Privacy Impact Assessment
What is a Privacy Impact Assessment (PIA)?
Privacy Impact Assessment is a process to determine the impacts of a program, system, service, scheme, initiative,...
Management, compliance & auditing
The Most Common Problems in the Implementation of Agile Methodologies in Companies, Part 2
Previously, we took a major problem with which organizations are faced in the implementation of Agile methodologies in companies. It was where the lack of...
InfoSec Book Excerpt: Security Metrics – Chapter 17
We like to read the latest and greatest security books, andsometimes the author and/or publisher is generous enough to share an extended with us - and you....
Attack Surface Reduction – Chapter 4
This is Chapter 4 in Tom Olzak‘s book, “Enterprise Security: A practitioner’s guide.”
Chapter 3 is available here: Building the Foundation: Architecture...
The Compliance Shell Game
"What's in a name? that which we call a rose. By any other name would smell as sweet"
Shakespeare would probably turn over in his grave knowing that I have...
Building the Foundation: Architecture Design – Chapter 3
In this chapter, we define the various types of enterprise architectures, how to integrate them into strategic and tactical business objectives, and how to build from business need to system and network design.
Enterprise Security: A practitioner’s guide – Chapter 1
Chapter 1Security: A working definition
Managing Risk
Probability of Occurrence
Business Impact
Threat Sources
Human Threats
Geographic Threats
Natural...
UEFI and the TPM: Building a foundation for platform trust
Table of Contents
Trusted Computing
Boot Path Security Challenges
Boot Path Attack Surface
The Trusted Memory Module (TPM)
TPM Architecture...
Goodbye DIACAP, Hello DIARMF
When C&A becomes A&A, will you be ready?
Every few months, an elite group of DoD security experts, IT managers, and senior leadership gather to chart...
ISO27002 Security Framework – Audit Program Template
Several people have asked for an IT Audit Program Template for an audit based on the ISO/IEC 27002:2005(E) security standard. This template, which can be...