Manage

Manage

Learn to apply best practices and optimize your operations.

• Counter third-party risk with continuous vendor monitoring

  Assessing a vendor's security posture is not a box that gets checked. The risk of a third-party attack requires the kind of diligence provided by continuous vendor monitoring. Continue Reading

• LLM firewalls emerge as a new AI security layer

  The race by organizations to AI-enable their operations and business workflows is exposing them to new risks that AI firewalls aim to address. Continue Reading

• MLSecOps: Bridging security and AI development processes

  MLSecOps ensures AI security by automating controls, fostering collaboration and addressing vulnerabilities early in the development lifecycle. Continue Reading

• How to evaluate NGFW products to strengthen cybersecurity

  Next-generation firewalls are critical tools in today's evolving threat landscape. Learn how to evaluate and select an NGFW that will bolster your company's cybersecurity posture. Continue Reading

• CISO's guide to demonstrating cyber resilience

  Elevating cybersecurity to a state of resilience requires a security team to adapt and strengthen defenses. The result should be that a future attack is less likely to succeed. Continue Reading

• CISO's guide: How to prevent business email compromise

  Business email compromise feeds on professional email norms -- and exploits emotions such as fear or urgency. Learn what BEC is, how it works and how to prevent it.Continue Reading

• How CISOs can balance AI innovation and security risk

  AI represents a powerful new tool for cybersecurity professionals, but the technology is not without risk. Discover what CISOs need to know when deciding how to use AI.Continue Reading

• A leader's guide to integrating EDR, SIEM and SOAR

  Understand the architecture, implementation, and maintenance of EDR, SIEM, and SOAR tools to optimize security workflows and ensure resilience.Continue Reading

• Secure MCP servers to safeguard AI and corporate data

  Model Context Protocol servers act as bridges between AI models and enterprise resources. But they can also give threat actors the keys to the castle if not secured.Continue Reading

• Top open source and commercial threat intelligence feeds

  Cybersecurity threat intelligence feeds provide critical data on attacks, including IPs, domains and malware hashes, helping teams detect and respond to threats effectively.Continue Reading

• 10 must-have security technologies in 2026

  Discover the top security technologies for 2026, from AI-enabled tools to quantum-safe protocols, as CISOs brace for evolving cyberthreats and attack surfaces.Continue Reading

• Prompt injection attacks: From pranks to security threats

  Prompt injection attacks manipulate AI systems to bypass security guardrails, enabling data theft and code execution -- yet they lack comprehensive defenses and CVE tracking.Continue Reading

• What is a virtual CISO (vCISO)? Does your business need one?

  The virtual chief information security officer is a C-suite-level security professional or service provider who offers CISO-level expertise on a part-time, remote or contractual basis.Continue Reading

• Authorization sprawl: Attacking modern access models

  Attackers exploit authorization sprawl by using legitimate credentials and SSO tokens to move between systems, bypassing security controls and deploying ransomware undetected.Continue Reading

• How to implement effective app and API security controls

  Security leaders must implement multilayered strategies combining threat modeling, balanced controls, cloud-first approaches and more to protect apps and APIs from evolving threats.Continue Reading

• Adopt passkeys over passwords to improve UX, drive revenue

  Password use leads to higher UX friction and lost sales because customers want a smoother sign-in experience. Passkeys can simplify authentication and improve UX.Continue Reading

• Add gamification learning to your pen testing training playbook

  Organizations that embrace gamification in their pen testing training are better positioned to build and maintain the skilled security teams needed to address evolving threats.Continue Reading

• How blockchain can support third-party risk management

  Third-party risk is of significant and growing concern to today's businesses. Explore how blockchain technology could transform third-party risk management for the better.Continue Reading

• Why fourth-party risk management is a must-have

  It's not just third-party vendors that pose a security risk. Organizations should also keep an eye on their suppliers' suppliers with a fourth-party risk management strategy.Continue Reading

• Follow a 6-phase roadmap to secure cyber-physical systems

  Cyber-physical systems help bridge the digital world with the physical world, but they introduce cybersecurity risks that must be addressed.Continue Reading

• 6 principles for building engaged security governance

  Security governance isn't enough. Enter engaged security governance -- an ongoing process that aligns business strategy with security across an organization.Continue Reading

• How to build a cyber-resilience culture in the enterprise

  Discover how organizations can build a culture of cyber resilience by reducing risk, limiting damage, having a disaster recovery plan and assuming a cyber attack is coming.Continue Reading

• 3 cloud security posture questions CISOs should answer

  As cloud adoption continues to accelerate, CISOs must help IT and cybersecurity teams keep pace with evolving cloud markets, especially when it comes to cloud security posture.Continue Reading

• Tips for developing cybersecurity leadership talent

  Navigating the skills gap from an employer's perspective starts with investing in talent. Get advice on how to develop and hire emerging leaders from an industry analyst.Continue Reading

• 3 ways to help cybersecurity pros avoid burnout

  Many security professionals are pushed to their breaking point. Discover three ways employers and managers can help their employees avoid burnout.Continue Reading

• How to address security risks in GPS-enabled devices

  GPS-enabled devices not only pose personal risks but also pose risks to organizations. Learn about the security risks associated with tracking devices and how to address them.Continue Reading

• 5 steps to ensure a successful access management strategy

  Access management is top of mind for organizations, especially in the hybrid workspace. Follow these five steps to create an access management strategy that benefits all users.Continue Reading

• 4 tips for selecting cybersecurity insurance

  Choosing a cybersecurity insurance provider can be a daunting and complex task. Follow this advice to select the best policy -- and provider -- for your business.Continue Reading

• How automated certificate management helps retain IT talent

  Organizations shouldn't waste their IT pros' time on unnecessary tasks -- especially during a skills shortage. Learn about the benefits of automated digital certificate management.Continue Reading

• How AI can help security teams detect threats

  AI and machine learning are reshaping modern threat detection. Learn how they help security teams efficiently and accurately detect malicious actors.Continue Reading

• Endpoint security is nothing without human operators

  The growing threat landscape has made endpoint security more important than ever. Deploying an endpoint security platform without the proper staff, however, is simply not enough.Continue Reading

• How to make security accessible to developers

  Apps are too often released with flaws and vulnerabilities. Learn how to make security accessible to developers by integrating best practices into the development lifecycle.Continue Reading

• The importance of automated certificate management

  Managing the plethora of digital certificates can no longer be done in a spreadsheet by hand. Discover the importance of automated certificate management here.Continue Reading

• The business benefits of data compliance

  Beyond appeasing auditors and avoiding fines, data compliance offers several business benefits. Discover how data compliance can build trust and improve publicity.Continue Reading

• Enterprise password security guidelines in a nutshell

  In this concise guide to passwords, experts at Cyber Tec outline the security problems that put enterprises at risk and offer answers on how to solve them.Continue Reading

• How to talk about cybersecurity risks, colloquially

  The cybersecurity field is riddled with confusion and complexity. Knowing how to talk about risk and how to manage it is key to building resilience.Continue Reading

• 5 principles for AppSec program maturity

  Applications remain a top cause of external data breaches. Follow these five principles to achieve application security program maturity.Continue Reading

• 7 tips for building a strong security culture

  Cybersecurity isn't just IT's responsibility. Use these seven tips to build a security culture where employees and IT work together to keep their organization safe.Continue Reading

• How to navigate cybersecurity product coverage

  Cybersecurity tools are complex. It can be difficult for organizations to know which tools do what, and which tools they need -- or don't.Continue Reading

• 3 steps to create a low-friction authentication experience

  Passwords are no longer sufficient, but more secure authentication methods frustrate users. Explore how to create a low-friction authentication process for improved UX and trust.Continue Reading

• 4 healthcare risk management tips for secure cloud migration

  From improving the security posture and updating threat modeling to securing cloud data, learn about four risk management tips for healthcare organizations migrating to cloud.Continue Reading

• 5 steps to implement threat modeling for incident response

  This five-step process to develop an incident response plan from Rohit Dhamankar of Alert Logic includes threat modeling, which is key to thwarting cyber attacks.Continue Reading

• 4 ways to build a thoughtful security culture

  It's time companies paid more attention to their security culture, working toward building an effective security awareness program that everyone can understand and get behind.Continue Reading

• Embrace speed and security for your cloud security strategy

  As companies solidify their cloud security strategies, they need to ensure that they're considering where they're at now, governance needed and metrics to follow.Continue Reading

• Cybersecurity contingency planning needs a face-lift

  Following the unexpected craziness of 2020, companies need to sit down and revamp their cybersecurity contingency plan to ensure their business continuity.Continue Reading

• Cybersecurity key to protect brands in the digital landscape

  The digital transformation disrupted the relationship between brand value and risk. Vishal Salvi explains how the right cybersecurity strategy protects both brands and customers.Continue Reading

• Companies must train their SOC teams well to prevent breaches

  SOC teams can have all the latest and greatest cybersecurity tools, but unless they have the proper training, it won't be enough to mitigate an attack.Continue Reading

• 5 cybersecurity testing areas CISOs need to address

  With increasing board interest in cybersecurity risk, CISOs need to explain the preventive steps they are taking to have the right cybersecurity testing in place to minimize risk.Continue Reading

• Utilizing existing tech to achieve zero-trust security

  A zero-trust security model can immediately be used to address current gaps and provide a secure foundation for managing risk going forward, from both internal and external threats.Continue Reading

• How security teams can prepare for advanced persistent threats

  Daniel Clayton explains how any organization can devise its cybersecurity strategy to account for advanced persistent threats, which have started changing the threat landscape.Continue Reading

• Strengthening supply chain security risk management

  In the wake of several supply chain attacks, Pam Nigro discusses how companies can work to reduce risk by broadening how to manage third-party vendors' access to company data.Continue Reading

• 6 ways to prevent cybersecurity burnout

  Consider investing in training for new employees, offering mentoring and setting goals, automating where possible and more to help prevent cybersecurity burnout.Continue Reading

• Dispelling 4 of the top cloud security myths today

  Booz Allen's Jimmy Pham and Brad Beaulieu dispel four major cloud security myths, exploring why staying in the cloud rather than returning to on premises may be the more secure option.Continue Reading

• How SolarWinds attack will change CISOs' priorities

  Following cybersecurity best practices used to be enough, but after the SolarWinds supply chain attack, CISOs now have to rethink all their security protocols.Continue Reading

• 4 ways to minimize the risk of IT supply chain attacks

  Mark Whitehead breaks down the importance of taking a zero-trust cybersecurity approach when it comes to protecting networks and data accessible by third-party partners.Continue Reading

• Standardize cybersecurity terms to get everyone correct service

  Some cybersecurity terms can refer to multiple service offerings, which can be confusing for companies looking to implement them as well as the companies providing them.Continue Reading

• Combine ML with human intelligence for your security strategy

  As hackers target the ever-increasing complexity of company networks, enterprises need to find a balance between machine learning and human intelligence when protecting systems and data.Continue Reading

• 7 cybersecurity priorities CISOs should focus on for 2021

  For 2021, Vishal Salvi argues that CISOs should tie cybersecurity to business agendas better, invest in cloud security, implement IT hygiene, modernize security architecture and more.Continue Reading

• The enterprise case for implementing live-fire cyber skilling

  Companies continue to grapple with the cybersecurity skills gap, but Adi Dar offers a way to ensure security teams are properly trained through the use of live exercises.Continue Reading

• 3 reasons why CISOs should collaborate more with CFOs

  C-suite may not always understand ROI of security efforts, which is why Nabil Hannan suggests that CISOs work more closely with CFOs to learn how to best communicate security's value.Continue Reading

• 5 myths about putting security into CI/CD pipelines

  Companies looking to introduce security testing earlier into software development must look past myths and understand what to realistically expect before creating their strategy.Continue Reading

• The need for independent cybersecurity solutions testing

  Rohit Dhamankar suggests implementing standardized testing of cybersecurity providers, like MSSPs and MDRs, to help companies better understand the services they're getting from each.Continue Reading

• For Cybersecurity Awareness Month, learn about emerging risks

  Tami Hudson examines why leaders should use October to educate themselves and their companies around the latest attacks bad actors are implementing and where to prioritize investment.Continue Reading

• 3 common election security vulnerabilities pros should know

  Election security remains top of mind for many right now, with Nabil Hannan discussing vulnerabilities like remote breaches, new attack surfaces and poor current controls.Continue Reading

• How to improve cybersecurity for the workforce of the future

  Many organizations continue to have employees work from home, but they haven't always hardened their cybersecurity efforts alongside this move to better protect employees and data.Continue Reading

• How to protect companies from business email compromise

  Research shows that business email compromise attacks continue to proliferate as threat actors continue to see success. Here are a few ways to protect your company.Continue Reading

• The 7 elements of an enterprise cybersecurity culture

  An effective 'human firewall' can prevent or mitigate many of the threats enterprises face today. Adopt these seven elements of a culture of cybersecurity to defend against risks.Continue Reading

• CISOs face the IoT security risks of stranger things

  The internet of things, by its very design, extends enterprise technology infrastructure further and further out, computerizing devices whose functions, if corrupted, could have catastrophic results. The sheer scope of internet-connected devices is ...Continue Reading

• Cloud security threats in 2018: Get ahead of the storm

  Consistent security for all data from cloud providers and third-party partners is what many consider the next evolution of cloud. The biggest cloud security threats for most companies, however, result from in-house staff mistakes, lack of patching ...Continue Reading

• Agnes Kirk on the role of CISO, Washington's state of mind

  A state CISO champions innovation for Washington, from early development of a single sign-on system to leadership of the new Office of Cyber Security.Continue Reading

• After Stuxnet: Windows Shell flaw still most abused years later

  A Windows Shell flaw used by the Stuxnet worm continues to pose problems years after it was patched. Nick Lewis explains how the flaw exposes enterprise security shortcomings.Continue Reading

• From security product marketing to CEO: Jennifer Steffens

  The CEO of a global pen tester used to work for the New York Yankees. Find out how Jennifer Steffens went from sports marketing to head of a security service provider.Continue Reading

• Why WannaCry and other computer worms may inherit the earth

  A vast majority of APT attacks and malware delivery happens via spear phishing. But worms have always had a place in the toolkit when the delivery method fit the mission.Continue Reading

• A damaging spring of internet worms and poor performance

  Security is a hot topic for media outlets that report on stock markets as companies founder on corporate earnings. The financial fallout of global malware is a call to action.Continue Reading

• The difference between security assessments and security audits

  Security audits vs. security assessments solve different needs. Organizations may use security audits to check their security stature while security assessments might be the better tool to use. Expert Ernie Hayden explains the differences.Continue Reading

• DoubleAgent malware could turn antivirus tools into attack vector

  DoubleAgent malware is a proof of concept for a zero-day vulnerability that can turn antivirus tools into attack vectors. Expert Nick Lewis explains how to contain the threat.Continue Reading

• Applying a hacker mindset to application security

  It can be beneficial to think like a black hat. Expert Kevin Beaver explains why enterprise security teams should apply a hacker mindset to their work and how it can help.Continue Reading

• How FBI cyber investigations handle obfuscation techniques

  An FBI agent discusses cyber investigations, how they handle obfuscation techniques, the anonymizing features of the deep web and how to catch the right person.Continue Reading

• Can a PCI Internal Security Assessor validate level 1 merchants?

  A PCI Internal Security Assessor might not be the best bet to validate the compliance of a level 1 service provider. Expert Matthew Pascucci explains why and the alternative.Continue Reading

• Tactics for security threat analysis tools and better protection

  Threat analysis tools need to be in top form to counter a deluge of deadly security issues. Here are tips for getting the most from your analytics tool.Continue Reading

• Information privacy and security requires a balancing act

  Maintaining information privacy and security seem to be separate challenges, but in reality, each is integral to the other. Expert Kevin Beaver explains how to work toward both.Continue Reading

• Q&A: GDPR compliance with Microsoft CPO Brendon Lynch

  Failure to achieve compliance with the EU's General Data Protection Regulation in the next 12 months can trigger fines of up to 4% of a company's gross annual revenue.Continue Reading

• Polycom CISO focused on ISO 27001 certification, data privacy

  Tasked with security and compliance, Lucia Milica Turpin watches over internal systems and remote communications customers entrust to the video conferencing company.Continue Reading

• Challenging role of CISO presents many opportunities for change

  With some reports showing incredibly short tenures, new CISOs barely have time to make their mark. The salaries are good; the opportunities for the right skills, unlimited.Continue Reading

• MSSPs add advanced threats as managed security services gain hold

  Skill shortages and budget constraints have lead some companies to adopt a hybrid approach to managed security. Is it time for CISOs to start looking for 'expertise as a service'?Continue Reading

• The managed security provider comes knocking

  A constantly evolving threat landscape and a deepening skills crisis has more enterprises looking to a managed security service provider for help handling some of their security requirements. The trend is expected to drive strong demand for MSSPs ...Continue Reading

• CJIS Security Policy: How can companies ensure FIPS compliance?

  Companies and government agencies handling criminal justice information need to comply with CJIS Security Policy. Expert Michael Cobb explains the cryptographic modules to use.Continue Reading

• IoT development and implementation: Managing enterprise security

  The CSA's guidelines for secure IoT development can give enterprises an idea of how to evaluate IoT products. Expert Nick Lewis explains the steps enterprises should take.Continue Reading

• Why authorization management is paramount for cybersecurity readiness

  After enterprise identities are authenticated, an authorization management system should monitor how resources are being used. Expert Peter Sullivan explains how it can work.Continue Reading

• What to consider about signatureless malware detection

  Endpoint security is changing into signatureless malware detection and protection. Expert Matthew Pascucci discusses the transition away from signatures.Continue Reading

• Q&A: IBM's Diana Kelley got an early start in IT, security came later

  How did an editor become a security architect? A fascination with computers sparked a lifelong journey for IBM's executive security advisor.Continue Reading

• MIAX Options CSO on security's role in business continuity

  Faced with the demands of derivatives trading, CSO John Masserini understands the value of aligning controls with business risk. We ask him how he does it.Continue Reading

• Recent ransomware attacks: Data shows 50% growth in 2016

  With high sums paid, ransomware gets all the attention. But malware is not the only way that criminals gained control of enterprise systems, a new report shows.Continue Reading

• Insider Edition: Attaining security for IoT, through discovery, identity and testing

  Ever since the internet of things became a "thing," the potential for abuse has been well documented; how best to achieve security for IoT is not yet clear. This Insider Edition of Information Security magazine tackles that second ...Continue Reading

• The dangers of using security policy templates in the enterprise

  Among other drawbacks, using security policy templates can make compliance audits and breach assessments harder for enterprises. Expert Joseph Granneman explains why they're risky.Continue Reading

• How tabletop exercises can help uncover hidden security risks

  A regular tabletop exercise could help to identify security risks in scenarios relevant to your organization. Expert Bob Wood explains the steps in the process.Continue Reading

• What new Asacub Trojan features should enterprises watch out for?

  The Asacub Trojan has new banking malware features. Expert Nick Lewis explains how it made this transition and what enterprises should be watching out for.Continue Reading

• Lessons in mobile data loss protection for enterprise IT pros

  With mobile devices everywhere in the enterprise now, learning tactics for data loss protection must become an IT priority.Continue Reading

• What do organizations need to know about privacy in a HIPAA audit?

  A HIPAA audit covers privacy compliance, and organizations need to be prepared. Expert Mike Chapple discusses privacy in the audits.Continue Reading

• CISSP quiz: Cryptography CISSP certification practice test

  Test your knowledge of the CISSP exam's Cryptography Domain by taking this practice quiz, which covers topics including public and private keys, encryption algorithms, digital certificates and more.Continue Reading