information security governance, risk management

  Spotlight article: Shon Harris offers an in-depth look at the topics covered in the CISSP domain on infosec governance and risk management.Continue Reading

• CISSP training video: Security enterprise architecture

  In this CISSP Essentials Security School presentation, expert Shon Harris discusses security enterprise architectures and their importance to the CISSP Information Security Governance and Risk Management domain.Continue Reading

• CISSP quiz: Information security governance and risk management

  Test your knowledge of the Information Security Governance and Risk Management domain of the CISSP exam by taking this practice quiz.Continue Reading

• CISSP Essentials: Domain 1, Information Security Governance and Risk Management

  In this CISSP Essential Security School lesson, learn about security management practices for securing information and assets.Continue Reading

• Hacking with Kali: Practical Penetration Testing Techniques

  In this excerpt of Hacking with Kali: Practical Penetration Testing Techniques, authors James Broad and Andrew Bindner outline the five phases of the penetration testing lifecycle.Continue Reading

• Ranum Q&A with Renee Guttmann: Thriving in the CISO role

  A Fortune 500 veteran chats with Marcus Ranum about her management career and what it takes to reach the top of the security pyramid.Continue Reading

• Open source software security: Who can you trust?

  Fears of backdoors and heightened concerns about encryption software are running rampant.Continue Reading

• Operational challenges as cybersecurity gets sensored

  As networking technologies move onto the factory floor, security executives bridge the gap between IT and industrial network security.Continue Reading

• CISSP introduction: A video guide to the CISSP exam

  In this CISSP Essentials Security School presentation, expert instructor Shon Harris offers a CISSP introduction. Learn about the 10 domains of the Common Body of Knowledge, typical exam content and what to expect after you pass the test.Continue Reading

• The key to assigning risk values in an IT security risk assessment

  Security expert Michael Cobb offers pointers on how to assign risk values during a security risk assessment.Continue Reading

• Next-generation firewall benefits: Is an NGFW best for your company?

  A next-generation firewall won't meet the security needs of every single organization. Before making the move to next generation, be sure your enterprise understands these key decision criteria.Continue Reading

• CISSP self-assessment quiz: Check your CISSP test knowledge

  Take this CISSP self-assessment quiz to check your general knowledge of CISSP test topics and learn where you need to hone your skills.Continue Reading

• Using metadata tagging tools for PCI DSS compliance

  Metadata tagging is not just for security. Expert Mike Chapple explains how tagging tools can be used to achieve PCI DSS compliance.Continue Reading

• The gaping hole in your vulnerability management program

  Authenticated vulnerability scanning may be just what your organization needs to complete its vulnerability management program. In this video, expert Kevin Beaver offers pointers for performing an authenticated vulnerability scan.Continue Reading

• RTF security: Avoiding embedded malware

  The Zeus malware is threatening RTF security by embedding itself in the file, which is commonly seen as safer than other file formats such as PDFs. Learn how to prevent the threat.Continue Reading

• How to detect Android malware that leverages TOR

  A new variety of Android malware is using TOR for C&C communications. Expert Nick Lewis explains how to mitigate the threat.Continue Reading

• Next-generation tools for next-generation network security

  The next-generation network -- one that must encompass the cloud, mobility and Internet of Things devices -- requires a different standard of network monitoring tools. Learn about new and improved tools that conquer those challenges.Continue Reading

• Turla spyware: Defending against undetectable malware

  Is there a way to detect malware that's designed to avoid detection? Nick Lewis explains how the Turla spyware works and how to defend against it.Continue Reading

• GICSP: Deconstructing SANS Institute's new ICS security cert

  A new SANS Institute certification, GICSP, could prove useful to industrial control system (ICS) security professionals. Expert Ernie Hayden explains the certification and how to prepare for the exam.Continue Reading

• Updating network diagrams for PCI DSS 3.0 compliance

  Compliance with the PCI DSS 3.0 requirements means enterprises need to update their network diagrams. Mike Chapple outlines how to make these changes.Continue Reading

• Network security: Threat intelligence feeds parse a sea of data

  Threat intelligence feeds help you prioritize signals from internal systems against unknown threats. Security intelligence takes it a step further.Continue Reading

• Is FedRAMP the cloud security standard we've been waiting for?

  FedRAMP raises the bar for security among applicable cloud providers, but can it influence broader cloud computing contracts and standards?Continue Reading

• The NoSQL challenge: What's in store for big data and security

  Big data offers horizontal scalability, but how do you get your database security to scale along with it?Continue Reading

• Vulnerability management: Benefits of a vulnerability scoring system

  What are the pros and cons of using a universal vulnerability scoring system from a vendor? Nick Lewis explains.Continue Reading

• Developing a compliance awareness training program

  Developing a compliance awareness training program is key to preventing accidental internal compliance breaches. Expert Mike Chapple explains the steps to follow when starting such a program.Continue Reading

• Non-malicious insiders: The biggest insider threat of all?

  Video: Insider threats expert Randy Trzeciak explains why non-malicious insiders, particularly developers, pose as much risk to an enterprise as intentionally malicious insiders.Continue Reading

• Pretexting: How to avoid social engineering scams

  Expert Nick Lewis explains how to keep call center employees from getting duped by social engineering scams and pretexting.Continue Reading

• Mobile keyloggers and touchscreen detection attacks

  A recent proof of concept shines new light on the future of mobile keyloggers. Michael Cobb reviews how to keep touchscreen devices safe from attack.Continue Reading

• Building the business case for a formal patch management program

  Delaying security patches is a huge risk. Michael Cobb explains how to build the business case for a formal patching program for a variety of systems.Continue Reading

• Multifactor authentication key to cloud security success

  Following the collapse of an AWS-based cloud hosting provider, experts say enterprises should prioritize use of multifactor authentication.Continue Reading

• P2P malware detection techniques

  The amount of malware using peer-to-peer communications has increased dramatically. Enterprise threats expert Nick Lewis explains how to detect P2P malware.Continue Reading

• Sandbox evasion: How to detect cloaked malware

  Cloaked malware, like DGA.Changer, can reportedly evade sandbox detection. Nick Lewis explains how to handle the risk.Continue Reading

• Whaling attacks: Taking phishing attacks to the next level

  Whaling attacks take phishing to the next level with much bigger targets. Enterprise threats expert Nick Lewis explains how to mitigate the risk.Continue Reading

• On prevention vs. detection, Gartner says to rebalance purchasing

  At its annual security confab, the research giant said enterprises buy too much threat prevention and not enough detection and response technology.Continue Reading

• Choosing PCI DSS-compliant service providers

  Learn how hiring the right PCI DSS-compliant service providers, especially payment services providers, can reduce your compliance burden.Continue Reading

• Third-party vendor management security best practices

  Third-party vendor management is important for avoiding incidents like the Target breach. Joseph Granneman offers four must-have security controls.Continue Reading

• How to use TripWire SecureScan, a free vulnerability scanning tool

  Video: Learn how to use TripWire SecureScan, the free vulnerability scanning tool that helps enterprises detect Heartbleed on networks and devices.Continue Reading

• API gateways emerge to address growing security demands

  With mobile, cloud and the Internet of Things driving massive API growth, experts say now is the time for API gateway technology to shine.Continue Reading

• The top five employee responsibilities in a BYOD security strategy

  Behind any successful enterprise BYOD strategy are employees who do the right things.Continue Reading

• How to hone an effective vulnerability management program

  You must know your system's weak points to form an effective risk management program and a strong defense.Continue Reading

• Cyberthreat intelligence is getting crowded

  As threat intelligence communities multiply, it may be time to revisit crowdsourcing security.Continue Reading

• Threat intelligence versus risk: How much cybersecurity is enough?

  Learn how threat intelligence plays into global risk assessment as more security officers are tasked with damage control.Continue Reading

• Command-and-control servers: The puppet masters that govern malware

  Are there shadow networks within your enterprise? Stop malware by shutting down command-and-control communication channels.Continue Reading

• How to explain information security concepts to business executives

  Conveying complex information security models to business executives isn't easy. Here's how IT pros can improve their communication skills.Continue Reading

• How to use Kismet: A free Wi-Fi network-monitoring tool

  In this video, CBT Nuggets' Keith Barker shows how to use the free Wi-Fi network monitoring tool Kismet to find possibly malicious wireless networks.Continue Reading

• Stop attackers hacking with Metasploit

  Metasploit attacks may not be sexy, but they can stab through enterprise defenses. Learn how basic security controls can thwart Metasploit hacking.Continue Reading

• A broader definition of identity governance

  The definition of identity governance has evolved to include a tool that could prove challenging for enterprises to implement.Continue Reading

• When single sign-on fails, is a second SSO implementation worthwhile?

  After a failed SSO implementation, is there any benefit to an enterprise trying again? Expert Michele Chubirka discusses.Continue Reading

• Information security spending in 2014: The top enterprise priorities

  Video: Editorial Director Robert Richardson examines enterprises planned 2014 security spending and whether it will lead to long-term success.Continue Reading

• Don't get spoofed by distributed denial-of-service attacks

  Distributed denial-of-service attacks continue to use spoofing. But there are means to stop the practice.Continue Reading

• Regulatory compliance requirements for security awareness programs

  Employees play an important role in achieving and maintaining regulatory compliance, explains compliance expert Mike Chapple.Continue Reading

• What should enterprises look for in vulnerability assessment tools?

  The main function of vulnerability assessment tools hasn't changed much, but enterprises must be aware of edge cases like cloud and virtualization.Continue Reading

• Password-free authentication: Figuring out FIDO

  Will open FIDO standards for better interoperability of next-generation authentication technologies actually work?Continue Reading

• Defense best practices for a man-in-the-middle attack

  Man-in-the-middle attack defense requires careful, layered security. Michael Cobb reviews the tactics enterprises should employ to stay secure.Continue Reading

• Java-based malware: Mitigating the threat of JRE vulnerabilities

  Java-based malware and JRE vulnerabilities are a constant enterprise threat. Expert Nick Lewis reveals how to reduce (or at least tolerate) the risk.Continue Reading

• Best practices for employer monitoring of social media

  Expert Joseph Granneman explains the best way for employers to approach social media monitoring as part of a social media policy for employees.Continue Reading

• Network segmentation: No-brainer or unseen network security threat?

  When it comes to security, network segmentation can be a blessing or a curse. In this tip, we look at the pros and cons of this enterprise decision.Continue Reading

• Strategic security staffing: Generalist or specialist?

  Expert Joseph Granneman explains whether a midsize company should hire security specialists or generalists and why.Continue Reading

• Preparing for a firewall failure: Firewall best practices

  Is your enterprise ready for a firewall failure? Uncover firewall best practices to help you prepare.Continue Reading

• Audit concerns when migrating from traditional firewall to NGFW

  Learn about a potential audit concern when transitioning from a traditional firewall to a next-generation firewall.Continue Reading

• Does TCP/IP reassembly pose a TCP/IP packet format risk?

  An obscure process called TCP/IP reassembly may pose an enterprise network security risk. Learn about this TCP/IP packet format security issue.Continue Reading

• Addressing the security vulnerabilities of IPMI-enabled systems

  The Intelligent Platform Management Interface (IPMI) protocol presents a number of security vulnerabilities. Uncover how to mitigate the risks.Continue Reading

• UTM vs. NGFW: Comparing unified threat management, next-gen firewalls

  What's the difference between unified threat management (UTM) products and next-generation firewalls (NGFW)? Brad Casey discusses.Continue Reading

• How Cisco's 'Application Centric Infrastructure' differs from SDN

  As Cisco rolls out a hardware-based alternative to software-defined networking approaches, what does it all mean for security?Continue Reading

• Data encryption, notification and the NIST Cybersecurity Framework

  Awkward? The NIST Cybersecurity Framework arrives as the U.S. government struggles to counter negative reports on its data privacy and encryption standards.Continue Reading

• Introduction to iCloud Keychain: Security for password synchronization

  ICloud Keychain can supposedly sync passwords across devices without using iCloud. But is it secure? Security expert Michele Chubirka explains.Continue Reading

• Linux Malware Incident Response

  In this excerpt from Linux Malware Incident Response, authors Cameron Malin, Eoghan Casey and James Aquilina discuss volatile data collection methodology, steps and preservation.Continue Reading

• Incident response planning for DNS attacks against enterprises

  Practicing incident response for a DNS attack will help enterprises recover faster. Nick Lewis offers incident response planning best practices.Continue Reading

• For merchants, Windows XP POS systems put PCI compliance at risk

  PCI compliance may be nearly impossible after the April 2014 Windows XP end-of-life date if merchants don't address vulnerable XP-based POS systems.Continue Reading

• Changes to ISO 27001: What's new in the 2013 ISO 27001 update?

  Expert Mike Chapple reviews the recent ISO 27001 update, including the three most significant changes to ISO 27001 and the effect on infosec programs.Continue Reading

• API security: How to ensure secure API use in the enterprise

  API security is a growing enterprise concern. In the wake of recent high-profile breaches, discover how to alleviate the issues of insecure APIs.Continue Reading

• Risk Management Framework

  In this excerpt from chapter 3 of Risk Management Framework, author James Broad discusses the four components of risk management.Continue Reading

• C&C infrastructure explained: Tilon malware lessons learned

  Expert Nick Lewis details how the Tilon malware strain utilizes a unique communication protocol with its C&C infrastructure.Continue Reading

• Required: A revamped antimalware strategy

  Increasingly sophisticated malware can divert the attention of IT departments from low-level security gaps. Here’s why you need a strategy that works on all levels.Continue Reading

• To protect privileged users, consider using least privilege principle

  To defend against "laterally" moving attackers, consider granting privileged users the least privileges necessary. Expert Nick Lewis explains how.Continue Reading

• Web browser protection for users: Adapting to new Web security threats

  Expert Nick Lewis explains how to provide a secure Web browsing experience for users when threats are no longer contained to certain parts of the Web.Continue Reading

• Social engineering attacks: Is security focused on the wrong problem?

  To combat social engineering techniques, know thy data and how to protect it against exfiltration by malicious actors.Continue Reading

• Ranum Q&A with Aaron Turner: Whitelisting is on enterprise blacklist

  An early proponent of Microsoft SRP, Aaron Turner says application whitelisting has finally taken hold in consumer app stores.Continue Reading

• Java patching: Lost cause, or an enterprise security necessity?

  After a plethora of Java and JRE security flaws, threats expert Nick Lewis weighs in on whether Java patching is now an exercise in futility.Continue Reading

• Attack obfuscation: How attackers thwart forensics investigations

  Expert Nick Lewis explains how attackers utilize offensive forensics techniques to thwart forensics investigations.Continue Reading

• Developing a continuous security monitoring program for 24/7 security

  Developing a continuous security monitoring program to ensure 24/7 security is no easy task. Michael Cobb offers key advice for completing the task.Continue Reading

• AxCrypt tutorial: How to use AxCrypt for simple file encryption

  Video: In this AxCrypt tutorial, Keith Barker of CBT Nuggets shows how to use AxCrypt, a free, open source tool for quick, simple file encryption.Continue Reading

• Enterprise firewall protection: Where it stands, where it's headed

  Get grounded on the state of the firewall, and explore the next generation of related Internet security devices.Continue Reading

• incident response plan (IRP)

  An incident response plan (IRP) is a set of written instructions for adequately detecting, responding to and limiting the effects of an information security incident, an event that may or may not be an attack or threat to computer system or ...Continue Reading

• How descoping measures can help reduce regulatory compliance burden

  Expert Mike Chapple explains how two descoping techniques can help many organizations reduce their regulatory compliance burden.Continue Reading

• Security analytics: The key to reliable security data, effective action

  It's tough to get reliable security data. This Security School explains how to use security analytics to safeguard your network system's health.Continue Reading

• Making the case: Mobile IDS/IPS vs. traditional IDS/IPS

  What's the difference between mobile IDS/IPS and traditional IDS/IPS? Expert Brad Casey discusses the value proposition for enterprise deployment.Continue Reading

• The benefits of subscription-based penetration testing services

  Should an enterprise opt for subscription-based services or conduct their pen testing in-house? Network security expert Brad Casey discusses.Continue Reading

• Three ways to raise infosec awareness among non-security executives

  Low infosec awareness among C-level execs can hurt security funding. Expert Joseph Granneman details three ways that CISOs can raise that awareness.Continue Reading

• Network tap vulnerabilities: Network traffic security over the Internet

  Is there any viable way to mitigate the risks of a potential wide-area network tap and ensure network traffic security over the Internet?Continue Reading

• Why TCP traffic spikes with source port zero should sound an alarm

  Are spikes in TCP traffic with source port zero warning signs that future attacks are imminent? Discover why enterprises should be concerned.Continue Reading

• Best practices for implementing an enterprise network air gap system

  Learn best practices for implementing an enterprise network air gap system as a defense against advanced attacks.Continue Reading

• Using Wireshark: Reviewing four key Wireshark features

  Become familiar with four Wireshark features network security pros value in this packet-capturing analytics tool.Continue Reading

• How to build an effective corporate privacy compliance program

  Expert Mike Chapple reviews major data privacy laws and explains how to build a data privacy compliance program to meet regulatory requirements.Continue Reading

• Tor networks: Stop employees from touring the deep Web

  Are employees using Tor to view blocked Web sites, or mining Bitcoins on corporate resources? Sinister or not, it needs to stop.Continue Reading