"What do you say to organizations considering software security, but struggling with adoption due to the inevitable, additional drag on release cycles?" -- I say read this, because there is a discussion to be had, still...
Lots going on in the enterprise space right now, including the rush to push out mobile apps. They're springing up like weeds, replacing websites, and are gaining multi-factor authentication for security... but wait, does any of this added security make sense, especially on the mobile platform?
Let's investigate.
Have you ever had a vacuum salesperson come to your door and offer a free demo on why their vacuum is 10x better than your existing unit? I have, and a recent pitch from a vendor I saw reminded me of this little trick...
Wrapping up the 5-part series "Deconstructing Defensible" we need to talk about the what, why, from whom, how and when of defensibility. These are key questions that need to be asked - and answered - while shifting your mindset from 'security' to 'defensibility'.
Every time someone says "Big Data" a collective cringe travels across the information security industry, like a disturbance in the Force. Some security professionals simply shrug off the term as a fad, or marketing buzzword. While the hype around big data has absolutely been marketing-driven lately, there is a very real need for Big Data style analysis in security...
As we deconstruct 'defensible' further we dive into 'understanding what you're defending'. Altogether too many CISOs and their organizations plunge head-long into defending without having a solid idea of the assets that they're charged with protecting - and the end result isn't pretty...
In this third post in the “Deconstructing Defensible” series I build upon my first post, in which I cover why defensible is not necessarily the same thing as secure, and how there are more assets to defend than you have resources. Today’s post focuses on how — unfortunately in an large number of enterprises — the security resources can become weaknesses.
Continuing on part 2 of "Deconstructing Defensible" this blog post is dedicated to those who attempt to secure the entirety of their enterprise assets with security widgets, and are struggling. One of the fundamental laws of the new way of thinking is that you can't defend everything equally, or you'll fail at defense completely...
It's time to move on, and if you're interested in what I'll be doing next, read this post...
This post is from a guest-blogger, Dan Houser, who read one of my previous posts and decided to expand on the point and add his own viewpoint on managed versus unmanaged technical debt ... it's a very interesting read I encourage you to take a minute to consume...
Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).
I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.
Get exclusive access to CSO, invitation only events, reports & analysis. 
