Security Manager's Journal

Recent Security Manager's Journals

Security Manager's Journal: You Can't Secure Every Home
By chance, our manager discovers that unauthorized network access from remote PCs at employees' homes and elsewhere has been widespread.

Security Manager's Journal: BYOD Planning Gets a Boost
A virtual desktop infrastructure will be the security key to reaching the CIO's goal of allowing personal devices on the corporate network.

A Rush to Judgment on DLP
Our manager has just gotten funding for data leak prevention added to his current budget. But that budget expires in a few weeks.

Sensitive Data, in the Wild
It isn't easy to stop your employees from posting things they shouldn't on social media and file-sharing sites.

Security Manager's Journal: Why would a company not spring for Cadillac security?
Too many corporate decision-makers think it's wise to shore up only the most glaring security weaknesses. But attackers will always be able to find the weaknesses you decided you could live with.

Spending a $10K Windfall Wisely
When you're suddenly offered an unexpected sum to spend on security quickly, you say yes first and figure out how to invest it later.

Security Manager's Journal: Sometimes even managers get their hands dirty
When you have a skeleton crew but a long list of things that need to get done, it just makes sense to do them yourself.

Getting the Most Out of SIEM
The CIO isn't convinced about the value to be derived from investing in a security incident and event management tool. Time to think outside of the box.

Security Manager's Journal: The bad guys are in the house
New IDS detects something horrifying.

Assessing the Company's Apps
A third party peers at our manager's Web-based applications and finds several problems.

Keeping the DMZ Safe
A security manager has to be vigilant about what goes into the exposed portion of the company network, and he has to make sure it's all configured correctly.

Security Manager's Journal: New economic woes lead to deep cuts
Needed security projects get the ax. Can layoffs be far behind?

Security Manager's Journal: Shrinking IT staff leaves security projects in the lurch
Newly purchased security products aren't going to deploy themselves.

The Perils of Enterprise Search
First and foremost, you have to make sure you don't compromise the rule of least privilege.

Security Manager's Journal: Sometimes nothing gets done if you don't do it yourself
Our manager's growing IT department has a lot of new managers, and they want to oversee the actual implementation of security projects. But very little implementation is actually taking place.

Cloud Storage Gets the Ax
None of the SaaS storage vendors at this point have implemented adequate safeguards that will keep corporate data safe.

Security Manager's Journal: Not even security managers immune to FakeAV infection
This insidious malware is hard to root out, which is why it's making a lot of money for its distributors.

Tracking the ROI on SIEM
The company's limited deployment of a security information and event management tool is paying off. But now it's time to convince the CIO and CFO that the payoff is real.

When Email Gets Hacked
An executive's webmail account is compromised, and it contains plain-text passwords for corporate apps.

Security Manager's Journal: Software security comes down to checking inputs
Our manager is surprised how little his company's developers know about making their software safer.

Keeping Our Code Safe
Our manager's company has shockingly little oversight on the security of software code written for it by third parties.

Security Manager's Journal: Helping out the in-house developers
They're working on a Web-based service and want to build in the authentication capability. But why not just use Active Directory?

Developing a Metrics System
Quarterly reports to the CIO will keep him aware of risks in the environment, and hopefully will reduce those risks.

Firming Up Firewall Protection
Our manager's company is trying out the latest generation of firewalls, which offer some exciting possibilities.

Security Manager's Journal: Security that doesn't get in the way
The RSA conference and Disneyland both demonstrate ways that it can be done.

Getting a Handle on Our Data
Improved data handling should be an easy win for our manager, who is especially excited about the opportunity to better protect his employer's intellectual property.

Dangers Under the Rocks
A security manager in a new job is like a gardener assessing the threats that lie below the rocks.

Security Manager's Journal: SOX giveth as well as taketh away
The Sarbanes-Oxley Act is a costly compliance nightmare, but it can help a security manager get what he needs sometimes.

Stopping Stupid Human Tricks
Widespread use of SaaS apps at our manager's new company makes it essential to raise employees' awareness of security risks.

Security Manager's Journal: Coming through for the business
Our manager finds a way to enable iPhones and Android devices to be used on the corporate network.

Buried in SIEM Configuration
The first rule in deploying a security incident and event management tool: Don't make assumptions.

Tightening Up SaaS Security
Our manager's new company uses more 30 SaaS apps, a situation that opens many doors to potential data compromise.

Security Manager's Journal: Assessing the plan for the new year
Our manager ends his first year at his new company ahead of the strategic plan, but challenges always await.

Heading for the Clouds
Our manager wanted a new challenge. His new job at a company that is offering software as a service fills the bill.

Spying, or Something Innocent?
When a log indicates that two high-level executives logged into a tool that they shouldn't mess with, it's time to investigate.

Keeping Things Simple for NAC
The first step toward deployment of network access control is to set up a network segmentation model.

Looking Gift iPads in the Mouth
Our manager's company celebrates stellar earnings with free iPads for everybody, but can all those personal devices be allowed on the network?

Incident Shows IP Still at Risk
Event management software could help, but it's expensive and resource-hungry.

Offshoring: What Can Go?
Our security manager is willing to outsource some things, but others are simply out of the question.

E-mail Shortcut Sounds Alarm
A look at the company's intranet chat board leads to the discovery that employees are getting around the VPN.

Security Manager's Journal: The need for real security in a virtual world
Virtualization, cloud computing and SaaS all carry their own security challenges.

It All Comes Down to Patching
You may have an extremely sophisticated security program in place, but it's all for naught without patch management.

Virtual PCs Need Real Security
The CEO thinks a virtual desktop environment will lessen the burden of PC support costs. But how will it affect security?

iPad Intro Brings a Nasty Surprise
Our manager's company hasn't bought any iPads. So, why are so many of them suddenly on the network?

Security Manager's Journal: Two new rollouts boost security of all company laptops
For the first time, every PC in the company is getting regular backups, and all the data on those laptops is now encrypted.

Initiative Crashes Into Security
The security manager misses one meeting, and all of a sudden the company's intellectual property is about to be put at risk.