Organizations More Fearful of Auditors Than Hackers

March 18th, 2008 Anthony Towry

An article by RSnake at DarkReading.com opens up discussion on where compliance and regulation is carrying the corporate attitude toward security.

Failing to pass audits significantly impacts the c-level of an organization.  Which in turn affects the value of the organization.  The idea is that in the end, this sort of breakdown in security can be more damaging than getting owned by some hellbent hacker.

I wonder how many organizations are including compliance weights appropriately in their risk management strategies.

Posted in Management, Security | No Comments »

Web Application Firewall Evaluation Criteria

February 10th, 2008 Anthony Towry

The deadline for the PCI Data Security Standard requirement for securing web applications against known attacks is effective June 30, 2008, currently the recommendations are only "best practice". Which leaves just over four months to address your organization's card holder environment web application security needs. Read the rest of this entry »

Posted in Programming, Security | No Comments »