Your organization vs. BP: what will faulty decisions lead to in your business?

Imagine a scenario where poor management, failure to take appropriate action, personnel changes and miscommunication about who's responsible for what leads to a catastrophic event at your business? That's exactly what the findings were of the BP oil spill.

Sadly, 11 people died because of this incident. Luckily, our line of work isn't quite so risky but your business can still get in a bind when information security is mismanaged.

Here's a link to articles, podcasts and webcasts I've written/recorded on the management's link to information security and a few more bits on how to sell people on information security and keep them on your side to help prevent poor management decisions in the first place.

Read More

NetIQ's file integrity monitoring solution

A couple of weeks ago, I had the privilege of speaking at the Information Week / Dark Reading Virtual Trade Show How Security Breaches Happen and What Your Organization Can Do About It.

In my presentation How to Win the War Against Cybercrime, I apparently had a brain-cramp moment and said that I'm not seeing anybody with good file integrity monitoring. Um, duh, Kevin (as I smack myself in the face), the very vendor who sponsored my session, NetIQ, has such a solution. It's called NetIQ Change Guardian. Sadly (stupidly), I knew this and don't know why I said what I said. I just wanted to set the record straight. Jill and Renee at NetIQ: thanks for keeping me on my toes. :-)

In case you missed the virtual tradeshow, I believe you can still register for it and listen to the recording. Lots of good info - not because of me, but because of the caliber of other IT and information security speakers they had on board. In fact, I was duly impressed by Steve Kovsky - the moderator for my session. I aspire to be able to speak that well one day.

Anyway, check out the virtual tradeshow and NetIQ's offerings. Both quality stuff.

Read More

Stephen Covey's insight applies to information security

I love the following quote...very applicable to what we do:

"You can't talk yourself out of a problem you behave yourself into." - Stephen Covey

Okay, you may be able to talk your way out of bad security decisions with the right attorneys or a cybersecurity insurance policy. Having worked cases involving data breaches, compliance and intellectual property, I can say that it won't be a short-lived, inexpensive or painless ordeal.

Read More

Speaking in Boston @ the CDW + TechTarget security seminar next week

I hope you'll have a chance to join me in Boston next week when I'm speaking at the TechTarget / CDW seminar: Predictive Security: Plan Ahead to Stay Ahead of the Next Threat.

Boston, like several other upcoming events, is a 2-track seminar where I'll be giving the keynote and splitting the breakout sessions with my friend and roadshow colleague Pete Lindstrom among other vendor experts. [sidenote: Pete's the real draw at these events, I'm just there to fill in the gaps....seriously, he's good.] After the keynote, breakout sessions of your choosing and a great lunch, we all get back together around 2pm and close out with a lively Q&A for which we've gotten great feedback.

If you can't make the Boston event or one of the other 2-trackers in Philly or New York this fall, I'll be leading two 1-track events in Phoenix and Raleigh coming up shortly as well.

Here's a sampling of audience feedback of my keynote and three breakout sessions at recent shows:

• Very good information, Great speaker
• Well laid-out, solid points/arguments, encouraged involvement
• Super
• Informative, broad, excellent!
• Mobile devices discussion was very good and insightful
• Informative and aligned with current issues
• Great - Clear - Real-time Current examples of industry security
• Good intro keynote
• Knowledgeable and personable
• Kevin does a great job - Good choice
• Very real life knowledge not just preaches - He feels the pain, that is great! What an honor to attend!!!
• Current real life examples is the best information that can ever be given at any seminar. A+++
• Lots of good group discussion
• Plenty of great examples, specific tools, crowd discussion, etc. Plenty of good info to take back
• Best of the day. Most valuable. Good discussion.
• Kevin's presentation was great
• Very relevant - focused on concerns that most of us seemed to have about mobile security
• Kevin is a great speaker/teacher
• Learned lots - Had a great time - Thank you! Very Much!
• Good technical info, plenty of things to take back for further use or investigation. Not too much kool-aid/sales pitches.
• The content was good. I'm not a security guy so my interest is limited. It was at a good level of complexity
• Although I was not here all seminar, what I saw was good - need more 1 day seminars
• More relevant to my job function that I had anticipated -- thanks!
• Security is a concern of upper management - This seminar provided me good information to take back to the organization
• Loved the fact that you gave us tools
• Great insights again - thanks for sharing some of the tools and hacks
• Liked location; kevin is a very good speaker
• Multi-tracks are a great idea! Continue with panel discussions/Q&A in future seminars
• More speakers like Kevin Beaver

Hope to see you there!

Read More

Microsoft Exchange Data Retention, Incident Response & Other Gotchas

Depending on where you're at with your Exchange "maturity model", here are a few pieces I've written for SearchExchange.com about Microsoft Exchange security oversights, policies and plans to help you along the way:

How to write an effective data retention policy for Exchange

Solidify Your Exchange Server Incident Response Plan

Common Exchange Security Oversights

Enjoy!

As always, be sure to check out www.principlelogic.com/resources.html for links to my additional information security articles, whitepapers, podcasts, webcasts, books and more.

Read More

What it takes to get ahead in IT and beyond

Good economy or not, people often ask: What can I do to get ahead in business? How can I stand out above the noise to enhance my career? How can I be a better network engineer, information security administrator, IT manager, speaker, writer and so on...?

Whether you work for yourself or for someone else the answer is the same. You simply seek out the people who are at the top of their fields and do what they do. That's it. You don't have to ask these experts directly, you don't have to pay to take some advanced training classes. Instead you simply see what experts in your line of business are doing how they think and model yourself after them.

Twitter, blogs and other social media provide a great way to follow what these people are doing, how they think, how they’re positioning themselves and the niche they create. It's amazing stuff that has worked for me and it can work for you.

So, seek out the people you respect which will likely be the people writing, presenting and evangelizing in the subject areas that you have an interest and go from there.

For additional reading, here are some links to articles I've written on the subject of enhancing your career in IT and beyond as well as my audio programs on IT and information security careers.

Read More

DNS hack: UPS, National Geographic, Acer, etc. websites affected

Happy (almost) Labor Day...here's the latest from the criminal hackers: a DNS hack has redirected numerous websites of UPS, National Geographic, Acer, The Register and more. Nice.



Betcha it was some low-hanging fruit someone, somewhere overlooked.

Read More