Data are a very decisive resource for any business due to shielding; regularly auditing the database should never be left to chance or patchwork solutions.

Today, most organizations continue to rely on a traditional approach to risk management. Such an approach is built on stovepipe-oriented risk management, in which the focus...

Any organization would like to have an optimal approach to a Sarbanes-Oxley Act review, whether it is the process used or the Sarbanes-Oxley review team's composition.

The big data1 craze has taken the industry by storm. With the advent of cost-effective technologies and solutions for longer-term storage of vast amounts of transaction data, more and more companies are investing in keeping more and more data for longer and longer periods.

As enterprises increasingly rely on IT to succeed, effective IT risk management has become an essential component of IT governance.1 In conjunction with this, there are various studies to address risk through the software development life cycle,2 while others are interested in risk in the production environment.

Service resilience has gained a lot of importance in recent years. A resilient service is one that is capable of withstanding major and minor disruptions caused by natural and man-made sources.

The number and complexity of cyberattacks has been increasing steadily in recent years. The major players in today’s cyberconflicts are well organized and heavily funded teams with specific goals and objectives...

A pessimistic prediction for the future of the RSA Conference, the somehow unfair public judgment of security agencies, the possibility of hacking a papal election, how to become a security expert...

COBIT 5 establishes a governance layer and does a good job of capturing stakeholder needs, driving enterprise, IT and enabler goals. COBIT 5 fosters the use of balanced...

Organizations maintain their operations with the help of processes that differ according to their organizational structure, business objectives and working styles.

Understanding who owns data is not as simple as it appears at first. It is easy to say that all data belong to the organization. This is correct, but it does not identify accountability for such ownership.

Over the past few years, there has been a shift in the business world pertaining to assets that need to be protected. The digital world has brought with it complexity in terms of...

Considering that the issue of fire protection in computer rooms is not specifically addressed in many national regulations, the US National Fire Protection Association (NFPA) Standard for...

Managers looking for a strategy to comply with the US NIST Cybersecurity Framework requirements for response and recovery should give due consideration to Cyber DRaaS.

Business and security teams alike have seen breathtaking changes over the last few years with the rise of a digital universe that is global, social, mobile and interconnected.

Reinspecting Windows sounds like reinventing the wheel, but reviewing password policy, account lockout policy and audit policy proves that auditing is not a one-time exercise; rather, it, must be...

The internal audit and information security functions should play complementary roles in an organization’s information security program.

With the advent of the latest wave of information technologies such as big data, social media, technologies as a service and the cloud in general, it is worth taking the time to revisit the basics of IT audit.

So many times, auditors of all types use a computer-generated report to perform some aspect of assurance. For example, financial auditors may pull a computer-generated list of accounts receivable ...

Protecting digital assets and intellectual property (IP) is becoming increasingly challenging for organizations. Looming patent challenges and court battles to claim ownership of IP illustrate the...

Almost all organizations are now dependent, one way or another, on information technology. This has led to a great deal of development as well as associated risk.

A fundamental part of an information systems (IS) audit and control professional’s job is to identify and analyse risk. Furthermore, risk factors need to be stated clearly and concisely to support effective management of risk.

Organizations should establish and implement an organization wide fraud risk management framework that integrates counter fraud capabilities through organization and governance.

Auditors should consider key risk and control points when performing privacy audits. The following methodology draws heavily on concepts presented in ISO 31000:2009 Risk management—Principles and guidelines.

Cloud-based services are on the rise. According to recent publications, the cloud is the future for the provision of a wide range of IT services.

Fourth-generation Long Term Evolution (4G LTE) is a broadband wireless data technology designed to offer users access to technology-agnostic across carriers and geographic regions.

Supervisory control and data acquisition (SCADA) systems are rapidly changing from traditional proprietary protocols to Internet Protocol (IP)-based systems.

Seven Mistakes Being Made in SIEM and How to Fix Them. A foundation for evaluating and implementing essential security control solutions against cyberattacks.

IT governance is an area in which IT and non-IT executives need to communicate at least with a basic understanding of each other’s positions.