Tips

Tips

• Getting to the bottom of the software vulnerability disclosure debate

  The vulnerability disclosure debate rages on: Enterprises should know they are at risk, but vendors need time to patch flaws. Which side should prevail? Expert Michael Cobb discusses.  Continue Reading

• How NIST SP 800-171 affects the protection of CUI

  The recently released NIST SP 800-171 is designed to protect controlled unclassified information (CUI) outside of the government. Expert Mike O. Villegas explores the impact of these guidelines.  Continue Reading

• How global threat intelligence fits into a security strategy

  Global threat intelligence services can be part of your security arsenal, but to prevent phishing and other threats basic defenses like strong passwords are vital too.  Continue Reading

• Microsegmentation strategies for smarter security

  Microsegmentation and zones of zero trust are security strategies inherent in software-defined networking. Expert Kevin Beaver explains how to get started.  Continue Reading

• Improve corporate data protection with foresight, action

  Better corporate data protection demands foresight and concrete action. Learn why breach training, monitoring and early detection capabilities can minimize damage when hackers attack.  Continue Reading

• Defending against the current generation of macro malware

  Attackers are increasingly phishing with macro malware. Expert Nick Lewis explains how to effectively defend against this new version of an old threat.  Continue Reading

• Trading Microsoft Patch Tuesday in for Windows Update for Business

  While the consumer world is going Patch Tuesday-less, Microsoft is evolving its Patch Tuesday into Windows Update for Business for enterprise software. Learn what this change means.  Continue Reading

• What QSAs need to know about new PCI requirements

  The PCI SSC changed the requirements for QSAs. Here's what current and future Qualified Security Assessors need to know about the PCI update.  Continue Reading

• Managed security service providers: Weighing the pros and cons

  Using a managed security service provider can be an appealing option to enterprises, but there are many factors to consider before making the move to outsourcing.  Continue Reading

• Cyberhunting: Why enterprises need to hunt for signs of compromise

  Cyberhunting can be a critical component of enterprise security. Expert Eric Cole explains how it can prevent attacks.  Continue Reading

• Six areas of importance in the PCI Penetration Testing Guidance

  Complying with PCI penetration testing mandates has always been a challenge for enterprises. Expert Kevin Beaver discusses the recently released PCI SSC pen testing guidance and how it can help enterprises overcome their PCI woes.  Continue Reading

• A closer look at the changes of PCI DSS version 3.1

  PCI DSS version 3.1 includes some minor updates that are far less prominent than the SSL/early TLS changes, but are equally as important. Here's a look at vulnerability scanning and POS device security changes.  Continue Reading

• Three steps to better mobile app security

  Better mobile app security in the enterprise starts with a few steps -- protect data confidentiality, integrity and access.  Continue Reading

• Microsoft Edge security features raise the bar in Web browser safety

  Learn about the new and improved security features in the upcoming Microsoft Edge browser, including on-by-default sandboxes, Passport and HTML5.  Continue Reading

• Can the security industry handle a chief information risk officer?

  Chief information risk officers seem to be on the horizon as CISOs become inundated with responsibilities, but adding another c-level could cause more harm than good.  Continue Reading

• How to protect corporate data from government surveillance

  News of government surveillance programs is appearing almost daily. Enterprises need to do what they can to protect corporate data from potential eavesdropping -- but how? Expert Kevin Beaver offers some best practices.  Continue Reading

• ERP security: How to defend against SAP vulnerabilities

  A recent study revealed more than 95% of SAP systems were exposed to potentially disastrous vulnerabilities. Expert Nick Lewis explains how to mitigate these SAP vulnerabilities and maintain ERP security.  Continue Reading

• How to perform IPv6 network reconnaissance

  While network reconnaissance is a critical step in identifying potential vulnerabilities, performing an IPv6 network audit without the right tools can be a challenge. Learn about the tools available and how to properly use them.  Continue Reading

• Third-party risk management: Avoid the dangers of weak controls

  If you know where the risk points are, you can request additional safeguards to protect the system and data access of trusted business partners.  Continue Reading

• PCI DSS 3.1 marks the end of SSL/early TLS encryption for retailers

  The early arrival of PCI DSS 3.1 could leave organizations scrambling. The biggest change to the standard -- and the top priority for organizations -- is the end of SSL and early TLS.  Continue Reading

• Six ways to improve endpoint device security

  Endpoint devices are often the root cause of data breaches. Expert Eric Cole explains the best ways to improve endpoint protection.  Continue Reading

• Certificate authorities are limited but new TLS versions can help

  SSL/TLS, long the cornerstone of Web security, has become a security vulnerability due to problems with certificate authorities. Learn what solutions the industry is pursuing.  Continue Reading

• A closer look at the Certified Information Security Manager certification

  The Certified Information Security Manager certification has been around for over a decade now, and it's only grown in prominence. What makes the ISACA CISM so important and how does it compare to its peers?  Continue Reading

• From SSL and early TLS to TLS 1.2: Creating a PCI DSS 3.1 migration plan

  PCI DSS 3.1 requires enterprises to deplete SSL and early TLS use by June 30, 2016. Expert Michael Cobb offers advice for putting a migration plan to TLS 1.2 in place.  Continue Reading

• PoSeidon: Inside the evolving world of point-of-sale malware

  Point-of-sale malware, such as the recent PoSeidon malware, continues to evolve to avoid detection. So what's an enterprise to do? Expert Nick Lewis explains how the malware functions and what organizations can do about it.  Continue Reading

• A new trend in cybersecurity regulations could mean tougher compliance

  State cybersecurity regulations may mean compliance will get more complicated, and that has experts worried. Learn what's causing this trend and what organizations should prepare for.  Continue Reading

• The importance of soft skills development for security professionals

  While technical skills are obviously important for security pros, the importance of soft skills shouldn't be overlooked. Here are the top four worth mastering.  Continue Reading

• State of the Network study: How security tasks are dominating IT staff

  The majority of networking teams are regularly involved in enterprise security tasks. Expert Kevin Beaver explains the phenomena and how to embrace it.  Continue Reading

• Network anomaly detection: The essential antimalware tool

  Traditional perimeter defenses are no longer enough; network anomaly detection tools are now essential in the battle against advanced malware.  Continue Reading

• Find network anomalies and you'll ax advanced malware

  Learn how advanced malware evades perimeter defenses and why tools to detect network anomalies are essential to keep your network secure.  Continue Reading

• Is Equation Group malware a game changer for advanced attack defense?

  Equation Group is one of the most advanced cyber-espionage actors out there, so how can the average enterprise defend against its attacks? Expert Nick Lewis explains.  Continue Reading

• Why security operations centers are the key to the future

  Security operations centers (SOCs) can help enterprises gain better visibility into their environments. Expert Eric Cole explains how to get the most out of SOCs.  Continue Reading

• Manage compliance controls with Adobe Common Controls Framework

  Adobe's Common Controls Framework sets an example for enterprises struggling to manage multiple compliance standards and looking to build their own compliance framework.  Continue Reading

• How to track and prevent crimeware attacks

  Crimeware is on the rise and enterprises that track attacks can discover malicious software trying to breach the environment.  Continue Reading

• After Windows Server 2003 end of life: An emergency action plan

  Microsoft is ending support for Windows Server 2003 in July 2015, yet many organizations will still run W2K3 beyond this date. Learn how to keep your enterprise safe.  Continue Reading

• Breaking down the CISO reporting structure

  The CISO reporting structure has come under fire after a long line of high-profile data breaches, so who should CISOs report to?  Continue Reading

• Endpoint protection: How to select virtualization security tools

  Most virtualization security tools still follow dedicated agent models, but some technologies are starting to offload resources to a dedicated VM and leverage hypervisor APIs.  Continue Reading

• Understanding and mitigating a FREAK vulnerability attack

  After the discovery that the FREAK vulnerability can affect a wide variety of OSes, enterprises should amp up mitigation efforts. Here's some background on the attack and how to stop it.  Continue Reading

• A look at the development of an ICS security framework

  Building an ICS security framework was an in-depth process and combined many different cybersecurity standards. Here's a look at how it developed.  Continue Reading

• Security lessons from the NSA malware defense report

  The NSA's Information Assurance Directorate released a report on malware defense. Uncover which guidance and best practices would be fruitful to integrate into your enterprise security plan.  Continue Reading

• Finding clarity: Unified threat management systems vs. next-gen firewalls

  The line between unified threat management systems and next-gen firewalls has grown increasingly unclear. Here, learn more about UTM vs. NGFW and choose the right technology for your enterprise.  Continue Reading

• Offensive countermeasures: How they can slow down adversaries

  Sometimes the best defense is a good offense. Expert Eric Cole explains the merits of offensive countermeasures in the enterprise.  Continue Reading

• Getting the CISOs on equal footing with other C-level positions

  CISOs sometimes need to work a bit harder to gain the same respect given to other C-level positions, but there are ways for CISOs to gain more respect.  Continue Reading

• The moving target defense: Turning the tables on polymorphic malware

  Security startups are using the techniques of polymorphic malware to better protect enterprises. Expert David Strom explores the moving target defense.  Continue Reading

• Bring your own device policy: Six questions to ask security providers

  Security managers increasingly combine existing tools to implement an overall BYOD security posture. Key security features can make the job easier.  Continue Reading

• PHP security tips to ensure enterprise Web safety

  Research shows more than three-quarters of PHP installations run with at least one vulnerability. Learn the steps for ensuring PHP security in the enterprise workplace.  Continue Reading

• Breaking bad password habits in the enterprise

  A bad password brings unnecessary risk into organizations, but how bad are they really? Expert Randall Gamby assesses just how dire the situation is.  Continue Reading

• The optional PCI DSS 3.0 requirements are about to become mandatory

  Organizations need to review the PCI DSS 3.0 requirements and prepare for the mandatory changes coming in June 2015. Expert Mike Chapple explains how to prepare for the deadline.  Continue Reading

• Will HTTP/2 satisfy the need for speed and enterprise Web security?

  HTTP/2 is close to becoming a formal Internet specification -- but how will it affect enterprise Web security? Expert Michael Cobb discusses how features, including compression and encryption, may help boost HTTP's safety.  Continue Reading

• How enterprises can bolster their crisis communication strategy

  Developing a thorough crisis communication strategy in the event of a data breach is an important task for CISOs. Expert Mike Villegas explains what the strategy should involve.  Continue Reading

• Accidental insider threats and four ways to prevent them

  Most insider attacks to enterprises are accidental, not intentional. SANS Faculty Senior Fellow Eric Cole, Ph.D., explains why security awareness training isn't enough to stop these threats.  Continue Reading

• Unmasking the Masque attack: Inside the iOS security flaw

  The Masque attack is a malicious threat, yet Apple has downplayed the risk. Expert Nick Lewis explains how to keep employees from being tricked into installing malware.  Continue Reading

• Creating an end-of-life policy for mobile products in the enterprise

  When mobile vendors stop maintaining security on their devices, enterprise data is at risk. Expert Michael Cobb discusses how to assess mobile product end of life and how to create end-of-life policies and controls to maintain BYOD safety.  Continue Reading

• How to bake security into your Wi-Fi deployment

  A Wi-Fi deployment is the preferred method for network access for most enterprises; it’s the InfoSec’s job to make that Wi-Fi secure.  Continue Reading

• The secrets of proper firewall maintenance and security testing techniques

  The Verizon 2015 PCI Compliance Report cited a lack of firewall maintenance and security testing as major causes for compliances breaches. Expert Kevin Beaver offers tips to successfully manage these tasks.  Continue Reading

• Why PCI non-compliance is a problem for many

  PCI DSS requirement 2 specifies companies must change vendor-supplied default passwords, but only 50% were in compliance. Expert Mike Chapple explains why.  Continue Reading

• The benefits of open source identity management software

  Organizations are often looking to minimize costs without compromising on security. Expert Randall Gamby examines the benefits of open source identity management software.  Continue Reading

• What enterprises need to know about the Regin malware toolkit

  The sophisticated Regin malware contains features that hackers can adopt into other enterprise malware threats. Expert Nick Lewis explains how to combat this risk.  Continue Reading

• Beyond PCI: Out-of-band security tips for credit card data protection

  Securing credit card data -- both online and at brick-and-mortar stores -- requires security measures beyond those mandated by PCI DSS. Expert Philip Alexander outlines six out-of-band security controls to consider.  Continue Reading

• Is the CISO job description getting out of hand?

  CISO roles and responsibilities are built on impossible standards and unrealistic expecations. Expert Joseph Granneman explains this trend and why enterprises need to reverse it.  Continue Reading

• Five network security lessons learned from the Sony Pictures hack

  Following the Sony Pictures hack, several of the company's network security shortcomings were revealed. Expert Kevin Beaver explains how better network security may have prevented the extent of the breach.  Continue Reading

• How to prevent firewall failures with proper testing and maintenance

  Expert Eric Cole explains how to remedy an underperforming or failing firewall with proper maintenance and testing.  Continue Reading

• Understanding footprinting as a predecessor to cyberattacks

  Footprinting can often lead to cyberattacks on an enterprise. Expert Ernie Hayden explains the footprinting technique and how it's performed.  Continue Reading

• What Apple Pay tokenization means for PCI DSS compliance

  Tokenization is a key technology underlying Apple Pay, promising to boost payment data security. Mike Chapple examines how Apple Pay's tokenization system works, and whether it will provide any PCI DSS compliance relief.  Continue Reading

• How Shellshock transformed the future of shell security

  The Shellshock Bash bug left millions of systems unsecure. Enterprise threats expert Nick Lewis discusses how the bug changed shell security for the better.  Continue Reading

• How TLS 1.3 updates aim to ensure secure Internet communications

  Following a slew of TLS vulnerabilities over the past year, the IETF is working on an updated version of the protocol. Security expert Michael Cobb discusses the changes and improvements.  Continue Reading

• SIEM systems: Using analytics to reduce false positives

  Combining data from a variety of sources with better analytics can reduce workloads.  Continue Reading

• Information security and lawyers: Three ways to be besties

  Legal teams play a key supporting role in successful information security programs. Expert Mike Chapple reviews three areas where infosec pros and lawyers should work together, and offers tips to foster effective collaboration.  Continue Reading

• Understanding FDA guidance on medical device cybersecurity

  Medical device security is a growing concern. Expert Mike Villegas shares how to make sense of the new FDA cybersecurity guidelines for medical device manufacturers.  Continue Reading

• Using intrusion detection systems for incident prevention, improving ROI

  Security expert Bill Hayes discusses the top benefits of intrusion detection systems, including identifying and preventing security incidents, protecting vulnerable assets, improving ROI and more.  Continue Reading

• Intrusion detection project design and rollout

  Evaluating intrusion detection technology requires an understanding of its capabilities. Get help with getting started on an intrusion system program design and uncover technical considerations your enterprise needs to know.  Continue Reading

• Final five considerations when evaluating intrusion detection tools

  Before making an investment in an intrusion detection and prevention system, be sure to read this list of five final considerations to keep in mind during intrusion detection system evaluation.  Continue Reading

• Introduction to intrusion detection and prevention technologies

  Intrusion detection and preventions systems can be critical components to an enterprise's threat management strategy. Learn the history behind the technologies and why they are so important.  Continue Reading

• Types of intrusion detection products: Suite vs. best-of-breed

  When evaluating types of intrusion detection products, it is important to distinguish whether a best-of-breed or suite-based product is the right match for your enterprise. Expert Bill Hayes offers guidance to help you decide.  Continue Reading

• Evaluating enterprise intrusion detection system vendors

  Selecting an intrusion detection and prevention system vendor can be a time-consuming task. Get help evaluating vendors and products with this list of must-ask questions. Plus, a comprehensive vendor list.  Continue Reading

• What the Community Health Systems breach can teach your organization

  The Community Health Systems breach in 2014 provided a learning opportunity for organizations handling PHI. Expert Mike Chapple reviews the key takeaways from the breach.  Continue Reading

• Benefits of the Cisco OpenSOC security analytics framework

  Cisco's open source security analytics framework aims to help enterprises address visibility and incident management challenges. Expert Kevin Beaver discusses OpenSOC and what to consider when integrating it into an enterprise security strategy.  Continue Reading

• Four ways security compliance standards strengthen enterprise security

  Rather than approaching security compliance standards as boxes to be checked, expert Steven Weil provides four ways enterprises can use compliance standards to strengthen security programs.  Continue Reading

• SSL/TLS security: Addressing WinShock, the Schannel vulnerability

  Schannel is the latest cryptographic library to encounter SSL/TLS security issues. Expert Michael Cobb discusses the WinShock vulnerability and how to mitigate enterprise risks.  Continue Reading

• How emerging threat intelligence tools affect network security

  Up and coming threat intelligence tools aim to improve data security and even standardize threat intelligence across the industry. Expert Kevin Beaver explains how.  Continue Reading

• Getting to know the new GIAC certification: GCCC

  The new GIAC certification, GCCC, is not a very specific certification, but it could prove useful in organizations. Expert Joseph Granneman explains why.  Continue Reading

• How to evaluate IPv6 network security with SI6 Networks IPv6 Toolkit

  Some security pros underestimate the importance of IPv6 network security assessment tools. Expert Fernando Gont offers an illustrated guide on how to use SI6 Networks' free IPv6 toolkit.  Continue Reading

• DDoS mitigation: Denying denial-of-service attacks

  Employ a mix of internal and cloud-based DDoS mitigation controls to minimize business disruptions from these increasingly complex attacks.  Continue Reading

• A CISO's introduction to enterprise data governance strategy

  Every enterprise must have a viable strategy for protecting high-value data. See if your plan aligns with Francoise Gilbert's advice on top priorities to consider when defining data governance plans.  Continue Reading

• Apple iOS 8 security features: What they mean for enterprise security

  Expert Lisa Phifer discusses new Apple iOS 8 security features and potential pitfalls, as well as the enterprise security ramifications of new iOS features, including Extensions, Family Sharing and Apple Pay.  Continue Reading

• What the FIDO specification means for multi-factor authentication

  Stay apprised of developments with the FIDO specification and share the joy of what FIDO authentication and freedom from passwords mean.  Continue Reading

• Mini risk assessments: Simplifying protection of critical assets

  Expert Eric Cole explains how his simplified, risk-based approach to security will help enterprises better identify -- and prevent -- the most dangerous threats.  Continue Reading

• The POODLE vulnerability and its effect on SSL/TLS security

  The POODLE vulnerability was patched in October, yet new vulnerabilities are causing concern. Expert Michael Cobb discusses how to maintain SSL/TLS security in the enterprise.  Continue Reading

• Lessons learned: Network security implications of Shellshock

  Shellshock had a tremendous impact on network security, affecting many popular vendors and products. Expert Kevin Beaver discusses what Shellshock means to network security, and the lessons that can be learned from the vulnerability.  Continue Reading

• How to increase the importance of information security in enterprises

  Expert Mike Villegas explains how to use the Three C's to emphasize the importance of information security within an organization.  Continue Reading

• What is endpoint security? What benefits does it offer?

  The increased number of smartphones, laptops and other endpoints in the enterprise is a major security concern. Learn what endpoint security is and how it can help combat your enterprise security woes.  Continue Reading

• Endpoint protection software features and functionality

  Learn about the different capabilities endpoint protection software often includes and the security benefits each of these capabilities have to offer.  Continue Reading

• Endpoint security software: Integrated suite or point products?

  Deciding whether your organization needs an integrated endpoint security software suite or set of point products can be challenging. Expert Karen Scarfone discusses.  Continue Reading

• Top benefits of an integrated endpoint security suite

  When implementing endpoint security, is it better to buy standalone products or an endpoint security suite? Expert Karen Scarfone discusses the top benefits of integrated endpoint protection.  Continue Reading

• Detecting backdoors: The Apple backdoor that never was?

  The debate over the purported Apple backdoor leaves enterprises asking, "When is a backdoor not a backdoor?" Application security expert Michael Cobb explains the difference.  Continue Reading

• Investing in endpoint security software: Final considerations

  Before investing in an endpoint security software product, be sure your enterprise asks itself these six critical questions.  Continue Reading

• Ten questions to ask endpoint security vendors

  Evaluating endpoint security vendors and their products can be a challenging task. Expert Karen Scarfone outlines 10 must-ask questions to start your list. Plus, check out a list of comprehensive endpoint security vendors  Continue Reading

• A first look at Windows 10 security features

  In a preview of Windows 10 security features, expert Michael Cobb discusses three improvements that will boost enterprise security.  Continue Reading

• Silverlight security: Defending against browser plug-in attacks

  Silverlight security has been called into question following recent drive-by attacks on the browser plug-in. Expert Michael Cobb explains how to prevent these attacks.  Continue Reading

• IPv6 extension headers and security: Analyzing the risk

  IPv6 security expert Fernando Gont explains why IPv6 extension headers can inadvertently subvert security controls or foster denial-of-service conditions.  Continue Reading