How are you spending your time?

Not long ago I had a conversation with a colleague of mine who's also a consultant. We were discussing the topic of how, even with today's shaky economy, people still goof off on the job as if they had nothing to lose.

Are you seeing this too?

I wrote about this phenomenon over three years ago. Funny how not much changes internally given all the external forces pressing down on us.

Not being willing to do whatever it takes to become - and remain - a valuable asset to your business is a sure-fire way to get axed when big decisions are being made. Trust me, I learned this lesson the hard way working for a previous employer before I went out on my own.

I recommend continually asking yourself: What's the most valuable use of my time? I often find the answer to be something else other than what I'm currently doing. We all struggle with this. We're only human. It's the people who learn and overcome that move to the head of the pack.

In case you're interested, check out the additional articles I've written on time management and IT careers and even a couple of audiobooks that can help you boost your current career situation.

Read More

Basic features of WebInspect - the kind of stuff great scanners are made of

Wondering what helps minimize the pain, stress and time required to run effective Web vulnerability scans? It's the things you can see in the toolbar of HP's WebInspect:

Start/Resume, Pause - because you're going to need to pause and resume your scans at some point.
Rescan - because you're going to want to re-run the scan again or re-test for the flaws uncovered previously.
Compare - because you're going to have a need to compare results for remediation validation testing, etc. eventually.

If you do this work enough, these types of vulnerability scanner features can have tremendous payoffs over the long haul.

Read More

Video: Here's the one thing you can do to improve #infosec right now

Read More

Disk encryption for HIPAA + HITECH & why BitLocker may not be the solution

I'm finally back in the swing of things after taking some time off for Spring Break. I hope you're enjoying your Spring as well.

Here are two articles I've recently written about full disk encryption...arguably the greatest missing link in any given business's information security program.

Things you need to think about regarding disk encryption and data protection for HIPAA and HITECH

BitLocker’s improvements leave gaps to be aware of


Enjoy!

As always, be sure to check out www.principlelogic.com/resources.html for links to all of my information security whitepapers, podcasts, webcasts, books and more.

Read More

Video: Don't worry about your title, focus on this instead

My thoughts on why you need not worry about how people address you. [Hint: it's not about you.] There are bigger things to be concerned with.

Read More

This is your crazy JetBlue captain speaking

Anyone is capable of doing anything...that's what comes to mind when I think about the JetBlue captain going mad on a flight yesterday. Here's what I know...Just because someone has passed a background check, has a good references and has created a good track record for himself doesn't mean he's not capable of flying off the hook and doing bad things. This applies to pilots as in this situation and it applies to your own users when it comes to information security.

Sadly, as with doctors, law enforcement officers and the like, we typically hold pilots on pedestals without question. These are the people we look up to assuming they're well put together and always doing good things. This is not always true. We have to trust, but verify...yet still, we never really know. I'm just glad the JetBlue co-pilot and passengers executed a worthy backup plan. Great reminder we always need a Plan B...especially today if you work in JetBlue's PR department.

Read More

Don't underestimate the value of firewall rulebase analysis

Are firewalls sexy? No...but you must understand that they're an integral part of your overall information risk equation. From configuration flaws to rulebase anomalies to overall system inefficiencies, your firewall rulebases can make or break security, business continuity and other critical parts of your IT operations.

Last week, AlgoSec's Nimmy Reichenberg and I recorded a webinar titled How to Automate Firewall Operations, Simplify Compliance Audits and Reduce Risk that you may want to check out. It's not salesy or filled with marketing fluff. It's more of us having a conversation about some common firewall security and management oversights and what needs to be done to rein in the problems.

I'm a believer in firewall rulebase optimization. I've seen mis-managed and undersecured firewalls do everything from take down an entire enterprise's operations for hours on end to making critical network flaws open to the outside world. I'm working on such projects right now and I'm pretty sure every network - every firewall - that hasn't been properly reviewed and that isn't being properly managed has these same risks present at this very moment.

Check out our discussion and see if you think there's a fit for better firewall oversight in your enterprise.You can't change what you tolerate in IT...acknowledge the issues that are hidden in your environment and vow to do something about them once and for all.

Read More