• Can a vendor be convinced to add security to its application development process?
• Are senior level executives a target for social engineering attacks?
• What is the relationship between open port range and overall risk?
• Will iptables screen UDP traffic?
• How expensive are IPsec VPN setup costs?
• Can reputation services be applied to network security?
• What kinds of network packet data can be extracted from Snort IDS?
• Can Snort be configured with a FreeBSD router?
• Will deploying VoIP on an 802.1x network create security problems?
• Do split-tunneling features make a VPN vulnerable?
• Should a router be placed between the firewall and DMZ?
• How is internal mail channeled through an enterprise firewall?
• Defining your security certification objective
• How to prevent audit-logging system from storing passwords?
• How to migrate from SAS 70 to ISO 27001
• How does SSL 'sit' between the network layer and application layer?
• Should a network be regularly checked for rogue access points?
• Can companies control their affiliate-based adware?
• Investigating phone phishing calls
• Can dynamic and static verification secure a platform?
• How secure is the Windows registry?
• Can an antivirus program's behavior-based functions be judged?
• Is it possible to detect today's peer-to-peer (P2P) botnets?
• Does SMS spoofing require as much effort as email spoofing?
• Will log-in form data posted to an SSL page always be encrypted?
• Should third-party software tools be used to customize applications?
• Will securing a wireless LAN make the data link layer vulnerable?
• Buy vs. build: Choosing an enterprise intrusion detection system
• Do WEP weaknesses call for an upgrade to WPA2 encryption?
• What risks are associated with biometric data, and how can they be avoided?
• Are one-time password tokens susceptible to man-in-the-middle attacks?
• What are the PCI DSS compliance benefits of tokenization?
• Will fixed-mobile convergence (FMC) create more security risks?
• Is it safe to use remote access tools to grant system access?
• Are attackers using malware to exploit service oriented architectures?
• Do the Common Vulnerabilities and Exposures protect applications?
• Should PCI DSS auditors be subjective?
• Are penetration tests essential for enterprise network security?
• What evaluation criteria should be used when buying a firewall?
• Is the Storm worm virus still a serious threat?
• What are the risks of turning off pre-boot authentication?
• Will the PCI DSS require encryption over dedicated lines?
• Is SSL no longer useful?
• What are the pros and cons of outsourcing email security services?
• Should all members of a security staff be involved in the risk assessment process?
• Can DHCP be used to selectively block instant messaging clients?
• Which email encryption products can be released internationally?
• How to select a penetration tester
• Best practices for implementing a retention policy
• Can database extrusion products effectively prevent data loss?
• Strategies for landing a security management position
• What is the difference between a SAS 70 Level 1 and Level 2 audit?
• Should ISO 17799 play a role in risk assessment?
• Do personal issues within a company pose a risk to the enterprise?
• What is the best organizational model for an IT security staff?
• Reacting to a business partner's insider threat
• What are the pros and cons of using an email encryption gateway?
• How can a CSO determine if a company has a data security problem?
• Can watching online videos present enterprise security risks?
• What are the best security practices for securing sensitive data on PDAs?
• What are the potential risks of giving remote access to a third-party service provider?
• Should void user IDs be preserved in an audit history?
• Is there any policy or regulation to help protect biometric data?
• What challenges arise when designing a logging mechanism for peer-to-peer networks?
• Is the use of digital certificates with passwords considered two-factor authentication?
• How to test an enterprise single sign-on login
• Creating a personal digital certificate
• Can network behavior anomaly detection (NBAD) products stop rootkits?
• What's the best way to verify client authentication across unrelated Web servers?
• Should a rise in text message spam be expected?
• What is a logic bomb?
• Who's fighting the spyware operators?
• Are encryption products better than self-destructing data?
• What are the drawbacks to application firewalls?
• What should be done with a RAID-5 array's failed drives?
• Should fuzzing be part of the secure software development process?
• How secure are document scanners and other 'scan to email' appliances?
• Is there an identity management software product for audit and analysis?
• Can a Web client not supporting SSL still connect to a secure server?
• What are the alternatives to RC4 and symmetric cryptography systems?
• Can smurf attacks cause more than just a denial of service?
• What are the best security practices to consider when developing a corporate blog?
• What policies will prevent employees from leaking sensitive data?
• Do P2P networks share the same risks as traditional ones?
• Which Unix programs can encrypt database files?
• Are desktop gadgets a target for hackers?
• Is Windows Vista SP1 necessary before making the upgrade?
• How can header information track down an email spoofer?
• Can a certificate authority be trusted?
• Can keyloggers monitor mouse clicks and keyboard entries?
• Will disabling thumb drives affect keyboard and mouse functions?
• Should USB token data be copied to a hidden directory called 'IEDW?'
• Is it possible to prevent email forwarding?
• How vulnerable are network printers?
• What is an Nmap Maimon scan?
• Is a digital watermark a legitimate authentication factor?
• How to keep packet sniffers from collecting sensitive data
• Choosing the right public key algorithm: RSA vs. Diffie-Hellman
• Are knowledge-based authentication systems doing more harm than good?
• How secure is the Chip and PIN card system?
• More