- Tools More Than a Hammer: Expanding the Information Security Toolbox
Security programs over-focus on networks and systems because infrastructure is most practitioners' background. The toolbox needs domain expertise in business functions, data analytics for measuring...
- Social Networking Security Scoreboard - "Yelp" for Enterprise Security Products?
- Malware The Worrisome State of the Information Security Industry
The security industry faces fundamental problems: tools don't cater to our needs, vendors misrepresent capabilities, professionals preach to the choir rather than connecting with colleagues, spending...
- Risk Management Non-Financial "Currency" for Framing Security Discussions
Frame security discussions using internal "currency" beyond dollars—reputation, service availability, trade secrets. Also consider individual concerns: looking bad in front of managers, being fired...
- Risk Management Which Information Security Controls Are Most Important?
Comparing Securosis, PwC, and SANS 20 Critical Controls projects, system hardening appears across all three lists. Other consistently important controls include centralized security event monitoring,...
- Leadership CISOs Can Find Allies at the General Counsel Office
CISOs and General Counsel share overlapping goals: policy legality, intellectual property protection, risk/business balance, compliance obligations, and freedom to critique other groups' decisions....