Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by IANS Faculty
How to Mitigate Your Risk as a CISO
CISOs must not only protect and defend their organization’s assets but also safeguard themselves as individuals. A strategic plan and clear communication are effective tools for a CISO’s personal protection. This piece provides recommendations for mitigating a CISO’s risks, including tips on retaining a personal attorney. The CISO Role: A Landmine of Potential Risks Today’s CISOs may find themselves increasingly concerned about potential legal liability.
2024 Security Budget Benchmark Report: Key Findings
Amidst global economic and geopolitical uncertainty, markets are jittery, companies are spending frugally and investors remain cautious. Security budgets are also affected by these realities, with most budgets remaining flat or increasing modestly. Situations of significant budget and staffing growth typically occur in response to external risks or the evolving maturity of the security function.
How to Approach DLP as a Process to Drive Business Value
Data Loss Prevention (DLP) is a critical tool to help organizations mitigate the risk of malicious or accidental data leaks. This piece emphasizes the importance of understanding DLP business drivers, the evolving technology landscape and the processes behind these tools to maximize their value. This piece also delves into new areas, such as DLP’s role in the context of generative AI and the remote workforce. Planning a DLP Deployment Successful DLP programs start with planning.
Vendor Consolidation: Identifying Overlaps and Maximizing Value
As organizations are increasingly asked to do more with less, now is a great time to explore cybersecurity consolidation both with vendors and the tools and services they provide. Your own relationships with vendors are shaped by economics, driving you to accumulate vendors over time to a point where costs can be significant.
Understanding the Evolving Privacy and Regulatory Landscape
The acceleration of digital transformation initiatives has rendered traditional security architectures, tools and techniques ineffective against the modern adversary. New privacy regulations are forcing organizations to review their data collection and management processes to minimize the data they manage. They also tend to impose stricter data-sharing requirements as well. This piece explains how cybersecurity laws and regulations especially in privacy are evolving to reflect this new reality.
Evolve Security Architecture: Prep for the Future
Organizations are changing the way security architecture factors into IT operations and engineering design, requiring a stronger focus on broad governance, cloud and DevOps workflows, automation and more. This piece explains how the security architecture function is evolving and the key initiatives to put in place now to better prepare the team for the future.
Build an Effective BCDR Plan for the Cloud
Business continuity and disaster recovery (BCDR) are more successful with top-down enforcement, starting with the board and the executive team, as well as key stakeholders held accountable for their respective pieces of the program. This piece details BCDR best practices when migrating to the cloud to ensure recoverability and continuity. Planning for Cloud Platform Failure Cloud platforms have tremendous resiliency, but nothing is completely fault tolerant.
RSAC 2024: Key Takeaways and InfoSec Trends
IANS was a research partner and our Faculty presented during multiple sessions at the 2024 RSA Conference in San Francisco. RSAC is the central meeting place for the cybersecurity community, with more than 500 sessions and 40,000 security professionals and luminaries in attendance. Nick Kakolowski and Gina Glendening, two of IANS’ senior research directors, and Mark Clauss, chief product officer, were there and are now sharing their reflections on RSAC 2024. 1.
Why Building a Cloud-Specific IR Playbook is Critical|IANS Research
Numerous Snowflake customers have reported cybersecurity incidents over the past weeks pointing to Snowflake as a likely nexus in the incidents. Separately, the threat actor group claims it breached Snowflake’s network and had access to hundreds of customers. Although Snowflake denies this claim, researchers have viewed sample data from the threat actor group and attested that it appears to be legitimate.
Tips to Negotiate Higher Pay
Current market conditions make it difficult to make a job switch. There are fewer open positions than in previous years, and hiring managers and internal teams take time to navigate this unique talent market. Here are tips from IANS and Artico Search to help CISOs and security leadership improve their current compensation and position themselves strongly for new opportunities. Vocalize the risk to the security posture of underpaying staff A security executive is inherently a risk executive.
Prioritize Security Projects for Leadership: Build a Risk Impact Matrix
An effort vs. impact analysis provides visibility into the value associated with the operational requirements of a security project. This allows for dynamic prioritization of initiatives as priorities and capabilities change. This piece provides an effort vs. impact template you can use to assess risks and threats relative to the work needed to address those issues.
Tips for Advancing Your GRC Program
Building out a governance, risk management and compliance (GRC) program requires controls and frameworks to push consistency, build inventories and standardize processes. You need to engage with compliance, security, IT, finance and more to build a cross-functional task force. This piece provides steps to flesh out your GRC program using key components of risk management.
IANS Faculty 2024 Cyber Predictions: Security Market Hiring Trends
Cybersecurity was not spared from the inflationary pressures and economic instability during the past year. Budget, staff and hiring cuts were made in various enterprise areas. As the year begins, IANS Faculty members take center stage to offer their thoughts on the trending topics in InfoSec for 2024. In this short video clip, IANS Faculty member Olivia Rose discusses what these cyber budget cuts and related hiring trends mean for your security program.
Address the Top 6 Objections to Zero Trust in Healthcare
Implementing zero trust is difficult in any environment, but healthcare organizations, especially those involved in patient care, tend to find it particularly challenging. This piece details six common stakeholder objections to implementing zero trust in the healthcare sector and provides some effective strategies for overcoming them.
Why Building a Cloud-Specific IR Playbook is Critical
Developing incident response (IR) playbooks specifically for the cloud is critical for all organizations with assets deployed in PaaS and IaaS cloud environments. Because cloud environments have unique assets, services, event types and controls, security teams need detection and response playbooks that align with the actual environment, which often differs significantly from on-premises infrastructure.
AI Governance: Tech Problems Without Tech Solutions
This piece is part of our ‘Faculty Focus' series, an interview-style article where a member of the IANS Faculty shares firsthand, practitioner-based insights on an infosec topic. In this feature Alex Sharpe discusses common AI adoption challenges for organizations and provides guiding principles to craft AI governance strategy. Alex Sharpe is a long time Cybersecurity and Privacy expert (+30 years) with real world operational experience.
Use NIST to Secure Baseline Configurations and Mitigate Risk
Multiple NIST standards allow for tailoring, i.e., changing the effects or prescriptive nature of a control based on a risk assessment of the specific vertical or other factors. NIST’s secure baseline standard (SP 800-128) explicitly calls out the use of risk assessments to tailor baselines and configuration monitoring. This piece details how to modify secure baseline configurations to account for risk and improve efficiency.
Ensure a Smooth Transition to New Security Leadership
Planning for expected and unexpected security leadership transitions is essential to maintaining a comprehensive infosec program. This piece explains the importance of good succession planning and documentation to help ensure the program remains effective, even in the face of unexpected leadership turnover.
The Role of SBOMs, Segmentation and Access Controls in Supply Chain Security
Reducing supply chain risk requires visibility, provenance and security. This piece explains how a software bill of materials (SBOM), segmenting and restricting access, can help secure the supply chain. Supply Chain Risk for Enterprises Every organization, large or small and regardless of vertical, is susceptible to supply chain risk—aka the idea that malicious code or objects can be introduced to your software upstream in the software procurement workflow.
IANS Faculty 2024 Cyber Predictions: Storm Attacks and Ransomware
Nasty ransomware and storm attacks plagued organizations during the year, and no one was immune -even casinos, a prime target for financially motivated attacks. Storm attacks released a dangerous security bug that enabled paralyzing supply chain damage to downriver targets. As the year draws to a close, IANS Faculty members take center stage to offer their thoughts on the trending topics in InfoSec for 2024.
Leadership Compensation Negotiation Checklist
This checklist combines real-world experience from security leaders as well as market-based insights from cybersecurity recruiters to help leadership negotiate an optimal compensation package. Leadership Compensation Negotiation Checklist Leverage your recruiter’s negotiating knowledge Discuss your ‘wants’ and ‘nice to haves’ with your main recruiter Team with them to understand components of your offer, especially detailed items like complex equity packages Tip: Find the right search partner.
CISO Challenges in Data Security: Best Practices for Privacy Compliance
As part of Data Privacy Week, IANS Faculty offer tips and insights focused on data integrity to ensure that policies are in place that manage, control and protect both personal and organizational data. In this feature, Rebecca Herold discusses common privacy and new data protection legislative challenges and provides best practices to make the compliance process much more efficient and effective.
Determine the Cost and Impact of a Security Breach
The financial effects of a data breach can range from losses due to business disruption and data exposure to regulatory fines, brand impacts and legal costs. This piece highlights the differences between security incidents and breaches and provides a process for determining breach costs specific to your organization. Security Incident vs. Breach: What are the differences?
SEC Cyber Disclosure Requirements: CISO Summary Checklist
The SEC has adopted new regulations that require publicly traded companies to disclose “material” cybersecurity incidents within four days, as well as make periodic disclosures around their cybersecurity risk governance. The new rules take effect on December 18, 2023. This piece summarizes the key SEC regulations and corresponding requirements outlined in the new rule to help CISOs and security teams gain compliance efficiently.
Market Salaries for Top Infosec Leaders: 2023 Security Org and Comp Report
In this piece, we're highlighting findings from our 2023 Security Organization and Compensation Benchmark Report around functional leadership compensation to help CISOs in their organizational decisions and in talent recruitment. This edition of the annual survey, jointly fielded with Artico Search, featured objective data from over 660 CISOs on compensation for seven—dedicated and full-time—security functional leader roles, one level down from the CISO.
InfoSec Org Design Guidance: Benchmark Report is Live
For CISOs, building and refining the cybersecurity organization is an ongoing responsibility and includes the timing of new functional leadership hires of the caliber befitting of their security agenda. Challenges are common for CISOs making org and staffing decisions for a dynamic organization influenced by market conditions, growth objectives, acquisition strategies and regulatory changes.
Tailor Your Definition of ‘Incident’ to Your Organization
For such a widely used and accepted term, it’s surprising to find so many different definitions for “incident” in cybersecurity. There are a great many ways we can define the term, and that can have a big impact—not just on how we count our own incidents, but in how we apply resources to them as well. This piece explains the importance of prioritizing what matters most to you, while recognizing the definitional inconsistencies when comparing numbers across the industry.
Gain Key 2023 Budget Insights: Security Budget Benchmark Report
Cybersecurity budgets were not immune to the global macroeconomic uncertainty and recessionary fears of 2022 – 2023; however, their impact was moderate compared to the widespread budget and staff cuts seen in other areas, particularly IT. To uncover the specifics of recent annual security budget developments, IANS Research and Artico Search jointly fielded their fourth annual Compensation and Budget Survey in April 2023.
Why CISOs Need D&O Liability Insurance Coverage Now
Directors and officers (D&O) liability insurance covers the directors and officers of a company against lawsuits alleging a breach of duty. This report explains the importance of D&O insurance for CISOs and offers tips for getting leadership buy-in. CISOs’ Liability Increases with Increased SEC Regulation The possibility of a lawsuit arising from a cybersecurity incident [link to: Defining a Security Incident vs Event: When to Report] is nothing new.
Public vs Private API Security: Use a Three-Step Approach
API abuse is currently the most frequent attack on the internet, and most cloud-related breaches occur due to misconfiguration. When considering API security, options, consider how reachable they are from public-facing internet. The threat profile of public-facing API access versus internal access means that an extra level of security on more reachable systems is a good general best practice. It’s important to keep development, deployment, and ongoing operations as simple as possible.
Understand First- and Second-Gen SAST: Guidelines for the Best Choice
First-generation SAST tools require large investments in time and resources, but when they’re placed in the right hands, they tend to catch most issues. Second-gen SAST is cheaper, quicker, and easier to use, but it can miss some vulnerabilities. This piece explains the main differences between first- and second-gen SAST tools and helps you determine which will work best for your environment.
Guidance to Create a PSIRT that Improves Incident Response
A product security incident response team (PSIRT) identifies, evaluates and coordinates responses to the security vulnerabilities and incidents in the products an organization develops and/or manufactures. A traditional cybersecurity incident response team (CSIRT) protects the organization’s infrastructure, and the PSIRT maintains the products themselves. Although the core focus of each team is different, there are many similarities in establishing and running these capabilities and teams.
Defining a Security Incident vs Event: When to Report
Security incidents are events that fall outside the range of normal operational noise, surpass a pre-defined threshold and/or have a negative impact on the overall security posture of the network, data, systems or organization. A computer security incident is an accidental or malicious action or event that has the potential to cause unwanted effects on the confidentiality, integrity and availability (CIA) of an organization’s information and IT assets.
Guidance to Improve Patching and Vulnerability Management
The core idea of patching timelines is very old and is based on the idea that vulnerabilities should be addressed in a priority order. This pattern was then picked up by the PCI standards which became a common requirement. However, the technical drivers behind the pattern have changed and it is time for practices to change as well.
CISO Traits Essential for SEC Board Readiness
With the SEC finally voting to adopt new cyber rules for publicly traded companies, the materiality of cyber risk was further emphasized. Cyber knowledge and disclosure in the business is the priority, however, the board’s role in cyber oversight along with the need for CISO expertise on public boards cannot be overlooked.
Gain Privacy Program Buy-In: Use Best Selling Leadership Points
Business leadership often views privacy programs as costly efforts with little return, but the changing regulatory environment makes a focus on privacy more imperative now than ever. The good news is the adoption of a cybersecurity framework (CSF) along with a complementary privacy framework can ease the process and gain leadership buy-in by leveraging existing processes/policies and fostering efficiencies.
Error Handling and Logging Checklist
Proper error handling is part of making a high-quality software system and assists in hardening our systems to attack. Logging assists not only in debugging, but when investigating security events and incidents. This piece features a timesaving checklist which establishes a universal list of error handling and logging requirements to facilitate use in all web applications, APIs and other software systems.
How to Develop a More Holistic Risk Management Program
A Strategic Guide to Maturing Your Risk Management Function A more-holistic risk management program that examines risk from cradle to grave adds a quantitative approach to its qualitative one. More mature programs will add classification of assets, rating assets by importance. This allows correlation between high-risk and high-value assets. The current state-of-the-art approach is cyber risk qualification (CRQ), which is decision analysis applied to cybersecurity risk management.
Microsoft Defender for Endpoint Settings Checklist
Consider boosting security posture by enabling and tuning a wide variety of Microsoft Defender for Microsoft Defender for Endpoint settings for Windows workstations and servers. Additionally, a set of more advanced security controls and policies should be enabled for privileged users like the information security team (and, possibly, IT operations teams) as soon as possible, and then later for most systems after extensive testing.
IANS Summer Reading List: Cool Faculty Cyber Books to Check Out
We’ve asked our IANS Faculty community to share some of their current book releases that not only entertain but fine-tune your security know-how. Here’s a list of just some of our IANS Faculty must-reads running the gamut from Star Wars Threats to Zero Trust.
Join IANS Faculty at Security Summer Camp in Las Vegas, Aug 7-10
Are you heading out to Vegas next week along with much of the security community? Join us at our Security Summer Camp from Aug 7-10 (no bug spray needed) to hear from several of the IANS Faculty at the Mandalay Bay Resort. Meet, mingle or dine with IANS Faculty and your peers to hear leading insights from our infosec experts during breakfast, happy hour, poolside or dinner events.
Reporting Meaningful Security Metrics to Leadership and the Board
There are two main classes of security metrics and two personas that consume metrics. Those classes are deployment-based and risk-based. You can use these two classes of metrics to communicate with the C-suite by mapping your key security capabilities to objects like threats or possibly things like NIST Cybersecurity Framework (CSF) functions. This piece sheds light on each metric and persona and how to get started measuring for each.
New SEC Cyber Rules: What to do Next
July 28, 2023 | By IANS Research After several months of anticipation, the SEC finally voted to adopt new cyber rules for publicly traded companies. This piece provides a high-level summary of the rules and advice for CISOs on next steps. SEC Cyber Rules The SEC has voted to adopt new rules requiring publicly traded companies to enhance and standardize disclosures of ‘material’ cyber incidents.
Passwordless Authentication in Enterprises: Metrics and Milestones for a Seamless Deployment
July 27, 2023 | By IANS Faculty less successfully within large organizations can be difficult—and difficult to measure. This piece explains how to set appropriate goals and measure progress when implementing passwordless authentication. Passwordless Authentication for Enterprises Passwordless is a relatively new advancement in authentication, so it is challenging to develop appropriate passwordless deployment timelines and success metrics.
Resonating with Leadership: Creating Security Metrics for Budgeting and Decision-Making
Creating metrics to support budgeting and decision-making requires a focus on threats, losses and return on controls (ROC). This piece explains how to use a cyber-risk quantification (CRQ) process to create cybersecurity metrics that resonate with the board and senior leadership. What is Cyber-risk Quantification? The ideal approach for creating metrics that inform decision-making with an emphasis on budgeting is called cyber-risk quantification.
Guidance for CISOs Pursuing Board Positions
July 18, 2023 | By IANS Research The new SEC Cyber Rules requiring public companies to disclose the cybersecurity expertise of members of the board of directors open up new opportunities for CISOs interested in corporate board director roles. In this piece we're highlighting findings from our CISOs as Board Directors, CISO Board Readiness Analysis.
How to Select the Right DAST and SAST Tools
This piece is part of our ‘Faculty Focus' series, an interview-style article where a member of the IANS Faculty shares firsthand, practitioner-based insights on an infosec topic. In this feature, Tanya Janca discusses how to select the right DAST and SAST tools for your organization. Six questions with IANS Faculty member Tanya Janca Tanya Janca is the best-selling author of ‘Alice and Bob Learn Application Security’.
A Strategic Guide to Maturing Your Risk Management Function
When maturing a risk management function, start by identifying value at risk in terms of data, service availability and cash. From there, map the relevant threats to exposed value—the value that matters. Last, consider the controls with the highest value (i.e., “return on control”) across those threats. This piece provides guidance to ensure your risk management program focuses on the right priorities as it grows and matures.
Understand Code Integrity Risks for LLM-Produced Content
The copyright and intellectual property risks that enterprises inherit through using code engines powered by Large Language Models (LLM) is currently tremendous, and organizations should avoid allowing developers to use LLMs for core technologies. We suggest implementing strict guidance to all LLM users about the confidentiality risks that are associated with the use of LLMs and create policies, processes and controls for sensitive data.
Guidance to Mature Your Threat Modeling Program
For those just starting with threat modeling, try starting small and targeting low-hanging fruit as you begin integrating it into the security development lifecycle. As your program develops, we suggest moving from ad hoc models to reproducible assessments. Threat modeling requires resources; be ready to assign team hours to this process.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with IANS
Contact IANS, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack