Mainframe July 15, 2014

6 Security Trauma Tips: Taking the Complexity Out of Compliance

2 min read - With the right tools in place, organizations can minimize the complexity and trauma of auditing and compliance while remaining vigilant against threats.

CISO July 11, 2014

Threat-Aware Identity and Access Management: Marketing Hype or the Real Deal?

2 min read - Threat-aware identity and access management tools have the advanced capabilities necessary to protect an organization's business-critical data.

Identity & Access June 2, 2014

3 Steps to Getting Data Access Governance Off Your To-Do List

7 min read - The issue of data access governance is a big one for IT security; here are the steps you can take to finally check this item off your security to-do list.

Application Security March 3, 2014

Application Security Risk Management and the NIST Cybersecurity Framework

5 min read - What value can the NIST Framework for Improving Critical Infrastructure Cybersecurity bring to my industry and my organization from a software security perspective? Understand how risk-based application security management intersects with the framework.

Software Vulnerabilities February 20, 2014

How do you know if a hardware or software vendor can be trusted?

3 min read - How do you know if the vendor providing hardware or software can be trusted? How do you know if their processes can be trusted to supply your organization with hardware and software that has not been maliciously tainted? This is…

Application Security January 27, 2014

How do I know my Cloud Service Provider’s (CSP) Applications are secure?

5 min read - How do I know my Cloud Service Provider's (CSP) Applications are secure? While it's a simple question, the answer is fairly complex. What organizations should consider when looking at their CSP's application security profile. This is a weekly post where…

Application Security December 13, 2013

What is the difference between PCI DSS and PA DSS?

4 min read - What is the difference between PCI DSS and PA DSS? If I'm not a payment application vendor, what value does the PA DSS have for me? Addressing the top questions of interest to the Application Information Security Community.

Software Vulnerabilities November 18, 2013

Does it really matter if my software is built securely?

3 min read - A couple of weeks ago, I was meeting with the application security team at a Fortune 500 company and one of the testing team members asked, “Does it matter whether or not software’s built securely? Can’t we just block attacks…

Data Protection October 30, 2013

When it Comes to Your Data: Fear Less, Encrypt More

2 min read - Why are people afraid to protect their information by encrypting their data? Why is encryption often the protection mechanism of last resort? Unfortunately, encryption is often perceived as complex, something akin to rocket science.

Intelligence & Analytics October 15, 2013

Sharpening Your Security Intelligence Ax with Big Data

3 min read - If you are the typical enterprise, you potentially have tens of thousands of software vulnerabilities spread across thousands and thousands of machines in your network. The possibilities for using existing data to enhance your vulnerability prioritization are immense.The best way…