Enterprise Security | Branden R. Williams, Business Security Specialist

RSA Europe Recap and the Spread of Regulatory Compliance standard

Why have I been radio silent this week? It’s certainly not because I have a lack of things to say. Even my own team mates are surprised when I tell the recent stories of being out talked. Couple of things are going on that you might be interested in. For one, I am doing a project for the next three weeks for the North Texas Chevy Dealers. In exchange for writing about and videoing my experiences, I have been given a 2011 Chevy Silverado Extended Cab, Texas Edition truck to drive. Follow my adventures over here to see me kick the tires! Outside of driving trucks and blogging about that, I spent the week in London for RSA Europe. The ...

Is Tokenization Safe? standard

In our industry, topics turn hot and cold in record time. The hot topic this week seems to focus on the safety of using Tokenization as a solution for reducing compliance and security requirements. I found this blog post on StoreFront BackTalk by Walt Conway that poses the question, “What happens to my data if my token vendor goes bankrupt?” Earlier in the week, as part of my ISSA Editorial Advisory Board duties, I reviewed an article that posed some of the very same questions. Outsourcing the handling of payment data is a critical decision for merchants to consider, and it should not be taken lightly. Just like any other major decision any company makes, merchants should perform a risk ...

What’s the Value? standard

If you were to give someone the task of protecting a room that holds anywhere from $10,000 to $100,000 in cash, the yearly spend to protect that room (in basic risk management theory) should not exceed the Annualized Loss Expectancy (ALE). ALE is a simple representation that contains an extremely complex portion of applied mathematics called probability. ALE = Impact of the event in Dollars * Probability of that event occurring on an annualized basis ((Meaning if the event probability is once every three years, you would use (1/3) here.)) Why is this complex? How hard is it to multiply a couple of numbers together? Imagine if someone tried to explain the complex dynamics of Football to you by saying, ...

Check me out on the Network Security Podcast! standard

I met up with Martin Mckeay out at BlackHat this year, and we found what we thought was a quiet corner to chat about security. Go check out the Network Security Podcast here! Possibly Related Posts: Level Up Cybersecurity with Kasm Workspaces Let’s Encrypt for non-webservers Selective Domain Filtering with Postfix and a SPAM Filtering Service PCI DSS 4.0 Released plus BOOK DETAILS! Preventing Account Takeover, Enable MFA!

Why your QSA should not be your Security Partner standard

This one is link-laden folks. Enjoy 🙂 It’s just mere weeks before we’ll see the FOURTH iteration of the PCI DSS, and companies inside the US seem to be getting better at it as we go. PCI continues to be a driving force in information security, and as the standard changes, your business environment will undoubtedly change as well. Many merchants and service providers mistakenly depend on their QSAs to find all security and PCI compliance issues. Considering the downward market pressure on assessment prices, many security professionals are discussing how QSAs are pressured to get a complete and compliant ROC in the cheapest way possible. QSA companies are motivated by three main things: Scope and price the deal in ...

2010 Verizon Business Data Breach Report Released standard

Verizon Business released their 2010 Data Breach report hours ago, and with the combination of Secret Service data for the 2010 report, there is a ton of interesting things in here. Here are a few of the highlights that I took from the report: Financial & Hospitality Beware: These two categories represent 56% of the groups involved in breaches ((Add in retail and you are up to 71%)). Those of us in the industry know the ridiculously poor state of security in the hospitality sector. Now with the economy on its way to recovery, these businesses will once again see an uptick and criminals will see an opportunity to capture valuable data. Medium-Sized Businesses are in the Crosshairs: The grouping ...

A Thought to Take You to the Weekend standard

It’s been a crazy week, and I’ve been busy gearing up for BlackHat on top of all the fun stuff my day job entails. To close out the week, I wanted to throw something at you that I thought about while discussing how to better approach compliance initiatives. It’s a simple one liner that really describes why companies should invest in security instead of compliance: A good information security program makes compliance with any standard a tweak, not an overhaul. Compliance should not be the notion that drives security in your organization. Security, among other things, should support and drive compliance. Compare that to your approach. Does that fit with how you execute your security strategy? If not, why? Possibly ...

Categories ArchivesEnterprise Security