Management, compliance & auditing

An Introduction to cybersecurity policy

Security policy Security policy is the statement of responsible decision makers about the protection mechanism of a company crucial physical and information

An Overview of the Payment Card Industry (PCI)

The payment card industry consists of all the organizations which store, process and transmit cardholder data and carry transactions through debit and credit

What’s So Different with Audit?

Though aimed at InfoSec practitioners, I hope this piece will also be of interest to audit practitioners, whether InfoSec centered or not. Audit, Assurance,

Technologies for Conducting Privacy Compliance Assessments

Section 1. Introduction Most jurisdictions worldwide have developed comprehensive privacy laws which impose a number of obligations on organizations collecti

Third-Party Risk Management

Third-party risk management has started to gain much importance, as organizations turn more toward outsourcing to reduce their operating costs and put more e

Entry Level Risk Management: Creating a First Security Risks Register

Organizations of all sizes apply risk management to their operations. In larger ones, this will normally be through a formal Enterprise Risk Management (ERM)

Legal issues of new and emerging technologies

Since the invention of the agriculture in the Fertile Crescent, the humanity has witnessed continuous technological developments. Such developments affect th

SAP Afaria Security: Attacking Mobile Device Management (MDM) Solution

It is known that the BYOD trend is changing the way enterprises are managed, delivered, and, most importantly, secured. While BYOD has its benefits, such as

Windows logging for PCI-DSS

Various organizations strive to be PCI-DSS compliant, and they often have a hard time deciding what to log from Windows Systems so as to retain all the essen

Why ITIL, COBIT and Other Non-Infosec Based Frameworks Are Infosec’s Best Friends

As a current or aspiring security professional, you will know of a range of information security frameworks and enablers. These might include standards, e.g.