Results ordered by term relevance.

December 9, 2016 | Risk Management
By Rich Guida, IANS Faculty

 Understanding the Relationship Between Physical and Logical Information Security

The relationship between physical security and cybersecurity can be more closely linked than some organizations might think. In this Ask-an-Expert written response, IANS Faculty Rich Guida details specific instances (i.e., insider threats) where the two types of security come together and offers insight into the practice of "incrementalism."

Read More »


March 8, 2017 | Directory Services
By Rich Guida, IANS Faculty

 Detailing Requirements for an IDAM System

Establishing a set of questions and requirements is a critical step in the process of constructing an identity and access management (IDAM) system. In this Ask-an-Expert written response, IANS Faculty Rich Guida details the important questions security teams should be asking their prospective IDAM vendors, ranging from cryptography and authentication requirements to privilege management and separation of duties. 

Read More »


March 24, 2017 | Directory Services
By Rich Guida, IANS Faculty

 Managing Terminated Active Directory Accounts

Managing AD accounts for terminated employees can become complex and confusing, especially as organizations evolve over time. In this Ask-an-Expert written response, IANS Faculty Rich Guida details best practices for managing terminated accounts to meet application, audit and regulatory requirements, and offers recommendations for easing the process.

Read More »


April 5, 2017 | Risk Management
By Rich Guida, IANS Faculty

 Creating an Effective IDAM Governance Committee

Planning an optimal identity and access management (IDAM) strategy requires participation and buy-in from a variety of stakeholders, including HR, legal and more. In this Ask-an-Expert written response, IANS Faculty Rich Guida offers recommendations for creating the right membership, rules and processes for a strong IDAM governance committee.

Read More »


April 7, 2017 | Password Management
By IANS Faculty, IANS Faculty

 Poll: What Are the Best Password Strategies?

Password guidelines seems to change all the time. With new recommendations from NIST and vendors like Microsoft cropping up, how can enterprises determine the best approach? In this report, IANS Faculty Rich Guida, John Galda, Jason Gillam, Kevin Beaver, Marcus Ranum and Stephen McHenry offer their opinions and some rules of thumb for creating strong, enforceable password policies.

Read More »


February 16, 2017 | Cloud Access Security Brokers
By George Gerchow, IANS Faculty

 Deciphering the Dynamic CASB Marketplace

The cloud access security broker (CASB) market continues to mature. In this report, IANS Faculty George Gerchow provides an update, detailing the relevant vendors, their latest capability sets and the various deployment models available. He also offers some guidance on choosing the right CASB for your needs and cloud maturity level, as well as trends to expect in the future.

Read More »


February 28, 2017 | Privacy
By Aaron Turner, IANS Faculty

 Protecting Data Transferred From Canada

While Canadian regulators in the past typically followed U.S. precedent on data protection standards, the country has moved closer toward the EU model over the past few years. In this Ask-an-Expert written response, IANS Faculty Aaron Turner recommends companies handling Canadian citizen data follow the EU General Data Protection and offers some technical guidance for implementing the necessary controls. 

Read More »


April 19, 2017 | Enterprise and IT Compliance Management
By Josh More, IANS Faculty

 Understanding the Australian Regulation’s ‘Two-Person Rule’ Requirement

The Australian Regulation's PPG 234 requires that extremely sensitive IT assets be subject to the "two-person rule," but it doesn't offer much guidance in terms of what it deems "extremely sensitive." In this Ask-an-Expert written response, IANS Faculty Josh More explains the rule and offers some practical   advice for complying with it efficiently. 

Read More »


April 26, 2017 | Cloud Access Security Brokers
By Rich Mogull, IANS Faculty

 Navigating an Increasingly Commoditized CASB Marketplace

Over the past few years, there has been a lot of consolidation in the cloud access security broker (CASB) market. In this live Ask-an-Expert interaction, IANS Faculty Rich Mogull offers an assessment of the current CASB marketplace and explains why the recent commoditization in the space means organizations should prioritize ease of integration when choosing a CASB. 

Read More »


November 7, 2016 | Vendor and Partner Management
By Marty Gomberg, IANS Faculty

 Identifying Vendor Risk Red Flags

When it comes to evaluating vendors, there are a number of factors organizations need to keep in mind, from integration costs to uptime guarantees. In this Ask-an-Expert written response, IANS Faculty Martin Gomberg lays out some of the major red flags organizations should look out for when evaluating vendors, from the due diligence phase to the questionnaire process.

Read More »


November 3, 2016 | Malware and Advanced Threats
By Michael Pinch, IANS Faculty

 Health Care Roundtable: Tackling Ransomware

Ransomware is a scourge across every vertical but it seems to have found a soft spot in health care. For this roundtable, IANS brought together a group of health care sector security executives to talk about the problems they face and the strategies they are using to get ahead of the ransomware issue.

Read More »


October 13, 2016 | Networking and Network Devices
By Mike Saurbaugh, IANS Faculty

 What to Look for in a Secure Web Gateway

Secure web gateways provide a staple in network infrastructure and the market seems to suggest they will be around for the next few years. In this Ask-an-Expert written response, IANS Faculty Mike Saurbaugh explores the capabilities of modern proxy solutions and offers selection criteria to help evaluate various solutions.

Read More »


November 2, 2016 | Risk Management
By Michael Pinch, IANS Faculty

 Breaking Down the Top 5 Security Risks Facing Health Care Organizations

The top priorities for health care organizations today are uptime and free access to data, which means companies in this space face a number of security challenges. In this Ask-an-Expert written response, IANS Faculty Mike Pinch details the major security risks the health care industry is dealing with today - from ransomware to the Internet of Things - and offers strategies for tackling these challenges.

Read More »


January 4, 2017 | Regulations & Legislation
By Daniel Maloof, IANS Managing Editor

 Trump and Security: What to Expect in the New Administration

We all know incoming U.S. President Donald Trump is focused on physical security and building the wall, but what about cybersecurity policy? In this report, a handful of IANS Faculty detail what they believe we should expect from the new Donald Trump administration in terms of digital privacy, consumer protections, the EU-U.S. Privacy Shield, the U.S. Cybersecurity Framework and more.

Read More »


January 6, 2017 | Cloud Application and Data Controls
By Dave Shackleford, IANS Faculty

 IANS Cloud Security Update: Q4 2016

As more organizations move services and computing assets into cloud service provider environments, the need for adequate security controls grows as well. In this quarterly research report, IANS Faculty Dave Shackleford updates IANS’ clients on the new developments occurring in the cloud security arena.

Read More »


January 26, 2017 | Threat Intelligence and Modeling
By Bill Dean, IANS Faculty

 Pros and Cons of CISA’s Threat-Sharing Program

With the passage of CISA and with DHS’ Automated Indicator Sharing (AIS) program getting up and running, organizations interested in sharing threat intelligence can now consider automating the process. How can they ensure their automated feed is scrubbed of PII and won’t leave them open to liability or privacy concerns? In this report, IANS Faculty Bill Dean offers tips for sharing threat indicators both automatically and safely.

Read More »


February 27, 2017 | Vendor and Partner Management
By Josh More, IANS Faculty

 Managing Vendors With Disparate Frameworks

Vendor due diligence becomes even more challenging when there are a variety of information security frameworks in play. In this Ask-an-Expert written response, IANS Faculty Josh More details two approaches to the problem: a formalized mapping process using the COBIT framework and an ad-hoc approach designed to prioritize the specific risks facing the organization. 

Read More »


April 12, 2017 | Vulnerability Assessment and Management
By Josh More, IANS Faculty

 Managing the Vulnerability Exception Process

Vulnerability remediation can often seem like a three-way tug of war between operations, compliance and security. In this Ask-an-Expert written response, IANS Faculty Josh More details best practices for managing exceptions and keeping the whole process on track.

Read More »


April 14, 2017 | Enterprise and IT Compliance Management
By Josh More, IANS Faculty

 Addressing PCI’s ‘One Primary Function’ Requirement

While PCI DSS 3.2 requires that IT implement just one primary function per server, it isn't exactly clear about what compliance entails. In this Ask-an-Expert written response, IANS Faculty Josh More explains the requirement and offers strategies for defending common business practices.

Read More »


April 25, 2017 | Enterprise and IT Compliance Management
By George Gerchow, IANS Faculty

 Selecting a GRC Tool

GRC tools have been around for a number of years now, but the market landscape and solutions themselves have evolved quite a bit. In this Ask-an-Expert written response, IANS Faculty George Gerchow details the primary features of today's GRC tools and offers recommendations for setting KPIs and completing a PoC. 

Read More »


May 3, 2017 | Enterprise and IT Compliance Management
By Dave Shackleford, IANS Faculty

 Deploying the Right Controls for DFARS Compliance

The deadline for DFARS compliance is coming fast, but many organizations are finding the requirements vague and difficult to implement. In this Ask-an-Expert written response, IANS Faculty Dave Shackleford explains how most companies are interpreting specific rules around cryptographic, cloud and session termination controls. 

Read More »


May 4, 2017 | Enterprise and IT Compliance Management
By Josh More, IANS Faculty

 Allocating the Right Resources for SOX Compliance

The optimal head count and cost structure for a Sarbanes-Oxley (SOX) compliance program varies widely depending on industry vertical, organization complexity, maturity and more. In this Ask-an-Expert written response, IANS Faculty Josh More details typical program requirements and offers recommendations for ensuring appropriate resources get allocated.

Read More »


May 4, 2017 | Threat Intelligence and Modeling
By Adam Shostack, IANS Faculty

 Threat Modeling in an Agile Environment

Threat modeling can be seen as a heavy, complex set of tasks that gets cast aside as we move at the speed of Agile, but in reality, it helps make the shift faster. In this report, IANS Faculty Adam Shostack explains why threat modeling is important, addresses concerns about fitting threat modeling practices into an Agile world and highlights some traps to avoid along the way.

Read More »


May 8, 2017 | Endpoints
By Dave Kennedy, IANS Faculty

 Weighing Traditional vs. Next-Gen Endpoint Protection

Traditional endpoint protection platforms (EPPs) like McAfee or Symantec tend to have rich feature sets, but are lagging in newer capabilities. Next-gen endpoint solutions, on the other hand, have cutting-edge features but don't offer a broad range of functionality. In this Ask-an-Expert live interaction, IANS Faculty Dave Kennedy compares the two spaces and offers recommendations for getting the best of both worlds.

Read More »


May 10, 2017 | Desktop Virtualization (VDI)
By James Tarala, IANS Faculty

 Securing a Virtual Desktop Infrastructure (VDI) Environment

While securing a VDI environment is not very different from securing a distributed PC environment, it does require some extra thought to ensure optimal performance, incident response and access control. In this Ask-an-Expert live interaction, IANS Faculty James Tarala recommends strategies to ensure the deployment is both secure and successful.

Read More »