Evaluate

Evaluate

Weigh the pros and cons of technologies, products and projects you are considering.

• CISO decisions: Weighing costs, benefits of dark web monitoring

  Forewarned is forearmed, and dark web monitoring can alert organizations when they're in attacker crosshairs. But for many, the risk and expense make it more trouble than it's worth. Continue Reading

• LLM firewalls emerge as a new AI security layer

  The race by organizations to AI-enable their operations and business workflows is exposing them to new risks that AI firewalls aim to address. Continue Reading

• How to evaluate NGFW products to strengthen cybersecurity

  Next-generation firewalls are critical tools in today's evolving threat landscape. Learn how to evaluate and select an NGFW that will bolster your company's cybersecurity posture. Continue Reading

• Why organizations need cloud attack surface management

  Cloud environments constantly change, expanding attack surfaces beyond traditional tools. Cloud ASM delivers continuous visibility to identify exposures, misconfigurations and risk. Continue Reading

• Top open source and commercial threat intelligence feeds

  Cybersecurity threat intelligence feeds provide critical data on attacks, including IPs, domains and malware hashes, helping teams detect and respond to threats effectively. Continue Reading

• 10 must-have security technologies in 2026

  Discover the top security technologies for 2026, from AI-enabled tools to quantum-safe protocols, as CISOs brace for evolving cyberthreats and attack surfaces.Continue Reading

• What is a virtual CISO (vCISO)? Does your business need one?

  The virtual chief information security officer is a C-suite-level security professional or service provider who offers CISO-level expertise on a part-time, remote or contractual basis.Continue Reading

• Migrate to passwordless to enhance security and UX

  Transitioning to passwordless authentication enables organizations to strengthen user account and sensitive data security without adding UX friction for end users.Continue Reading

• How AI is shaping the future of the cybersecurity workforce

  ISACA's 'State of Cybersecurity 2024' report found that, while AI helps automate lower-level tasks, it presents issues when it comes to succession planning and talent development.Continue Reading

• How to prepare for a secure post-quantum future

  Quantum computing is expected to arrive within the next decade and break current cryptographic algorithms. SANS' Andy Smith explains how to start securing your company now.Continue Reading

• The enduring importance of digital trust

  Digital trust is an increasingly important issue, yet confusion remains about what exactly it is, how to achieve it and how to get started.Continue Reading

• 4 steps CISOs can take to raise trust in their business

  When CISOs align their investments with CIOs' tech investments, both can fuel business success and enable greater trust with customers, employees and partners.Continue Reading

• GenAI development should follow secure-by-design principles

  Every company wants a piece of the GenAI pie, but rushing to develop a product without incorporating secure-by-design principles could harm their business and customers.Continue Reading

• SEC cyber attack regulations prompt 10 questions for CISOs

  New SEC regulations governing the disclosure of cyber attacks by public companies lead to 10 questions board members should ask their CISOs about managing cyber-risk.Continue Reading

• Intersection of generative AI, cybersecurity and digital trust

  The popularity of generative AI has skyrocketed in recent months. Its benefits, however, are being met with cybersecurity, digital trust and legal challenges.Continue Reading

• Standardized data collection methods can help fight cybercrime

  Implementing standards similar to NERC CIP for the entire cybersecurity industry could make it easier for law enforcement to investigate and prosecute cyber attackers.Continue Reading

• Pen testing amid the rise of AI-powered threat actors

  The importance of pen testing continues to increase in the era of AI-powered attacks, along with red teaming, risk prioritization and well-defined goals for security teams.Continue Reading

• 6 principles for building engaged security governance

  Security governance isn't enough. Enter engaged security governance -- an ongoing process that aligns business strategy with security across an organization.Continue Reading

• Web3 blockchain enables users to take control of identity

  A centralized identity model creates security and privacy risks. Decentralized identity through Web3 could mitigate these risks, but companies must adapt to keep pace.Continue Reading

• Understanding current XDR elements and options

  What do existing extended detection and response products provide? Learn about EDR+, SIEM+ and Comprehensive options, which all provide varying levels of XDR.Continue Reading

• Do companies need cyber insurance?

  As cyber insurance costs rise, companies must determine whether they truly need cyber insurance to tackle their increased risk of cyber attacks.Continue Reading

• It's time to rethink security certification for OT devices

  Security certifications don't protect OT devices from vulnerable processes and insecure-by-design practices. It's time to update security certs for the connected OT age.Continue Reading

• The role of transparency in digital trust

  To retain digital trust, organizations must be transparent in the aftermath of cybersecurity attacks and data breaches. Learn more about the roles of transparency in trust.Continue Reading

• How SOCs can identify the threat actors behind the threats

  Learn how SOC teams can track threat actors by understanding the factors that influence an attack, such as the type of infrastructure used or commonly targeted victims.Continue Reading

• Why the next-gen telecom ecosystem needs better regulations

  The telecom industry keeps the world connected but also poses national and cybersecurity risks. Learn why the sector needs better -- and uniform -- regulations.Continue Reading

• How cryptocurrencies enable attackers and defenders

  Threat actors use cryptocurrencies for their anonymity, but they're not as impenetrable as once thought. Discover how cryptocurrencies can help attackers and defenders alike.Continue Reading

• The benefits and challenges of SBOMs

  While software bills of material present new challenges for security teams, they offer the benefits of improved visibility, transparency and security.Continue Reading

• The importance of a policy-driven threat modeling approach

  An expanding threat landscape, combined with increasing cloud use and a cybersecurity skill shortage, is driving the need for a policy-driven threat modeling approach.Continue Reading

• 5 infosec predictions for 2022

  If the predictions are correct, 2022 will be another groundbreaking year for information security. Have a look at the security forecast for the next 12 months.Continue Reading

• Is ransomware as a service going out of style?

  Increased government pressure has backed many ransomware gangs into a corner, in turn forcing attackers to replace the ransomware-as-a-service model with a smash-and-grab approach.Continue Reading

• 3 components to consider when selecting an MDR service

  In the market for an MDR service? Read up on three considerations to keep in mind and questions to ask potential providers before making a decision.Continue Reading

• CompTIA SYO-601 exam pivots to secure bigger attack surface

  The latest CompTIA Security+ exam, SYO-601, tests skills and knowledge for dealing with an expanded attack surface and the latest forms of assault on cybersecurity defenses.Continue Reading

• Why zero-trust models should replace legacy VPNs

  Many organizations use legacy VPNs to secure their networks, especially in the work-from-home era. Expert Pranav Kumar explains why zero-trust models are a safer option.Continue Reading

• Network security in the return-to-work era

  IT teams are dealing with the challenge of reconnecting devices to office networks as employees return to work. Here's how your organization can overcome that challenge.Continue Reading

• Balancing the benefits with the risks of emerging technology

  Emerging technologies enable companies to maintain a competitive edge through their various benefits but can come with high risks. A balancing act is required.Continue Reading

• Top 5 benefits of a new cybersecurity market model

  Companies are struggling to identify the cybersecurity technology that would actually be useful for their use cases. It's time for a new market model around efficacy instead.Continue Reading

• Why cloud changes everything around network security

  Vishal Jain examines why the data center mindset doesn't work for network security when it comes to using the public cloud and how companies should think instead.Continue Reading

• The security battle over entitlements and permissions creep

  IT must continually keep track of entitlements and permissions for all their cloud services, with methods such as CI/CD tools, increased visibility and continuous monitoring.Continue Reading

• 2021 cybersecurity predictions: Oh, where cybersecurity may go

  Jonathan Meyers sees 2021 bringing cybersecurity challenges to the forefront, like more cyberattacks on local governments, BYOD security issues and AI and ML overhype.Continue Reading

• Why SASE should be viewed as an evolution, not revolution

  The hype around secure access service edge (SASE) is palpable. But by taking a step back, security leaders can align an emerging trend to their long-term goals.Continue Reading

• Cybersecurity testing essentials for mergers and acquisitions

  Before moving forward with an M&A, conduct some cybersecurity testing to ensure your company knows how the acquired company protects data, employees and customers.Continue Reading

• How security champions can help, despite working remotely

  By effectively using collaboration tools, security champions can still spread a company's security message even as most offices stay closed and employees work remotely.Continue Reading

• What cybersecurity teams can learn from COVID-19

  Nabil Hannan examines key similarities between medical and computer viruses that cybersecurity teams can use to keep businesses protected effectively.Continue Reading

• Three examples of multifactor authentication use cases

  When evaluating the business case for multifactor authentication, an organization must first identify how these three operational scenarios apply to a potential implementation.Continue Reading

• SIEM benefits include efficient incident response, compliance

  SIEM tools enable centralized reporting, which is just one of the many SIEM benefits. Others include real-time incident response, as well as insight for compliance reporting.Continue Reading

• VMware AppDefense: How will it address endpoint security?

  VMware announced AppDefense, its latest effort to help improve endpoint security. Matt Pascucci explains how AppDefense addresses applications in vSphere environments.Continue Reading

• Can the STIX security framework improve threat intelligence sharing?

  Can Structured Threat Information eXpression improve threat intelligence sharing? Nick Lewis breaks down the evolution of the STIX security framework.Continue Reading

• Electronic voting systems in the U.S. need post-election audits

  Colorado will implement a new system for auditing electronic voting systems. Post-election audits have been proven to help, but are they enough to boost public trust in the systems?Continue Reading

• Trend Micro OfficeScan endpoint protection software and its offerings

  Expert contributor Ed Tittel takes a look at Trend Micro OfficeScan, an endpoint protection product with antivirus and antimalware functionality for physical and virtualized endpoints.Continue Reading

• An in-depth look into McAfee Endpoint Threat Protection

  McAfee Endpoint Threat Protection is an antimalware protection product that is designed to secure Windows systems against malware, data loss and other threats in standalone or networked environments.Continue Reading

• The GDPR right to be forgotten: Don't forget it

  Nexsan's Gary Watson explains that the GDPR right to be forgotten will be an important piece of the compliance picture and means deleting data securely, completely and provably when customers ask for it.Continue Reading

• Why security incident management is paramount for enterprises

  Enterprises aren't truly prepared for cyber threats unless they have proper security incident management in place. Expert Peter Sullivan explains what enterprises need to know.Continue Reading

• Evaluating endpoint security products for antimalware protection

  Expert contributor Ed Tittel explores key criteria for evaluating endpoint security products to determine the best option for antimalware protection for your organization.Continue Reading

• How does the Microsoft Authenticator application affect password use?

  The Microsoft Authenticator application enables smartphone-based, two-factor authentication and attempts to reduce the use of passwords. Expert Matthew Pascucci explains how.Continue Reading

• The digital certificate: How it works, which to buy

  This expert guide on the digital certificate provides essential information to what can be a complex purchase. Learn about the options and how to find the best for one for your network.Continue Reading

• What breach detection systems are best for corporate defenses?

  A system breach is inevitable, and BDS products provide a valuable means of detection. But a strategy that blends both defense and offense is the best approach to security.Continue Reading

• Use a web app firewall to halt app attacks

  As the demands on web application firewalls grow, the available WAF features are also expanding. What do you need to know to evaluate the tools vendors offer?Continue Reading

• How does Facebook's Delegated Recovery enable account verification?

  Facebook's Delegated Recovery aims to replace knowledge-based authentication with third-party account verification. Expert Michael Cobb explains how this protocol works.Continue Reading

• Experian's Tom King tackles role of CISO from the ground up

  An early career as a geologist helped the veteran financial services CISO thrive in the security field. The CISO role is now broader than technical functions, he says.Continue Reading

• Okta Adaptive MFA gives companies flexible authentication

  Okta Adaptive MFA offers businesses a range of flexible authentication methods that use different contexts to determine which factors provide users with access.Continue Reading

• An in-depth look at Gemalto's SafeNet Authentication Service

  Expert David Strom provides an in-depth look at Gemalto's SafeNet Authentication Service, a SaaS-based multifactor authentication product for boosting login security.Continue Reading

• Timeline: Symantec certificate authority improprieties

  Timeline: Follow along as Google and Mozilla raise issues with Symantec certificate authority actions, and then attempt to return trust to the CA giant.Continue Reading

• Should the Vulnerabilities Equities Process be codified into law?

  The Vulnerabilities Equities Process is a controversial subject. Expert Matthew Pascucci looks at the arguments for and against codifying it into law.Continue Reading

• ISAOs: The benefits of sharing security information

  ISAOs are a good way for organizations to share information about security threats. Expert Steven Weil explains what these organizations are and their attributes.Continue Reading

• Mobile endpoint security: What enterprise infosec pros must know now

  Do you know how to take care of mobile endpoint security in your enterprise? This guide walks you through all aspects of the issue, from policy and strategy to emerging threats.Continue Reading

• How does an active defense system benefit enterprise security?

  Active defense systems work as deception techniques on private networks, but are they good for enterprise use? Expert Judith Myerson discusses some options.Continue Reading

• RSA NetWitness Suite and its threat intelligence capabilities

  Expert Ed Tittel examines the RSA NetWitness Suite threat intelligence platform, which offers network forensic and analytics tools for investigating incidents and analyzing data.Continue Reading

• Incorporating user behavior analytics into enterprise security programs

  User behavior analytics can be used for a number of different objectives within an enterprise. Expert Ajay Kumar examines some of the most important features and capabilities.Continue Reading

• MSSPs add advanced threats as managed security services gain hold

  Skill shortages and budget constraints have lead some companies to adopt a hybrid approach to managed security. Is it time for CISOs to start looking for 'expertise as a service'?Continue Reading

• DLP systems: Spotting weaknesses and improving management

  DLP systems are becoming a necessity, but their weaknesses need to be tightened to ensure enterprise asset security. Expert Kevin Beaver explains what areas to focus on.Continue Reading

• The best SSO for enterprises must be cloud and mobile capable

  The best SSO today can handle the apps mobile workers use, identity as a service and more. Learn to make single sign-on, and other identity management approaches, more effective.Continue Reading

• Pulse Connect Secure offers a variety of authentication options

  Expert Karen Scarfone takes a look at the Pulse Connect Secure series of SSL VPNs for securing the connection between clients and networks through encrypted tunnels.Continue Reading

• How a single ICMPv6 packet can cause a denial-of-service attack

  Expert Fernando Gont explains how Internet Control Message Protocol version 6 can be used by threat actors to stage a simple, yet effective, denial-of-service attack.Continue Reading

• What are the pros and cons of hiring a virtual CISO?

  A virtual CISO is a good option for smaller organizations that want stronger security leadership, but don't have the budget. Expert Mike O. Villegas discusses the pros and cons.Continue Reading

• Risk & Repeat: Pentagon cybersecurity under fire

  In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss Pentagon cybersecurity amid reports of misconfigured servers at the U.S. Department of Defense.Continue Reading

• What new NIST password recommendations should enterprises adopt?

  NIST is coming up with new password recommendations for the U.S. government. Expert Michael Cobb covers the most important changes that enterprises should note.Continue Reading

• Choosing the best web fraud detection system for your company

  This guide explains the technology and the key features an effective system should include to help readers evaluate fraud detection products and choose the best for their company.Continue Reading

• Ransomware worm raises concerns for enterprise security

  In this Risk & Repeat podcast, SearchSecurity editors break down the discovery of the ZCryptor ransomware worm and what it means for future ransomware threats.Continue Reading

• Is the FedRAMP certification making a difference?

  There was speculation in the security world over whether the FedRAMP certification would be helpful or not. Now that it's in full use, Mike Chapple looks at the state of FedRAMP.Continue Reading

• Can Google's Chrome extension policy improve Web security?

  The updated Chrome extension policy allows users and developers to only install extensions from the Chrome Web Store. Learn how this affects security and enterprise apps.Continue Reading

• Q&A: Marcus Ranum chats with AT&T's CSO Ed Amoroso

  There's no shortage of new security technology, but enterprise integration is still a major hang-up, says AT&T's chief of security.Continue Reading

• What to look for in threat intelligence services

  Acquiring access to threat intelligence services is a relatively easy way to improve the quality of attack detection throughout the network security infrastructure of your enterprise. A threat intelligence service identifies the IP addresses, ...Continue Reading

• How can vishing attacks be prevented?

  Enterprise threats expert Nick Lewis explains what vishing attacks are and offers best practices for defending against them.Continue Reading

• Return on security investment: The risky business of probability

  You are better off with real numbers when it comes to measuring probability and the elements of security risk, even if they are wrong.Continue Reading

• Thirteen principles to ensure enterprise system security

  Designing sound enterprise system security is possible by following Gary McGraw's 13 principles, many of which have held true for decades.Continue Reading

• Information Security Magazine: FEBRUARY 2012

  Learn about the latest malware threats targeting enterprises and what you can do to reduce the risk of infection.Continue Reading

• Virtualization 101: Best practices for securing virtual machines

  VMs introduce a new security dynamic, one that emphasizes asset discovery, change management and tweaks to existing security technology.Continue Reading

• Results Chain for Information Security and Assurance

  Continue Reading

• IT security auditing: Best practices for conducting audits

  Even if you hate security audits, it's in your best interest to make sure they're done right.Continue Reading