Get started

Get started

Bring yourself up to speed with our introductory content.

• Comparing the top wireless intrusion prevention systems

  Expert Karen Scarfone examines the top wireless intrusion prevention systems (WIPS) to help readers determine which may be best for them. Continue Reading

• Comparing the best UTM products in the industry

  Expert Ed Tittel examines the top unified threat management appliances to determine which one could be the best for your organization. Continue Reading

• endpoint security management

  Endpoint security management is a policy-based approach to network security that requires endpoint devices to comply with specific criteria before they are granted access to network resources. Continue Reading

• Six criteria for purchasing unified threat management appliances

  Expert Ed Tittel explores key criteria for evaluating unified threat management (UTM) appliances to determine the best choice for your organization. Continue Reading

• From SSL and early TLS to TLS 1.2: Creating a PCI DSS 3.1 migration plan

  PCI DSS 3.1 requires enterprises to deplete SSL and early TLS use by June 30, 2016. Expert Michael Cobb offers advice for putting a migration plan to TLS 1.2 in place. Continue Reading

• Definitions to Get Started

  • What is cybersecurity?
  • Android System WebView
  • data masking
  • computer worm

  • corporate governance
  • cyber attack
  • homomorphic encryption
  • DomainKeys Identified Mail (DKIM)

  View All Definitions

• What do organizations need to know about privacy in a HIPAA audit?

  A HIPAA audit covers privacy compliance, and organizations need to be prepared. Expert Mike Chapple discusses privacy in the audits.Continue Reading

• Tips for creating a data classification policy

  Before deploying and implementing a data loss prevention product, enterprises should have an effective data classification policy in place. Expert Bill Hayes explains how that can be done.Continue Reading

• A new trend in cybersecurity regulations could mean tougher compliance

  State cybersecurity regulations may mean compliance will get more complicated, and that has experts worried. Learn what's causing this trend and what organizations should prepare for.Continue Reading

• strong cryptography

  Strong cryptography is used by most governments around the world to protect communications. It involves secreted and encrypted communication that is not amenable to cryptographic analysis.Continue Reading

• network vulnerability scanning

  A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures.Continue Reading

• How to keep track of sensitive data with a data flow map

  Expert Bill Hayes describes how to create a data flow map to visualize where sensitive data is processed, how it transits the network and where it's stored.Continue Reading

• State of the Network study: How security tasks are dominating IT staff

  The majority of networking teams are regularly involved in enterprise security tasks. Expert Kevin Beaver explains the phenomena and how to embrace it.Continue Reading

• Introduction to database security tools for the enterprise

  Expert Adrian Lane explains why database security tools play a significant, if not the majority, role in protecting data in the enterprise data center.Continue Reading

• Three usage scenarios for deploying data loss prevention products

  Expert Bill Hayes details usage scenarios for deploying data loss prevention: standalone suites, integrated tools and standalone/integrated DLP combined.Continue Reading

• The business case for data loss prevention products

  Data loss prevention (DLP) can help any organization where the loss of sensitive information could seriously impact continued operation, explains Bill Hayes.Continue Reading

• Introduction to data loss prevention products

  Expert Bill Hayes describes how data loss prevention (DLP) products can help identify and plug information leaks and improve enterprise security.Continue Reading

• Six criteria for procuring security analytics software

  Security analytics software can be beneficial to enterprises. Expert Dan Sullivan explains how to select the right product to fit your organization's needs.Continue Reading

• web server security

  Web server security is the protection of information assets that can be accessed from a Web server.Continue Reading

• Introduction to unified threat management appliances

  Expert Ed Tittel describes unified threat management (UTM) appliances and features, and explains its advantages to organizations of all sizes.Continue Reading

• Common Vulnerabilities and Exposures (CVE)

  Common Vulnerabilities and Exposures (CVE) provides unique identifiers for publicly known security threats.Continue Reading

• ISSA (Information Systems Security Association)

  The Information Systems Security Association, commonly known as ISSA, is an international, nonprofit organization for information security professionals.Continue Reading

• The three enterprise benefits of SSL VPN products

  Expert Karen Scarfone outlines the ways SSL VPN products can secure network connections and communications for organizations.Continue Reading

• Microsoft Schannel (Microsoft Secure Channel)

  The Microsoft Secure Channel or Schannel is a security package that facilitates the use of Secure Sockets Layer (SSL) and/or Transport Layer Security (TLS) encryption on Windows platforms.Continue Reading

• card-not-present fraud (card-not-present transaction)

  Card-not-present (CNP) fraud is the unauthorized use of a payment card to conduct a card-not-present transaction when the cardholder cannot or does not physically present the card at the time of the transaction.Continue Reading

• The top full disk encryption products on the market today

  Full disk encryption can be a key component of an enterprise's desktop and laptop security strategy. Here's a look at some of the top FDE products in the industry.Continue Reading

• The secrets of proper firewall maintenance and security testing techniques

  The Verizon 2015 PCI Compliance Report cited a lack of firewall maintenance and security testing as major causes for compliances breaches. Expert Kevin Beaver offers tips to successfully manage these tasks.Continue Reading

• What are the secrets to SIEM deployment success?

  Many organizations deploy security information and event management systems without the proper planning and therefore can't reap the proper rewards. Expert Kevin Beaver offers tips for a successful implementation.Continue Reading

• Introduction to security analytics tools in the enterprise

  Expert Dan Sullivan explains how security analysis and analytics tools work, and how they provide enterprises with valuable information about impending attacks or threats.Continue Reading

• How should agencies prepare for federal security scanning?

  What do agencies need to consider before going through the Department of Homeland Security's network security scanning? Expert Mike Chapple answers.Continue Reading

• International Information Systems Security Certification Consortium (ISC)2

  The International Information Systems Security Certification Consortium -- (ISC)2 -- is a non-profit organization that provides security training and certificates.Continue Reading

• Four questions to ask before buying a Web application firewall

  Web application firewalls are complex products. Expert Brad Causey explains the key criteria enterprises need to consider before investing in a WAF product.Continue Reading

• Six ways to use wireless intrusion prevention systems in the enterprise

  Expert George V. Hulme presents six real-world use cases for the deployment of WIPS to beef up wireless network security in the enterprise.Continue Reading

• single-factor authentication (SFA)

  Single-factor authentication (SFA) is the traditional security process that requires a user name and password before granting access to the user.Continue Reading

• Introduction to intrusion detection and prevention technologies

  Intrusion detection and preventions systems can be critical components to an enterprise's threat management strategy. Learn the history behind the technologies and why they are so important.Continue Reading

• Oracle Critical Patch Update (Oracle CPU)

  The Oracle Critical Patch Update (CPU) is an ongoing series of regularly issued fixes for security flaws in products made by or maintained by software giant Oracle Corp.Continue Reading

• Business-use scenarios for a Web application firewall deployment

  Web application firewalls can be a critical security layer for many companies. Expert Brad Causey explains when and how to deploy a WAF in the enterprise.Continue Reading

• knowledge-based authentication (KBA)

  In a KBA scheme, the user is asked to answer at least one "secret" question before being allowed to change account settings or reset a password.Continue Reading

• Getting to know the new GIAC certification: GCCC

  The new GIAC certification, GCCC, is not a very specific certification, but it could prove useful in organizations. Expert Joseph Granneman explains why.Continue Reading

• What's the best way to find enterprise compliance tools?

  Looking for compliance tools? Expert Mike Chapple explains why the best place to start the search is within your own information security infrastructure.Continue Reading

• How to increase the importance of information security in enterprises

  Expert Mike Villegas explains how to use the Three C's to emphasize the importance of information security within an organization.Continue Reading

• What is endpoint security? What benefits does it offer?

  The increased number of smartphones, laptops and other endpoints in the enterprise is a major security concern. Learn what endpoint security is and how it can help combat your enterprise security woes.Continue Reading

• Detecting backdoors: The Apple backdoor that never was?

  The debate over the purported Apple backdoor leaves enterprises asking, "When is a backdoor not a backdoor?" Application security expert Michael Cobb explains the difference.Continue Reading

• multifactor token

  Multifactor tokens are security tokens that use more than one category of credential to confirm user authentication. The standard categories of authentication credentials are knowledge factors things that the user knows) inherence factors (things ...Continue Reading

• mobile authentication

  Mobile authentication is the verification of a user’s identity through the use a mobile device and one or more authentication methods for secure access.Continue Reading

• shared secret

  A shared secret is data known to only the two entities involved in a communication so that either party's possession of that data can be provided as proof of identity for authentication.Continue Reading

• grid authentication

  Grid authentication is a method of ensuring that an end user is who he claims to be by requiring him to enter values from specific cells in a grid whose content should be only accessible to him and the service provider. Because the grid consists of ...Continue Reading

• soft token

  A soft token is a software-based security token that generates a single-use login PIN. Traditionally, a security token has been a hardware device that produces a new, secure and individual PIN for each use and displays it on a built-in LCD display.Continue Reading

• out-of-band authentication

  Out-of-band authentication is a type of two-factor authentication that requires a secondary verification method through a separate communication channel along with the typical ID and password. Out-of-band authentication is often used in financial ...Continue Reading

• inherence factor

  The inherence factor, in a security context, is a category of user authentication credentials consisting of elements that are integral to the individual in question, in the form of biometric data.Continue Reading

• possession factor

  The possession factor, in a security context, is a category of user authentication credentials based on items that the user has with them, typically a hardware device such as a security token or a mobile phone used in conjunction with a software ...Continue Reading

• knowledge factor

  The knowledge factor, in a security context, is a category of authentication credentials consisting of information that the user possesses, such as a personal identification number (PIN), a user name, a password or the answer to a secret question.Continue Reading

• four-factor authentication (4FA)

  Four-factor authentication (4FA) is the use of four types of identity-confirming credentials, typically categorized as knowledge, possession, inherence and location factors.Continue Reading

• three-factor authentication (3FA)

  Three-factor authentication (3FA) is the use of identity-confirming credentials from three separate categories of authentication factors – typically, the knowledge, possession and inherence categories.Continue Reading

• one-time password token (OTP token)

  A one-time password token (OTP token) is a security hardware device or software program that is capable of producing a single-use password or PIN passcode.Continue Reading

• COMSEC (communications security)

  Communications security (COMSEC) is the prevention of unauthorized access to telecommunications traffic, or to any information that is transmitted or transferred.Continue Reading

• Altman Z-score

  The Altman Z-score is a statistic that is useful for evaluating the financial health of a publicly traded manufacturing company. Continue Reading

• Google Authenticator

  Google Authenticator is a security application used to verify user identities before granting access to websites and services. The application uses a two-step verification process involving two-factor authentication to make it less likely that an ...Continue Reading

• two-step verification

  Two-step verification requires the sequential use of two authentication methods to verify that someone or something is who or what they are declared to be. In contrast with two-factor authentication processes, the methods in two-step verification ...Continue Reading

• Duo Security

  Duo Security is a vendor of cloud-based two-factor authentication products.Continue Reading

• Shellshock

  Shellshock is the common name for a coding vulnerability found in the Bash shell user interface that affects Unix-based operating systems, including Linux and Mac OS X, and allows attackers to remotely gain complete control of a system.Continue Reading

• Understanding security flaws in IPv6 addressing schemes

  Expert Fernando Gont explains why underlying characteristics of IPv6 address-generation schemes may enable nodes to be targeted in IPv6 address-scanning attacks.Continue Reading

• authentication factor

  An authentication factor is a category of credential used for identity verification. The three most common categories are often described as something you know (the knowledge factor), something you have (the possession factor) and something you are ...Continue Reading

• The fundamentals of FDE: Full disk encryption in the enterprise

  Expert Karen Scarfone examines full disk encryption, or FDE, tools and describes how the security technology protects data at rest on a laptop or desktop computer.Continue Reading

• The three stages of the ISO 31000 risk management process

  The ISO 31000 risk management process proposes three stages. Expert Mike Chapple reviews this alternative to the ISO 27001 framework.Continue Reading

• POODLE (Padding Oracle On Downgraded Legacy Encryption)

  POODLE (Padding Oracle On Downgraded Legacy Encryption) is a security flaw that can be exploited to conduct a man-in-the-middle attack that targets Web browser-based communication between clients and servers using Secure Sockets Layer (SSL) 3.0.Continue Reading

• SSL certificate (Secure Sockets Layer certificate)

  A Secure Sockets Layer certificate, known commonly as an SSL certificate, is a small data file installed on a Web server that allows for a secure connection between a Web server and a Web browser.Continue Reading

• Certified Information Systems Risk and Compliance Professional (CISRCP)

  A Certified Information Systems Risk and Compliance Professional (CISRCP) is a person in the information technology (IT) field that has passed an examination on risk and compliance topics developed by the International Association of Risk and ...Continue Reading

• CISSP cryptography training: Components, protocols and authentication

  Spotlight article: Shon Harris outlines the main topics in the CISSP domain on cryptography -- background information, cryptography components, digital authentication, protocols and more.Continue Reading

• CISSP online training: Inside the access control domain

  Spotlight article: Shon Harris discusses the main topics covered in the CISSP domain on access control, including authorization, authentication, identity management and more.Continue Reading

• total risk

  Total risk is an assessment that identifies all of the risk factors, including potential internal and external threats and liabilities, associated with pursuing a specific plan or project or buying or selling an investment.Continue Reading

• Introduction to Information Security: A Strategic-Based Approach

  In this excerpt of Introduction to Information Security: A Strategic-Based Approach, authors Timothy J. Shimeall and Jonathan M. Spring discuss the importance of intrusion detection and prevention.Continue Reading

• Security School: Distributed denial-of-service attack defense

  Check you're up to speed and ready to protect your organization from the threat of denial of service attacks.Continue Reading

• information assurance

  Information assurance (IA) is the practice of protecting against and managing risk related to the use, storage and transmission of data and information systems.Continue Reading

• identity governance

  Identity governance is the policy-based centralized orchestration of user identity management and access control.Continue Reading

• TAN (transaction authentication number)

  A transaction authentication number (TAN) is a type of single-use password used for an online banking transaction in conjunction with a standard ID and password. TANs are often in a list made by a financial institution and sent to the owner of the ...Continue Reading

• OpenAppID

  OpenAppID is an application-layer network security plugin for the open source intrusion detection system Snort.Continue Reading

• unknowable risk

  An unknowable risk is a potential threat to an organization's processes that is not known and cannot be quantified or controlled.Continue Reading

• Big data security analytics: Facebook's ThreatData framework

  Expert Kevin Beaver explains how enterprises can take a page from Facebook's ThreatData framework security analytics to boost enterprise defense.Continue Reading

• Cloud Controls Matrix

  The Cloud Controls Matrix is a baseline set of security controls created by the Cloud Security Alliance to help enterprises assess the risk associated with a cloud computing provider.Continue Reading

• antispoofing

  Antispoofing is a technique for countering spoofing attacks on a computer network.Continue Reading

• address space layout randomization (ASLR)

  Address space layout randomization (ASLR) is a memory-protection process for operating systems (OSes) that guards against buffer-overflow attacks by randomizing the location where system executables are loaded into memory.Continue Reading

• PCI analysis: Marcus Ranum on why PCI DSS sets the bar too low

  Tenable CSO Marcus Ranum says Target-like breaches occurred even with PCI compliance because PCI established only a minimal set of requirements.Continue Reading

• United States Secret Service (USSS)

  The United States Secret Service (USSS) is a federal law enforcement agency mandated by Congress to carry out two sets of primary objectives: provide protection for designated sites and events as well as national and visiting leaders, and preserve ...Continue Reading

• TrueCrypt

  TrueCrypt is a cross-platform open source program for file and full disk encryption (FDE).Continue Reading

• How to use Kismet: A free Wi-Fi network-monitoring tool

  In this video, CBT Nuggets' Keith Barker shows how to use the free Wi-Fi network monitoring tool Kismet to find possibly malicious wireless networks.Continue Reading

• Stop attackers hacking with Metasploit

  Metasploit attacks may not be sexy, but they can stab through enterprise defenses. Learn how basic security controls can thwart Metasploit hacking.Continue Reading

• cardholder data environment (CDE)

  A cardholder data environment or CDE is a computer system or networked group of IT systems that processes, stores and/or transmits cardholder data or sensitive payment authentication data, as well as any component that directly connects to or ...Continue Reading

• cardholder data (CD)

  Cardholder data (CD) refers to the primary account number (PAN) of a payment card belonging to a cardholder, along with any of the following data types: cardholder name, expiration date or service code (a three- or four-digit number coded onto the ...Continue Reading

• systemic risk

  Systemic risk is a category of risk that describes threats to a system, market or economic segment.Continue Reading

• inherent risk

  Inherent risk is a category of threat that describes potential losses or pitfalls that exist before internal security controls or mitigating factors are implemented.Continue Reading

• Verizon VERIS (Vocabulary for Event Recording and Incident Sharing) Framework

  The VERIS (Vocabulary for Event Recording and Incident Sharing) Framework is a taxonomy that standardizes how security incidents are described and categorized.Continue Reading

• Verizon Data Breach Investigations Report (DBIR)

  The Verizon Data Breach Investigations Report (DBIR) is an annual publication that provides data from and analysis of information security incidents, with a specific focus on data breaches.Continue Reading

• speculative risk

  Speculative risk is a category of risk that can be taken on voluntarily and will either result in a profit or loss. Continue Reading

• Heartbleed

  Heartbleed is a vulnerability in some implementations of OpenSSL. Because OpenSSL is used by approximately 66% of all active websites on the Internet, many experts have called Heartbleed one of the worst security bugs in the history of the Internet.Continue Reading

• Essential Guide: Windows XP security after end of updates for XP

  Learn about security implications of the April 2014 Windows XP end-of-life date and the end of XP security updates, plus planning an XP migration.Continue Reading

• Robert Morris worm

  The Robert Morris worm is widely acknowledged as the first computer worm to be distributed across the Internet and the first computer virus to receive mainstream media attention.Continue Reading

• How to develop software the secure, Gary McGraw way

  This compilation of content featuring software security expert Gary McGraw covers every aspect of secure software development, from training to coding to post-launch analysis.Continue Reading

• Center for Internet Security (CIS)

  The Center for Internet Security (CIS) is a nonprofit organization focused on improving public- and private-sector cybersecurity readiness and response.Continue Reading

• Beat the security odds with a cloud risk equation

  Contributor Peter Lindstrom takes on cloud security economics and offers up a simple risk equation to help security pros plan their cloud strategies.Continue Reading

• RSA 2014: News, analysis and video from RSA Conference 2014

  Find out what's happening in the infosec industry with breaking news via reporting, video and tweets by the SearchSecurity team at RSA's 2014 conference in San Francisco.Continue Reading