Tips

Tips

• 5 ethical hacker certifications to consider

  From Offensive Security Certified Professional to GIAC Web Application Penetration Tester, learn about the certifications worth earning to begin your ethical hacker career.  Continue Reading

• How cyber deception technology strengthens enterprise security

  They say the best defense is a good offense. Cyber deception puts that philosophy into practice in the enterprise, using a combination of technology and social engineering.  Continue Reading

• 8 cybersecurity roles to consider

  Cybersecurity is an exciting and increasingly important field with a wealth of career opportunities. Explore eight cybersecurity roles and the skills, talent and experience required.  Continue Reading

• 4 tips to find cyber insurance coverage in 2023

  The cyber insurance industry is settling down but isn't without challenges. Read up on cyber insurance in 2023 and how to get the most from your organization's coverage this year.  Continue Reading

• How to select a security analytics platform, plus vendor options

  Security analytics platforms aren't traditional SIEM systems, but rather separate platforms or a SIEM add-on. Learn more about these powerful and important tools.  Continue Reading

• Top 10 ICS cybersecurity threats and challenges

  Industrial control systems are subject to both unique and common cybersecurity threats and challenges. Learn about the top ones here and how to mitigate them.  Continue Reading

• State of data privacy laws in 2023

  Concern about how personal data is processed and stored is leading to the passage of new regulations that govern how companies handle consumer data.  Continue Reading

• Enterprise cybersecurity hygiene checklist for 2023

  Enterprise cybersecurity hygiene must be a shared responsibility between employees and employers. Follow these steps to get the job done by both.  Continue Reading

• How to prevent and detect lateral movement attacks

  Reduce the success of lateral movement attacks by performing these eight key cybersecurity activities at strategic, operational and proactive levels.  Continue Reading

• What is Triple DES and why is it being disallowed?

  Triple DES no longer provides the encryption strength it once did. Prepare now to transition away from its use to a more security alternative.  Continue Reading

• Top 7 enterprise cybersecurity challenges in 2023

  Security teams faced unprecedented challenges in 2022. The year ahead appears no less daunting. Here are the cybersecurity trends and safeguards to take into account in 2023.  Continue Reading

• 10 cybersecurity certifications to boost your career in 2023

  A consensus of industry professionals rank these 10 security certifications as the most coveted by employers and security pros -- plus links to 10 vendor security certifications.  Continue Reading

• How to prevent and mitigate process injection

  Process injection is a defense evasion technique that helps attackers hide from enterprise security systems. Learn how it works and how to mitigate it.  Continue Reading

• 10 must-have cybersecurity skills for career success in 2023

  Looking to advance your cybersecurity career? Here are the skills you'll need to win that CISO job, land a gig as a threat hunter and snag other security positions in high demand.  Continue Reading

• What enumeration attacks are and how to prevent them

  Web applications may be vulnerable to user enumeration attacks. Learn how these brute-forcing attacks work and how to prevent them.  Continue Reading

• The 14 best cloud security certifications for IT pros in 2023

  Certifications can help security pros prove their baseline knowledge of infosec topics. Consider adding these top cloud security certifications to your arsenal.  Continue Reading

• Top 12 online cybersecurity courses for 2023

  Our panel of experts picked the best free and paid online cybersecurity courses for working professionals looking to advance their careers and for newbies breaking into the field.  Continue Reading

• Low-code/no-code security risks climb as tools gain traction

  Organizations are looking for ways to reduce their application development costs, but automated coding can usher in some unpleasant surprises if you're unprepared.  Continue Reading

• Top 7 data loss prevention tools for 2023

  Data loss prevention software is a necessity for most companies. Our guide gives you a quick overview of seven top DLP providers and tells you what works -- and what doesn't.  Continue Reading

• Top 15 email security best practices for 2023

  Attackers exploit email every day to break into corporate networks, but the risk can be reduced by adhering to these 15 email security best practices.  Continue Reading

• What are the differences between su and sudo commands?

  Linux administrators have choices when deciding how to delegate privileges. Learn about the options they can take while ensuring their operations remain secure.  Continue Reading

• As a new CISO, the first 100 days on the job are critical

  As a chief information security officer, you won't get a second chance to make a first impression. Learn how a CISO's first 100 days lay the foundation for a successful tenure.  Continue Reading

• How to implement least privilege access in the cloud

  More organizations are moving their resources to the cloud but are not paying attention to how cloud access privileges are allocated. Learn how to limit access in the cloud.  Continue Reading

• Top 5 key ethical hacker skills

  Ethical hacking can be a rewarding career, but it requires tenacity, curiosity and creativity, among other traits. Oh, and you better be a good writer, too.  Continue Reading

• Top metaverse cybersecurity challenges: How to address them

  As the metaverse takes shape, companies must consider a slew of new cybersecurity challenges and how to deal with them.  Continue Reading

• Top 5 vulnerability scanning tools for security teams

  Use these five vulnerability scanning tools to find weaknesses and potential exploits in web applications, IT and cloud infrastructure, IoT devices and more.  Continue Reading

• Industrial control system security needs ICS threat intelligence

  Threat actors and nation-states constantly try to find ways to attack all-important industrial control systems. Organizations need specialized ICS threat intelligence to fight back.  Continue Reading

• Top Kali Linux tools and how to use them

  Learning to use Kali Linux is a journey, the first step of which is discovering which of the hundreds of cybersecurity tools included are most relevant to the task at hand.  Continue Reading

• Reality check: CISO compensation packages run the gamut

  A capable security executive is invaluable -- a fact organizations increasingly recognize. CISOs' salaries are generally trending up, but the range in compensation is wide.  Continue Reading

• How Wireshark OUI lookup boosts network security

  Learn why using Wireshark OUI lookup for tracking devices by their network interface's organizationally unique identifier is such an important tool for security pros.  Continue Reading

• 5 essential programming languages for cybersecurity pros

  Coding is an important skill across almost every technology discipline today, and cybersecurity is no exception. Learn about the top programming languages for security professionals.  Continue Reading

• Common lateral movement techniques and how to prevent them

  Lateral movement techniques enable attackers to dig deeper into compromised environments. Discover what lateral movement attacks are and four attack techniques.  Continue Reading

• How to perform a cybersecurity risk assessment in 5 steps

  This five-step framework for performing a cybersecurity risk assessment will help your organization prevent and reduce costly security incidents and avoid compliance issues.  Continue Reading

• Types of vulnerability scanning and when to use each

  Vulnerability scanning gives companies a key weapon when looking for security weaknesses. Discovery, assessment and threat prioritization are just a few of its benefits.  Continue Reading

• Ideal CISO reporting structure is to high-level business leaders

  CISOs usually report to a high-level executive, but reporting to a top-level business executive like the CEO rather than a technology executive protects the business best.  Continue Reading

• Types of cloud malware and how to defend against them

  Cloud malware isn't going away anytime soon, but organizations have a growing number of tools at their disposal to combat the threat.  Continue Reading

• Why it's time to expire mandatory password expiration policies

  Password expiration policies that force users to regularly reset passwords are counterproductive. It's time to align those policies with proven approaches to password security.  Continue Reading

• Top security-by-design frameworks

  Following a security-by-design framework, or designing one specific to your company, is key to implanting security into every step of the software development lifecycle.  Continue Reading

• 6 ways to prevent privilege escalation attacks

  Privileges dictate the access a user or device gets on a network. Hackers who access these privileges can create tremendous damage. But there are ways to keep your networks safe.  Continue Reading

• The top 5 ethical hacker tools to learn

  Ethical hackers have a wealth of tools at their disposal that search for vulnerabilities in systems. Learn about five such tools that should be part of any hacker's tool set.  Continue Reading

• How to manage and reduce secret sprawl

  Secret sprawl plagues companies, making them vulnerable to data breaches. Discover what causes secret sprawl and how to better protect secrets.  Continue Reading

• Compare vulnerability assessment vs. vulnerability management

  Vulnerability assessments and vulnerability management are different but similar-sounding security terms. Discover their similarities and differences.  Continue Reading

• An overview of the CISA Zero Trust Maturity Model

  A zero-trust framework blocks all attempts to access internal infrastructure without authentication. The CISA Zero Trust Maturity Model is a roadmap to get there.  Continue Reading

• Top 6 challenges of a zero-trust security model

  Zero trust has a number of challenges, but because the model is highly beneficial, it's important for organizations to learn how to overcome them.  Continue Reading

• How to conduct a cybersecurity audit based on zero trust

  This checklist offers guidance on how to prepare for a zero-trust cybersecurity audit and helps document how well cybersecurity controls are performing based on CISA's ZTMM.  Continue Reading

• Perimeter security vs. zero trust: It's time to make the move

  Perimeter security requires a border to protect enterprise data. With more and more users working outside that border, zero trust promises a better security option for the future.  Continue Reading

• Top zero-trust use cases in the enterprise

  Still hesitating to adopt zero trust? Learn about the main zero-trust use cases, as well as its benefits, myths and trends that are beginning to emerge.  Continue Reading

• The 5 principles of zero-trust security

  Zero trust is a journey, not a destination. Ensure your corporate network is safe from internal and external threats by implementing these five principles of zero-trust security.  Continue Reading

• Why zero trust requires microsegmentation

  Microsegmentation is a key security technique that enables organizations to achieve a zero-trust model and helps ensure the security of workloads regardless of where they are located.  Continue Reading

• How to get into cybersecurity with no experience

  Cybersecurity needs new talent now more than ever, but landing that first job without a computer science degree can still be difficult. Here are five tips for getting in the door.  Continue Reading

• 10 PCI DSS best practices to weigh as new standard rolls out

  PCI's Security Standards Council revamped the requirements governing how organizations store payment card information. Companies need to act fast to ensure they are in compliance.  Continue Reading

• Does AI-powered malware exist in the wild? Not yet

  AI sending out malware attacks may invoke images of movielike, futuristic technology, but it may not be too far from reality. Read up on the future of AI-powered malware.  Continue Reading

• 10 security-by-design principles to include in the SDLC

  Security is rarely a priority in the SDLC, but it should be. Adhere to these security-by-design principles for secure software and learn the importance of threat modeling.  Continue Reading

• How to develop a cybersecurity strategy: Step-by-step guide

  A cybersecurity strategy isn't meant to be perfect, but it must be proactive, effective, actively supported and evolving. Here are the four steps required to get there.  Continue Reading

• Cybersecurity career path: 5-step guide to success

  Taking the lead from ISSA's framework, here's a guide to how you can map out a long and profitable career in cybersecurity.  Continue Reading

• Discover the benefits and challenges of bug bounty programs

  Bug bounty programs have a number of benefits and challenges. Before adopting such a program at your organization, read up on the pros and cons to decide if it would be a good fit.  Continue Reading

• Use shadow IT discovery to find unauthorized devices and apps

  Shadow IT may be convenient for users, but it isn't for IT -- especially where security is concerned. Shadow IT discovery finds unmanaged devices and apps.  Continue Reading

• How to connect cyber-risk and climate risk strategies

  Every business faces two global systemic risks: cybersecurity and climate change. Learn how to integrate these two areas of risk management for greater business resilience.  Continue Reading

• Cloud detection and response: CDR vs. EDR vs. NDR vs. XDR

  Cloud detection and response is the latest detection and response abbreviation. Explore how it differs from endpoint, network and extended detection and response.  Continue Reading

• How to become a CISO

  The chief information security officer role is growing in profile and importance. Explore six actionable tips for aspiring CISOs as they work toward cybersecurity's top job.  Continue Reading

• 7 CISO succession planning best practices

  Nothing is certain except death, taxes and CISO turnover. Learn how to prepare for the inevitable and future-proof your security program with a succession plan.  Continue Reading

• Cybersecurity budget breakdown and best practices

  Once budget is secured, CISOs must figure out where it should be allocated -- as well as how to justify the costs. Get the lowdown on a cybersecurity budget breakdown here.  Continue Reading

• Remote work cybersecurity: 12 risks and how to prevent them

  Expanding attack surfaces, increasing vulnerabilities and overstressed staffs are among a litany of security risks whose ultimate cure requires more than an ounce of prevention.  Continue Reading

• How SPF records prevent email spoofing, phishing and spam

  Forged email has long been used by hackers to break into protected systems. Learn how the Sender Policy Framework protocol helps stop spoofing, phishing and other malicious mail.  Continue Reading

• 15 benefits of outsourcing your cybersecurity operations

  For companies battling increasing security breaches and cyber attacks, MSSPs can offer reliability, continuity, nonstop coverage, broader experience and better access to talent.  Continue Reading

• PCI DSS v4.0 is coming, here's how to prepare to comply

  Organizations need to start laying the groundwork to reap the benefits of the forthcoming PCI DSS v4.0 specification. Creating a team to focus on the upgrade is one good step.  Continue Reading

• 5 key questions to evaluate cloud detection and response

  Consider these five questions before deciding to invest in a specialized cloud detection and response product.  Continue Reading

• How to conduct a secure code review

  Learn how to conduct a secure code review -- a critical step in the software development lifecycle -- to avoid releasing an app with bugs and security vulnerabilities.  Continue Reading

• 13 common types of cyber attacks and how to prevent them

  To prevail in the battle against cybercrime, companies must understand how they are being attacked. Here are the most damaging types of cyber attacks and how to prevent them.  Continue Reading

• 8 secure file transfer services for the enterprise

  With a plethora of options, finding the best secure file transfer service for your business can pose a challenge. Learn how to make an informed decision.  Continue Reading

• 7 key cybersecurity metrics for the board and how to present them

  Learn how to present important cybersecurity metrics for the board to ensure that business leaders understand that money allocated to security is money well spent.  Continue Reading

• Top 10 cybersecurity interview questions and answers

  Interviewing for a job in cybersecurity? Memorizing 100-plus security definitions won't cut it. Here are the 10 interview questions you should be ready for -- and how to answer them.  Continue Reading

• 5 reasons to integrate ESG and cybersecurity

  Every business faces global systemic risks, yet most have failed to integrate cybersecurity with ESG programs. Here are five reasons why integration makes good business sense.  Continue Reading

• What is identity sprawl and how can it be managed?

  With identity-based attacks on the rise, organizations need to prioritize identity management. Learn about identity sprawl, why it's a risk and how it can be managed.  Continue Reading

• How to create a threat profile, with template

  Read five key steps on how to create a threat profile, and get started making them customized to your organization with our free template.  Continue Reading

• How to ensure a secure metaverse in your organization

  Before deploying your company's metaverse, follow these practices -- including inventorying vulnerabilities and developing T&Cs -- to proactively address metaverse security issues.  Continue Reading

• 5 tips for building a cybersecurity culture at your company

  As a company's cyber risks evolve, so must its culture. Here are five tips for creating a cybersecurity culture that protects the business and is meaningful for employees.  Continue Reading

• Cybersecurity skills gap: Why it exists and how to address it

  The cybersecurity skills shortage is putting enterprises at risk. Worse, it shows no sign of abating. Here is why it's happening and what employers can do to mitigate the problem.  Continue Reading

• Compare SAST vs. DAST vs. SCA for DevSecOps

  SAST, DAST and SCA DevSecOps tools can automate code security testing. Discover what each testing method does, and review some open source options to choose from.  Continue Reading

• Cloud database security: Key vendor controls, best practices

  If your company is using a cloud database, it's critical to stay on top of security. Review the security features offered by top cloud providers, plus some best practices.  Continue Reading

• 10 top open source security testing tools

  From Kali Linux to Mimikatz to Metasploit, learn about 10 open source penetration testing tools organizations can use to determine how secure their network is.  Continue Reading

• 5 data security challenges enterprises face today

  Data empowers enterprises to succeed. But with great power comes great responsibility -- to keep that data secure. Here are five challenges today's businesses must meet.  Continue Reading

• Data masking vs. data encryption: How do they differ?

  Discover how the data security techniques of data masking and data encryption compare, while also learning about different types of both and their use cases.  Continue Reading

• 10 enterprise database security best practices

  Beyond protecting enterprise databases from vulnerabilities, it is critical to improve and review their security on a regular basis. Learn more with these database security best practices.  Continue Reading

• Top 10 UEBA enterprise use cases

  The top user and entity behavior analytics use cases fall in cybersecurity, network and data center operations, management and business operations. Check out the risks.  Continue Reading

• SSH key management best practices and implementation tips

  SSH connects key systems and the people and processes necessary to keep them functioning. Learn how to use SSH key management best practices to protect your systems and network.  Continue Reading

• How to perform a data risk assessment, step by step

  Organizations need confidence that they are properly identifying and protecting sensitive data. Follow these five steps to create a data risk assessment.  Continue Reading

• How to prevent a data breach: 10 best practices and tactics

  When it comes to data breach prevention, the stakes are high. While it's impossible to eliminate the risk, organizations can minimize it by following these best practices.  Continue Reading

• SSH2 vs. SSH1 and why SSH versions still matter

  The Secure Shell protocol, SSH, was redesigned and released as SSH2 in 2006. While SSH1 lingers for legacy uses, find out how the protocols differ and why it's important.  Continue Reading

• Top 10 enterprise data security best practices

  To protect your organization's data and prevent its misuse, incorporate these 10 data security best practices into your enterprise data security strategy.  Continue Reading

• Key factors to achieve data security in cloud computing

  Enterprises face a variety of data security concerns when deploying assets to the cloud. But there are some guidelines you can follow to make sure your assets are protected.  Continue Reading

• Pen testing vs. vulnerability scanning: What’s the difference?

  Confused by the differences between pen tests and vulnerability scans? You're not alone. Learn the key differences between the two and when each should be used.  Continue Reading

• 3 steps for getting started with security service edge

  Before getting started with security service edge (SSE), formulate a migration strategy. Check out these three expert tips for tackling SSE with maximum efficiency and ease.  Continue Reading

• SecOps vs. CloudSecOps: What does a CloudSecOps team do?

  Now, more than ever, organizations need to build controls, monitor and enact security response activities for the cloud. This is where the CloudSecOps team comes into play.  Continue Reading

• How to create a critical infrastructure incident response plan

  Does your organization have an incident response plan for disruptions to critical infrastructure? Learn how to write a successful plan for your company.  Continue Reading

• How to conduct a cyber-resilience assessment

  It's a good cyber hygiene practice to periodically review your organization's cybersecurity plans and procedures. Use this checklist to guide your cyber-resilience assessment.  Continue Reading

• Negotiating a golden parachute clause in a CISO contract

  If a CISO becomes the company scapegoat after a security incident, a strong golden parachute clause can mean the difference between a soft landing and a hard crash.  Continue Reading

• Top 4 best practices to secure the SDLC

  NIST's Secure Software Development Framework is a set of practices for mitigating software vulnerabilities. Learn about the top SDLC best practices included in this framework.  Continue Reading

• Key software patch testing best practices

  Every company has to update and patch its software, but unless the process is carefully managed, serious problems can occur. How can you make sure you're following the right steps?  Continue Reading

• 7 enterprise patch management best practices

  It might not be the most exciting responsibility, but the value of a well-executed patch management strategy can't be denied. Use these best practices to build a smooth process.  Continue Reading