Tips

Tips

• How to negate business logic attack risk: Improve security in the SDLC

  Expert Nick Lewis details the threat posed by business logic attacks and how stressing the importance of security in the SDLC can reduce that threat.  Continue Reading

• Defense-in-depth security: How to establish an ultra-redundant network

  Matthew Pascucci discusses layered security, explaining how to apply defense-in-depth principles toward an ultra-redundant network security posture.  Continue Reading

• SSL certificate management: Avoiding common mistakes

  Errors are bound to occur when SSL certificate management is handled manually. Learn how to avoid these common mistakes.  Continue Reading

• BYOD platform support: Why an iOS and Android strategy makes sense

  All BYOD platform options come with cost and risk. Craig Mathias explains why an iOS and Android BYOD program is viable for most organizations.  Continue Reading

• How a next-generation firewall prevents application-layer attacks

  Next-generation firewalls can block common yet dangerous SQL-injection and buffer-overflow attacks. Learn how an NGFW stops application-layer attacks.  Continue Reading

• BYOD security: How to remotely wipe iPhone and Android devices

  Remote data wipe is key to any BYOD security policy, but each OS handles it differently. Lisa Phifer covers how to use it with other controls to protect data.  Continue Reading

• Windows Server 2012 security: Is it time to upgrade?

  Expert Michael Cobb wades through the security features of Windows Server 2012 to find out what's new and beneficial in Microsoft's latest release.  Continue Reading

• Overview: New PCI mobile application development guidelines

  The PCI SSC recently released mobile application development security guidelines. Mike Chapple outlines the document and highlights key takeaways.  Continue Reading

• How to avoid security issues with VPN leaks on dual-stack networks

  The ongoing transition to IPv6 has revealed security issues with VPN leaks on dual-stack networks. Fernando Gont explains and offers mitigations.  Continue Reading

• How to secure Java amid growing Java security vulnerabilities

  Constant Java security vulnerabilities plague Oracle and enterprises alike. Expert Nick Lewis offers tips on how to use Java and the JRE securely.  Continue Reading

• PCI validation: Requirements for merchants covered by PCI DSS

  Mike Chapple details the PCI validation requirements for merchants covered by PCI DSS.  Continue Reading

• After antimalware: Moving toward endpoint antivirus alternatives

  Is it time to "cut the cord" with endpoint antimalware? Matthew Pascucci discusses possible antivirus alternatives.  Continue Reading

• Secure Web gateway overview: Implementation best practices

  In this secure Web gateway overview, learn how to implement, configure and maintain a Web security gateway to support other security devices.  Continue Reading

• Aligning enterprise identity and access management with CIO priorities

  Randall Gamby says aligning enterprise identity and access management with business and CIO priorities demands a more strategic approach to IAM.  Continue Reading

• How to begin corporate security awareness training for executives

  Expert Ernie Hayden provides advice for enterprises that are establishing security awareness training for their security-unaware executives.  Continue Reading

• Security big data: Preparing for a big data collection implementation

  Learn how security big data initiatives support enterprise information security and how to prepare for a big data collection implementation.  Continue Reading

• Options for mitigating digital security certificate problems

  Is your enterprise struggling with digital security certificate problems? Expert Nick Lewis discusses mitigations for digital certificate attacks.  Continue Reading

• How to comply with updated NIST incident response guidelines

  NIST recently updated its incident response guidelines. Find out how to comply with these changes and incorporate them into an incident response plan.  Continue Reading

• Under the Surface: How Windows tablet security meets BYOD challenges

  Expert Michael Cobb says the forthcoming Windows tablet security features on Microsoft's Surface could help meet enterprise BYOD challenges.  Continue Reading

• Software-defined networking: Exploring SDN security pros and cons

  Matthew Pascucci offers an intro to software-defined networking and explains why SDN security relies on securing the SDN controller at all costs.  Continue Reading

• Five tips to improve a threat and vulnerability management program

  Utilize these five simple tips from expert Diana Kelley to improve your enterprise's threat and vulnerability management program.  Continue Reading

• Forrester's GRC framework: Using three lines of defense

  Chris McClean of Forrester Research provides a GRC framework. It offers three lines of defense to boost participation rates and define clear roles.  Continue Reading

• Network log management on a budget: How to streamline log analysis

  Expert Matt Pascucci examines free tools and offers simple tactics that organizations can use to streamline the network log analysis and management process.  Continue Reading

• Why focus on SIEM integration, coverage maximizes anomaly detection

  Reliable anomaly detection using a SIEM hinges on collecting a wide range of security events. Andrew Hutchison covers SIEM integration best practices.  Continue Reading

• Firewall vs. IPS: Will next-generation firewalls nix stand-alone IPS?

  News analysis: Will the evolution of next-generation firewalls eliminate the stand-alone IPS market? Sean Martin discusses firewalls vs. IPS.  Continue Reading

• Essential enterprise mobile device security controls

  Learn about the mobile security controls you should consider when formulating an enterprise mobile security strategy.  Continue Reading

• Web application firewalls: Patching, SDLC key for security, compliance

  Mike Chapple on improving defense-in-depth security with Web application firewalls (WAFs) and a strong software development lifecycle (SDLC) process.  Continue Reading

• The case for using anomaly-based monitoring in zero-day detection

  Expert Char Sample explains how anomaly-based monitoring may be a key step forward in uncovering zero-day vulnerabilities.  Continue Reading

• Antivirus alternatives: Evolving enterprise endpoint security strategy

  Do any viable antivirus alternatives exist? Security expert Matt Pascucci offers an endpoint security strategy that looks beyond AV to fight malware.  Continue Reading

• Information security controls for data exfiltration prevention

  Enterprises may be amazed to discover how valuable their data is to attackers. Learn five information security controls to prevent data exfiltration.  Continue Reading

• Exploring new features, uses for secure Web gateway appliances

  Expert Michael Cobb reviews secure Web gateway appliance features that can better shield endpoints, plus SWG deployment options.  Continue Reading

• Surviving cyberwar: Preparing for APTs, Stuxnet malware-style attacks

  Surviving cyberwar is now a priority for enterprises, with more Stuxnet malware-style attacks sure to come. Expert Nick Lewis has a defensive primer.  Continue Reading

• Using the network to prevent an Oracle TNS Listener poison attack

  Expert Michael Cobb details the Oracle TNS Listener poison attack and tells how enterprises can use the network to defend vulnerable applications.  Continue Reading

• IPS/IDS technologies: Innovations and changes

  Haven’t shopped for an IDS/IPS in a while? Karen Scarfone details important recent innovations to IDS/IPS technologies.  Continue Reading

• Social engineering penetration testing: Four effective techniques

  Social engineering penetration testing is now a must for enterprises. Learn about the four methods your pen tests should use.  Continue Reading

• Visa's PCI compliance policy change: The end of the PCI assessment?

  Does Visa's PCI compliance policy change mean the end of the PCI assessment? Mike Chapple discusses what it means for security professionals.  Continue Reading

• Remote Desktop Protocol security: How to secure RDP network endpoints

  What is RDP and why does it pose a security threat? Expert Matt Pascucci explains why it’s needed and how best to secure RDP it in the enterprise.  Continue Reading

• Comparing enterprise data anonymization techniques

  Compare data anonymization techniques including encryption, substitution, shuffing, number and data variance and nulling out data.  Continue Reading

• With JOBS Act, Sarbanes-Oxley compliance likely won't get easier

  While SMBs may benefit from the JOBS Act, Sarbanes-Oxley compliance for enterprises may remain largely unchanged. Expert Mike Chapple explains why.  Continue Reading

• Analysis: Vast IPv6 address space actually enables IPv6 attacks

  For World IPv6 Launch Day 2012, Fernando Gont covers why common ways of generating IPv6 addresses actually make an attacker’s job easier.  Continue Reading

• HIPAA compliance: How to prepare for upcoming KPMG HIPAA audits

  KPMG HIPAA audits will hit 150 companies this year. What if yours is one of them? Mike Chapple explains how to handle the HIPAA compliance hot seat.  Continue Reading

• Examining Kindle Fire security, Silk browser security in the enterprise

  Do Kindle Fire security issues, combined with weak Silk browser security, make the red-hot consumer device too risky for enterprises? Michael Cobb explains.  Continue Reading

• How to prevent a WPS flaw from damaging enterprise wireless security

  The recent WPS flaw isn't just a consumer issue. Nick Lewis explains the effect on enterprise wireless security and how to avoid security issues.  Continue Reading

• DNS attack prevention: Inside DNS components vulnerable to attack

  DNS attack prevention demands an understanding of the four core DNS components attackers often target. Expert Char Sample explains.  Continue Reading

• Types of DNS attacks reveal DNS defense tactics

  A thorough understanding of the types of DNS attacks, including DoS, reflector attacks and DNS cache poisoning, reveal key DNS defense tactics.  Continue Reading

• HTML5 security: Will HTML5 replace Flash and increase Web security?

  Will HTML5 replace Flash? Expert Michael Cobb discusses whether HTML5 security is better than Flash, and why HTML5 traffic can be harder to secure.  Continue Reading

• DoS attack responses demand better business continuity plans

  Expert Nick Lewis says an effective DoS attack responses demand better business continuity plans, including pre-negotiating with providers.  Continue Reading

• How to test a firewall: A three-step guide for testing firewalls

  There are three steps when testing firewalls for your organization. Expert Joel Snyder explains how to test a firewall.  Continue Reading

• Web-facing applications: Mitigating likely Web application threats

  New, interactive Web-facing applications are popping up all the time, but expert Nick Lewis advises enterprises on how to be vigilant against Web application threats.  Continue Reading

• How to set up your own secure enterprise Android app store

  Reduce the risk posed by smartphones and mobile applications by setting up a corporate app store for users that helps ensure Android application security.  Continue Reading

• SIEM technology primer: SIEM platforms have improved significantly

  After a rocky start with early SIEM technologies, current offerings are easier to use and provide more reliable automated responses.  Continue Reading

• For U.S. companies, EU cookie compliance calls for website changes

  With recent changes to European data privacy laws, U.S. enterprises must make website changes to meet EU cookie compliance deadlines.  Continue Reading

• Security event log management, analysis needs effective ways to search log files

  Search is a key discipline for security log management. John Burke explains how to better search log files to improve security event log management.  Continue Reading

• Securing the SIEM system: Control access, prioritize availability

  The prospect of a SIEM system crash should scare any enterprise. Guard against a compromised SIEM system to protect the security nerve center.  Continue Reading

• Key steps to perform a successful information security gap analysis

  Need to assess the holes in your organization’s network? Learn how an information security gap analysis can help you find network security weaknesses.  Continue Reading

• How to ensure data security by spotting enterprise security weaknesses

  How can a specialized organization spot security weaknesses? Nick Lewis offers a process to help niche companies ensure data security.  Continue Reading

• Employee risk assessment: Helping security spot high-risk employees

  Expert Ernie Hayden offers a brief primer on employee risk assessment using CERT guidelines to help security teams spot high-risk employees.  Continue Reading

• SEC disclosure rules: Public company reporting requirements explained

  Learn the public company reporting requirements necessary to comply with CF Disclosure Guidance Topic No. 2, the SEC's cybersecurity reporting rules.  Continue Reading

• Exploring Google Chromebook security for the enterprise

  The Chromebook is unique among new entrants in the mobile device arena. Mike Cobb breaks down the key Google Chromebook security issues enterprises need to know.  Continue Reading

• Android security settings and controls for Android enterprise security

  Can Androids ever be secure enough for corporate use? Learn about Android security controls to enable effective Android enterprise security.  Continue Reading

• Adopt Zero Trust to help secure the extended enterprise

  Forrester Analyst John Kindervag explains Zero Trust Model and how it can be applied to protect data in today’s extended enterprise.  Continue Reading

• Metadata security and preventing leakage of sensitive information

  Without accounting for metadata security, sensitive document data can easily be extracted. Mike Chapple explores technologies to support metadata security.  Continue Reading

• VoIP eavesdropping: Hardening network security to contain VoIP risks

  Mike Chapple analyzes the VoIP risks posed by implementing a VoIP network and exposes the reality of telephone eavesdropping.  Continue Reading

• Privileged user access management: How to avoid access creep

  One of the most difficult areas of privileged user access management is avoiding access creep. John Burke covers how to keep privileged users in check.  Continue Reading

• How to implement an enterprise threat assessment methodology

  Learn how incorporating an assessment of external threats can increase the accuracy and comprehensiveness of risk assessments.  Continue Reading

• P2P encryption: Pros and cons of point-to-point encryption

  P2P encryption is an emerging technology; one that may be helpful for many companies, especially merchants. Mike Chapple dissects the pros and cons.  Continue Reading

• Building a compliance culture means learning from mistakes

  In this bonus to our "Compliance scorecard" Security School lesson, Eric Holmquist covers the importance of learning from failure by assessing how and why mistakes happen.  Continue Reading

• Modern security management strategy requires security separation of duties

  Contributor Matthew Pascucci argues that enterprises need security separation of duties to ensure an effective, modern security management strategy.  Continue Reading

• Anti-social engineering training: The first line of defense against human error

  Security team member Jeffrey Catalfamo details the key elements of a successful anti-social engineering training program.  Continue Reading

• How to write an effective enterprise mobile device security policy

  Expert Lisa Phifer explains the process for creating a winning enterprise mobile device security policy that reduces the risk of mobile data threats.  Continue Reading

• Four VDI security concepts for every virtual desktop deployment

  Traditional IT security measures don’t always apply well to virtual desktop infrastructures; apply these four VDI security concepts.  Continue Reading

• How to create a problem management process flow to minimize incidents

  Most organizations have an incident response team, but how many have a problem management team? Michael Cobb explains how problem management can prevent incidents.  Continue Reading

• Best practices for enterprise database compliance

  Successful enterprise database compliance means, for starters, access must be tightly controlled and monitored. Get an understanding of key database compliance essentials.  Continue Reading

• Securing Android devices with a mobile device security policy

  Secure employee-liable Android devices with workable security policies that discover, enroll, protect and monitor all Android endpoints.  Continue Reading

• Zero-day vulnerabilities and the patch management process: To test or not to test?

  Learn whether it’s better to risk exposure and take time to test zero-day patches, or risk business disruption and patch without testing.  Continue Reading

• Using standardized enterprise security practices to secure and defend your network

  PCI DSS, HIPAA, ISO and other enterprise compliance guidelines offer a foundation to build repeatable information security processes and procedures. Marcos Christodonte II explains how.  Continue Reading

• Remediating IT vulnerabilities: Quick hits for risk prioritization

  There's no way to eradicate all IT vulnerabilities, but spotting the most critical ones is essential. Read these quick hits for risk prioritization.  Continue Reading

• How to prevent phishing attacks: User awareness and training

  In this expert tip, David Sherry describes how a combination of technical controls and user awareness training can help put a dent in phishers’ attempts at spear phishing.  Continue Reading

• How to know if you need file activity monitoring to track file access

  Is file activity monitoring, a new product meant to integrate with DLP to provide more granular file access tracking, right for your enterprise?  Continue Reading

• Role-based access control for effective security management

  Effective role-based access control is vital for properly managing user access rights and enforcing access policies, but avoiding role sprawl can be challenging.  Continue Reading

• XACML tutorial: Using XACML as a foundation for entitlement management

  Learn how to use XACML to externalize fine-grained authorization from application logic and support cloud-based IAM initiatives.  Continue Reading

• Spear phishing examples: How to stop phishing from compromising users

  Spear phishing targets the weakest link in most security programs: users. These spear phishing examples can help your enterprise thwart attacks.  Continue Reading

• SOX compliance checklist: Five ways to refine a SOX compliance program

  SOX compliance is still too burdensome for many enterprises. Here are five ways to streamline a lagging SOX compliance program.  Continue Reading

• How to use OWASP Broken Web Apps to prevent vulnerabilities

  OWASP Broken Web Apps allows pen testers to attack applications that are intentionally insecure to hone their skills at securing their own apps.  Continue Reading

• COBIT 5: A first look at the recent updates

  In this tip, learn how to integrate the new management practices from COBIT 5 into current IT security framework implementations.  Continue Reading

• Proactive security measures: How to prevent malware attacks

  Security teams don't always need to be on the reactive. Learn how to implement proactive security strategies that prevent malware infections.  Continue Reading

• Mitigating security risks of mobile location-based services technology

  What can enterprises do to mitigate the security risk of mobile location-based services technology and the like? Start by limiting smartphone apps.  Continue Reading

• Secure tokens: Preventing two-factor token authentication exploits

  What are the most common attacks against two-factor authentication, and how can you protect against them? Expert Nick Lewis weighs in.  Continue Reading

• An inside look into OWASP’s Mantra tool

  OWASP’s Mantra tool is being praised by security pro’s for its abundance of options and ease of use. In this screencast, Mike McLaughlin takes a look at what Mantra has to offer.  Continue Reading

• How to collect Windows Event logs to detect a targeted attack

  Targeted attacks are growing, and eventually your enterprise will be a target. Expert Richard Bejtlich covers how to collect Windows Event logs to detect an intrusion.  Continue Reading

• Understanding iPad security concerns for better iPad enterprise management

  Are iPad security concerns burdening your company’s adoption of the technology? Expert Michael Cobb discusses common security concerns and iPad enterprise management issues.  Continue Reading

• Business partner security: Managing business risk

  Allowing outside business partner access to your systems and data always comes with some level of risk. Nick Lewis examines what those risks are and strategies for managing business risk.  Continue Reading

• WebScarab tutorial: Demonstration of WebScarab proxy functionalities

  In this WebScarab tutorial video, get step-by-step advice on how to install and use this free tool, including the WebScarab proxy features, among others.  Continue Reading

• Requirements for secure IPv6 deployments include better IPv6 tester tools

  More staff training, industry research and improved IPv6 tester tools are essential for secure IPv6 deployments in the enterprise. Expert Fernando Gont explains why.  Continue Reading

• Choosing the best security certifications for your career

  Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.  Continue Reading

• Using an IAM maturity model to hone identity and access management strategy

  Forrester Research’s Andras Cser discusses how to use an IAM maturity model to assess your identity and access management strategy.  Continue Reading

• Is private browsing really private? Identifying Web browser risk

  Private browsing may offer users a false sense of security when surfing the Web. In this expert tip, learn how private browsing really works, and how to mitigate its risks.  Continue Reading

• IPv6 myths: Debunking misconceptions regarding IPv6 security features

  Aggressive marketing has helped perpetuate a number of security-related IPv6 myths. Expert Fernando Gont helps separate myth from fact to ensure a secure IPv6 deployment.  Continue Reading

• How to detect content-type attacks in information security

  Malicious attackers have increasingly turned to exploiting vulnerabilities in client-side software. Learn how to detect and prevent these types of attacks in your environment.  Continue Reading

• Auditing virtualization: Security training for infosec pros

  This chapter discusses auditing virtualized environments, and begins with an overview of common virtualization technologies and key controls.  Continue Reading