Security Operations: Page

How can companies implement ITSM compliance standards?

In this Ask the Expert, IT governance expert Jeffrey Ritter discusses his formula to successfully align new technology with ITSM compliance standards -- all while minimizing risk.

By Jeffrey Ritter • Oct. 12, 2018

Give your SIEM system a power boost with machine learning

The enterprise SIEM is still essential to IT defenses, but the addition of AI, in the form of machine learning capabilities, gives it even more potential power.

By Karen Kent • Oct. 10, 2018

Prepping your SIEM architecture for the future

Is your SIEM ready to face the future? Or is it time for a major tune-up or at least some tweaks around the edges? Learn how to approach your SIEM assessment and updates.

By Karen Kent • Oct. 10, 2018

Picking the right focus for web application security testing

Deciding which web applications on which to focus application security testing is a challenging task. Read this list of considerations to ensure you're addressing the right areas.

By Kevin Beaver • Oct. 9, 2018

(ISC)² Security Congress 2018 tackles industry challenges

Professional development will take center stage this week at the eighth annual (ISC)² Security Congress.

By Kathleen Richards • Oct. 8, 2018

How to collect open source threat intelligence in the cloud

Threat intelligence analysis can be challenging and expensive for enterprises. Expert Frank Siemons explains how open source threat intelligence can simplify the process.

By Frank Siemons • Oct. 3, 2018

Seven criteria for evaluating today’s leading SIEM tools

Using criteria and comparison, expert Karen Scarfone examines the best SIEM software on the market to help you determine which one is right for your organization.

By Karen Kent • Oct. 2, 2018

White hat Dave Kennedy on purple teaming, penetration testing

Russia and other nation-states use application control bypass techniques because they don't "trigger any alarms," the chief hacking officer says.

By Marcus Ranum • Oct. 2, 2018

How can GravityRAT check for antimalware sandboxes?

A remote access Trojan -- dubbed GravityRAT -- was discovered checking for antimalware sandboxes by Cisco Talos. Learn how this technique works and how it can be mitigated.

By Nick Lewis • Oct. 2, 2018

How do cloud deployment models affect IT operations?

Security plays a vital role in cloud operations. Test your knowledge of important concepts covered in Domain 5 of the CCSP exam, “Operations,” with this practice quiz.

By (ISC) 2 • Sept. 26, 2018

Can monitoring help defend against Sanny malware update?

Changes to the Sanny malware were recently discovered by FireEye researchers. Learn who is at risk and how elevated privileges can help protect you with Nick Lewis.

By Nick Lewis • Sept. 25, 2018

How hardening options help handle unpatchable vulnerabilities

Using multiple hardening options to endure unpatchable vulnerabilities is explored in a recent NIST report. Learn how entropy sources can be an additional option with Judith Myerson.

By Judith Myerson • Sept. 11, 2018

What issues can arise from hardware debug exception flaws?

Misinterpretation of Intel's System Programming Guide resulted in a hardware debug exception vulnerability. Expert Michael Cobb explains how attackers can gain unauthorized access.

By Michael Cobb • Sept. 11, 2018

How to monitor and detect a cloud API vulnerability

A REST API vulnerability in Salesforce's Marketing Cloud service put users at risk of data disclosure. Learn how to detect cloud API vulnerabilities from expert Rob Shapland.

By Rob Shapland • Aug. 29, 2018

Red team assessments and post-assessment posture improvement

Testing an organization's security maturity is crucial for an organization to improve their post-assessment posture. Learn how red teaming can help this situation with Matt Pascucci.

By Matthew Pascucci • Aug. 28, 2018

SamSam ransomware: How can enterprises prevent an attack?

SamSam ransomware infected the Colorado DOT after hitting hospitals, city councils and companies. Learn how this version differs from those we've seen in the past.

By Nick Lewis • Aug. 28, 2018

Amanda Rousseau on becoming a cybersecurity researcher

Cybersecurity researcher Amanda Rousseau discusses the relationship between the infosec community and law enforcement and how to create the next generation of white hat hackers.

By Michael Heller • Aug. 14, 2018

Amanda Rousseau talks about computer forensics investigations

Amanda Rousseau, aka Malware Unicorn, discusses her time in computer forensics investigations with the DoD, as well as the joys of reverse engineering malware encryption by hand.

By Michael Heller • Aug. 14, 2018

Ransomware recovery: How can enterprises operate post-attack?

A report detailed how Maersk recovered its infrastructure from a NotPetya ransomware attack along with its chosen recovery option. Expert Nick Lewis explains how it worked.

By Nick Lewis • Aug. 14, 2018

Lessons learned from Meltdown and Spectre disclosure process

During a Black Hat 2018 session, Google, Microsoft and Red Hat offered a behind-the-scenes look at the disclosure and response effort for Meltdown and Spectre.

By Rob Wright • Aug. 13, 2018

How criticality analysis benefits from an entropy engineer

NIST published 'Criticality Analysis Process Model: Prioritizing Systems and Components' to guide organizations when prioritizing systems. Discover the key processes with Judith Myerson.

By Judith Myerson • Aug. 9, 2018

How online malware collection aids threat intelligence

Threat intelligence can facilitate cloud-based malware collection, which has value for enterprise cybersecurity. Expert Frank Siemons discusses collecting and analyzing malware.

By Frank Siemons • Aug. 8, 2018

A comprehensive guide to SIEM products

Expert Karen Scarfone examines security information and event management systems and explains why SIEM systems and SIEM products are crucial for enterprise security.

By Karen Kent • July 26, 2018

Microsoft launches Identity Bounty Program, offers up to $100,000

Microsoft introduced its new Identity Bounty Program that offers up to $100,000 in rewards for reported vulnerabilities in its identity services, such as Azure Active Directory.

By Rob Wright • July 20, 2018

Endgame’s Devon Kerr on what it takes to be a threat hunter

Threat hunting goes beyond mere monitoring and detection. Endgame's Devon Kerr explains tomorrow's threat hunters and the keys to successful cyberthreat hunting.

By Peter Loshin • July 19, 2018