Security Operations: Page

Outsourcing data center services: SMB security best practices

Learn best practices for outsourcing data center services and about the security and compliance considerations that influence whether an SMB should outsource data center services.

By Joe Malec, Contributor • Nov. 5, 2010

Lack of incident response plan leaves hole in compliance strategy

Without an incident response plan, businesses can tend to be reactive rather than proactive when data breaches occur. Here are some steps to follow.

By Kevin Beaver • Jan. 22, 2010

Is it possible to crack the public key encryption algorithm?

Is it possible to create a PKI encryption key that is unbreakable? IAM expert Randall Gamby weighs in.

By Randall Gamby • Jan. 14, 2010

Determine your Microsoft Windows patch level

A handful of patch management tools from Microsoft and third -parties can help your organization determine your Windows patch level and identify missing security patches.

By Tony Bradley • Sept. 23, 2009

PCI DSS compliance requires new vendor management strategy

Requirement 12.8 requires a better vendor management strategy for PCI DSS compliance.

By Andrew M. Baer, Contributor • Aug. 24, 2009

How to mitigate operational, compliance risk of outsourcing services

Companies must have an approach to evaluating partner risk, the level of risk of both the service and the provider, and the adequacy of the security practices of the provider.

By Richard Mackey • June 15, 2009

What are the ethical issues when consulting for two competing companies?

Security consulting is a job in which privacy is paramount. Leaking security strategies to the wrong people -- especially a company's competition -- could lead to breaches or break ins. In this expert response, David Mortman gives best practices for handling consulting ethically.

By David Mortman • Feb. 3, 2009

What is the cause of an ‘intrusion attempt’ message?

Have you ever received a message from your endpoint security product stating that an intrusion attempt has been blocked? Mike Chapple gives three possibilities for the alert's likely cause.

By Mike Chapple • Jan. 9, 2009

PCI DSS 3.1 requirement best practices

Requirement 3.1 of the PCI Data Security Standard requires minimum cardholder data storage. In this tip, learn how to determine how much data your organization should store.

By Roger Nebel, Contributor • Dec. 2, 2008

What vendors would you recommend for software write-blockers?

In a forensics investigation, a software write-blocker can be very helpful. But which vendors offer the best blockers? Security management expert Mike Rothman explains what to look for.

By Mike Rothman • Aug. 6, 2008

Is the Orange Book still relevant for assessing security controls?

Is the Orange Book still the be-all and end-all for assessing security controls in the enterprise? Security management expert Mike Rothman explains what happened to the Orange Book, and the Common Criteria for Information Technology Security Evaluation that replaced it.

By Mike Rothman • July 9, 2008

Intrusion detection system deployment recommendations

Before you take the time and effort to deploy an IDS, consider this advice.

By Edward Yakabovicz, Contributor • March 17, 2008

Is centralized logging worth all the effort?

Network log records play an extremely important role in any well-constructed security program. Expert Mike Chapple explains how to implement a centralized logging infrastructure.

By Mike Chapple • March 11, 2008

Built-in Windows commands to determine if a system has been hacked

In this tip, contributor Ed Skoudis identifies five of the most useful Windows command-line tools for machine analysis and discusses how they can assist administrators in determining if a machine has been hacked.

By Ed Skoudis • March 5, 2008

What software development practices prevent input validation attacks?

Improper input validation leads to numerous kinds of attacks, including cross-site scripting, SQL injection and command injection. In this expert Q&A, Michael Cobb reviews the most important application development practices.

By Ed Skoudis • Feb. 11, 2008