Tech Support For Dummies

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Wednesday, 31 August 2011

Talk is cheap: Time to rethink your data retention strategy (or lack thereof)?

Posted on 05:01 by Unknown
Here's a fascinating story about a court case involving data retention you need to read. And pass it along to your management as well. It talks about how businesses aren't doing what they need to be doing with regard to data retention and how decisions are being made for us by the courts.



Interestingly most businesses I come across (large and small) don't have any semblance of a data retention policy in place - much less do it well. Or they have their in-house legal counsel in charge of it often resulting in nothing more than a piece of paper saying what's supposedly being done (but usually isn't) and management signing off on it under the assumption that all is well in IT-land. It's the same issue I talk about in this recent article I wrote for SearchCompliance.com:

Why it may not be ideal for your lawyer to be your compliance officer



Maybe it's time for business managers to stop hiding behind their "talk" and start doing something about this stuff before something negative comes of it...We're often presented with the opportunity to make decisions. If we choose not to, they're going to be made for us.

Read More
Posted in compliance, data retention, expert witness, forensics, security leadership, security policies, stupid security, thinking long term | No comments

Friday, 26 August 2011

My new book: Implementation Strategies for Fulfilling and Maintaining IT Compliance

Posted on 04:54 by Unknown
Check out my latest book published by Realtimepublishers.com:

Implementation Strategies for Fulfilling and Maintaining IT Compliance
In Implementation Strategies for Fulfilling and Maintaining IT Compliance I share strategic and tactical methods for getting your arms around the compliance beast. You can download all the chapters (below) for free by signing up on Realtime's site. They've got a ton over other good content too.

Here's the low down:
Businesses are struggling more and more with the compliance requirements being pushed on them from every angle. The reality is that such regulations aren't going away. However, there’s a silver lining – IT compliance doesn’t have to be that difficult and once you've mastered compliance it can serve as a business enabler and competitive differentiator.

In Implementation Strategies for Fulfilling and Maintaining IT Compliance, a practical guide on real-world issues related to IT compliance, the reader will find reasonable solutions for the professionals responsible for making things happen.

It's great for anyone faced with implementing the standards mandated by regulations such as HIPAA, HITECH Act, GLBA, SOX, and PCI DSS. CIOs, compliance officers, IT directors and network administrators can all benefit from the anecdotal stories, down-to-earth strategies and sage advice for creating gaining and maintaining control of IT compliance so that it can enable rather than hinder the business moving forward.

Chapter 1: Understanding the Real-World Issues Associated with IT Compliance
Chapter 2: The Costs of Compliance and Why It Doesn't Have to be So Expensive
Chapter 3: Simplifying and Automating to Reduce Information Systems Complexity
Chapter 4: Establishing a System of Network Visibility and Ongoing Maintenance

Enjoy!
Read More
Posted in compliance, Kevin's books, Kevin's security content, message from Kevin, security leadership, security management | No comments

Thursday, 25 August 2011

Join me live today at Dark Reading's webinar #iwkdrbreaches

Posted on 06:58 by Unknown
I'm speaking at the #Information Week/Dark Reading Virtual Trade Show How Security Breaches Happen and What Your Organization Can Do About It.



My session is titled How to Win the War Against Cybercrime and starts at 2:30pm ET. Here are a few words about it:

What are you doing to avoid becoming the next Wikileaks, Google, or Sony? Despite the fact that businesses will spend over 50 billion dollars worldwide on IT security projects this year, it is a virtual certainty that your organization will experience a security breach at some point.



While the complexity of cyber threats may be increasing, the good news is that the answer to combating these threats need not be complex. By implementing solutions that integrate your identity, access, and security environments, you can protect your organization's network, systems, and critical information from insiders and criminal hackers.



In this presentation, noted information security expert Kevin Beaver will discuss current and evolving cyber security threats, some common oversights he sees in his work and recommend solutions that deliver the information you need to reduce the risk of security breaches across your enterprise.




Thanks to the nice folks at NetIQ for making it happen.



Hope to "see" you there!



Read More
Posted in data breaches, Kevin's security content, Kevin's seminars, message from Kevin, risk analysis | No comments

Wednesday, 24 August 2011

What direction are you heading with data protection?

Posted on 06:26 by Unknown
Here's a new guest blog post I wrote for the folks at Credant:



Heading in the Wrong Direction with Data Protection?



You may see this differently but I think we're heading down the wrong path in this area - especially on phones and other mobile devices. I suspect we'll end up in a situation like we have recently in the U.S. where the very people putting the "stimulus" bill and Obamacare in place are suddenly clamoring to get our national debt under control. Come 2013 or so, it'll be, remember those vendors and bloggers spouting off about how important mobile security was back in 2010/2011 when our network environment was much simpler?



The inability to think long-term is so, so dangerous folks. Don't be like our politicians who can't see past the next election. Make the decision to get your arms around the mobile security beast now. Start today. Here's a link to some resources that can help.

Read More
Posted in government intrusion, government regulations, mobile security, personal responsibility, stupid security, thinking long term | No comments

Monday, 22 August 2011

Fine-tuning your Web application security

Posted on 04:08 by Unknown
I think I could write about Web application security every hour of every day...there's just so much involved with building secure apps, proper security testing, getting (and keeping) management on board and so on...But I wouldn't want to torture you in that way. Anyway, here are a few bits you may be interested in:



Properly scoping your Web security assessments



The cure for many Web application security ills




How much Web security is enough?




Enjoy!



As always, be sure to check out www.principlelogic.com/resources.html for links to my additional Web security whitepapers, podcasts, webcasts, books and more.
Read More
Posted in Kevin's security content, security assessments, vulnerability assessments, web application security | No comments

Sunday, 21 August 2011

Getting ahead in your career + keeping IT staff on board

Posted on 06:57 by Unknown
Here are some new bits I've written about IT and information security careers. First, what you can do to stand out above the noise and move your career ahead:

How IT pros can boost their worth -- and their salaries



...and second, what management can do to keep IT and security professionals interested in their jobs and on board with the business:

How to retain your IT talent



8 best practices for retaining IT talent



Enjoy!



As always, be sure to check out www.principlelogic.com/resources.html for links to my 500+ articles, whitepapers, podcasts, webcasts, books and more.

Read More
Posted in careers, Kevin's security content, security leadership, security management, thinking long term | No comments

Friday, 19 August 2011

What's up with conferences in October?

Posted on 05:26 by Unknown
I've had to turn down 3 speaking engagements the weeks of October 10th & 17th because I'm, well, speaking at other shows those weeks. Maybe it's something about the weather that time of year? Perhaps discounted meeting facility rental rates? I suspect the real reason is that all the top-notch security speakers are busy then so the conference organizers are reaching out to second stringers like me.



BTW, my apologies for being silent on my blog over the past week...will be re-engaging soon. Have a great weekend!

Read More
Posted in Kevin's keynotes, Kevin's seminars, message from Kevin, presentations | No comments

Wednesday, 10 August 2011

My webcast/Q&A today on managing network threats

Posted on 03:21 by Unknown
Join me today in TechTarget's SearchCompliance.com virtual tradeshow:

Enterprise Risk Management: Mitigation Strategies for Today's Global Enterprise



My presentation "Managing Network Security Threats with an ERM Strategy" starts around 3pm ET and I'll be doing a live Q&A just after.







Read More
Posted in internal threat, Kevin's seminars, network security, risk analysis, security management | No comments

Tuesday, 9 August 2011

Steve Jobs' ridiculous iTunes interface

Posted on 16:45 by Unknown
I just spent 6.5 minutes cracking a family member's laptop password in order to demonstrate the dangers of not having whole disk encryption. I then went on to spend 20 minutes+ of my life trying to sync some new music to an iPod Touch with the unbelievably difficult iTunes interface.... After investing a lot of time (that I'll never get back, mind you) I still didn't get the music synced.



What's wrong with this picture!?



Apple and Mr. Jobs: Ask any IT professional what they think about iTunes and it'll echo my experience. We all dislike it in the same way. What gives?





Read More
Posted in laptop encryption, mobile security, scary stuff, uncool products | No comments

Friday, 5 August 2011

You're the sum of your choices

Posted on 02:37 by Unknown
Here's a 67 second video that defines the essence of where we are in life, our careers and even in information security today:



I really like what John Wooden said:
"There's a choice you have to make in everything you do. So keep in mind that in the end the choice you make makes you."

I also love what John Maxwell says:
"It's your personal choices. If they're good, it's going to help make you. If they're bad, it's going to be the unmaking of you."

Indeed, we must use wisely our power of choice...Great stuff.
Read More
Posted in careers, great quotes, information security quotes, personal responsibility, security leadership, thinking long term | No comments

Thursday, 4 August 2011

Digital distractions take top priority

Posted on 06:00 by Unknown
Be it texting while driving, browsing Facebook while in a meeting or checking emails while having lunch with a friend, it seems that there's always something better for us to be doing. It's so much easier being somewhere else rather than in the moment. That's the essence of this well-written piece on Gizmodo:
The Epidemic of Digital Distraction

You see there's a human epidemic that not many people really care to acknowledge or talk about. It's the dangerous desire for instant gratification. Those who don't have the ability to think long term create many, many problems in their own lives and many, many problems in society (think big government). I believe it also contributes to people goofing off on the job.

Don't get me wrong, the desire for instant gratification is in us all. We just have to be disciplined enough to make the right choices. If you're interested in finding ways to slow down and live in the moment, you must read The Speed Trap:



It helped solidify this concept and made me realize I need to focus on the things that count.
Read More
Posted in personal responsibility, scary stuff, thinking long term | No comments

The difference between "No" and "How"

Posted on 05:52 by Unknown
Here's a humorous and thought-provoking post by my friend Pete Lindstrom that you should check out:
Dr. Laura as Information Security Officer

It's so easy for people to say "No" to information security rather than "How"...similar to how many people - children and adults alike - say "I can't!" rather than "How can I?".

People are always going to take the path of least resistance...if you let them.
Read More
Posted in personal responsibility, security leadership, security management, stupid security, thinking long term | No comments

Tuesday, 2 August 2011

Indeed, many executives are insulated from reality

Posted on 06:28 by Unknown
Here's a piece where I, Richard Stiennon, Andrew Baker and others weigh on executive management's involvement in information security:

Focus Experts’ Briefing: How CEOs Can Prepare for and Respond to Cyberattacks

Unless and until executives get on board with security - across the board - I'll continue reciting one of my favorite quotes:

“Many executives are insulated from reality and consequently don’t know what the hell is going on.” -James Champy
Read More
Posted in careers, great quotes, information security quotes, security leadership, selling security, stupid security | No comments
Newer Posts Older Posts Home
Subscribe to: Posts (Atom)

Popular Posts

  • How you can get developers on board with security starting today
    Some people - including a brilliant colleague of mine - think security is not the job of software developers . In the grand scheme of things...
  • NetScan Tools LE - a must-have for investigators
    Have you ever had a need to run a program and get a relatively small amount of data just to do your job but end up getting caught in the com...
  • "Top Blogs" list & some home security considerations
    I think I may have found the first sign that my blog is growing and gaining some traction. I've made it to the Top 20 Home Security Blog...
  • Wooo...HIPAA audits are coming & the irony of KPMG's involvement
    I've always believed that compliance is a threat to business [hence why I help businesses take the pain out of compliance by addressing ...
  • Great tool for seeking out sensitive info on your network
    One of the greatest risks in business today is the issue of unstructured information scattered about the network waiting to be misused and ...
  • It's hard being human
    Cavett Robert once said something about character that resonates within information security - especially regarding ongoing management and l...
  • Dario Franchitti and I
    As many of you know I'm a motorsports nut -both as a driver and a fan. This provided the influence for my Security On Wheels logo. Well,...
  • The value of partial code scanning, now
    Check out my new piece on the business value of partial code scanning where I outline why it's better to start your source code analysi...
  • Be it in healthcare or infosec, the short term is for losers
    With all the doctor & hospital visits I've gone (and am still going) through with family members in the past few years, I've com...
  • Live from #RSAC: Cloud computing's got some kinks (but you knew that)
    I'm attending the RSA Conference this week and just sat through a panel discussion on cross-jurisdictional issues in the cloud. It was p...

Categories

  • active directory
  • application firewalls
  • APTs
  • aslr
  • atm security
  • audio programs
  • audit logging
  • automated scanner oversights
  • back to basics
  • backups
  • big brother
  • bitlocker
  • budget
  • business case for security
  • business continuity
  • BYOD
  • car hacking
  • careers
  • certifications
  • change management
  • checklist audits
  • cissp
  • clear wireless
  • cloud computing
  • communication
  • compliance
  • computer glitch
  • conferences
  • consulting
  • content filtering
  • cool products
  • cool sites
  • cross-site request forgery
  • cross-site scripting
  • csrf
  • customer no service
  • cybersecurity bill
  • data at rest
  • data breach laws
  • data breaches
  • data centers
  • data destruction
  • data leakage
  • data protection
  • data retention
  • database security
  • degrees
  • desktop management
  • disaster recovery
  • disk imaging
  • disposal
  • dns
  • document security
  • domino
  • DoS attacks
  • drive encryption
  • e-discovery
  • ediscovery
  • employee monitoring
  • encrypting data in transit
  • encryption
  • end point security
  • ethical hacking
  • exchange
  • experience
  • expert witness
  • exploits
  • facebook
  • FERPA
  • file integrity monitoring
  • firewalls
  • forensics
  • full disk encryption
  • global warming
  • goal setting
  • good blogs
  • government intrusion
  • government regulations
  • great quotes
  • hacking
  • hardware
  • hipaa
  • hitech
  • hitech act
  • home security
  • humor
  • identity access management
  • identity theft
  • IIS
  • incident response
  • information classification
  • information security quotes
  • intel
  • intellectual property
  • internal threat
  • java
  • Kevin's books
  • Kevin's interviews
  • Kevin's keynotes
  • kevin's panels
  • kevin's quotes
  • Kevin's security content
  • Kevin's seminars
  • Kevin's videos
  • laptop encryption
  • laptop security
  • legal
  • Linux
  • locking screens
  • low-hanging fruit
  • malware
  • marketing hype
  • message from Kevin
  • messaging security
  • metasploit
  • metrics
  • mobile apps
  • mobile security
  • motivation
  • multi-factor authentication
  • network analysis
  • network complexities
  • network protocols
  • network security
  • networking essentials
  • Novell
  • office
  • online backup
  • online safety
  • open source security
  • owasp
  • p2p
  • passwords
  • patch management
  • patching
  • pci 6.6
  • pci dss
  • PCNAA
  • penetration testing
  • people problems
  • personal responsibility
  • phishing
  • physical security
  • pii
  • podcasts
  • policy enforcement
  • politics
  • presentations
  • privacy
  • quality assurance
  • recommended books
  • recommended magazines
  • recycling
  • remote access security
  • ridiculous password requirements
  • risk analysis
  • risk management
  • rogue insiders
  • ROI
  • RSA 2012
  • running a business
  • saas
  • salary
  • scary stuff
  • sccm
  • sdlc
  • security assessments
  • security audits
  • security awareness
  • security committees
  • security leadership
  • security management
  • security operations
  • security policies
  • security policy
  • security scans
  • security standards
  • security statistics
  • security technologies
  • security testing tools
  • security tools
  • selling security
  • sharepoint
  • small business
  • smartphone security
  • SMBs
  • social media
  • software development
  • source code
  • source code analysis
  • special offer
  • SQL injection
  • sql server
  • ssl
  • storage security
  • student information systems
  • stupid security
  • success
  • telecommuting
  • testimonials
  • thinking long term
  • third-party applications
  • threat modeling
  • time management
  • training
  • twitter
  • uncool products
  • unstructured information
  • unstructured infromation
  • user awareness
  • vendors
  • virtual machine security
  • visibility
  • voip
  • vulnerability assessments
  • web 2.0
  • web application security
  • web browser security
  • web server security
  • webcasts
  • WebInspect
  • whitelisting
  • whitepapers
  • Windows
  • Windows 7
  • windows 8
  • windows 8.1
  • Windows Mobile
  • windows security
  • Windows Vista
  • wireless
  • wireless security
  • zero tolerance

Blog Archive

  • ►  2013 (35)
    • ►  November (3)
    • ►  October (3)
    • ►  September (1)
    • ►  August (2)
    • ►  July (3)
    • ►  June (1)
    • ►  May (4)
    • ►  April (4)
    • ►  March (4)
    • ►  February (5)
    • ►  January (5)
  • ►  2012 (77)
    • ►  December (2)
    • ►  November (2)
    • ►  October (4)
    • ►  September (3)
    • ►  August (3)
    • ►  July (4)
    • ►  June (5)
    • ►  May (9)
    • ►  April (5)
    • ►  March (10)
    • ►  February (14)
    • ►  January (16)
  • ▼  2011 (163)
    • ►  December (15)
    • ►  November (11)
    • ►  October (9)
    • ►  September (16)
    • ▼  August (13)
      • Talk is cheap: Time to rethink your data retention...
      • My new book: Implementation Strategies for Fulfill...
      • Join me live today at Dark Reading's webinar #iwkd...
      • What direction are you heading with data protection?
      • Fine-tuning your Web application security
      • Getting ahead in your career + keeping IT staff on...
      • What's up with conferences in October?
      • My webcast/Q&A today on managing network threats
      • Steve Jobs' ridiculous iTunes interface
      • You're the sum of your choices
      • Digital distractions take top priority
      • The difference between "No" and "How"
      • Indeed, many executives are insulated from reality
    • ►  July (8)
    • ►  June (13)
    • ►  May (18)
    • ►  April (16)
    • ►  March (13)
    • ►  February (13)
    • ►  January (18)
  • ►  2010 (170)
    • ►  December (10)
    • ►  November (14)
    • ►  October (7)
    • ►  September (27)
    • ►  August (20)
    • ►  July (8)
    • ►  June (15)
    • ►  May (4)
    • ►  April (23)
    • ►  March (21)
    • ►  February (11)
    • ►  January (10)
  • ►  2009 (55)
    • ►  December (5)
    • ►  November (10)
    • ►  October (21)
    • ►  September (19)
Powered by Blogger.

About Me

Unknown
View my complete profile