Making Vendor Risk Management Part of Your Security Strategy

Posted by:

When we think of Vendor Risk Management (VRM), there’s usually a policy or a procedure, possibly even a process to follow – and for good reason. The consistent approach that effective VRM gives you should lead to lower financial and strategic risks, increased admin efficiencies, reduced costs and quicker onboarding of suppliers.

A painful lessons this year has taught businesses is that they are only as resilient as the vendors they rely on. A promise is only ...

Read More →
0

Examining the How of NIST Privacy

Posted by:

Last time I discussed why you should consider using the NIST Privacy framework as both a foundation and methodology for managing data protection and privacy risk management

In this article, I’d like to explain how it works in practice.

Here we bring together facts and information from disparate and sometimes rather technical documents. When I began my research into the NIST Privacy framework, I saw it described as both “

Read More →
0

NIST Privacy Framework – Your Foundation for Future Privacy Compliance

Posted by:

In preparing to write an article about the NIST Privacy Framework I asked some friends who work in infosec and data protection for their thoughts. With few exceptions the conversation went:

“Oh, you mean the NIST CyberSecurity Framework.”

“No, the Privacy Framework”, I’d reply.

“I’m pretty sure it’s Cybersecurity.”

“I’ll send you a link.”

It’s not surprising that it’s gone under the ...

Read More →
0

Virgin Media and Not-Quite-Best-Practice Incident Reporting

Posted by:

Virgin Media, a UK telephone, cable TV and internet services provider released a statement two weeks ago admitting that they had exposed certain personal data of up to 900,000 people.

The short story is that they admitted it, they apologized, they informed both the affected people and the relevant authorities, and they set up a help and advice page for customers.

Great stuff, except…

While ...

Read More →
0

Coronavirus And The Sudden Remote Worker Cybersecurity Problem – 5 Things to Consider

Posted by:

While the Covid-19 situation is changing rapidly, companies need to prepare for any eventuality. For IT departments, this means that, at any moment, any number of staff might be required to stay at home for a period of quarantine or self-isolation at very short notice. 

Where appropriate, companies ought to consider how they can keep their employees productive if they can’t come into work for a few weeks. 

In many cases, a remote working setup might ...

Read More →
0

Security Benefits and Perils of Serverless Computing

Posted by:

Whether you run your infrastructure in house or in the cloud, you’ve probably heard of serverless computing, and how it can make running applications easier and cheaper.  But is it all it’s cracked up to be, and is it more secure than running ‘always on’ servers?

Let’s start with the obvious advantages:

No infrastructure to maintain, not even virtual

With serverless computing, you don’t have to worry about provisioning servers, not even virtual ones. Your code runs ...

Read More →
0

Why it is high time to consider a CISO on demand

Posted by:

Many years ago I went to the doctor with a weird arm.  If I held my elbow and wrist just-so, it seemed to stop the blood supply going to my fingers.  Nothing too dramatic, but worth getting checked out. I was referred to the local hospital where the specialist remarked that he had never seen anything like it and he was keen to investigate further.

“I should add that you’ve been referred to the wrong department.  This ...

Read More →
0

Take aways from the NASA Raspberry Pi “incident”

Posted by:

 

Some of you might be thinking that it being an IT security guy is not all that tough. All an expert has to do is block the bad stuff and grease the wheels for the good stuff. 

But you’d be wrong. While yes, there are a growing number of tools out there to help IT security officers better manage their networks, the sheer complexity of the machines that basic users have at their fingertips can give a ...

Read More →
0

The Delicate OpSecs needed to secure Supply Chains

Posted by:

OPSEC is a pretty familiar term in this industry, but reviewing its fundamental meaning and what it implies for us today in our current threat landscape is a useful exercise.

After all, being able to secure our systems and information from prying eyes from the likes of cyber thieves, scammers, ransomers, and so on, is a key priority for most businesses today.

OPSEC is the term the industry uses to talk about operational security. ...

Read More →
0

Securing IoT can make profitable sense to any company

Posted by:

A survey conducted by Ponemon in 2018 found that 97 percent of security professionals thought that a cyber attack vectoring from an insecure device could be “catastrophic” for the business. They also found that only 15 percent had bothered to do an inventory of the IoT devices, which were indeed connected to their systems. And only half had protocols to disconnect high-risk devices upon detection.

The survey stresses the importance of addressing this vulnerability:

Read More →

0
Page 1 of 2 12
})
SEC Cybersecurity Exams