Security Operations & Management

How criticality analysis benefits from an entropy engineer

NIST published 'Criticality Analysis Process Model: Prioritizing Systems and Components' to guide organizations when prioritizing systems. Discover the key processes with Judith Myerson. Continue Reading

By

• Judith Myerson

WebAssembly updates may cancel out Meltdown and Spectre fixes

News roundup: Upcoming WebAssembly updates may undo the Meltdown and Spectre mitigations. Plus, FireEye denied claims it 'hacked back' China, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

GlobalSign, Comodo launch competing IoT security platforms

Rival certificate authorities GlobalSign and Comodo CA have strengthened their presence in the IoT security market with new platforms for connected devices. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

McAfee CISO explains why diversity in cybersecurity matters

Improving diversity in cybersecurity teams can help improve their ability to address cybersecurity challenges through diversity of thought, suggests McAfee CISO Grant Bourzikas. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How security operations centers work to benefit enterprises

One key support system for enterprises is security operations centers. Expert Ernie Hayden reviews the basic SOC framework and the purposes they can serve. Continue Reading

By

• Ernie Hayden, 443 Consulting LLC

SOC services: How to find the right provider for your company

SOCs are the latest services you can now outsource rather than build in-house. But should you entrust them to a third party? Yes—but make sure you know how to pick the best. Continue Reading

By

• Steven Weil, Point B

How security automation and orchestration impacts enterprises

The use of security automation and orchestration systems is on the rise, as they have the ability to provide automatic responses to threats. Learn how this benefits the enterprise. Continue Reading

By

• Matthew Pascucci

AMD patches in testing with ecosystem partners

The timeline for the AMD patches promised to fix chipset flaws disclosed in March is being criticized, but AMD said the patches are being tested by partners and are still on track. Continue Reading

By

• Michael Heller, TechTarget

How the BloodHound tool can improve Active Directory security

Auditing Active Directory can be made easier with tools like the open source BloodHound tool. Expert Joe Granneman looks at the different functions of the tool and how it can help. Continue Reading

By

• Joseph Granneman, Illumination.io

CCSP Practice Exam and Study Guides

Studying for, obtaining and maintaining your CCSP® certification has now become more convenient with SearchCloudSecurity.com. Continue Reading

Women in cybersecurity discuss hiring, advice and being mentors

A panel of women cybersecurity professionals at the RSA Conference discussed ways to find the best job candidates, the best advice they've received and how to be better mentors. Continue Reading

By

• Michael Heller, TechTarget

CCSP practice test: Do you know the cloud computing basics?

Preparing to take the CCSP exam? Test your knowledge of key topics in Domain 1, which covers cloud concepts, reference architectures, security concerns and design principles. Continue Reading

By

• (ISC) 2

Imran Awan case shows lax security controls for IT staff

Investigations into the conduct of the IT staff of the House of Representatives raised alarms. Kevin McDonald explains what we can learn from the case of Imran Awan. Continue Reading

By

• Kevin McDonald, Alvaka Networks

CPE for CISSP: Top 10 ways to master continuing education

Who says you can't have fun while earning CPE credits to maintain your CISSP certification? Check out the top 10 creative ways to meet CISSP continuing education requirements. Continue Reading

By

• Donald C. Donzal

Tenable introduces Lumin cyber exposure platform

Tenable.io Lumin enables organizations to gauge their 'cyber exposure' to vulnerabilities and allows them to compare remediation efforts against industry benchmark data. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

McAfee cloud security platform expands to Microsoft Azure

In its first move following the acquisition of cloud access security broker Skyhigh Networks, McAfee extended its cloud security platform to Microsoft Azure customers. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Patch management programs: Who should run them?

Patch management is a crucial part of enterprise security defenses, but should security teams be in charge of it? Charles Kao explains how to make patching programs successful. Continue Reading

By

• Charles Kao, Simply Auri

Continuous security monitoring advances automated scanning

Battling threats in today's fast-paced cyberworld means shutting down vulnerabilities fast, which requires round-the-clock monitoring. Learn how to make it happen in your company. Continue Reading

By

• Mike Chapple, University of Notre Dame

Automated patch management and the challenges from IoT

From creating an inventory to scanning for IoT vulnerabilities, learn the key steps to take when it comes to automating patch management in your company. Continue Reading

By

• Mike Chapple, University of Notre Dame

CISSP Domain 8: Software development security explained

If you're studying for the CISSP exam, don't miss this special Security School on Domain 8. Review important concepts in software development security and sharpen your skills. Continue Reading

Domain 8: Security in software development lifecycle quiz

Understanding the ins and outs of the software development lifecycle is pivotal to passing Domain 8 of the CISSP exam. Are you ready? Find out with this practice quiz. Continue Reading

By

• (ISC) 2

SheHacks hackathon at BU promotes female tech advancement

For 36 hours during the last weekend in January, more than 1,000 attended one of the largest women's hackathons ever at SheHacks Boston. SheHacks Boston organizer Natalie Pienkowska said that the ... Continue Reading

By

• Tom Gambardella

Microsoft: Windows Analytics can detect Meltdown and Spectre exposure

Microsoft says Meltdown and Spectre vulnerabilities are now being tracked by Windows Analytics, which shows users the update status for CPU microcode and OS patches. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

CISSP Domain 7: Security operations

Learn about important cybersecurity techniques and technologies that serve as the foundation of both day-to-day security operations and incident response. Continue Reading

How should BGP route hijacking be addressed?

A new report from NIST shows how BGP route hijacking can threaten the internet. Expert Judith Myerson reviews the guidance for improving BGP security. Continue Reading

By

• Judith Myerson

Dynamic application security testing, honeypots hunt malware

Stealth is an attacker's best friend, especially when it comes to sneaking malware past the firewall. Learn about some trusty tools that can stop malware in its tracks. Continue Reading

By

• (ISC) 2

Risk & Repeat: Let's Encrypt certificates offer pros, cons

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Let's Encrypt certificates and weigh the positives and negatives the free certificate authority provides. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How should undocumented features in software be addressed?

Kaspersky Lab recently discovered an undocumented feature in Microsoft Word. Expert Kevin Beaver explains the risks and what to do if you come across one of these software flaws. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Information security certification guide: Intermediate level

Part two of this information security certificate guide looks at vendor-neutral intermediate certifications for IT professionals interested in midlevel positions. Continue Reading

By

• Ed Tittel

CISSP Domain 6: The importance of security assessments and testing

Security assessment and testing should be baked into your regular IT workflows so that you’re able to spot software vulnerabilities before they turn into full-blown attacks. Continue Reading

CISSP Domain 6 quiz: Vulnerabilities in software

Domain 6 of the CISSP exam tests how well you understand the security assessment and testing strategies needed to recognize, prevent and remedy vulnerabilities in software. Continue Reading

By

• (ISC) 2

Security Controls Evaluation, Testing, and Assessment Handbook

In this excerpt from chapter 11 of Security Controls Evaluation, Testing, and Assessment Handbook, author Leighton Johnson discusses access control. Continue Reading

By

• Syngress & SearchSecurity

How security controls affect web security assessment results

Network security controls are a blessing and a curse as they help an organization's IT environment, yet hinder web security assessment results. Kevin Beaver explains how they work. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Why threat models are crucial for secure software development

Threat modeling is an important component of the secure software development process. Steve Lipner of SafeCode explains how threat models benefit software security. Continue Reading

By

• Steve Lipner, SafeCode

How should security teams handle the Onliner spambot leak?

A security researcher recently discovered a list of 711 million records used by the Onliner spambot. Expert Matt Pascucci explains what actions exposed individuals should take. Continue Reading

By

• Matthew Pascucci

Next-gen SOC: What's on your automation roadmap?

The concept of a security operations center that optimizes resources -- security technologies, threat intelligence and analysts -- to counter threats is a great idea. However, in reality, designing an effective SOC is hard. Many companies struggle first with implementation and then with figuring out how to take their SOC to the next level. What will the next-gen SOC look like?

Security operations centers today are found mostly in large organizations and focus on detection and remediation. The lack of big data analysis tools that can work with wide varieties of data is a major obstacle.

"That's one of the reasons I think people say SOCs are not very effective yet," said Randy Marchany, CISO at Virginia Tech. The university's SOC project has been put on hold as they implement another security information and event management tool and ramp up on the open source Elastic Stack, formerly known as ELK.

Integration of tools and increased automation may help security analysts prioritize security events in a next-gen SOC, but once a serious security incident has been identified, many companies lack a sophisticated incident-response process. CISOs need to work on building internal and external relationships, like with law enforcement, that will assist the company in the event of a breach.

In this issue of Information Security magazine, we look at the strengths and weaknesses of security operations centers. To what extent are SOCs integrating the tools they have? How are they automating these processes? We ask CISOs and other security leaders what strategies will help organizations build the next-gen SOC. What is your three-year plan for getting your organization's security operations center to the next level?

 Continue Reading

Are security operations centers doing enough?

SOCs are maturing, but organizations facing the increased threat landscape understand that improving their effectiveness must be a priority in the year ahead. Continue Reading

By

• Steve Zurier, ZFeatures

October 2017 Patch Tuesday includes Windows zero-day fix

The top priority for Microsoft's October 2017 Patch Tuesday goes to a Windows zero-day vulnerability, but IT should also beware of two publicly disclosed flaws. Continue Reading

By

• Michael Heller, TechTarget

CISSP Domain 3 quiz: Security engineering

In preparing for Domain 3, Security Engineering, CISSP candidates should review a wide range of concepts, from security models to cryptography systems. Continue Reading

By

• (ISC) 2

CISSP Domain 3: Security systems engineering

Planning to take the CISSP exam? Brush up on essential concepts and vocabulary in security systems engineering, covered in Domain 3, in this Security School. Continue Reading

Why DevOps security must be on infosecs' priority list

In the rush to implement DevOps, security is too often overlooked. But DevSecOps is essential in these hack-filled days. Learn how to add security to software development. Continue Reading

By

• Johna Till Johnson, Nemertes Research

CISSP Domain 2: Asset security

This Security School will help prepare you for Domain 2 of the CISSP exam, providing overviews of data encryption methods, data ownership concepts and asset protection. Continue Reading

Security teams must embrace DevOps practices or get left behind

DevOps practices can help improve enterprise security. Frank Kim of the SANS Institute explains how infosec teams can embrace them. Continue Reading

By

• Frank Kim, SANS Institute

What you need to know about setting up a SOC

Setting up a SOC is different for every enterprise, but there are some fundamental steps with which to start. Expert Steven Weil outlines the basics for a security operations center. Continue Reading

By

• Steven Weil, Point B

How can OSS-Fuzz and other vulnerability scanners help developers?

Google's OSS-Fuzz is an open source vulnerability scanner. Expert Matthew Pascucci looks at how developers can take advantage of this tool and others like it. Continue Reading

By

• Matthew Pascucci

Bipartisan group launches effort to improve election security

News roundup: The Defending Digital Democracy project brings together security experts to tackle election security. Plus, government shake-ups could hit cybersecurity, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Incorporating static source code analysis into security testing

Static source code analysis, along with dynamic analysis and pen testing, can help strengthen your application security. Expert Kevin Beaver goes over the features to look out for. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Select the best patch management software for your company

Patch management software enables businesses to prioritize and automatically update systems so that their assets remain secure. See which best fits your infosec strategy. Continue Reading

Patch management tool comparison: What are the best products?

With so many different vendors in the market, it isn't easy to pick the right patch management tool. Read this product comparison to see which is best for your company. Continue Reading

By

• Earl Follis

Know why patch management tools are required in the IT infrastructure

Regulations, efficiency and protection are the main drivers for purchasing patch management tools. See why automated patch management is a requirement for most businesses. Continue Reading

By

• Earl Follis

Report: Threat hunting is more SOC than intel

Threat hunting is driven by alerts with less emphasis on cyberthreat intelligence, according to researchers. Yet 60% of those surveyed cited measurable security improvements. Continue Reading

By

• Kathleen Richards

Security Update Guide brings growing pains to Patch Tuesday

Microsoft fundamentally changes how IT pros will consume Patch Tuesday releases with the Security Update Guide and brings fixes for an actively exploited Word zero-day. Continue Reading

By

• Michael Heller, TechTarget

Dedicated security teams: The pros and cons of splitting focus areas

Could using dedicated security teams that focus on one area of risk help reduce the attack surface for enterprises? Expert Steven Weil looks at the pros and cons of that approach. Continue Reading

By

• Steven Weil, Point B

CISSP Practice Exam and Study Guides

Studying for, obtaining and maintaining your CISSP® certification has now become more convenient with SearchSecurity.com. Continue Reading

Totally automatic: Improve DevOps and security in three key steps

Concerned about DevOps security? Learn three key steps to embedding security into the software development process, including how to improve automation. Continue Reading

By

• Johna Till Johnson, Nemertes Research

Obama-era cyber executive order extended by Trump

A cyber executive order from the Obama era has been extended by President Trump to allow sanctions placed on cybercriminals who attack the U.S. Continue Reading

By

• Michael Heller, TechTarget

Nine critical Windows security bulletins in Patch Tuesday

After its cancelled February Patch Tuesday, Microsoft's March 2017 Patch Tuesday includes nine critical Windows security bulletins targeting remote code execution flaws. Continue Reading

By

• Michael Heller, TechTarget

WikiLeaks vows to disclose CIA hacking tools; CIA to investigate

WikiLeaks founder Julian Assange promised to work with vendors to help patch products vulnerable to CIA hacking tools, while the FBI and CIA will investigate the leak. Continue Reading

By

• Michael Heller, TechTarget

AI or not, machine learning in cybersecurity advances

As more companies promote machine learning and artificial intelligence technologies, chief information security officers need to ask some tough questions to get past the hype. Continue Reading

By

• Kathleen Richards

Security looks to machine learning technology for a cognitive leg up

Advances in machine learning technology and artificial intelligence have proven to work well for some information security tasks such as malware detection. What's coming next? Continue Reading

By

• Robert Lemos

How can enterprises leverage Google's Project Wycheproof?

Google's Project Wycheproof tests crypto libraries for known vulnerabilities, but there are potential drawbacks to this tool. Expert Matthew Pascucci explains them. Continue Reading

By

• Matthew Pascucci

Microsoft Patch Tuesday February release delayed by a month

News roundup: Microsoft Patch Tuesday was canceled in February without a clear reason. Plus, APT28 is linked to new Mac malware; Lazarus targets more banks and more. Continue Reading

By

• Madelyn Bacon, TechTarget

How to organize an enterprise cybersecurity team effectively

The structure of an enterprise's cybersecurity team is important for ensuring it's as effective as possible. Expert Steven Weil outlines strategies for setting up a security group. Continue Reading

By

• Steven Weil, Point B

Q&A: Rapid7's Beardsley and Brown dish on Mirai botnet, pen testing

Rapid7's Beardsley and Brown offer insight on Mirai botnet attacks, while also sharing some of their craziest penetration testing and incident response experiences. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

January Patch Tuesday sparse before Windows security updates change

Microsoft offers up a meager January 2017 Patch Tuesday release before bigger changes planned for Windows security update announcements, which are set to take effect in February. Continue Reading

By

• Michael Heller, TechTarget

What are the potential pros and cons of a Cyber National Guard?

A congressman proposed adding a Cyber National Guard to the military to protect the U.S. from cyber adversaries. Expert Mike O. Villegas examines the potential drawbacks of this branch. Continue Reading

By

• Mike O. Villegas, K3DES LLC

Should one cybersecurity mistake mean the end of a CEO's career?

In one case, a tenured CEO made one cybersecurity mistake and was fired. Expert Mike O. Villegas discusses whether this sets a precedence for enterprises going forward. Continue Reading

By

• Mike O. Villegas, K3DES LLC

Splunk Enterprise Security: Product overview

Expert Dan Sullivan explores how Splunk Enterprise Security uses big data security analytics to incorporate multiple methods of data integration to identify malicious events. Continue Reading

By

• Dan Sullivan

How can security automation tools keep organizations protected?

Sometimes security teams fall into 'set and forget' habits with security automation. Expert Mike O. Villegas explains how to take advantage of automation while staying secure. Continue Reading

By

• Mike O. Villegas, K3DES LLC

Blue Coat Security Analytics Platform: Product overview

Expert Dan Sullivan takes a look at the Blue Coat Security Analytics Platform, which is designed to capture comprehensive network information and apply targeted security analytics. Continue Reading

By

• Dan Sullivan

CISSP online training: Software Development Security domain

Spotlight article: Shon Harris explains the core concepts in the CISSP domain on software development security, including models, methods, database systems and security threats. Continue Reading

By

• Shon Harris , Logical Security

How CMMI models compare and map to the COBIT framework

Following ISACA's recent acquisition of the CMMI Institute, expert Judith Myerson takes a closer look at COBIT and CMMI models and how they compare to one another. Continue Reading

By

• Judith Myerson

Designing and Building Security Operations center

In this excerpt of Designing and Building Security Operations Center, author David Nathans reviews the infrastructure needed to support a SOC and maintain SOC security. Continue Reading

By

• SearchSecurity and Syngress

Outdated apps: What are the best ways to address them?

Dead and outdated apps can pose serious security risks for enterprises. Expert Nick Lewis explains how to find and remove dead apps before they become a problem. Continue Reading

By

• Nick Lewis

How can software transplants fix bad code?

Copying and pasting bad code into an application is a big problem for developers, but software transplants can help. Expert Michael Cobb explains the technology. Continue Reading

By

• Michael Cobb

AlienVault OSSIM: SIEM Product overview

Expert Karen Scarfone checks out AlienVault's Open Source SIEM and Unified Security Management products for collecting event data from various security logs within an organization. Continue Reading

By

• Karen Kent, Trusted Cyber Annex

IBM Security QRadar: SIEM product overview

Expert Karen Scarfone takes a look at IBM Security QRadar, a security information and event management (SIEM) tool used for collecting and analyzing security log data. Continue Reading

By

• Karen Kent, Trusted Cyber Annex

LogRhythm's Security Intelligence Platform: SIEM product overview

Expert Karen Scarfone examines LogRhythm's Security Intelligence Platform, a SIEM tool for analyzing collected data. Continue Reading

By

• Karen Kent, Trusted Cyber Annex

Can a new encryption trick prevent reverse engineering?

Expert Michael Cobb explains how reverse engineering can be made more difficult with an approach called Hardened Anti-Reverse Engineering System or HARES. Continue Reading

By

• Michael Cobb

Introduction to security analytics tools in the enterprise

Expert Dan Sullivan explains how security analysis and analytics tools work, and how they provide enterprises with valuable information about impending attacks or threats. Continue Reading

By

• Dan Sullivan

Benefits of the Cisco OpenSOC security analytics framework

Cisco's open source security analytics framework aims to help enterprises address visibility and incident management challenges. Expert Kevin Beaver discusses OpenSOC and what to consider when integrating it into an enterprise security strategy. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

Getting to know the new GIAC certification: GCCC

The new GIAC certification, GCCC, is not a very specific certification, but it could prove useful in organizations. Expert Joseph Granneman explains why. Continue Reading

By

• Joseph Granneman, Illumination.io

The Basics of Information Security

In this excerpt of The Basics of Information Security, author Jason Andress outlines methods for improving operating systems security. Continue Reading

By

• SearchSecurity and Syngress

CISSP cryptography training: Components, protocols and authentication

Spotlight article: Shon Harris outlines the main topics in the CISSP domain on cryptography -- background information, cryptography components, digital authentication, protocols and more. Continue Reading

By

• Shon Harris , Logical Security

address space layout randomization (ASLR)

Address space layout randomization (ASLR) is a memory-protection process for operating systems (OSes) that guards against buffer-overflow attacks by randomizing the location where system executables are loaded into memory. Continue Reading

By

• Sharon Shea, Executive Editor

Use John the Ripper to test network devices against brute forcing

Enterprise IT security organizations should test network devices using John the Ripper to ensure they are not susceptible to brute-force attacks. Continue Reading

By

• Brad Casey

How to define SIEM strategy, management and success in the enterprise

Enterprise SIEM technology is as functional, manageable and affordable as it's ever been. Learn how to achieve success with SIEM in your organization. Continue Reading

Comparing certifications: ISO 27001 vs. SAS 70, SSAE 16

Learn about ISO 27001 vs. SAS 70, and why enterprises should pay attention to SSAE 16 over SAS 70. Continue Reading

By

• SearchSecurity

The hypervisor security patch management process

Enterprises using virtualization must include hypervisor patching in their patch management process. Robbie Higgins explains why. Continue Reading

By

• Robbie Higgins

Outsourcing data center services: SMB security best practices

Learn best practices for outsourcing data center services and about the security and compliance considerations that influence whether an SMB should outsource data center services. Continue Reading

By

• Joe Malec, Contributor

Determine your Microsoft Windows patch level

A handful of patch management tools from Microsoft and third -parties can help your organization determine your Windows patch level and identify missing security patches. Continue Reading

By

• Tony Bradley, Bradley Strategy Group

PCI DSS compliance requires new vendor management strategy

Requirement 12.8 requires a better vendor management strategy for PCI DSS compliance. Continue Reading

By

• Andrew M. Baer, Contributor

How to mitigate operational, compliance risk of outsourcing services

Companies must have an approach to evaluating partner risk, the level of risk of both the service and the provider, and the adequacy of the security practices of the provider. Continue Reading

By

• Richard Mackey

What are the ethical issues when consulting for two competing companies?

Security consulting is a job in which privacy is paramount. Leaking security strategies to the wrong people -- especially a company's competition -- could lead to breaches or break ins. In this expert response, David Mortman gives best practices for handling consulting ethically. Continue Reading

By

• David Mortman, Dell

PCI DSS 3.1 requirement best practices

Requirement 3.1 of the PCI Data Security Standard requires minimum cardholder data storage. In this tip, learn how to determine how much data your organization should store. Continue Reading

By

• Roger Nebel, Contributor

Is the Orange Book still relevant for assessing security controls?

Is the Orange Book still the be-all and end-all for assessing security controls in the enterprise? Security management expert Mike Rothman explains what happened to the Orange Book, and the Common Criteria for Information Technology Security Evaluation that replaced it. Continue Reading

By

• Mike Rothman, Securosis

Intrusion detection system deployment recommendations

Before you take the time and effort to deploy an IDS, consider this advice. Continue Reading

By

• Edward Yakabovicz, Contributor

Is centralized logging worth all the effort?

Network log records play an extremely important role in any well-constructed security program. Expert Mike Chapple explains how to implement a centralized logging infrastructure. Continue Reading

By

• Mike Chapple, University of Notre Dame

What software development practices prevent input validation attacks?

Improper input validation leads to numerous kinds of attacks, including cross-site scripting, SQL injection and command injection. In this expert Q&A, Michael Cobb reviews the most important application development practices. Continue Reading

By

• Ed Skoudis, SANS Technology Institute