2013 InfoSec Risk 
Krebs on Security
JUNE 18, 2021
Under First American’s documented vulnerability remediation policies, the data leak was classified as a security weakness with a “level 3” severity, which placed it in the “medium risk” category and required remediation within 45 days. “The [employee] did not request a waiver or risk acceptance from the CISO.”
Cisco Security
MAY 5, 2022
A strategic compliance and risk management approach is as essential to the success of an organization as its product strategy. ISO IEC 27001:2013 – Information technology — Security techniques — Information security management systems — Requirements. Infosec Registered Assessors Program (IRAP December 2020).
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Adam Shostack
MAY 20, 2020
For others, such as the first, there’s a risk that journalists are going to say ‘really, we only know how 15% of incidents start?’ For example, I believe that patch management is way harder than you’d believe if you read infosec twitter, but so what? ’ (I would be surprised if it’s that high.).
Adam Shostack
JANUARY 2, 2025
For others, such as the first, there's a risk that journalists are going to say 'really, we only know how 15% of incidents start?' (I For example, I believe that patch management is way harder than you'd believe if you read infosec twitter, but so what? I would be surprised if it's that high.) That would be exciting and actionable.
Troy Hunt
JANUARY 10, 2018
Just as in my post on NatWest last month , that entry point must be as secure as possible or else everything else behind there gets put at risk. By recognising this, they also must accept that the interception may occur on that first request - the insecure one - and that subsequently leaves a very real risk in their implementation.
The Falcon's View
JANUARY 3, 2019
Consider, if you will, that fundamentally we in infosec want people to make better decisions. That's right, it's infosec. Those are the Three Ways of DevOps as introduced within The Phoenix Project way back in 2013. 3) InfoSec Bifurcation: Functional vs. Strategic. Truly, that's at the core of much that we do.
Notice Bored
FEBRUARY 20, 2022
Aside from restructuring and generally updating the controls from the 2013 second edition, the committee (finally!) Monitoring activities (8.16) - 'anomalies' on IT networks, systems and apps should be detected and responded to, to mitigate the associated risks. The fine details, however, do matter in practice.
Expert insights. Personalized for you.
333 
Let's personalize your content