When outsourcing development and external systems, businesses should be careful to outline the obligations and requirements of those...

The exchange of information performed by organizations must be protected with appropriate security controls. These controls need to be...

Audit logs are key to monitoring for unauthorized activities, insider threats, and issues that may be affecting system performance. The...

Malicious and mobile code protection is critically important. New variants of malicious code are released every day while mobile code...

Organizations should ensure that before equipment (e.g., servers, network infrastructure, information systems) is installed, the location...

In the first work week of the year, I’ve seen several different articles and blog posts about predictions and what to expect from an IT...

If organizations are not able to account for individuals in their buildings or offices at any given time, it will likely result in an...

Organizations that allow wireless access for computer communications or networking need to focus on how best to protect wireless...

Organizations need to implement system utility access controls to protect and ensure standard, non-administrative users do not have the...

Security categories for an organization’s information systems need to be defined to enable appropriate risk decisions to be made. Without...

Once organizations have developed a risk management strategy and a risk management program, regular risk assessments should be performed...

With the Independence Day holiday earlier this week, the pitfall I’m highlighting here from my eBook, Security Program Pitfalls and...

The next pitfall from my eBook, Security Program Pitfalls and Prescription to Avoid Them, that I’d like to highlight in this blog post is...

As part of our quest to highlight different pitfalls from my eBook Security Program Pitfalls and Prescription to Avoid Them, this blog...

Over the next year or so, we’ll be highlighting a different pitfall each week from the eBook Security Program Pitfalls and Prescription...

It all starts with a plan. If a Security Program Plan is not developed, documented, and effectively communicated to all stakeholders,...