Evaluate your security program’s maturity before dropping money on a quick-fix “hot” product.
Evidently, there is an increasing fascination within the American psyche with hoarding, the excessive collection of items, along with the inability to discard them. This is evident in the popularity of television shows such as “Buried Alive” and “Hoarders”.
Read more of this post on our new blog site http://blog.securestate.com/post/2011/05/05/Quit-Hoarding.aspx
Read more!
Thursday, May 5, 2011
Information Policies & Procedures, Part 7
This is part of an ongoing series on documentation development.
Do words matter? Of course they do. There are few places where this statement is as true as in documentation. When developing policies and procedures, we must be very clear about the rules. Must and shall mean, as the name implies, that the action is not optional. May means that the action is allowed, but not required. This is an essential difference. Take for instance: sharing passwords. A policy statement should be in place saying something like “users shall not disclose passwords to others.” This clearly dictates that passwords must not be disclosed. May, on the other hand, allows a bit more flexibility. For example, take the statement “users may bring in their own monitors.” In this case, users are allowed, but not required, to use their own monitors.
Read the rest of this post at our new blog site: http://blog.securestate.com/post/2011/05/02/Information-Security-Policies-and-Procedures-Part-7.aspx
Read more!
Do words matter? Of course they do. There are few places where this statement is as true as in documentation. When developing policies and procedures, we must be very clear about the rules. Must and shall mean, as the name implies, that the action is not optional. May means that the action is allowed, but not required. This is an essential difference. Take for instance: sharing passwords. A policy statement should be in place saying something like “users shall not disclose passwords to others.” This clearly dictates that passwords must not be disclosed. May, on the other hand, allows a bit more flexibility. For example, take the statement “users may bring in their own monitors.” In this case, users are allowed, but not required, to use their own monitors.
Read the rest of this post at our new blog site: http://blog.securestate.com/post/2011/05/02/Information-Security-Policies-and-Procedures-Part-7.aspx
Read more!
Thursday, April 21, 2011
“We Have a Vulnerability Management Program…It’s in Our Data Center”
From Running Scans to Building a Vulnerability Management Program
I perform the Vulnerability Assessments and Payment Card Industry Approved Scanning Vendor (PCI ASV) Scans at our information security firm. I have been running scans for over 100 different companies for the last year, and I see the same recurring vulnerabilities again and again. What I have also seen is that people do not understand what it means to manage vulnerabilities.
Learn more on our new blog site
http://blog.securestate.com/post/2011/04/21/e2809cWe-Have-a-Vulnerability-Management-Programe280a6Ite28099s-in-Our-Data-Centere2809d.aspx
Read more!
I perform the Vulnerability Assessments and Payment Card Industry Approved Scanning Vendor (PCI ASV) Scans at our information security firm. I have been running scans for over 100 different companies for the last year, and I see the same recurring vulnerabilities again and again. What I have also seen is that people do not understand what it means to manage vulnerabilities.
Learn more on our new blog site
http://blog.securestate.com/post/2011/04/21/e2809cWe-Have-a-Vulnerability-Management-Programe280a6Ite28099s-in-Our-Data-Centere2809d.aspx
Read more!
Tuesday, April 19, 2011
Spring into a New Career!
SecureState will be holding on-site open interviews on Thursday, April 21 from noon to 6:30 p.m.
at the SecureState Headquarters: 23340 Miles Road, Bedford Heights, OH 44128
http://blog.securestate.com/post/2011/04/19/Spring-into-a-New-Career!.aspx
Read more!
at the SecureState Headquarters: 23340 Miles Road, Bedford Heights, OH 44128
http://blog.securestate.com/post/2011/04/19/Spring-into-a-New-Career!.aspx
Read more!
Friday, April 15, 2011
Let’s Go with the Web Application Scan… It is cheaper
Why a Manual Web Application Security Assessment is worth every penny over an automated tool.
Choosing the Assessment: As a Security Consultant for SecureState, I have performed my share of Web Application Security Assessments in the last couple of years, including both Assessments which relied heavily on Web Application Scanners to find vulnerabilities in the web application, as well as Assessments which relied primarily on manual techniques. There is a great difference between these two techniques for performing Web Application Assessments, and I believe that the Web Application Scanner based Assessments are of little value compared to Web Application Assessments that rely on manual techniques. Many times, when choosing a Web Application Assessment, a company will choose the cheapest Assessment available without truly understanding the Pros and Cons of each Web Application Security Assessment. It is important to realize the fact that the cheapest option is not always the best option.
Learn more at SecureState's new blog site http://blog.securestate.com/post/2011/04/15/Lete28099s-Go-with-the-Web-Application-Scane280a6-It-is-cheaper.aspx
Read more!
Choosing the Assessment: As a Security Consultant for SecureState, I have performed my share of Web Application Security Assessments in the last couple of years, including both Assessments which relied heavily on Web Application Scanners to find vulnerabilities in the web application, as well as Assessments which relied primarily on manual techniques. There is a great difference between these two techniques for performing Web Application Assessments, and I believe that the Web Application Scanner based Assessments are of little value compared to Web Application Assessments that rely on manual techniques. Many times, when choosing a Web Application Assessment, a company will choose the cheapest Assessment available without truly understanding the Pros and Cons of each Web Application Security Assessment. It is important to realize the fact that the cheapest option is not always the best option.
Learn more at SecureState's new blog site http://blog.securestate.com/post/2011/04/15/Lete28099s-Go-with-the-Web-Application-Scane280a6-It-is-cheaper.aspx
Read more!
Friday, April 8, 2011
PCI DSS Applicability To Closed Accounts
We recently ran into some questions from multiple organizations regarding PCI DSS applicability to closed or inactive credit card account numbers. For example, when someone passes away, the disposition of their debts and assets may go through probate. What may happen during this process is the collection of all of the deceased’s debt accounts, including credit cards, to determine how claims will be paid from the estate. Based on discussions with some of our clients, the credit card accounts are closed before they are handed over to the probate organization. That being said, these organizations will have credit card data in their systems, albeit inactive account numbers.
Read more on SecureState's new blog site http://blog.securestate.com/post/2011/04/08/PCI-DSS-Applicability-To-Closed-Accounts.aspx
Read more!
Read more on SecureState's new blog site http://blog.securestate.com/post/2011/04/08/PCI-DSS-Applicability-To-Closed-Accounts.aspx
Read more!
Wednesday, April 6, 2011
Penalty Double Ups: PCI Intersects with State Privacy Laws
A lawsuit out of Massachusetts related to a breach of cardholder data by the Briar Group, LLC resulted in an $110,000 settlement by the company. This is some interesting news, as it shows that penalties for not protecting cardholder data can hit you from both the card brands and regional privacy lawsuits. Although the amount of the settlement is not extremely high, the other requirements coming out of the settlement can definitely push those costs up. Read more on SecureState's new blog site http://blog.securestate.com/post/2011/04/06/Penalty-Double-Ups-PCI-Intersects-with-State-Privacy-Laws.aspx
Read more!
Read more!
Subscribe to:
Posts (Atom)
Posts
