HomeResourcesNews and Trends

It's All Right Here!

All of ISACA's timely and industry-leading articles, blogs and podcasts, in one place.

Layout

List Layout Card Layout

Filters

Article Type

Domain

Credentials

Subjects

Product Type

Level

Language

15 of 4501 Results

Richard Beck
Blog Post

When Intelligence Becomes a Controlled Capability

As frontier AI systems grow in capability, governments are viewing them as strategic assets that impact cybersecurity, intelligence, economic competitiveness and national security.

13 July 2026
Jon Shende
Blog Post

The AI Intervention Layer: From AI Proof to Runtime Control

Effective artificial intelligence governance amid a complex threat landscape calls for decision-capable enforcement at runtime.

10 July 2026
Iftikhar Javed
Blog Post

The Browser Is the New Security Enforcement in Hybrid Work

The perimeter has evolved into a dynamic, user-defined construct, but there are key steps security practitioners can take to keep pace.

7 July 2026
Online exclusive banner promoting a free download offer.
ISACA Journal Article

Strengthening Supply Chain Security From Vendors to Dependencies

Enterprise systems must be managed to ensure that vendor compromise does not become organizational compromise.

Author: Akanksha Chaturvedi
Massimo Migliuolo
@ISACA Article

2026-27 ISACA Board Slate Includes New Chair Massimo Migliuolo

The 2026-27 ISACA Board will be recognized on 22 July at ISACA’s Annual General Meeting.

6 July 2026
Three colleagues at a table
@ISACA Article

Five Strategies for Utilizing CPE for Impactful Professional Development

Discover how five ISACA community members uniquely approach earning CPE credits, transforming a compliance requirement into a pathway for career growth and professional development.

6 July 2026
Thomas Bell
Blog Post

Making AI-Powered Audits Understandable: A Practical Guide Using COBIT EDM05

While AI is rapidly transforming internal audits, promising faster insights and broader coverages than traditional audit approaches, many stakeholders don't fully understand how AI works or why they should trust it.

6 July 2026
Adedayo Ojo
Security Article

Preparing Zero Trust for AI Disruption

Explore how AI disrupts zero trust architecture and gain strategies to secure expanding machine identities and automated decisions amidst evolving technologies.

6 July 2026
Safia Kazi and Jake Bernardes
Podcast

Why You Should Use the F Word More

FedRAMP 20x is redefining what federal compliance looks like. Designed to modernize the authorization process, this bold initiative is moving cybersecurity governance toward automation while reducing the lengthy timelines and documentation burdens that have traditionally defined FedRAMP.

6 July 2026
Sapna Paul
Blog Post

Vulnerability Is Not a Bug: It’s a State of Being

The moment we treat vulnerability as a checklist item to close instead of a condition to continuously manage, we are asking for trouble.

2 July 2026
Ali Nouman
Blog Post

The CISO vs. Shadow AI Cold War

Organizations' biggest artificial intelligence risk may not be the model, but how shadow AI is being adopted across the enterprise.

1 July 2026
Blue and pink circuit lines and squares
ISACA Journal Article

Information Security Matters: Tomorrow’s Problems Today

Quantum computing may not be fully realized, but it is already impacting information security.

Author: Steven Ross
An illustration of an open padlock, with a circuit board design
ISACA Journal Article

The Digital Trust Imperative: A Focus on Data Privacy

Data privacy is an integral part of digital trust. Organizations must act wisely to improve it.

Author: K. Brian Kelley
An illustration of a padlock on a blue background
ISACA Journal Article

Privacy in Practice: Debunking the AI vs. Privacy Dilemma

As technology evolves, innovation must happen in a safe and responsible way.

Author: Safia Kazi
Abstract image of blue and purple light streaks against a dark background
ISACA Journal Article

Practitioner’s Corner: Modernizing Risk Governance Through SaaS GRC Platforms

Selecting a SaaS GRC platform should be an exercise in organizational clarity.

Author: Jack Freund
Load More
Cover of "The Art of the Mind," featuring abstract artwork and the title in bold typography
ISACA Journal Article

Combating Bias in Learning Models

When models generate unfair outcomes, the consequences are more than just theoretical.

Author: Ashwathama Rajendran
A network of interconnected locks and dots displayed on a dark background, symbolizing security and connectivity.
ISACA Journal Article

Reimagining Data Loss Prevention in Healthcare and Manufacturing

Healthcare and manufacturing are built around a critical operational asset: data.

Author: Nnamdi Nwosu
Blue fiber optic lines illuminated against a dark background, creating a dynamic and futuristic visual effect.
ISACA Journal Article

Addressing Control Gaps in Agentic AI Governance

While it is still too early to define agentic AI governance standards, several clear needs have surfaced.

Author: Nik Kale
A symbolic key labeled "Key to the Future," representing opportunities and potential for growth and innovation.
ISACA Journal Article

Revising Cryptographic Standards and Managing Long‑Term Data Risk

When cryptographic standards change, the effects ripple far beyond the security team.

Author: Ankit Gupta
Cyber lock
ISACA Journal Article

Certified Compliant, Demonstrably Vulnerable: Shifting from Policy Review to Behavioral Stress Testing

Systems exhibiting compliance during testing can fail dramatically under realistic use conditions.

Author: Rupinder Pal Singh
Abstract digital background with interconnected blue and red squares and lines
ISACA Journal Article

The Impact of Risk Culture and APTs on Federated Organizational Structures

A federated operating model is viable, but requires a strong technology risk culture.

Author: Adeline Chan
Abstract digital background on dark blue background
ISACA Journal Article

Using IAC to Improve Governance and Reduce Cloud Risk

IaC empowers organizations to incorporate security and compliance requirements within their workflows.

Author: Taiwo Justice Olorunlana
Richard Beck
Blog Post

The Grey-Zone Threat to AI Sovereignty, Subsea Sabotage, Connectivity and National Security

In an era of intensifying geopolitical competition, the sea is an often overlooked domain where matters of economic security, national resilience, technological advantage and state power overlap.

30 June 2026
Hussam Khattab
Blog Post

Not Yet in the Boardroom, and Why That Is Exactly the Point

The value of voluntary work might lead to immediate rewards, but the cumulative effect of volunteering eventually becomes transformative.

29 June 2026
Hannah Hunt
Blog Post

Recognizing Excellence and Encouraging Future Generations: 2027 ISACA Awards Nominations Now Open

Nominations for the 2027 ISACA Awards are open, providing the opportunity to recognize those who have made outstanding contributions to the ISACA professional community.

25 June 2026
Ts. Alan Yau, Director, Technology & Cybersecurity Leader, ALE Advisory, M.Sc., CISA, CISM, CGEIT, CRISC, CDPSE, AAISM, AAIA, AAIR
Blog Post

How ISACA’s Advanced AI Credentials Support the Three Pillars of Responsible AI: Risk, Security and Assurance

ISACA's Advanced in AI Risk (AAIR), Advanced in AI Security Management (AAISM) and Advanced in AI Audit (AAIA) certifications provide three complementary perspectives that organizations need to adopt AI responsibly.

24 June 2026
An illustration depicting the transformation of the digital landscape
ISACA Journal Article

A Governance-Driven Approach to Secure Data Management in Manufacturing

Securing data is a key component of stakeholder trust and operational reliability in manufacturing.

Author: Nnamdi Nwosu
CMMI AIM
Blog Post

CMMI AIM Provides Path for Responsible AI Integration

The new CMMI Artificial Intelligence Maturity (CMMI AIM) model provides a structured path for organizations to integrate AI responsibly and effectively.

23 June 2026
Theresa Payton
Blog Post

Ten Bonus Questions with Theresa Payton

ISACA Conference North America keynote speaker Theresa Payton shares her perspective around cybersecurity and AI metrics, upskilling employees, preparing for quantum computing threats, and more.

22 June 2026
Maman Ibrahim
Blog Post

When AI Joins the Party, Vulnerability Backlogs Become Fiction

A clean vulnerability backlog is not necessarily a sign that an organization is well prepared to thwart cyber attackers.

18 June 2026
ER Kritka
Blog Post

Neural Data as a Cyber Kill Chain Enabler: Redefining Data Classification and DLP for the Neurotechnology Era

The attack surface within an enterprise has increased in a manner that most governance frameworks did not envision. With organizations moving to deploy neurotechnology at scale, they are creating a type of data that their current classification schemas were not designed to deal with.

17 June 2026
A futuristic digital landscape featuring advanced technology, holograms, and interconnected networks.
ISACA Journal Article

Operationalizing COBIT® for AI-Enabled Financial Guidance

COBIT, in conjunction with evolving oversight, can be a powerful tool for authorizing AI-enabled advisory systems.

Author: Erik Jensen
Richard Beck
Blog Post

The Unwitting Accomplice Behind the Modern Insider Threat

Artificial intelligence agents, copilots, orchestration frameworks, autonomous workflows, machine identities, and more operate with trusted access across enterprise environments, resetting the insider threat landscape.

16 June 2026
Anand Janja
@ISACA Article

From Documentation to Execution: Rethinking GRC for Continuous Authorization and Zero Trust

Most governance, risk and compliance (GRC) programs are built for a world where systems changed slowly. That world no longer exists.

15 June 2026
Mark Thomas
@ISACA Article

Thirty Things COBIT Taught Us About Governing Technology

Explore 30 key lessons from 30 years of COBIT's influence on technology governance, highlighting strategic insights and real-world applications for managing technology as a vital asset.

15 June 2026
2020-volume-4
Privacy Article

Privacy Risk Management: A Shield in the Age of Big Data

Learn about privacy risk management strategies to ensure compliance, protect personal data, and build trust.

12 June 2026
Julie Chatman
Blog Post

CMMC as a Business Design Decision, Part 3: Measure What Leadership Cares About

Explore key metrics that help to connect CMMC to business outcomes that resonate with boards of directors and executive leadership.

11 June 2026
Magnifying glass
Blog Post

Unlocking Security: How a Routine Audit Transformed Secrets Management at a Multinational Conglomerate

A routine audit revealing hardcoded API keys in a multinational conglomerate's CI/CD pipeline set in motion a recalibration of their secrets management, underscoring the importance of addressing blind spots for increased security, efficiency and agility.

10 June 2026
Graphic displaying "Online Exclusive" with a padlock icon, highlighting enhanced security measures for online services.
ISACA Journal Article

The Value Proposition of TPRM in the Financial Sector

TPRM must transform from being viewed as additional overhead to a true value-add for the enterprise.

Author: Ashish Kumawat
Gabriel Oludare Fabiyi
Blog Post

The Audit Evidence Crisis: How AI Deepfakes Are Rewriting Assurance Standards

With AI creating flawless deepfakes, auditors can no longer afford to start with trust; auditors must begin with zero trust, verify relentlessly, and only then decide what can be trusted.

8 June 2026
Ramona Ratiu
Blog Post

Cyber Readiness as Competitive Advantage in the AI Era

Forward-thinking companies can leverage AI-enabled simulations and readiness programs to build robust cyber resilience.

5 June 2026
Cover illustration of a cube integrated with a network, representing concepts of connectivity and technology.
Blog Post

Blockchain Auditing in Practice: What Executives Need to Understand Now

Blockchain systems do not eliminate risk, but rather shift its location, requiring executives to understand where control truly lives in these environments.

3 June 2026
Visual of a shield with a digital padlock, illustrating the concept of cyber security and online safety.
ISACA Journal Article

The Cybersecurity Crisis of Neural Identity

In the emerging technology era, safeguarding neural data and securing cognitive function are nonnegotiables.

Author: Er. Kritika
David Foote
Blog Post

AI’s Impact on ISACA Certification Pay Premiums: Demand Growing for Governance, Audit and Risk Expertise

CISA, CRISC and CGEIT are among only 17 of 663 industry IT certifications to make Foote Partners’ “Hot List” of certifications earning well above average cash pay premiums in early 2026.

2 June 2026
A man delivers a speech on stage, facing a large crowd of engaged listeners in a well-lit venue
@ISACA Article

Five Takeaways from 2026 ISACA Conference North America

Explore insights from the May ISACA Conference North America in Las Vegas, focusing on AI and emerging tech's impact on digital trust,

1 June 2026
A computer screen displaying a stock market graph with fluctuating lines and data points.
@ISACA Article

New ISACA Resource Shares Guidelines for Measuring and Reducing Security Debt

ISACA’s 2026 AI Pulse Poll reveals a gap in organizational readiness for AI, with 90% acknowledging its use but only 45% prioritizing AI risks, highlighting security debt as a major threat to enterprise resilience.

1 June 2026
Richard Beck
Blog Post

Managing Malevolent AI Agents

Artificial intelligence agents are not secured by making them behave, but rather by ensuring that even if they do not, they are not able to cause material harm.

29 May 2026
Atish Dash
Blog Post

The Strategic ROI of Privacy-Enhancing Technologies (PETs) in the AI Era

Privacy-enhancing technologies are the business enablers that allow organizations to move faster in the era of artificial intelligence.

28 May 2026
Sriram Mani
Blog Post

Cloud Security Posture Management: The Control Plane for Modern Cloud Risk

In an era where infrastructure is temporary but risk is persistent, continuous posture management becomes a foundational element of cyber resilience.

27 May 2026
John de Santis
Blog Post

Future to Bring New Tasks, Same Purpose for ISACA Members

Professionals who keep purpose top of mind instead of focusing heavily on the specific tasks they are used to performing will be better positioned to thrive in the dynamic tech workforce of the future.

27 May 2026
Anamika Roy
Blog Post

When Cybersecurity Met Soccer: The World’s Most Beautiful Game Meets the World’s Most Complex Digital Challenges

Cybersecurity and soccer both call for reading the environment, proactively anticipating opponents' moves and making quick decisions under pressure, as well as requiring leaders who see patterns in the chaos.

27 May 2026
A digital shield symbolizing advanced cybersecurity measures for a secure future in technology and data protection.
ISACA Journal Article

Operationalizing Secure by Default Certification for Risk and Compliance Assurance

Secure by default certification can help shift security assurance upstream into shared engineering building blocks.

Author: Anunay Bhatt
Irina Olifer
Blog Post

Five Questions Leaders Should Answer Before Piloting Advanced AI or Quantum-Enabled Systems

Before organizations pilot advanced AI models or quantum-enabled systems, leaders need to address the following governance questions that determine whether the foundations for responsible experimentation are already in place.

26 May 2026
The Future of IT Audit: Key Changes in ITAF 5
Podcast

The Future of IT Audit: Key Changes in ITAF 5

Technology is transforming how organizations operate — and IT audit and assurance must evolve alongside it.

28 May 2026
Eugene Frank
Blog Post

Remembering Founding ISACA Member Eugene Frank

Eugene "Gene" Frank, a founding member of ISACA, helped lay the groundwork for decades of ongoing major growth and global impact.

22 May 2026
Alex Mathew
Governance Article

Auditing the Void: Governance Strategies for Digital Proxies in Spatial Computing

Discover how to navigate the digital frontier with cutting-edge governance strategies for digital proxies in spatial computing. Uncover insights into audit trails, identity verification, and risk management to secure virtual environments effectively.

22 May 2026
Donnie Carpenter and Matt Fangman
Podcast

Breaking the Compliance Mentality​

In today’s evolving cybersecurity landscape, strong leadership is the foundation of an effective security posture. Yet many agencies struggle when a “compliance mentality” takes hold, where meeting minimum requirements overshadows proactive risk management.

21 May 2026
Holographic lines in various colors swirl across a dark background
ISACA Journal Article

Beyond Cybersecurity: A Strategic Framework for Evolving Digital Risk

The Digital Confidence Framework can help enterprises make cybersecurity decisions that support business continuity, trust, and long-term value.

Author: Robert Putrus
A bearded man sitting at a desk, focused on his laptop while working in a well-lit office environment.
@ISACA Article

How CISM Lessons Connect to the Current Security Landscape

As the technology landscape evolves, security managers must address a threat landscape that is increasingly complex as well as calibrate their security programs to shifting business contexts.

18 May 2026
Two women engaged in discussion while looking at a computer screen together.
@ISACA Article

ISACA Research Shows AI Safeguards, ROI Remain Elusive for Many Organizations

Nine in 10 respondents to ISACA’s recently released 2026 AI Pulse Poll say employees are using AI within their organizations, yet only 22% report that AI has met or exceeded their ROI expectations

18 May 2026
Donnie Carpenter
Blog Post

Preparing for a Quantum Future: Navigating Accelerated Timelines for Secure Encryption

Conducting a risk assessment of the impacts of quantum computing on your organization would be wise in the context of recent updates to projected timelines based on new research.

18 May 2026
Julie Chatman
Blog Post

CMMC as a Business Design Decision, Part 2: Lock Your Architecture and Govern the Build

Learn how to structure your environment to protect Controlled Unclassified Information (CUI) and how to effectively govern the build to enhance CMMC success.

15 May 2026
Donnie Carpenter and Matt Fangman
Podcast

Audit-Ready by Design: How AI Powers Smarter Identity Security

In this episode, we explore how AI-driven control and automation transforms identity security from a costly headache into an audit-ready powerhouse.

15 May 2026
Richard Beck
Blog Post

Taking the Myth out of Claude Mythos

Recent discourse around Claude Mythos reinforces that the gap between discovery and exploitation is getting smaller and attack chains have become continuous.

13 May 2026
Graphic representation of the online exclusive logo, highlighting its modern aesthetic and distinctive typography.
ISACA Journal Article

Quantum-Safe Cryptography as a Governance Imperative

Quantum computing will soon test the durability of every organization’s promise to safeguard information.

Author: Kimberly E. Rich
Maman Ibrahim
Blog Post

When AI Joins the Party, Credentials Become the Weapon: Fix Access Without Slowing Delivery

Stop treating identity as a tool and instead treat it as an operating habit to effectively address access concerns without slowing delivery.

12 May 2026
Hannah Hunt
Blog Post

Pillars For Vetting Vendors for a Sturdier Supply Chain

Explore how certifications, scopes, business continuity planning and supply chain collaboration can aid organizations in preventing costly cyber-attacks and ensuring uninterrupted operations.

8 May 2026
Visual representation of advanced smart technology and devices, symbolizing the future of the Internet of Things
ISACA Journal Article

CMMC 2.0 and Supply Chain Risk: Integrating SBOM Governance Into Defense Contractor Compliance

CMMC compliance is not simply checking a box.

Author: Gnanedra Reddy
Tamim Ahmed
Blog Post

The AI Security Gap: Adoption Is Accelerating, but Response Capability Is Lagging

ISACA's 2026 AI Pulse Poll reinforces that strengthening AI governance and response capabilities is crucial to ensure trustworthy innovation and protect against emerging AI risks.

5 May 2026
A man pointing at a computer screen, indicating something of interest or importance.
@ISACA Article

Aligning Audit with the Digital Workplace

Traditional lines separating business audits and IT audits are disappearing.

4 May 2026
A woman confidently poses in a vibrant red suit, showcasing a professional and stylish appearance.
@ISACA Article

ISACA 2025 Annual Report: Advancing Expertise for a New Era

The newly released 2025 ISACA Annual Report highlights how ISACA empowers members to expand their skill sets for a dynamic future as AI takes center stage on the enterprise landscape.

4 May 2026
Jon Shende
@ISACA Article

The AI Audit Trail: From AI Policy to AI Proof

Are most organizations still treating AI governance like a documentation exercise? Still following the process of “create review boards, publish responsible AI principles, and document model selection criteria?

4 May 2026
Stephen Gilfus
Blog Post

Vanishing Boundaries: Leading Member Innovation in a World of AI, Cyber and Vibe Coding

At a time when traditional boundaries between digital trust disciplines are vanishing, ISACA is focused on driving innovation that will support members in a new era.

4 May 2026
Gaudam Suriyakala Thiyagarajan and Nivathan Athiganoor Somasundharam
Risk Article

Enhancing Third-Party Risk Management: Moving from Questionnaire Fatigue to Contextual Assurance

Explore modern third-party risk management with contextual assurance, continuous monitoring, and AI for improved decision making and resilience.

4 May 2026
White sphere surrounded by blue lines
ISACA Journal Article

Operational and Model Risk Approaches to AI Governance

AI risk must be integrated into established operational risk thinking and quantitative cyberrisk governance approaches.

Author: Jack Freund
Jack Alexander
Security Article

AI-Driven Ransomware Fuels Rise in New Cyberthreat Groups

Artificial intelligence (AI) automation and ransomware as a service (RaaS) platforms have fundamentally altered the threat landscape by lowering the capability bar of entry and enabling nation-state actors to automate up to 90% of intrusions.

1 May 2026
Blue futuristic design
ISACA Journal Article

Information Security Matters: AI Security in Context: Part 2

The language of security must be adapted for use with AI, because AI does not have controls. Instead, it has guardrails.

Author: Steven Ross
Glowing lines on a blue background
ISACA Journal Article

The Digital Trust Imperative: The Case for Staying Current

To be relevant and trusted in the digital ecosystem means staying up to date on current offerings and expectations.

Author: K. Brian Kelley
Blue background featuring a magnifying glass
ISACA Journal Article

Practitioner’s Corner: Every Audit Is a Technology Audit—How ITAF Aligns Audit With the Digital Workplace

ITAF provides a timely lens for aligning audit and assurance practices with how work and risk operate in the digital workplace.

Author: Mary Carmichael
A map displaying interconnected lines and a hand holding a pen
ISACA Journal Article

The Security Implications of Remote Work and RTO Mandates

While there are benefits to the RTO model, a return to the office introduces its own security concerns.

Authors: Mitul Chittoory and Himanshu Kumar
Abstract lines in various colors swirl across a dark background
ISACA Journal Article

Contract-to-Code Reconciliation: An AI-Driven Test Automation Method

Human in the loop governance can support AI-driven test automation that reconciles contracts with technical implementation.

Author: Ashwathama Rajendran
Abstract background featuring intersecting lines
ISACA Journal Article

Future-Ready: An Agentic AI Governance Framework

As AI agents take on a greater share of operational roles, organizations require an agentic AI-ready governance model.

Author: Noam Koriat
Cyber shield over digital globe
ISACA Journal Article

From Container Security to AI Supply Chains: Applying Shift-Left Principles to ML Pipelines

Container security concepts can be applied to ML DevSecOps pipelines to identify AI supply chain risk considerations.

Author: Sapna Paul
Cyber shield with circles around it
ISACA Journal Article

The Browser as the Final Control Plane: Governing User–Data Interaction in Hybrid Work

Enterprise browsers provide a means to enforce policy, strengthen compliance, and operationalize zero trust in hybrid environments.

Author: Iftikhar Javed
A checkmark and a scale
ISACA Journal Article

Leveraging COBIT for Stakeholder Engagement in AI-Powered Audits

COBIT can serve as a guide for using AI-powered audits to empower governance and decision making.

Author: Thomas J. Bell III
Interconnected security locks
ISACA Journal

Case Study: Reimagining Secrets Management to Maximize Business Agility

One organization replaced its brittle, risky secrets management approach with a flexible, business-aligned one.

Author: Ed Moyle
Richard Beck
Blog Post

AI Assurance vs. AI Governance

The path forward for responsible artificial intelligence usage is not choosing between governance and assurance but a more deliberate integration of both.

30 April 2026
An illustration depicting the transformation of the digital landscape and its impact on modern work methods.
ISACA Journal Article

Commercial Cybersecurity in the Post-Quantum Era: Applying NSA CSfC Principles

Organizations can prepare for a controlled post-quantum transition by adapting CSfC principles to improve cryptographic resilience.

Author: Jim West
Tony Rosas
Blog Post

A Proven Seven-Step Process to Accelerate Cybersecurity Transformation

Explore a seven-step roadmap for putting in place an effective, risk-based cybersecurity program.

27 April 2026
Wickey Wang
Blog Post

RSA 2026: The Agent Revolution Is Already Here

A growing need exists for organizations to govern AI agents effectively, as they operate at machine speed and increasingly shape identity frameworks, while traditional human-centered security measures struggle to keep pace.

24 April 2026
Julie Chatman
Blog Post

CMMC as a Business Design Decision, Part 1: Decide What Work You Want

Before becoming CMMC-ready, organizations must dig into supplier relationships, architecture and governance models to understand how CMMC fits into strategic direction.

23 April 2026
Jack Freund
Blog Post

Leadership in Risk: The Strategic Advantage of Adding AAIR to Your Credentials

Learn how AAIR complements other certifications by signaling readiness to engage in strategic risk leadership, including advising executives and boards on complex tradeoffs arising from AI implementations.

23 April 2026
Safia Kazi
Emerging Technology Article

AI’s Environmental Impact Is Harder to Measure Than It Looks

Discover AI's true environmental impact. Learn how AI technology influences water use, debunk myths, and compare differing viewpoints for a clearer picture.

22 April 2026
The logo of the game appears against a solid black backdrop.
ISACA Journal Article

Building Robust Cyberresilience: A Practical Guide to Modern TPRM

A robust TPRM program requires that organizations move away from checklist-style vendor risk management and toward third-party cyberresilience.

Authors: Ulises Retamal and Megan Sepper
Julia Hermann
Blog Post

Security Debt Is Eating Your Organization Alive

Security debt is a business problem that should have visibility in board discussions and planning, not merely be buried in a risk register.

21 April 2026
COBIT
Blog Post

Celebrating Three Decades of COBIT

Explore COBIT's 30-year journey of optimizing enterprise I&T governance. Discover its history, global impact, and upcoming updates, including resources for effective AI system governance.

20 April 2026
Caico
@ISACA Article

Transition to ISACA’s New Role as CAICO Complete

Learn about ISACA's transition to its new role as CAICO in the CMMC program. Find answers to frequently asked questions regarding account setup, certification processes, investigations, and more.

20 April 2026
Noelle Pickler
Blog Post

Volunteer Appreciation Week: ISACA Volunteers Share Journeys and Advice

To celebrate Volunteer Appreciation Week this year, we reached out to several ISACA volunteers to hear their journeys and the advice they have for others who may be considering starting their own volunteering journey.

20 April 2026
Ali Nouman
Blog Post

The Security Metrics That Lie

Security reporting should shift from activity-based to exposure-based insights, addressing artificial intelligence's expanded risk landscape, for true visibility and control.

17 April 2026
Donnie Carpenter
Emerging Technology Article

Claude Mythos is Redefining the Cyberthreat Landscape

Explore how Claude Mythos is reshaping cybersecurity with AI-driven threat detection, raising new challenges for defenders.

17 April 2026
Ashish Bhatti
Security Article

Rethinking Microsoft Defender Hardening: From One-Time Fix to Continuous Security Control

Microsoft Defender has become the default endpoint protection for enterprises, but a control-oriented approach is needed to ensure its configurations are enforceable and measurable.

17 April 2026
Mercy Omollo, Pongpisit Wuttidittachotti and Sushila Nair
Blog Post

Meet ISACA's 2026 Global Achievement Award Winners

Learn more about the 2026 ISACA Global Achievement Award recipients and what this recognition means to them.

16 April 2026
A colorful collage showcasing various free online games suitable for children, featuring engaging characters and fun themes.
ISACA Journal Article

AI Governance in the Age of Multipolarity

As AI and its impacts continue to evolve, approaches to governance and risk management must evolve

Author: İlayda Süer
chris dimitriadis
Blog Post

ISACA’s Critical Work of Growing Capacity Across CMMC Ecosystem

As ISACA fully transitions to CAICO for the CMMC program, ISACA is standardizing the credentialing and member experience process to offer candidates and members a consistently high level of service quality.

13 April 2026
Kaali Dass
Blog Post

The Future of Software Delivery: Why "Shift-Left" Security is Your Competitive Advantage

Shift-left security is more than a set of tools. Kaali Dass shares how to embed these practices into your workflows.

13 April 2026
AI Risk in Practice: How Structured Capability Changes Outcomes
Blog Post

AI Risk in Practice: How Structured Capability Changes Outcomes

Understanding AI risk in principle is straightforward, but applying it effectively under practical pressures, such as deployment deadlines or vendor negotiations, requires a structured approach to risk management.

10 April 2026
Maman Ibrahim
Blog Post

When AI Joins the Party, Five Lines Beat Fifty Slides

Organizations often mistake declining vulnerability counts for improved security, but real safety requires understanding actual exposure, how quickly threats can be contained and whether risk is truly reduced or just obscured by better metrics.

9 April 2026
Cover of the book titled "Online Exclusive," featuring a modern design with bold typography and vibrant colors.
ISACA Journal Article

Tracking Cloud Emissions for Greener DevOps

Every build and deployment carries an energy cost and a carbon footprint.

Author: Radhakrishnan Krishna Kripa
Richard Beck
Blog Post

Agentic AI Evolution and the Security Claw

Autonomous agents only boost productivity until managing them becomes the job; treating an agent as a digital employee can increase oversight costs to more than the work they replace.

7 April 2026
A bustling cityscape filled with colorful shipping containers and bright lights illuminating the urban environment at night.
@ISACA Article

Balancing Efficiency and Resilience in Digital Supply Chains

Governance models must focus on how systems behave under stress, ensuring all trade-offs are visible and well-considered.

6 April 2026
A glittery graduation cap, symbolizing achievement and celebration, rests on a flat surface.
@ISACA Article

ISACA Foundation 2026 Scholarships: Applications Now Open for Cycle 1

The first cycle of applications for the ISACA Foundation’s 2026 scholarships are now open.

6 April 2026
A glowing brain illuminated in the dark, showcasing its intricate structure and neural pathways.
@ISACA Article

Recent Developments on AI Landscape Prompt Updated ISACA AI Risk Guidance

The shifting business contexts and rising stakes of artificial intelligence risk are explored in ISACA’s newly updated white paper, The Promise and Peril of the AI Revolution: Managing Risk.

6 April 2026
muhammad-ali-khan_blog
Blog Post

The New Battleground for ICS/OT: Why AI-Driven Defense is Becoming Essential for ICS/OT Cybersecurity

Modern malware challenges traditional ICS/OT cybersecurity with its ability to adapt and blend into normal operations, striking discreetly when detection is least likely.

6 April 2026
ISACA Introduces Advanced in AI Risk (AAIR) Credential
Blog Post

Who AAIR is for, and When It’s the Right Credential

The ability to demonstrate formalized AI risk capability is a key differentiator for an increasing number of job roles, and ISACA's Advanced in AI Risk (AAIR) helps professionals to establish their credentials in this emerging area.

6 April 2026
A man sits at a desk using a laptop, which features a face graphic on the screen, as he engages with the device.
Blog Post

Five Signs your Organization is Underestimating AI Risk at Senior Levels

Is your organization underestimating AI risk at senior levels? Discover five signs of critical AI oversight gaps and learn how to align leadership accountability with AI risk management.

3 April 2026
Rob Clyde
Blog Post

When Transitioning off the Board, Choose the Graceful Path

Responsibilities to an organization do not end when the term does for outgoing members of a board of directors.

3 April 2026
Anant Wairagade
Governance Article

When COTS Is Not Enough: Building Custom Connectors in Identity Governance

Explore the vital role of rapidly evolving IT frameworks like IAM, IGA, and PAM in securing user identities and managing access within organizations. Discover how these foundational pillars enhance security and compliance.

3 April 2026
Safi Kazi
Blog Post

Understanding the Ethical Impacts of AI Systems

ISACA's AI Impact Assessment Tool helps practitioners to understand and calibrate for a range of potential outcomes of deploying an AI system.

1 April 2026
Vibrant abstract wallpaper with intersecting blue and orange geometric shapes.
ISACA Journal Article

The Value of the Cyberrisk Agent in M&A

The cyberrisk agent (CRA) can accelerate risk discovery, enhance deal accuracy, and increase confidence.

Authors: Yuri Bobbert and Lucas Kuijper
Cem MEsci
Blog Post

Combining Risk Management with the Sales Process for Greater Success

When the risk management and sales teams collaborate effectively, viewing the company from their unique perspectives, the organization becomes more agile and more successful.

31 March 2026
Richard Beck
Blog Post

Does Claude Have a Security Problem?

While Claude Code Security improves aspects of application security, it does not yet provide comprehensive assurance systems, highlighting the ongoing need for human oversight and collaboration with security teams.

30 March 2026
Carla Guimarães Nascimento, Risk Management Systems Analyst
Blog Post

How Basic Principles of Access and Identity Can Prevent Major Security Crises

Successful identity and access management are not driven by advanced tools or isolated policies.

26 March 2026
chris dimitriadis
Blog Post

Setting the Baseline for Secure Software: Why the Code of Practice Matters

Explore the significance of the UK Government's Software Security Code of Practice in bolstering software supply chain resilience, and learn how ISACA's participation in the Ambassador Scheme aligns with industry standards and certifications, enhancing community practices.

25 March 2026
A person typing at a computer
ISACA Journal Article

Designing Quantum-Safe Apostille Systems in a Multiregime Privacy World

It is critical to ensure that the integrity and authenticity of apostilled documents remain verifiable throughout quantum advances.

Author: Kimberly E. Rich
AI Pulse Poll Reveals Rampant Uncertainty on Enterprise Landscape
Blog Post

AI Pulse Poll Reveals Rampant Uncertainty on Enterprise Landscape

Explore the challenges of AI accountability, transparency, and capabilities in organizations, as highlighted by ISACA's 2026 AI Pulse Poll.

23 March 2026
Ramona Ratiu
Blog Post

Beyond the Frame: Strengthening the Future of Technology Through the SheLeadsTech Chicago–WECode Harvard University Partnership

A collaboration between SheLeadsTech Chicago and WECode represents a partnership between emerging technologists seeking mentorship and a shared sense of purpose to build a more inclusive and resilient digital world.

20 March 2026
Hafiz Ahmed
Security Article

The Cybersecurity Implications of Australia's Landmark Social Media Ban

Australia's SMMA legislation shifts accountability from parents to platforms, enforcing age verification to protect children online while navigating technical, privacy, and social challenges.

20 March 2026
Anjali Gopinadhan Nair
Blog Post

Securing the AI Frontier: A Practical Framework for Assessing AI Coding Assistant Vulnerabilities

Anjali Gopinadhan Nair presents a practical four-phase approach for managing AI coding assistant vulnerabilities, covering prompt injection risks, data leakage problems, and shadow AI challenges.

19 March 2026
ER Kritka
Blog Post

The CISO’s Dilemma: When Your Employees’ Thoughts Become Attack Vectors

The enterprise security perimeter is expanding beyond networks and terminals into the brain itself as thoughts become attack vectors.

18 March 2026
Three women looking at an Ipad
@ISACA Article

Five ISACA Resources to Honor Women’s History Month

Discover five ISACA resources to explore highlighting ISACA’s work in supporting women in the tech workforce.

16 March 2026
Maman Ibrahim
Blog Post

When AI Joins the Party, Assurance Checks the Receipts Before the Board Gets the Bill

From accountability to technical validity and beyond, assurance has a critical role to play in this era of artificial intelligence models and implementations.

13 March 2026
Chidambaram Narayanan
Blog Post

What Failing the AAIA Taught Me About Resilience, Learning and Our Shared Journey

A near-miss on passing the AAIA exam provided one exam-taker with clarity and inspiration, along with a commitment to continuing his learning journey.

11 March 2026
A futuristic digital landscape symbolizing the arrival of advanced internet technology and connectivity.
ISACA Journal Article

When AI Writes the Vulnerability: Securing the Cognitive Layer of Modern Development

DevSecOps took a decade to mature from concept to standard practice. AI security does not have that runway.

Author: Danny Gershman
Keith bloomfield deweese
Blog Post

Four Emerging AI Risk Areas for Digital Trust Professionals in 2026

The risks emerging with AI are different than what enterprises dealt with even a year ago. Keith Bloomfield-DeWeese shares four emerging AI risks for digital trust professionals.

10 March 2026
David Foote
Blog Post

Why CISA and CGEIT Are Outperforming the Certification Market in 2026

Recent pay data from Foote Partners shows that CISA and CGEIT certifications posted cash pay premium growth in the 11% to 20% range over the last six months of 2025 while earning premiums well above the industry average.

9 March 2026
SheLeadsTech Fireside Chat: Celebrating Women in Cybersecurity
Podcast

SheLeadsTech Fireside Chat: Celebrating Women in Cybersecurity

Join Debbie Lew and Jo Stewart-Rattray, both ISACA Hall of Fame inductees and recipients of the Eugene Frank Founders Award, as they sit down with Gail Coury, who will be inducted into the ISACA Hall of Fame in 2026.

9 March 2026
Omogbehin Awoderu Muthoni
Blog Post

Rising While Lifting Others: SheLeadsTech Scholars Share Their Journeys and Inspirations

Discover the SheLeadsTech Scholarships by ISACA Foundation, offering financial support and career resources for students pursuing IT audit, risk, security, assurance, or cybersecurity degrees globally.

6 March 2026
Erik Prusch
Blog Post

CMMC Program Provides New Career Pathways for ISACA Members

ISACA's role as CMMC Assessor and Instructor Certification Organization (CAICO) provides ISACA members new cybersecurity career pathways while strengthening ISACA's standing as a leader in developing the global cybersecurity workforce.

5 March 2026
Leron Zinatullin
Blog Post

The Socio-Technical Playbook: Practical Patterns for Security Culture

Resilient organizations start with redesigning security so that it better aligns with human cognition, incentives and workflows, with an eye toward ongoing measurement and improvements.

4 March 2026
Humans Are IT Security’s Weakest Link
Podcast

Humans Are IT Security's Weakest Link

In this episode of the ISACA Podcast, host Chris McGowan is joined by Amit Patel, Senior Vice President at Consulting Solutions, to explore one of the most underestimated threats in cybersecurity: the human element.

3 March 2026
Gokhan Polat
Blog Post

The DeFAI Revolution: Unlocking a Democratic and Intelligent Financial Future

Decentralized Finance AI is not only transforming finance but also democratizing artificial intelligence, while simultaneously altering the risk landscape.

3 March 2025
A vibrant orange background illuminated by a glowing line, creating a striking visual effect.
@ISACA Article

ITAF Updates Reflect Evolving Emerging Technology Landscape

ITAF, 5th Edition, provides an array of key updates from the previous edition. Adherence with ITAF is a requirement for CISA-certified professionals.

2 March 2026
A woman with glasses, looking thoughtfully to the side, showcasing her stylish eyewear and confident demeanor.
@ISACA Article

Planning Your Upcoming ISACA CPE Opportunities

Discover several of the virtual and in-person learning opportunities ISACA has within the next several months, and the related CPE opportunities.

2 March 2026
Purple lights on a dark background
ISACA Journal Article

Information Security Matters: AI Security in Context

In some ways, AI systems are familiar. But in others they are totally distinct.

Author: Steven J. Ross
Visual representation of cloud computing
ISACA Journal Article

The Digital Trust Imperative: The Need for Multicloud

Deploying services in a multicloud architecture is a business decision, not a technical one.

Author: K. Brian Kelley
Zeros and ones representing a digital interface
ISACA Journal Article

Privacy in Practice: No Winner in the AI Arms Race

It is imperative to understand what winning the AI arms race might mean and the costs.

Author: Safia Kazi
An abstract design with a blue background filled with various lines and dots
ISACA Journal Article

Practitioner’s Corner: When Systems Are Designed to Work, But Not to Fail

Digitized supply chain operating models can unintentionally expand the attack surface.

Author: Mary Carmichael
A document with a shield icon
ISACA Journal Article

Evidence Over Policy: Auditing the Modern Vendor Chain

The seemingly endless vendor chain has evolved into a main attack route for cyberattackers.

Author: Pranay Mehta
A green screen displaying an intricate geometric pattern
ISACA Journal Article

Vetting Vendors to Combat the Supply Chain War

Supply chain attacks are increasing on a global scale and professionals are sounding the alarm.

Author: Hannah Hunt
A hand is directing attention to an atom symbol on a computer screen, representing scientific or educational content.
ISACA Journal Article

Auditing the Quantum Neural Network Era

Assurance functions must begin preparing for scenarios where quantum components coexist with classical systems.

Author: Irina Olifer
Digital wallpaper displaying cascading binary code in vibrant green against a black backdrop.
ISACA Journal Article

Decoding SBOMs in the Era of AI-Powered Threats

A comprehensive SBOM helps establish and maintain trust in a highly interconnected digital environment.

Author: Imran Khan
An illustration representing digital security and privacy, highlighting the challenges and solutions in today's technology-driven world.
ISACA Journal Article

Developments in Cross-Border Data Transfer Risk

IT auditors must work with legal and compliance teams to manage cross-border data transfer risk.

Author: Kevin M. Alvero
A woman with an overlay of medical icons around her
ISACA Journal Article

Case Study: Transforming Healthcare With GRC

An IT governance enterprise partnered with a home healthcare agency to implement a tailored GRC framework.

Author: Katie Teitler-Santullo
Richard Beck
Blog Post

Space Security, and Why It Matters to Your Organization

Space is becoming more fragile and strategically important, with cyber threats, geopolitical dynamics, supply-chain weaknesses, electronic warfare, and more creating a volatile and high-risk environment.

27 February 2026
Atish Dash
Emerging Technology Article

Autonomous Red vs Blue Teaming: A New Frontier in Cybersecurity Risk and Reward

For organizations, this evolution offers both promise and peril. On one hand, these autonomous teams can work independently to discover complex attack paths and respond rapidly to threats, reducing a significant amount of manual workload.

27 February 2026
Mary Carmichael
Blog Post

Why ITAF 5 Matters: Six Big Shifts Transforming IT Audit and Assurance

The new addition of ITAF modernizes the framework for the modern technology environment, including digital ecosystems, stronger governance and a more strategic audit function.

26 February 2026
Advait Patel
Blog Post

The Hidden Mountain of Compliance Debt in AI Cloud Pipelines

In AI-heavy cloud pipelines, compliance debt grows faster over time than most teams realize.

25 February 2026
A graphic showcasing top online dating sites for singles, featuring logos and names of popular platforms.
ISACA Journal Article

Examining the Role of AI and Automation in IT Audit

Auditors must use AI and automation in a way that supports their work rather than complicates it.

Author: Rebecca Lam
Netwrix Podcast
Podcast

Securing Data in the Age of AI with DSPM: Lessons from a High-Impact ISACA Webinar

In this ISACA Podcast episode, host Safia Kazi, Principal Research Analyst – Privacy, is joined by Dirk Schrader, VP of Security Research at Netwrix, to discuss how generative AI is revealing long-standing gaps in enterprise data security and governance.

23 February 2026
Robert Putrus
Blog Post

Responsible AI: From Emerging Technology to Executive Governance Imperative

Enterprises who are committed to responsible artificial intelligence usage require clear executive leadership, well-integrated governance and diligent risk management.

23 February 2026
Nandita Rao Narla, Head of Technical Privacy and Governance at DoorDash
Blog Post

Five Practical Strategies to Address Privacy Engineering Challenges

Organizations can turn privacy into a core capability by elevating privacy engineering into a distinct practice with consistent, proactive focus.

18 February 2026
A futuristic graphic illustrating AI technology as the key to transforming business operations and strategies.
ISACA Journal Article

Leveraging AI-Powered Dashboards and Compliance Automation to Strengthen Cybersecurity

The rapid digitalization of healthcare and community services has exposed vulnerabilities that did not exist a decade ago.

Author: Dorys Marylu Gallardo Castaneda
A woman is engaged in conversation with another woman, both appearing attentive and interested in the discussion
@ISACA Article

ISACA Professionals Share Tips for Rising IT Auditors

Enthusiasm for supporting and sharing guidance with the next wave of professionals is part of what makes ISACA’s global community unmatched.

16 February 2026
AI technology integrated into a circuit board, showcasing advanced electronic components and connections.
@ISACA Article

Keep Tabs on Trending AI News and Insights with ISACA SmartBrief on AI

Keeping track of the latest AI trends becomes integral to making better informed decisions and growing your career.

16 February 2026
Ali Nouman
Blog Post

The EU AI Act is Here: Why Tech Leaders Should Stop Waiting and Seeing

Translating the legal jargon of the EU AI Act into a productive roadmap for your organization is achievable, beginning with conducting a gap analysis.

16 February 2026
Carol Lee, CISM, CRISC, CDPSE, C|CISO, CCSP, CEH, CIPM, CSSLP; Terence Law, CISA, CFA, CISSP, CPA, Certified Banker; Karen Liang, OSEP, OSCP, CISA;
Blog Post

Navigating Global AI Governance: Privacy Implications in EU and China Frameworks

By understanding and integrating global AI governance approaches, organizations can ensure compliance and contribute to the responsible and ethical advancement of AI, leading to sustainable innovation in our digital ecosystem.

13 February 2026
Fene Osakwe
Audit Article

5 Ways Auditors Can Drive Cyberresilience Across Sectors

There are 5 key ways auditors can shape the cybersecurity perspective of senior leaders in organizations across sectors.

13 February 2026
Jayakumar Sundaram
Blog Post

The Reckoning of Silence: Medical Device Cybersecurity in a Transparent Age

As the cybersecurity landscape evolves, so must our conversations around medical device security and vulnerability disclosures.

11 February 2026
A collage of online course icons representing business and technology education options.
ISACA Journal Article

Securing AI in Multicloud Environments

The security of AI environments cannot be based on the measures of the perimeter alone; it must be verified on a regular basis.

Author: Anant Wairagade
Ramona Ratiu and Garry Barnes
Blog Post

Leading from the Heart: Servant Leadership Attributes for ISACA Chapter Leaders

By making chapter members and volunteers feel heard and uplifted, ISACA chapter leaders can make a huge difference in growing their local ISACA communities and equipping their members for success.

9 February 2026
Richard Beck
Blog Post

Critical Skills for Veterans in 2026: From Service to Security

Service leaders and veterans develop the critical thinking skills that will be increasingly important on the security landscape in this era of widespread artificial intelligence.

6 February 2026
An infographic displaying the best security software of 2019, including logos and key features of each program.
ISACA Journal Article

Strengthening Cloud Security With Six Essential Controls

Cloud risk related to misconfiguration vulnerabilities can be mitigated through a set of six critical controls.

Authors: Niranjali Suresh and  Ashley Nichols
Maman Ibrahim
Blog Post

How Decentralized Audit Architectures Reinvent Assurance for a Distributed Future

Decentralized audit architectures provide a useful reset for how modern assurance practitioners can be more impactful within a distributed, platform-driven, enterprise ecosystem.

3 February 2026
Jon Shende
@ISACA Article

AI Answers Are Becoming Business Decisions: Most Organizations Aren’t Governing Them That Way

AI adoption will accelerate. What is not inevitable is whether organizations build AI systems that they can defend under scrutiny, justify under regulation and trust under pressure.

2 February 2026
Stars
@ISACA Article

Honoring Outstanding Tech Professionals with the 2026 ISACA Awards and Hall of Fame Induction

ISACA’s community is strengthened by the many individuals who strive to make remarkable impacts in their industry, communities and organizations.

2 February 2026
Mohammed J. Khan
Blog Post

Preparing IT Auditors for the Next Wave of Digital Risk: AI, IoT & Privacy

Gaining expertise and skills in privacy, the Internet of Things and artificial intelligence will be a necessity for IT auditors as the digital risk landscape becomes a major challenge in the profession.

2 February 2026
mayeul-obel-okeli
Blog Post

Three Proven Ways to Boost Security in Amazon Web Services

The digital era has prompted leaders to migrate business-critical systems to the cloud, which offers undeniable benefits in terms of agility, flexibility, and innovation, but also carries substantial risks.

29 January 2026
Aparna Achanta
Blog Post

How to Operationalize Data Sovereignty in Your GenAI Deployments

Data sovereignty in the GenAI era calls for adapting existing governance systems to adjust to a technology that is blurring traditional boundaries.

28 January 2026
Man holding lights
ISACA Journal Article

Blockchain Governance and the Move Toward Decentralized Models

Decentralization does not abolish governance; it simply changes the way it should work.

Author: Omotayo F. Salako
Ravikumar Ramachandran
Blog Post

Can Artificial Intelligence Replace Software Engineers and Cybersecurity Professionals?

While artificial intelligence is becoming increasingly useful in cybersecurity and software engineering, humans will remain essential for effective and responsible implementations.

26 January 2026
Brian Hileman
Blog Post

Detect, Prevent, Comply: The Three Pillars of Modern DLP Use Cases

Detect, prevent, and comply are now inseparable foundations of modern data protection, and a data‑centric DLP strategy that addresses both internal and external threats is the path to resilience and trust.

23 January 2026
Phil Odai-Ayiku
Security Article

Crafting Better Phishing Simulations: A Call for Innovation in Cybersecurity

Despite unprecedented advances in technology, phishing remains one of the most persistent cybersecurity threats organizations face.

23 January 2026
C. Warren Axelrod
Blog Post

Is AI ‘Serving’ Humankind?

Minimizing unintended negative consequences of artificial intelligence is a critical imperative, but it might prove very difficult to achieve in practice.

21 January 2026
A man sitting at a computer with the text "online exclusive" displayed on the screen.
ISACA Journal Article

This Is How They Tell Me a SOC Works

The SOC Critical Path offers SOC managers tangible steps for more effectively and efficiently detecting and neutralizing threats.

Author: Antonio Villalón Huerta
A group of business people navigating a vibrant, futuristic city filled with innovative buildings and urban design.
@ISACA Article

ISACA Experts Frame the Big Questions That Will Shape Digital Trust in 2026

What will be the biggest challenges ISACA professionals need to navigate in 2026?

20 January 2026
A 3D illustration depicting cyber security themes, featuring digital shields and interconnected data networks.
@ISACA Article

New ISACA Report Spotlights Latest Privacy Trends

ISACA’s newly released State of Privacy 2026 report shows that practitioners still face a range of difficulties when it comes to staffing, compliance and more.

20 January 2026
Ankit Gupta, CISA, CISM, CRISC, AAISM, Senior Security Engineer, and Shilpi Mittal, CISA, CISM, CRISC
Blog Post

Post Quantum Cryptography: A 12 Month Playbook for Digital Trust Professionals

A well-organized, quarter-by-quarter planning approach can enable digital trust professionals to be well-prepared for the post-quantum cryptography landscape to come.

20 January 2026
Ernest Blankson
Risk Article

Transforming Cybersecurity Metrics into Strategic Business Insights for Executive Leadership

Translating technical data into meaningful business metrics requires more than rewording—it involves quantification, context, and correlation.

16 January 2026
Five Key Findings from ISACA State of Privacy 2026 Report
Blog Post

Five Key Findings from ISACA State of Privacy 2026 Report

Smaller privacy teams and challenges in keeping up with the regulatory environment are among the notable trends discovered in ISACA's State of Privacy 2026 report.

15 January 2026
Ramona Ratiu
Blog Post

The 2026 Cyberthreat Landscape: Ten Signals Shaping Trust, Collaboration and Resilient Design

The 2026 cyberthreat landscape will not be shaped by any specific threat, but rather by how intentionally organizations approach trust, identity and human–AI collaboration.

14 January 2026
Anant Wairagade
Security Article

Passwordless Authentication: Risk, Reward, and Readiness

Passwordless authentication promises enhanced security, streamlined user experiences, and reduced operational costs.

14 January 2026
Justin Rende
Security Article

The 6 Cybersecurity Trends That Will Shape 2026

AI is embedded in virtually everything cyberprofessionals do, both offensive and defensive, and it is reshaping how leaders think about security strategy and risk management.

14 January 2026
Online exclusive offer highlighting healthcare services, with a clean layout and engaging visuals.
ISACA Journal Article

Integrating Privacy by Design Principles Into eHealth

A framework for embedding privacy into information systems was implemented successfully within Slovenia’s national eHealth system.

Authors: Matjaž Drev, PH.D. and Boštjan Delak, PH.D
Noelle Pickler
Blog Post

Building the Whole Professional: Mentorship Month at ISACA

The ISACA Mentorship Program has enabled more than 1,400 members in more than 100 countries to nurture their careers, facilitating conversations that spark real professional growth and connection.

13 January 2026
Pranjal Sharma
Blog Post

Beyond Compliance: Building Lasting Digital Trust

Organizations that limit themselves to treating compliance as a checkbox won't earn the trust of customers and partners. Integrating compliance into everyday culture leads to a resilient organization.

12 January 2026
Mark Thomas
Blog Post

Five Questions IT Governance Professionals Will Need to Answer in 2026

Effective information and technology governance in the new year will center on enabling responsible innovation, fortifying digital trust and helping organizations to adapt at speed without taking ethical or legal shortcuts.

8 January 2026
Mary Carmichael
Blog Post

Five Questions Risk Professionals Will Need to Answer in 2026

Resilience to disruptions, navigating technology supply chains, harnessing AI, dealing with tight budgets and delivering on changing expectations from business leaders are among the challenges facing risk professionals in 2026.

7 January 2026
A modern office space showcasing advanced technology and collaboration tools, symbolizing the future of work.
ISACA Journal Article

Zero Trust and Agile for Scalable Technology Deployment

By combining zero trust with Agile delivery processes, practitioners can achieve a balance between agility and resilience.

Author: Olumide Abiola
Chirag Joshi
Blog Post

Five Questions Cybersecurity Professionals Will Need to Answer in 2026

Cybersecurity leaders are being judged less by the controls that they are implementing and more by the manner in which they explain decisions, trade-offs and outcomes to business leaders with clarity.

6 January 2026
Individuals at a conference
@ISACA Article

Five Ways to Continue Your Career Journey with ISACA in 2026

Starting to think ahead to your professional goals for the new year? Here are five ways you can grow your career journey with ISACA in 2026.

5 January 2026
Cybersecurity Maturity Model Certification
@ISACA Article

ISACA Authorized to Manage Training, Certification Across CMMC Ecosystem

ISACA has been authorized as the new CMMC Assessor and Instructor Certification Organization (CAICO) for the Cybersecurity Maturity Model Certification (CMMC) program of the US Department of War (DoW).

5 January 2026
Maman Ibrahim
Blog Post

Five Questions Audit Professionals Will Need to Answer in 2026

When it comes to auditors being prepared for the profession's evolving landscape in 2026, there is no substitute for lived experience, due diligence and courage.

5 January 2026
A hand typing on a laptop, with network connection lines and icons displayed around
ISACA Journal

Information Security Matters: What Ever Happened to Disaster Recovery?

Disaster recovery is necessary to understand the recovery capabilities of the systems business areas rely on.

Author: Steven J. Ross
A finger pointing to a cyber lock
ISACA Journal Article

The Digital Trust Imperative: Red Teams and Digital Trust

Without red teams, the first time an organization learns of a vulnerability may be when a threat actor exploits it.

Author: K. Brian Kelley
A dark blue screen showing code and network lines
ISACA Journal Article

AI-Powered Cyberdefense: Strategic Playbooks Unveiled

Playbooks can unify people, processes, and emerging technologies into a cohesive cybersecurity strategy.

Author: Robert Putrus
Hands typing on a keyboard
ISACA Journal Article

Building Effective Internal Controls: A Reintroduction to Segregation of Duties

When SoD is applied to the complex world of systems, it requires a more nuanced outlook.

Author: Carla Guimarães Nascimento
A digital rendering of crypto
ISACA Journal Article

Post-Quantum Cryptography Migration: A 3Ps Approach

Focusing on the 3Ps—proactive, preventive, and practical—is a useful strategy for migrating to post-quantum cryptography.

Authors: Hoon Wi Lim, John Buselli, Choon Hock Niow, and Guomin Yang
Hands typing on a keyboard
ISACA Journal Article

Shift-Left Security: Optimizing Software Delivery With Agile and DevSecOps

By integrating security early in the development process, teams can detect and address vulnerabilities proactively.

Author: Kaali Dass
Image illustrating strategies to safeguard businesses against cyber attacks and enhance digital security measures.
ISACA Journal Article

Beware Chat Leaks: LLMs for Insider Threat Detection

To combat insider threats in customer interactions, organizations must adopt detection mechanisms that can flag suspicious patterns while reducing unnecessary alerts.

Author: Terrence Cai
A blue computer screen filled with various lines of code, illustrating programming concepts.
ISACA Journal Article

Navigating Blockchain Risk: Audit Beyond Traditional Cybersecurity Frameworks

The nature of blockchain requires a thorough reassessment of audit to uphold effective governance and risk management.

Author: Dinesh Velusamy
A hand pressing a button on a computer, indicating user interaction with the device.
ISACA Journal Article

Case Study: Mitigating Protestware Threats Through Open-Source Software Security

Organizations relying on open-source software face a significant risk of being exposed to protestware.

Author: Mick Brady
Veronica Rose
Blog Post

Reflections on My ISACA Global Journey: Building Digital Trust Through Service

Veronica Rose's service on the ISACA Global and ISACA Foundation boards reinforced the importance of community, mentorship, representation, resilience and much more.

31 December 2025
Engr. Md. Mushfiqur Rahman, CISA, CISM, CRISC, CGEIT, CDPSE
Blog Post

Securing the Digital Perimeter: A Holistic Approach Through the CISA and CRISC Certifications

Professionals who have both CISA and CRISC credentials are equipped to bridge the gap between technical assurance and risk intelligence, strengthening organizations' holistic preparedness for the cyber risk landscape.

30 December 2025
J. Efrim Boritz, PhD, FCPA, CISA
Blog Post

Building the Future of IT Audit: Insights from ISACA Award Winner J. Efrim Boritz

J. Efrim Boritz, PhD, FCPA, CISA, is this year’s ISACA Educational Excellence Award recipient in recognition of his leadership and significant contributions to advancing research and education in the IT audit and assurance space.

29 December 2025
Krutik Poojara
Blog Post

Cybersecurity at the World’s Biggest Stages

Global events are prime targets for cyber attacks, but proactive planning, layered defenses, secure communications and practiced incident response can ensure robust protection.

23 December 2025
Matt Dechant
Risk Article

The Time for AI Governance is Now: Key Considerations and Guidelines for Organizations

Establishing governance frameworks that prioritize risk mitigation and system security ensures that AI is not only harnessed effectively but also ethically.

22 December 2025
rashmi-tallapragada
Blog Post

When a ‘Default Password’ Isn’t Really a Default: Why System Understanding and Documentation Matter

Security practitioners need to thoroughly understand systems to identify which alerts are truly important and establish processes to ensure that solutions are available when the same issue arises again.

19 December 2025
Vatsal Gupta
Emerging Technology Article

The Looming Authorization Crisis: Why Traditional IAM Fails Agentic AI

Organizations must act now to address the complexity of this technology, recognizing that agentic AI presents not only technical and compute challenges but also profound identity and policy dilemmas.

19 December 2025
Jack Freund
Blog Post

Balancing the Scales: What AI Teaches Us About the Future of Cyber Risk Governance

By blending operational risk, model validation and quantitative analysis, a robust governance system capable of scaling with the technology it oversees can be created.

18 December 2025
Erik Prusch
Blog Post

New Oversight of CMMC Training, Certification Showcases ISACA’s Cybersecurity Leadership

Being entrusted as the Cybersecurity Assessor and Instructor Certification Organization (CAICO) for the world’s largest cybersecurity certification program—the US Department of War’s Cybersecurity Maturity Model Certification (CMMC)—is a proud moment for ISACA.

17 December 2025
The phrase "the law of the internet" displayed prominently on a digital background, symbolizing online regulations and guidelines.
ISACA Journal Article

Innovating Audit for an Innovative World

Audits have anchored cybersecurity for decades, but their continued relevance will require enterprises to keep pace with emerging digital risk.

Authors: Joshua Scarpino, Katie Grillaert, Esther Chung, Nia Richards and Keith Parkman
suraj-raghupathy-iswaran
Blog Post

COBIT Reimagined: Building Trust and Security through Public and Private Sector Partnership

COBIT can assist in establishing shared responsibilities and decision-making authority among organizations with diverse resources, risk tolerances and regulatory requirements.

16 December 2025
A woman with glasses, looking thoughtfully to the side, showcasing her stylish eyewear and confident expression.
@ISACA Article

Top @ISACA Articles from 2025

In our final @ISACA newsletter edition of 2025, we look back at 10 of the articles from the year that resonated most with our readers.

15 December 2025
Mary Carmichael
Blog Post

Avoiding AI Pitfalls in 2026: Lessons Learned from Top 2025 Incidents

Explore the patterns that emerged in major AI incidents from 2025 and what needs to change in 2026 so organizations can bolster the trustworthiness of their AI implementations.

15 December 2025
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Breach-Nomics, How Assumptions Drive Up the Cost of Cyberattacks

Cybersecurity budgets are often built on assumptions, including the assumption that backups will always work, that insurance will cover the losses and that existing controls are “good enough.”

15 December 2025
Jeff Wade
Blog Post

Threat Intelligence Isn’t Just a Feed – It’s Owning Your Decision Power as a CISO

Discover a practical blueprint for building a modern, intelligence-driven threat program aligned with enterprise risk and today’s evolving cyber landscape.

12 December 2025
Malcolm Kafesu
Blog Post

Three Primary Reasons Why GRC Is Failing — And How to Fix It

Operating in siloed and reactive fashion, in addition to too much reliance on manual procedures, can put the success of GRC programs in peril.

11 December 2025
Visual depicting cyber security themes, emphasizing online exclusivity and safeguarding digital information
ISACA Journal Article

Neurotech and PETs: Securing Cognitive Data

What if the next major breakthrough in privacy is not merely a matter of protecting personal digital data, but shielding the very thoughts inside one’s mind from external surveillance and influence?

Author: Er. Kritika
Omotayo F. Salako
Blog Post

Cloud Compliance & Continuous Assurance: Harnessing AI, RPA, and CSPM For a New Era of Trust

Organizations would schedule internal audits, assemble mountains of documentation, and pass a point-in-time review. Once complete, the team would often exhale until the next cycle.

9 December 2025
Gnanendra Reddy
Emerging Technology Article

ISO/IEC 42001 and EU AI Act: A Practical Pairing for AI Governance

With upcoming artificial intelligence (AI) regulatory obligations and rules set to take effect, organizations face immediate compliance deadlines.

8 December 2025
ISACA Introduces Advanced in AI Risk (AAIR) Credential
Blog Post

ISACA Introduces Advanced in AI Risk (AAIR) Credential

See answers to frequently asked questions about the new ISACA Advanced in AI Risk (AAIR) certification, designed to equip professionals to excel as artificial intelligence changes the risk landscape.

5 December 2025
Vatsal Gupta
Blog Post

Building a Quantum-Resilient, Compliance-First Identity and Access Management Solution

Identity and Access Management (IAM) is a key component of cybersecurity, and the arrival of quantum computing will only magnify its importance in the coming years.

4 December 2025
Graphic indicating an online exclusive deal, emphasizing limited-time offers available solely on the internet.
ISACA Journal Article

From Static to Strategic: Rethinking Access Control with Continuous Authentication

Adopting continuous authentication is essential to staying ahead of increasingly sophisticated cyberthreats.

Authors: Krutik Poojara and Mansi Poojara
Andre Porsch
Blog Post

When Control Fragments: Rethinking Resilience in a Distributed World

True business resilience centers on remaining worthy of stakeholders' trust even when adversity strikes.

2 December 2025
John P Pironti
@ISACA Article

Five Key Considerations for Avoiding Complacency in Third-Party Security Management and Monitoring

Third-party security management and monitoring have been a focus of many organizations’ information risk and security and vendor compliance programs for several years, but they have yet to yield expected results.

1 December 2025
Donavan Cheah
@ISACA Article

Rethinking Cybersecurity: From Governance to Social Trust

Cybersecurity in a digital world is the means to which we establish trust. And trust is what keeps societies together.

1 December 2025
jorge carrillo
Blog Post

World’s Most ISACA-Certified Professional a Testament to ‘Power of Persistence’

Jorge Carrillo, who has earned more ISACA certifications than anyone in the world, says the lessons he has learned from his numerous credentials extend well beyond the exam content.

1 December 2025
Gerard Chukwu
Security Article

Enhancing Asset Visibility with the DAIN Methodology

Against this backdrop, assets are the proverbial treasure chest, and a comprehensive asset inventory is the map that contains information about all assets in an organization.

1 December 2025
Sandeep Dommari
Blog Post

CISO’s Playbook: Aligning AI Innovation with Ethical and Regulatory Requirements

As artificial intelligence continues to reshape the security landscape, CISOs must approach their roles with a focus on ethics and resilience, communicate transparently and adopt a business leadership mindset.

26 November 2025
Bruno Soares
Blog Post

Has COBIT Lost Its Salt or Are Organizations Resisting Being ‘COBITized’?

The COBIT framework has evolved from a checklist to a compass and from control to governance, providing organizations with a valuable resource to further their digital transformations.

25 November 2025
Gloribert Roque-Melendez
Blog Post

From Learner to Leader: Gloribert Roque-Melendez’s Journey with ISACA and Academia

ISACA has been a big part of Gloribert Roque-Melendez’s career journey since her days as a student, and she has come full circle as a faculty advisor to an ISACA university student group.

24 November 2025
CA. Ratan Singh Tanwar, CISA, DISA, FAFD, Managing Partner- Tanwar Ratan Singh & Associates CA. Firm, Chartered Accountant
Blog Post

Embracing AI in Information Systems Audit: A New Era of Assurance

Artificial intelligence is enhancing audits, but AI needs to be considered a tool to complement, not replace, the critical work of audit practitioners.

21 November 2025
Steve Stein and John Goff
Risk Article

The Legal and Regulatory Risk of Data Overretention

When teams fail to defensibly dispose of data and uphold rigorous deletion and retention practices across all information sources, an array of legal, compliance, financial, and operational risk can quickly accumulate.

21 November 2025
C. Warren Axelrod
Blog Post

Are We Outsourcing Our Brains to AI?

Even with so much technological assistance at our fingertips, practitioners must avoid the temptation to outsource their core knowledge and skills to AI.

19 November 2025
Computer screen displaying a warning sign, indicating a potential issue or alert for online users.
ISACA Journal Article

To Pay or Not to Pay: Unpacking Ransomware Response Through Human Decision Making

At the ISACA® North America Conference, hundreds of cybersecurity and audit professionals gathered for ISACA's first debate-style keynote.

Author: Jeremy Treadwell
A circuit board featuring a red warning sign, signaling caution or a malfunction in the system.
@ISACA Article

ISACA White Paper Provides Blueprint for Strengthening Threat Intelligence

The rapid commercialization of the cybercrime ecosystem, the rise of generative AI and escalating geopolitical tensions have all heightened the urgency for intelligence-driven security.

17 November 2025
Adebola Aramide Olawaye
Blog Post

Generative AI in Cloud Operations: How AI Copilots Are Transforming DevOps, Cloud Monitoring, and Incident Response

Generative AI copilots are redefining three spheres of current cloud practices: DevOps, monitoring, and incident response.

17 November 2025
Chidambaram Karthik Narayanan, CISA
@ISACA Article

Five Signs You’re Ready to Take Your Certification Exam

Being ready for your exam is not about the absence of fear, but the presence of preparation.

17 November 2025
Nipun Mahajan
Security Article

Protecting SAP Systems in the Cybersecurity Era

As digital transformation continues to evolve globally, SAP’s role as a technology partner remains vital—helping organizations navigate an increasingly complex landscape and manage risk, including critical vulnerabilities that could threaten enterprise operations.

14 November 2025
hafiz sheikh adnan ahmed
Blog Post

Facial Recognition and Privacy: Concerns and Solutions in the Age of AI

Facial recognition technology raises substantial ethical, legal, and privacy issues, particularly in the era of artificial intelligence, which has greatly enhanced the power and scope of these systems.

13 November 2025
A businesswoman in a suit writes on paper with a tablet in hand, focused on her work at a desk.
Blog Post

How to Earn ISACA CPE: Free and Discounted Options to Keep Learning and Maintain Your Credentials

Discover how digital trust professionals can easily earn valuable Continuing Professional Education (CPE) credits through ISACA online courses, webinars, virtual summits and in-person events.

12 November 2025
Graphic indicating an online exclusive deal, emphasizing limited-time offers available solely on the internet.
ISACA Journal Article

Future-Ready: An Audit Maturity Model for Shifting Impact With Action

The Audit Proactivity Maturity Model (APMM) serves as a practical guide for advancing audit proactivity to transform audit into an agent of change.

Author: Noam Koriat
Chris Moschovitis
Blog Post

Tool Sprawl: Why More Cyber Tools Make You Less Secure

An organization that has carefully maintained defenses and clear response protocols is more secure than one with a flashy collection of 'solutions' that lack proper management.

11 November 2025
Ravikumar Ramachandran
Blog Post

Safeguarding the Future: Strategies for Protecting Generative AI, LLMs, and Agentic AI

AI and generative AI are fast becoming essential requirements for any organization to increase its productivity and research capabilities across the globe.

10 November 2025
Sushila Nair
Blog Post

Why I Changed My Mind and Took Yet Another Certification Exam: AAISM

Artificial intelligence has changed the rules, and the Advanced in AI Security Management (AAISM) credential helps security professionals keep up with the critical connection points between AI and security.

7 November 2025
Yakir Golan
Risk Article

Repositioning Cyberrisk Registers as Strategic Assets

Until cyberrisk registers evolve to adopt the more tangible language used to describe enterprise value, they will remain static documentation tools that are useful for compliance but inadequate for advancing organizational goals.

7 November 2025
Maman Ibrahim
Blog Post

Why Stopping at Gender and Race Makes AI Bias Worse

AI bias goes beyond gender and race, encompassing socioeconomic, geographic, disability, age, linguistic and other factors that subtly influence outcomes, necessitating new tools, mindsets and constant vigilance to detect.

6 November 2025
Nipun Mahajan
Blog Post

ISACA Career Catalyst Stories: Nipun Mahajan, Senior Cybersecurity Analyst

Nipun Mahajan, executive vice president of the ISACA Denver Chapter, started by pursuing a single volunteer opportunity through ISACA, and it turned into so much more.

5 November 2025
A laptop is surrounded by a colorful digital backdrop, showcasing various abstract designs and patterns
Newsletter

Ten Top ISACA Resources for Risk Professionals

Risk professionals face major challenges in keeping pace with the constantly changing digital ecosystem, accelerated by increased enterprise adoption of artificial intelligence and other emerging technologies.

3 November 2025
Ramesh Ramani and Aparna Patil, CISA, ISO 27001 LA, ISO 22301 LI, PCI DSS Implementer
Blog Post

Securing the Deal: Addressing the Information Security Gap in Mergers & Acquisitions

While frequently overlooked, information security ramifications should be a key priority for those developing strategies both before and after a merger or acquisition.

3 November 2025
Cyber shield on a blue graphic
ISACA Journal Article

Information Security Matters: Cybersecurity and Business Continuity—A New Standard

It is a common line of thinking (or ought to be) that cybersecurity is a business matter, not only a technical one.

Author: Steven J. Ross
A networked ball, illustrating quantum computing
ISACA Journal Article

The Digital Trust Imperative: The Impact of Quantum Computing on Digital Trust

The call to action for organizations to prepare for a post-quantum cryptographical world is upon us.

Author: K. Brian Kelley
A caution sign with a finger pointing to it
ISACA Journal Article

Privacy in Practice: Responsibly Deploying Generative AI—A Safety Imperative

Generative AI is especially concerning when considering individual safety and well-being.

Author: Safia Kazi
A detailed view of a computer chip on a circuit board
ISACA Journal Article

Building Resilient Security in the Age of Quantum Computing

It is essential to to embed quantum-safe math into today’s systems through software updates and protocol changes.

Authors: Ankit Gupta and Shilpi Mittal
Hands typing on a keyboard
ISACA Journal Article

From Rules to Reasoning: How AI Is Transforming Code Security

Static application security testing (SAST) must be combined with artificial intelligence (AI) to find vulnerabilities before attackers do.

Authors: Jason Lau and Sam Ng
Cyber lock with a key hole
ISACA Journal Article

Evaluating Privacy Enhancing Technologies: Key Considerations for Security and Audit

The need to secure digital systems has never been greater. PETs are essential to this endeavor.

Authors: Ayanda Mthimkhulu, Kimentha Govender, Lerato Riba, Muhammed Loonat, and Nande Mbixo
Digital cloud and shield with a checkmark
ISACA Journal Article

Data Loss Prevention: A Blueprint

While organizations may adopt various cybersecurity strategies, protecting data remains central.

Author: Grant Hughes
Digital padlocks
ISACA Journal Article

Safeguarding Critical Infrastructure in the IoT and Edge Era

Sweeping changes to the way critical infrastructure organizations approach IoT and edge computing risk are in order.

Author: Suraj Raghupathy Iswaran
A digital lock symbolizing security and privacy in the modern online landscape, emphasizing the importance of data protection.
ISACA Journal Article

Future-Proofing Cybersecurity: A Practical Roadmap to Quantum Resilience

While the arrival of quantum computing may be years away, its impact is clear and cannot be underestimated.

Author: Pranjal Sharma
A computer chip positioned on a circuit board, showcasing detailed circuitry and electronic components.
ISACA Journal Article

Case Study: Building a Secure Retail Banking Operation From Scratch

A new bank needed a complete revamp of its application systems on a deadline that many IT professionals would consider impossibly tight.

Author: Mick Brady
Hakan Kantas
Blog Post

Operational Resilience in the Age of Artificial Intelligence

To thrive in this era of artificial intelligence, enterprises must prioritize resilience at the center of their operations, leveraging AI to anticipate and respond to business disruptions.

31 October 2025
Richard Beck
Blog Post

ISO 42001: Balancing AI Speed & Safety

Aligning with ISO 42001 can become a confidence-inspiring engine of innovation for your organization, increasing the agility and legitimacy of AI deployments.

29 October 2025
Law firm advertisement highlighting online exclusive services and consultations available through their website.
ISACA Journal Article

The Growing Cost of Compliance Debt

Avoiding compliance debt and its consequences begins with understanding how it forms, what it looks like, and the risk it presents.

Author: Advait Patel
Scholarship recipients 2025
Blog Post

ISACA Foundation Scholarship Recipients Look to the Future of Cybersecurity

ISACA Foundation Cybersecurity Month Scholarship recipients share their future plans in the field and how they see cybersecurity evolving as they grow into their careers.

28 October 2025
Pranjal Sharma
Blog Post

When Air-Gaps Vanish: Making IT and OT Play Nice

With IT and OT boundaries becoming less distinct over time, addressing the vastly expanding attack surface becomes a significant challenge for security professionals.

27 October 2025
Maria Koslunova
Blog Post

ISACA Tech Trends Data Reinforces Need for Culture of Resilience

ISACA’s 2026 Tech Trends and Priorities Pulse Poll points to the need for organizations to develop and prioritize a culture marked by resilience, innovation and preparedness.

24 October 2025
Steven Lawrence
Blog Post

How the Updated CRISC Can Be Beneficial to Security Professionals

The updated CRISC exam covers key risks related to artificial intelligence and machine learning, providing security practitioners the knowledge they need to adapt frameworks, risk registers and compliance layers to keep pace with the evolving landscape.

23 October 2025
A hand gripping a light bulb, accompanied by the phrase "online exclusive" in bold lettering.
ISACA Journal Article

Collective Intelligence: A Systemic Debt in the Cybersecurity Community

In the face of increasingly sophisticated attacks, the lack of collective intelligence between cyberprofessionals is a systemic debt.

Author: Andres Almanza
Caroline Petroque
Blog Post

Navigating Cyber Incident Disclosure Demands Across Jurisdictions: Toolbox for a Fintech CISO

Caroline Petroque-Gomer shares proven strategies for fintech CISOs to mitigate risk and boost regulatory compliance across countries.

21 October 2025
Patience Ogunbona
@ISACA Article

Building Charisma and Executive Presence for Your Career and Leadership Path

When you think about career growth, most people focus on skill acquisition, certifications, or climbing the organizational chart.

20 October 2025
@ISACA Article

ISACA Looks Ahead to Top Tech Trends of 2026

2026 will be a challenging year for technology leaders, many of whom will have artificial intelligence top of mind as both a leading priority and point of concern.

20 October 2025
Visual representation of AI applications in business, highlighting innovation and efficiency in various industries.
Blog Post

ISACA 2026 Tech Trends and Priorities Pulse Poll Reinforces High Stakes of AI Preparedness

ISACA's 2026 Tech Trends and Priorities Pulse Poll shows that dealing with the implications of artificial intelligence, the increasingly complex cyber risk landscape and solidifying regulatory/compliance preparedness will be top of mind for digital trust professionals in 2026.

20 October 2025
Ayseli Sen, CISA, CRISC, CFE, CIA, CPA, CRMA and Farah Sammour, CISA, CRISC
Blog Post

Ready, Set, Remote Audits: Mastering the Art of Virtual Assessments

Adapting to remote audits is not just a necessity but a strategic advantage. By embracing digital protocols, managing evidence carefully, and maintaining strong communication, auditors can enhance their audit techniques while meeting the dynamic needs of today's workforce.

22 December 2025
Tamim Ahmed
Blog Post

Responsible Use of AI in IT Risk Management: A Balance of Innovation and Ethics

Many organizations are turning to AI to help manage their IT risks. However, while AI increases efficiency and power, it also increases responsibility, particularly in terms of ethics.

17 October 2025
A visual representation of the evolving legal landscape, highlighting the role of artificial intelligence in shaping future laws.
ISACA Journal Article

Leveraging Automation for Enhanced Risk Assessment

Automation utilizing data points can reduce the dependency on inaccurate risk assessments performed by application owners.

Author: Rajendra Jakku
Brain illustration on a blue background with white text overlay, emphasizing neurological concepts.
Blog Post

How to Better Integrate AI into Your Security Program

A step-by-step approach to integrating artificial intelligence into information security programs, including aligning initiatives with clear business objectives, can put security teams on stronger footing.

13 October 2025
Alfonso Lopez Moreno
Security Article

Secure Management of Former Employee Data: A Practical Approach

One of these areas for improvement has to do with the actions taken when an employee departs from an organization. The moment an employee leaves the organization marks the start of a series of critical actions related to information security and regulatory compliance that frequently goes ignored.

10 October 2025
Sandeep Dommari
Blog Post

Digital Trust as a Strategic Asset: Why CISOs Must Think Like CFOs

When it comes to conveying the value of digital trust to their organizations, CISOs need to think like CFOs and find a balance between technical considerations and measurable business results.

9 October 2025
Chidambaram Narayanan
Blog Post

CISA, CISM and CISSP: Why They’re More Complementary Than Competing

ISACA's CISA and CISM certifications pair well with the CISSP credential, and ISACA's new AI credentials can make that blend of credentials even more impactful.

8 October 2025
Visual representation of online exclusive security and compliance measures for enhanced digital protection.
ISACA Journal Article

What It Means to Be Compliant

Whether regulatory requirements lead to benefits or wasted effort ultimately depends on the organization’s approach to them.

Author: Tom Schneider
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Buying AI? You Are Also Buying Risk, Here is How to Manage It

Procurement is now a strategic control point and one of organizations’ first lines of defense for managing AI risk.

6 October 2025
ISACA's 2025 State of Cybersecurity report
@ISACA Article

Cybersecurity Staffing Challenges Persist, With Adaptability and Soft Skills in High Demand

Adaptability is now the top qualification factor for cybersecurity professionals, ISACA’s 2025 State of Cybersecurity report found.

6 October 2025
Rajasekharan Kr
@ISACA Article

From Shadow IT to Shadow AI: Navigating the New Frontier of Enterprise Risk

In today’s fast-paced digital landscape, agility is everything. Employees are constantly seeking faster, more efficient ways to get their work done, often turning to tools and platforms outside the purview of their IT/ICT departments.

6 October 2025
Advait Patel
Blog Post

Serverless Security Risks Are Real, and Hackers Know It

Serverless development appears to be an ideal solution for programmers. However, attackers take advantage of the specific security weaknesses found in serverless platforms.

6 October 2025
Brennan Baybeck
Blog Post

Staying Involved: My Reflection on Years of ISACA Volunteering and Board Service

Longtime ISACA volunteer and Board leader Brennan P. Baybeck shares what has motivated him to stay connected to the ISACA community, year by year and decade by decade.

3 October 2025
Greg Sullivan
Security Article

Securing Legacy OT Systems in the Modern Threat Environment

Organizations must significantly decrease their willingness to accept risk and strongly increase their commitment to better monitor and secure these environments.

3 October 2025
ER Kritka
Blog Post

From Phishing to Neuro Phishing: A New Frontier in Cognitive Tech Warfare

Counteracting the rising menace of neurophishing will require a “cognitive firewall" that combines AI ethics, digital literacy, neuroscience and behavioral psychology.

1 October 2025
Gabriela Hernández-Cardoso
Blog Post

Major Growth Opportunities Ahead for ISACA in Latin America

ISACA is poised for growth in Latin America by taking steps forward in localization, member engagement and advocacy, as well as benefiting from a new accredited training program for chapters.

30 September 2025
A street scene featuring several cars parked and driving along the road under a clear blue sky.
ISACA Journal Article

Cybersecurity, Mobility, and the Connected Ecosystem

As digitalization and transportation converge, protection against cyberattacks has become increasingly critical.

Author: Soheil Nazem
Cyber security shield on a blue background
Blog Post

Roundtable Q&A: 2025 State of Cybersecurity

Cybersecurity professionals from around the world recently weighed in on some of the key findings from ISACA’s latest State of Cybersecurity survey report.

29 September 2025
Jeff Wade
Blog Post

Adaptability Over Experience: Why Cybersecurity’s Top Talent Trait Has Changed, and What It Means for Leadership

At a time when keeping pace with artificial intelligence and the evolving threat landscape is no small task, organizations increasingly are valuing adaptability as a top trait for their cybersecurity professionals.

29 September 2025
Mohamed Isa Hammad
Blog Post

ISACA Innovative Solutions Award Winner Emphasizes Human-Centric Security

Mohamed Isa Hammad was recognized this year with the ISACA Innovation Solutions Award for spearheading initiatives that reduced fraud cases and breaches.

26 September 2025
Alex Mathew
Emerging Technology Article

The Rise of Shadow AI: Auditing Unauthorized AI Tools in the Enterprise

Shadow AI resembles shadow IT, a problem associated with unauthorized technological innovations circumventing formal enterprise IT controls.

26 September 2025
Hakan Kantas
Blog Post

ISACA Career Catalyst Stories: Hakan Kantas, Managing Partner & Principal Consultant

Hakan has been an ISACA member for 15 years, and is one of the earliest members in Istanbul, Turkey. Learn more about his journey with ISACA.

25 September 2025
Richard Beck
Blog Post

The Rise of the Agentic AI Defender

Agentic AI can serve as a powerful tool for security teams, enabling them to transition from a reactive to proactive security posture.

24 September 2025
AI application for Android, represented as an APK file, highlighting its mobile capabilities and user interface.
ISACA Journal Article

Unlock Safe AI Acceleration With Clear Governance

Although business leaders increasingly recognize the risk related to AI, structured governance often lags.

Authors: Kannappan Sekar and Ruchi Khurana
ShanShan Pa
Blog Post

The Shared Responsibility Model for Responsible AI

The AI Shared Responsibility Model is foundational for organizations working toward implementation of responsible AI systems.

23 September 2025
Andre Porsch
Blog Post

Three Penetrating Leadership Questions to Create a Cyber Resilient Culture

Posing these three straightforward questions to executives is the best way to work toward building the cyber-resilient culture that all organizations need.

19 September 2025
Bhavya Jain
Emerging Technology Article

Collaboration and the New Triad of AI Governance

The traditional boundaries between privacy, cybersecurity, and legal functions must give way to integrated governance if organizations are to meet emerging regulatory expectations, reduce systemic risk, and preserve trust in a future increasingly shaped by artificially-derived decisions.

19 September 2025
John Pouey
Blog Post

Why AAISM is the Next Step for CISMs

ISACA's new Advanced in AI Security Management (AAISM) credential is a natural next step to layer AI expertise for those who hold the CISM credential.

17 September 2025
Collin Beder
Emerging Technology Article

A New Era of App Development

Vibe coding refers to the practice of developing software applications through the use of natural language instructions with the assistance of generative artificial intelligence (gen AI) systems and agentic AI.

17 September 2025
An illustration of "The Mind Games," a puzzle game with diverse challenges aimed at enhancing cognitive skills and problem-solving.
ISACA Journal Article

Using Psychology to Build a Smarter, Human-Centered Cyberdefense

As the number of cyberattacks continues to rise globally, there is a growing need to understand the human elements at play.

Author: Kelven M. Leverett
Maman Ibrahim
Blog Post

Unseen, Unchecked, Unraveling: Inside the Risky Code of Self-Modifying AI

When it comes to autonomous and self-modifying AI, organizations should invest in tailored audit frameworks or risk facing unpredictable and potentially disastrous outcomes.

16 September 2026
Sonia-Rose Lyle
@ISACA Article

From Theory to Practice: A Cybersecurity Professional’s Guide to Risk Registers

A risk register is more than just a list; it's a dynamic framework for prioritizing and managing security risks in a way that aligns with business objectives.

15 September 2025
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

Sharpen your Spidey Sense: Seven Ways Auditors Can be Superheroes, Not Just Question Machines

A good auditor doesn’t just find issues—they sense what matters, communicate with empathy, and prioritize what adds value.

15 September 2025
Julie Chatman
Blog Post

Is Your Cybersecurity Team the ‘Department of No’? What Smart Business Leaders Do When Cybersecurity Blocks Progress

Friction between the cybersecurity team and the business can keep organizations from innovating the way they need to, but key mindset shifts can reposition cybersecurity as a partner instead of an obstacle.

15 September 2025
Dhaval Deepak Joshi, CISA, CDPSE
Blog Post

Leading with Integrity: Why Courageous Governance is the New Competitive Edge

At a time in which technology outpaces our capacity to have all the needed guardrails in place, effective governance goes beyond merely following rules and checklists.

12 September 2025
Beyond the Checklist: Embedding Ethical AI Principles in Your Third-Party Compliance Assessments
Blog Post

Beyond the Checklist: Embedding Ethical AI Principles in Your Third-Party Compliance Assessments

As artificial intelligence increasingly is embedded into companies' products and services, ethical implementations must be treated as a foundational requirement.

11 September 2025
Omotayo F. Salako
Blog Post

When Cyber Meets Physical: Practical Paths for Digital Trust Professionals

Omotayo F. Salako shares practical ways digital trust professionals can embrace and safeguard the powerful convergence of cyber-physical systems.

11 September 2025
Rashmi Tallapragada
Security Article

Beyond NIST: Why Compliance Standards Fall Short in the PCN World

For most organizations, aligning with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) feels like a logical choice.

11 September 2025
Optimizing Supplier Cyberrisk Assessment
ISACA Journal Article

Optimizing Supplier Cyberrisk Assessment

Cyberattacks targeting suppliers have become increasingly common, with a number of high-profile cases drawing significant attention in recent years.

Authors: Sergeja Slapničar and Tim Vidmar
Graduation cap graphic illustrating the milestone of completing an academic program.
Blog Post

The Transition from IT Risk Management to Academia

Khadiza Laskor shares the journey of leaving a nearly 20-year career in IT audit, compliance, and risk management to pursue a PhD in cybersecurity.

8 September 2025
AI Reshaping Risk and Governance: Top Takeaways from GRC Conference 2025
Blog Post

AI Reshaping Risk and Governance: Top Takeaways from GRC Conference 2025

The recent GRC conference, from ISACA and The IIA, focused on how emerging technologies are changing responsibilities for GRC professionals and how practitioners can take action to continue to excel.

5 September 2025
Rajiv Dewan
Blog Post

Non-Human Identities: The Next Big Challenge for Organizations

Maintaining an inventory of all machine identities and assigning ownership for all non-human identities are among the key steps that can improve organizations' identity management.

3 September 2025
Online exclusive banner promoting the best online banking software with a modern design and user-friendly interface.
ISACA Journal Article

SOX IT Control Optimization: Driving Risk-Based Efficiency and Stronger Governance

A SOX Act IT control rationalization initiative helped one organization modernize its compliance environment.

Author: Ravi Sharma
ISACA CommunITy Day
@ISACA Article

ISACA CommunITy Day 2025 Is Fast-Approaching: Make a Difference

Join ISACA for our seventh annual CommunITy Day on Saturday, 4 October.

2 September 2025
ISACA Advanced in AI Security Management Credential
@ISACA Article

ISACA Introduces Advanced in AI Security Management Credential

ISACA has launched its new Advanced in AI Security Management (AAISM) certification, which enables security professionals to demonstrate their ability to implement enterprise AI solutions while being able to identify, assess, monitor and mitigate related risks.

2 September 2025
Marcel Rieger
Blog Post

Is Artificial Intelligence Rewriting Our Perception of Truth and Trust?

Artificial intelligence is driving sophisticated social engineering and deepfake threats, putting more pressure than ever on digital trust professionals to preserve truth, trust and their companies' reputations.

2 September 2025
Nirupam Samanta
Emerging Technology Article

The Growing Challenge of Auditing Agentic AI

Agentic AI presents a growing challenge for audit and governance functions, primarily because its decision-making processes often lack clear traceability.

2 September 2025
A hand with a glowing light illuminates a network
ISACA Journal Article

Information Security Matters: Artificial Intelligence and Entry-Level Cybersecurity Jobs

There are a lot of openings for cybersecurity professionals. To a certain extent, AI may ease this shortage.

Author: Steven J. Ross
A hand grasping a badge with a check mark, indicating success or confirmation
ISACA Journal Article

The Digital Trust Imperative: Compliance Fuels Digital Trust

Compliance is key when it comes to operating in a digital ecosystem.

Author: K. Brian Kelley
Close-up of a fingerprint scanner, showcasing the technology used for biometric authentication
ISACA Journal Article

A Strategic Model for Compliance-First IAM

A compliance-first IAM model will help enterprises enhance their security posture and ultimately achieve compliance.

Author: Vatsal Gupta
A finger pointing to a globe
ISACA Journal Article

The Digital Trust–Compliance Nexus

The trust–compliance nexus transforms compliance into a strategic enabler of digital trust and resilience.

Author: Pranjal Sharma
A digital shield with a padlock in the middle
ISACA Journal Article

Event-Driven User Access Revalidation: A Proactive Approach to Compliance and Digital Trust

Event-driven user access revalidation can dramatically improve regulatory compliance, risk management, and digital trust.

Authors: Durgaprasad Balakrishnan and Aadithya Francis
Digital image of a computer set against a blue background, highlighting a sleek and contemporary tech aesthetic.
ISACA Journal Article

Data Sovereignty in the Age of Generative AI: A New Compliance Frontier

Data sovereignty can become a blind spot for organizations if it is not considered when adopting generative AI.

Author: Aparna Achanta
Visual representation of earth law intertwined with the law of nature, highlighting their interconnected principles.
ISACA Journal Article

Making Sense of Regulatory Changes in a Global Economy

Different regulations with distinct objectives can create conflict for organizations that operate across regions.

Author: Sumit Sharma
A visual representation of mobile medical applications on mobile devices, illustrating tools for health management and consultations.
ISACA Journal Article

Coordinated Vulnerability Disclosure in Medical Device Manufacturing

As connected medical devices become integral to patient care, cybersecurity vulnerabilities threaten safety, data integrity, and healthcare continuity.

Author: Jayakumar Sundaram
A computer screen displaying a padlock, illustrating the importance of cyber security and data protection measures.
ISACA Journal Article

Case Study: Rewriting the Risk Playbook Through AI-Enabled Third-Party Risk Management

To scale securely, the GBC required a new playbook—one driven by automation, intelligence, and integration.

Author: Katie Teitler-Santullo
Richard Beck
Blog Post

Cyber Insurance in Crisis with AI Blind Spots

Artificial intelligence services used by third-party vendors are complicating the cyber insurance landscape, as no policy can cover what it can not see.

29 August 2025
Tim Sattler
Blog Post

How ISACA Is Building the Next Generation of Leaders

Leadership development is a valuable component of ISACA membership, including opportunities to develop those skills at the local chapter level and leadership-themed webinars, conference sessions and courses.

28 August 2025
Jayakumar Sundaram
Blog Post

Why Smart Organizations Still Choose Structured Processes in the Age of AI

Despite artificial intelligence becoming increasingly prevalent, structured process maturity is still needed for organizations to achieve efficiency, trust and long-term performance.

27 August 2025
Michael Podemski
Audit Article

The Future of IT Audit: Embracing Agile and Continuous Learning

Today's IT auditors are agile, curious, and committed to continuous learning, ensuring that they remain effective and relevant in the face of new challenges.

27 August 2025
ER Kritka
Blog Post

Five Ways AI Is Changing the Threat Landscape

Discover the five critical ways in which AI is changing the threat landscape as we know it – and what we need to do in response.

25 August 2025
Sandeep Dommari
Blog Post

Adaptive Identity Is the Future of IAM and Zero Trust Alone Won’t Get Us There

When it comes to Identity and Access Management, it's time to move away from fixed rules and instead focus on adaptive, risk-aware identity management that evolves in real time.

21 August 2025
Online exclusive promotion for the best app available only through digital platforms.
ISACA Journal Article

Automating the RMF: A Necessary Evolution

By integrating automation into risk management, organizations can enhance their security posture and reporting accuracy while reducing administrative burden and overhead.

Author: Davida Maria Futch
AAISM
Blog Post

ISACA Advanced in AI Security Management (AAISM) FAQs

Learn more about AAISM through these frequently asked questions.

19 August 2025
Danephraim Endashaw
@ISACA Article

Beyond the Black Box: An Auditor’s Guide to AI Models, Considerations and Requirements

AI is reshaping how organizations operate, innovate, and compete, ranging from customer service chatbots to sophisticated fraud detection systems.

18 August 2025
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Crisis as Catalyst: What the M&S Breach Teaches Us About Cybersecurity Decision-Making

Cyberattacks often make headlines due to dramatic ransomware demands, system shutdowns and delayed response efforts.

18 August 2025
Goh Ser Yoong
Blog Post

How AAISM Can Differentiate Information Security Managers

As AI systems become increasingly sophisticated, the need for pragmatic and robust security management is paramount.

18 August 2025
Andre Porsch
Blog Post

Three Simple But Powerful Strategies to Radically Transform Cybersecurity Culture

Disengaged leadership is often at the core of organizations' cybersecurity failures, but that inadequate culture can be turned around through a few straightforward, practical steps.

18 August 2025
Osman Azab
Blog Post

Building Unshakable Foundations: Why Effective IT Audit is Your Key to Cyber Resilience

Osman Azab previews his upcoming session at ISACA Europe Conference on enhancing cyber resilience through effective IT audit practices.

15 August 2025
Mary Carmichael
Blog Post

Is Vibe Coding Ready for Prime Time?

'Vibe coding' is bringing new approaches for software development, but the speed of code generation makes putting in place strong controls and accountability even more critical.

13 August 2025
Leading online security software, emphasizing its role in enhancing cybersecurity for users
ISACA Journal Article

A Proposed Model for Reasonable Cybersecurity in a Digital Ecosystem

An organization may believe it is protected on all fronts, but the entire attack surface cannot be equally protected in every position. This can have unpredictable consequences.

Author: Luigi Sbriz
Shruthi Gnana
Blog Post

Effective Change Management to Mitigate AI Risks

Shruthi Gnana shares potential risks with the AI model change process and recommendations for reducing risk.

11 August 2025
Keith bloomfield deweese
Blog Post

AI Agents and Agentic AI: Understanding the Difference That Matters for Your Organization

By understanding the differences between AI agents and agentic AI, organizations can make better decisions about which AI solutions best fit their business goals.

8 August 2025
Maman Ibrahim
Blog Post

Proven Strategies to Supercharge Your Cyber Risk Strategy

A Risk Operations Center can serve as a critical survival tool and business enabler that allows organizations to deal with escalating cyber risk in smarter and more rapid fashion.

7 August 2025
Aparna Achanta
Emerging Technology Article

The New Oil, the New Risk: Data Security in the Era of AI, Cloud, and IoT

Securing data is a highly challenging task and is quickly becoming a top priority for organizations as emerging technologies continue to advance and shape the way data is handled.

7 August 2025
Ravikumar Ramachandran
Blog Post

Five Reasons IT Governance Should Not Be Overlooked

The consequences of insufficient IT governance during a time of digital disruption and heavy reliance on technology should convince enterprises to put good governance front and center.

6 August 2025
Visual representation of top online courses for business professionals, highlighting various subjects and learning formats available.
ISACA Journal Article

Cybersecurity Governance and Risk Management in Smart Manufacturing

The transformation of industrial manufacturing into a digital-first, AI-driven ecosystem has introduced an era of unprecedented cyberrisk complexity.

Author: Jarvis Tyrell Curry
Isla Sibanda
Emerging Technology Article

Combating the Threat of Adversarial Machine Learning to AI-Driven Cybersecurity

Due to their vast potential, these tools and their implementation have become the top focus for AI spending in most tech budgets. However, as these technologies become more sophisticated, they also present new vulnerabilities.

5 August 2025
Warning sign with an exclamation point
@ISACA Article

How to Conduct an AI Impact Assessment

Organizations are ramping up their use of AI to make business processes more efficient. Adoption is high, and the same goes for the advancement of the AI models powering this technology.

4 August 2025
Threat Modeling Revisited
@ISACA Article

New ISACA White Paper Highlights Threat Modeling Strategies

One of the best ways to prevent data leaks and other security breaches is establishing effective threat modeling.

4 August 2025
Emily Bastedo
Blog Post

New US Legislation Enhances Access to ISACA Trainings and Certifications

A new policy will help US-based credential candidates fund ISACA certifications and training through their 529 savings accounts.

4 August 2025
Chris McGowan
Blog Post

Threat Modeling = Proactive Security

ISACA’s white paper, Threat Modeling Revisited, provides a step-by-step process for organizations to integrate threat modeling into their security frameworks.

31 July 2025
Safia Kazi
Emerging Technology Article

Moving Beyond the AI Hype

The developers of AI products and business leaders may not be asking the important questions—or worse, they are disregarding the troubling answers to these questions...

31 July 2025
James Omorogbe
Blog Post

Multilayer Zero Trust Security: A Blueprint from Biological Cell Architecture

Evolutionary intelligence on display in nature offers a blueprint for modern digital defense, particularly when it comes to approaches to zero-trust security.

30 July 2025
Purple background with starbursts
ISACA Journal Article

Keeping Pace With the Evolving Software Ecosystem

As software continues to play a greater role in everyday life, it is crucial to be able to understand and control it.

Author: C. Warren Axelrod
A digital padlock
Blog Post

Defending Against Human-Operated Ransomware Attacks

Successful defense against human-operated ransomware attacks can benefit from categorizing key capabilities into the themes of Reduced Attack Surface, Enhanced Detection, Effective Response and Robust Recovery.

28 July 2025
Tolgay Kizilema
Blog Post

Security Culture as a Measurable, Strategic Asset

Effective security culture is a must for organizations or even the most well-structured compliance programs struggle to deliver the desired, sustainable results.

25 July 2025
George McPherson
Blog Post

AI Governance and the Need for Auditors Well-Trained in AI

Auditors have a key role to play in a healthy AI governance ecosystem, and the new AAIA credential can help audit professionals be better prepared to rise to the occasion.

24 July 2025
Visual representation of the first online eco-friendly shopping platform, highlighting its commitment to sustainability and eco-conscious products.
ISACA Journal Article

From Risk to Reward: Harnessing AI for Environmental Sustainability

Despite AI's potential, it also involves new risk. Any failure of implementation or data quality variance may worsen the environmental landscape rather than protect it.

Author: Adam Ennamli
Rajiv Dewan
@ISACA Article

Bridging the Gap: Making Disconnected Applications Work

Organizations still need to govern these applications to meet regulatory & compliance needs and to reduce security risks.

21 July 2025
A man walks through a vibrant futuristic city filled with sleek buildings and advanced technology.
@ISACA Article

Designing Your Career Roadmap

Careers in tech can be highly rewarding but they require staying up to date on the latest threats, risks, regulations and more.

21 July 2025
Caroline Petroque
Blog Post

Creating Winning Cyber Transformation Business Cases

Learn five proven tactics to win executive support for cybersecurity business cases, beginning with the importance of knowing your audience and tailoring your messaging accordingly.

21 July 2025
Charles Cresson Wood
Blog Post

The New Role of the Chief Artificial Intelligence Risk Officer (CAIRO)

As artificial intelligence introduces new risks that are not yet fully understood, adding a Chief Artificial Intelligence Risk Officer could help organizations sharpen their preparedness.

17 July 2025
Cover showcasing dynamic artwork against a colorful background.
ISACA Journal Article

The Case for AI-Powered Vulnerability Management

Recent advancements in artificial intelligence (AI) and machine learning (ML) have paved the way for the transformation of vulnerability management.

Author: Ritesh Gupta
Isheanesu Sithole, AAIA, CISSP, CISA, CISM, CRISC, COBIT D&I, ISO27k LI, ISO27k LA, CDPO
Blog Post

Advancing Your IT Audit Career with AI Expertise: An AAIA Success Story

Find out how pursuing the ISACA Advanced in AI Audit (AAIA) credential has left audit professional Isheanesu Sithole feeling empowered with expanded confidence and new capabilities.

15 July 2025
Natalie Hingco Perez
Blog Post

ISACA Career Catalyst Stories: Natalie H. Perez, Internal IT Audit Manager

Natalie Hingco Perez utilized ISACA resources to accelerate her early career growth, and more recently has developed her leadership skills through various roles with the ISACA Melbourne Chapter.

14 July 2025
Onur Korucu
Blog Post

The Compliance-Innovation Dilemma: Rethinking Data Protection and Privacy for Emerging Technologies

Explore how principles like data minimization, federated learning and differential privacy are not just compliance tools, but also innovation enablers.

10 July 2025
Justin Rende
Emerging Technology Article

Organizations Need More Than Book Smart AI

AI excels at processing information but lacks emotional intelligence. Without this, it cannot form human connections or successfully lead within an organization

10 July 2025
A visual representation of top industrial IoT solutions showcasing connectivity and smart technology in action.
ISACA Journal Article

Understanding and Maintaining Trust in the Software Supply Chain

To secure valuable data, organizations need to implement digital trust in software supply chains; however, several key challenges, vulnerabilities, and risk factors must be addressed to establish trust.

Author: Imran Khan
Luigi Sbriz
Blog Post

The Challenges of Measuring Risk Culture

Evaluating risk culture requires being able to examine significant indicators of decision-making processes, their daily implementation, the monitoring of outcomes and the responses to challenges.

8 July 2025
John De Santis will remain Chair of the ISACA Board of Directors for the 2025-26 Board term while Jamie Norton will be the new Vice Chair for the coming term, ISACA announced.
@ISACA Article

ISACA Announces 2025-26 Board Slate

ISACA announces John De Santis will continue as Chair and Jamie Norton will serve as Vice Chair for the 2025-26 Board term.

7 July 2025
A brain illuminated by a spiral of light, symbolizing thought and creativity.
@ISACA Article

ISACA Research: AI Use Booms While Training Lags

ISACA’s 2025 AI Pulse Poll offers insights into AI training, skill development, and risks, shaping the future of work for digital trust professionals.

7 July 2025
Anamika Roy
Blog Post

The Control Matrix: Rebooted

Organizations should see the control matrix as it truly is—not merely a series of separate tasks to be executed, but as a cohesive ecosystem that must operate holistically.

7 July 2025
Collin Beder
Emerging Technology Article

The Reality of AI: Oversold and Underdelivered

Artificial intelligence (AI), especially generative AI, has been dominating headlines and enterprise conversations in recent years.

3 July 2025
Jeff Wade
Blog Post

Securing the Welcome: How I Transformed Onboarding into a Business-Driven Cybersecurity Strategy

Jeff Wade shares how to transform a cybersecurity onboarding program by starting early, reinforcing often, and shaping behaviors through clarity.

2 July 2025
Kyle Miller
Blog Post

Why AAIA is the Next Step for CISAs

ISACA's Advanced in AI Audit (AAIA) credential is a natural next step for CISA-certified professionals looking to layer in AI expertise into their audit and assurance qualifications.

1 July 2025
Anirudh Murali
Emerging Technology Article

Safeguarding the Enterprise AI Evolution: Best Practices for Agentic AI Workflows

Agentic AI represents a breakthrough in technological innovation, but the capabilities of AI agents remain somewhat mysterious and warrant further exploration of their essential components. Organizations must understand this new technology and implement proactive security practices to harness agentic AI, a significant force multiplier in recent times.

1 July 2025
A shield to signify safety against privacy invasion
ISACA Journal Article

Information Security Matters: Whatever Happened to Privacy?

CISOs have to deal foremost with cyberattacks today and maybe AI tomorrow. But that does not necessitate disregarding data privacy.

Author: Steven J. Ross
A man's face fingerprint displayed on a blue background
ISACA Journal Article

The Digital Trust Imperative: Biometrics—Addressing Fear and Enhancing Trust

Given the ability of threat actors to attack password-protected platforms, the digital trust community is looking for more secure login methods.

Author: K. Brian Kelley
The Earth surrounded by a network of interconnected lines and dots
ISACA Journal Article

Cybersecurity on the World’s Biggest Stage: Defending Global events from Digital Threats

Large-scale global events such as the Olympic Games, World Cups, and international summits present unique cybersecurity challenges.

Author: Krutik Poojara
A cybersecurity lock and key
ISACA Journal Article

Navigating the Future: Exploring Opportunities and Challenges of Cyber-Physical Systems

The evolution of technology has transformed human–machine relationships, resulting in an unprecedented computing environment for physical systems with digital components.

Author: Omotayo F. Salako
Blue background with white lines meeting in a glowing circle
ISACA Journal Article

The Governance Dilemma of Cyber-Physical Systems and Emissions Reduction

The paradigm of digital–physical systems, called cyber–physical systems (CPS) by ISO, has evolved significantly. CPS continues to push the frontiers of digital innovation.

Author: Guy Pearce
Digital circuit board on blue background
ISACA Journal Article

Bridging the IT/OT Security Gap

The convergence of information technology (IT) and operational technology (OT) is rapidly changing the industrial landscape due to the increased efficiency and automation it brings.

Author: Pranjal Sharma
A hand typing on a laptop
ISACA Journal Article

The Art of Remote Auditing

Two of the most significant challenges in remote auditing are enabling key relationships and accessing information. But remote audits do have numerous benefits.

Authors: Ayseli Sen and Farah Sammour
A warehouse interior with a robot navigating through the aisles
ISACA Journal Article

Automating Packaging Material Management: A Case Study of a Leading E-commerce Marketplace

When an e-commerce marketplace in Asia recognized its packaging management was inefficient, the need for an automated solution became evident.

Author: Ishtiak Hossain
Illustration of a globe with multiple currencies
ISACA Journal Article

Guarding the Financial System: Strengthening IT Governance to Combat Mule Accounts

Mule accounts, or bank accounts used for illegal financial transactions, pose a significant threat to the integrity of financial systems worldwide.

Author: Udom Netrattanagul
Abstract background in purple and blue with a glowing light trail weaving through
ISACA Journal Article

Centralized Egress Access Policies: Why They Matter in Hybrid Environments

The increasing adoption of hybrid cloud environments introduces significant security complexities, particularly regarding egress traffic control.

Authors: Aparna Patil & Ramesh Ramani
White and red dice displaying a lock symbol
ISACA Journal Article

Closing Risk Appetite Loopholes to Shore Up Security

What happens if weaknesses in an organization's monitoring and detection capabilities cloud visibility so severely that it has no idea how much risk it is truly absorbing?

Author: Mick Brady
Maman Ibrahim
Blog Post

Proven Strategies to Navigate Leadership Paradoxes in Audit and Risk

Traditional audit and risk frameworks belong to a world that no longer exists at a time of digital upheaval, but there are new opportunities to strengthen the audit and risk functions.

30 June 2025
Syed Salman
Security Article

Enhancing Security Awareness to Uplift Security Culture

Enterprises are becoming increasingly aware of advanced phishing and social engineering attacks, recognizing that a strong cybersecurity awareness culture is essential for defending against these sophisticated threats.

30 June 2025
Yuri Bobbert
Blog Post

ISACA Inspirational Leadership Award Winner Prioritizes Embracing Daily Journey

Yuri Bobbert, ISACA Inspirational Leadership Award winner, says work should be 'fun, inspiring, joyful, and healthy to help cope with failures and setbacks.

27 June 2025
Hassan Ahmed
Blog Post

No Looking Back: Transforming Audit with Artificial Intelligence

IT auditors have traditionally had to rely on looking backward at what already has happened, but with artificial intelligence transforming IT audit, a more forward-looking lens has become possible.

26 June 2025
Chasserae Coyne
Blog Post

Seven Tactics for Overcoming AI Training Obstacles

Organizations face several obstacles in providing sufficient AI training to their teams, but companies must find a way to overcome them if they are going to keep pace with the fast-moving enterprise AI landscape.

25 June 2025
Visual representation of online data protection, showcasing a shield icon with digital patterns, emphasizing security for exclusives.
ISACA Journal Article

Striking a Balance Between Value and Privacy in the Data Market

Can organizations balance harnessing the value of data with protecting consumer privacy? What is the balance between the price of privacy and the value of convenience?

Author: Adam Ennamli
Aditya Patel
Blog Post

How Security Analysts Can Elevate Their Career with ISACA’s CCOA Credential

Security analysts can sharpen their technical skills and investigative capabilities through ISACA's Certified Cybersecurity Operations Analyst (CCOA) credential.

24 June 2025
Chester Avey
Security Article

Mastering IoT Defense Strategies With Cybersecurity Education

As innovative technologies such as artificial intelligence (AI) and big data analytics evolve and as supply chains become more convoluted and intertwined, the attack surface of organizations deploying a wealth of IoT devices expands significantly.

23 June 2025
Sonia Rose lyle
Blog Post

Proactive Approaches to Identify Cyberthreats

Waiting for a cyber attack to take place before jumping into action is not a viable strategy for organizations that are serious about protecting their digital assets.

20 June 2025
Anuj Choudhary
Security Article

Trapped Virtually: Understanding Digital Arrest Scams

As cyberscams grow increasingly complex and difficult to detect, it is imperative that cybersecurity professionals not only recognize the severity of these scams but also take proactive measures to fortify both personal and organizational defenses.

20 June 2025
Muneeb-imran-shaikh
Blog Post

AI Governance: Dynamics of Legitimacy, Fairness and Transparency

Muneeb Imran Shaikh writes about the need for legitimacy, fairness and transparency in artificial intelligence practices.

18 June 2025
A collection of vibrant cubes displaying the text "online exclusive" in a bold font.
ISACA Journal Article

The Measurability of Risk Culture

How a system is implemented depends on the organizational culture. Its effectiveness is demonstrated by the risk profile.

Author: Luigi Sbriz
Renaldo Jack
Blog Post

Fortifying the Operational Technology Sector: Battle-Tested Cyber Resilience Strategies

Battle-tested operational technology cybersecurity strategies starts with performing an OT cyber risk assessment and includes focus on foundational controls and multilayered network security.

17 June 2025
A brain integrated into a circuit board, illuminated by blue lights, symbolizing the fusion of technology and intelligence.
@ISACA Article

Upleveling AI Governance to Enhance Trust

Today’s AI systems are dynamic, complex and deeply embedded into business operations. Managing them requires more than traditional controls. It demands a governance model that is strategic, adaptive and deeply cross-functional.

16 June 2025
Woman laughs with two men and another woman during a meeting, creating a lively and engaging atmosphere.
@ISACA Article

Want to Beat Burnout? Start Having More Fun

Fun isn’t just good for your personal life—it’s a powerful tool for professional success.

16 June 2025
Krishan Bagla
Blog Post

A Practical Approach to Integrating Vulnerability Management into Enterprise Risk Management

Organizations can strengthen their vulnerability management and improve their risk posture without expensive tools by utilizing existing resources, fine-tuning internal processes and creating a security-aware culture.

13 June 2025
David Foote
Blog Post

Versatilists in the Vanguard: Why the Future of Info/Cyber Security, Audit, Risk and Privacy Belongs to the Agile

Versatilists connect dots and adapt, characteristics that increasingly are in demand by employers as the digital trust landscape becomes more complex and interconnected.

11 June 2025
Bhavya Jain
Security Article

Cyberwargaming in 2025: Why Enterprises Cannot Afford to Skip It

Cybercriminals are constantly refining their tactics, and many organizations fail to keep pace with newly evolved threats due to inadequate security training and obsolete IR plans.

11 June 2025
Blue backdrop and a striking white design element.
ISACA Journal Article

Unified SASE as a Service: Toward Agile Security Incident Response

Unified secure access service edge as a service empowers organizations to adapt quickly to dynamic needs and enhance their overall cybersecurity posture.

Author: Aditya K Sood
Jas Gill, CISA, CISM, Senior Internal Audit Manager at RELX
Blog Post

ISACA Career Catalyst Stories: Jas Gill, CISA, CISM, Senior Internal Audit Manager at RELX

ISACA member Jas Gill says her audit career has progressed since tapping into ISACA credentialing and learning resources, with an emphasis on auditing emerging technologies.

6 June 2025
Aamir Jamil
Blog Post

DORA and NIS2: Connection Points and Key Differences

Compliance with the DORA and NIS2 regulations should not be viewed only as a regulatory obligation but as a strategic opportunity to strengthen digital trust.

5 June 2025
Screenshot of an online exclusive offer, highlighting special deals available only through the website.
ISACA Journal Article

The Future of Auditing: Combining Artificial Intelligence and Agile Scrum for Dynamic Risk Management

By bringing together the power of AI and the step-by-step methods of Agile Scrum, exciting new possibilities are available to internal auditors.

Author: Thomas J. Bell III
Chidambaram Narayanan
Blog Post

Iron Man’s Due Diligence: How Tony Stark Would Audit J.A.R.V.I.S. Before Deployment

Would your artificial intelligence audit align with industry standards in governance, risk and cybersecurity, and pass an Iron Man-level due diligence check?

3 June 2025
Patience Ogunbona
@ISACA Article

Communicate to Connect: How to Unlock Career Growth Opportunities

Discover how developing clear, confident communication can elevate your career, improve team dynamics, and drive long-term success.

2 June 2025
A vibrant shield design displayed on a circuit board, showcasing a blend of technology and color.
@ISACA Article

Six Takeaways from the 2025 RSA Conference

Several ISACA members attended RSA Conference in San Francisco, California. Read their top takeaways, especially on industry trends involving AI.

2 June 2025
Mohammed J. Khan
Blog Post

The Evolving Connection Points Between AI and Audit

The integration of artificial intelligence (AI) in the audit profession is rapidly transforming how auditors work, enhancing skills development, improving efficiency, and revolutionizing risk analysis and monitoring processes.

30 May 2025
Glenda Suarez Cabrera
Blog Post

Five Mistakes Leading to a Biased Information Security Training and Awareness Program – and How to Avoid Them

Building a quality information security training and awareness program capable of elevating organizations requires intention, investment and a willingness to evolve.

29 May 2025
Online exclusive graphic illustrating risk management strategies and tools for businesses.
ISACA Journal Article

Revisiting the Risk Equation: A Comprehensive Look at Measuring Control Strength in Cybersecurity

By examining control strength in multidimensional terms, security professionals achieve a better understanding of how controls function.

Author: Jack Freund
Advait Patel
Blog Post

Zero Trust in the Age of AI: Securing Cloud Environments Against Evolving Threats

The number of AI-powered attacks continues to grow and are becoming more difficult to detect, and security models using traditional methods are no longer effective.

27 May 2025
Sumit Sharma
Blog Post

Automation and AI/ML Opportunities in Third-Party Risk Assessment

Automation and artificial intelligence/machine learning can set in motion a smarter, faster and more scalable future for third-party risk management.

22 May 2025
Alaina Lawson
Blog Post

Beyond the Moat: Modern Defense- in-Depth Strategies

Just as medieval castles depended upon more than a single knight to stave off potential attacks, modern organizations need a deep arsenal of security tools to protect their critical assets.

21 May 2025
Biotechnology and IT Governance: Ethical and Security Implications for IT Professionals
ISACA Journal Article

Biotechnology and IT Governance: Ethical and Security Implications for IT Professionals

Biotechnology has become the backbone of data-driven healthcare. With this advancement comes significant ethical and security challenges.

Author: Alexis Collier
Chelson Chong, and Meng Fai Chan, CISA, CDPSE, CISSP, GRID
Audit Article

Harnessing GenAI to Improve Audit Work Efficiency Through Proper Planning

GenAI has the potential to improve the audit function’s efficiency and effectiveness. However, the use of GenAI does not come without risk, and organizations should be aware of that risk when implementing GenAI. It is of the utmost importance to identify and mitigate risk before implementing GenAI or any emerging technology.

20 May 2025
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

How to Conduct a Quantum Risk Assessment Using ISACA’s Risk IT Framework

Could organizational encrypted customer data be at risk before quantum computing becomes mainstream?

19 May 2025
ISACA 2024 Annual Report Showcases Future Focus
@ISACA Article

ISACA 2024 Annual Report Showcases Future Focus

The 2024 ISACA Annual Report highlights ISACA’s renewed focus on preparing members to thrive amid the dynamic technology landscape.

19 May 2025
Man looking at a computer screen
@ISACA Article

Top ISACA Resources for Auditors to Keep Pace with AI

Artificial intelligence is reshaping the audit profession – to the extent that 70% of audit/assurance professional respondents to ISACA’s 2025 AI Pulse Poll believe they will need to increase their skills and knowledge in AI within the next year to advance their career or even simply retain their jobs.

19 May 2025
Abdul Jaleel
Blog Post

Five Ways that IT Auditors Can Put AI to Good Use

The success auditors have in leveraging artificial intelligence is dependent upon balancing the technological capabilities with sound governance, clear objectives and a thorough understanding of audit standards.

19 May 2025
Wojciech Misiura
Blog Post

Why IT Auditors Need AAIA: Addressing AI Challenges in Audit

The new ISACA Advanced in AI Audit (AAIA) credential equips auditors for a changing landscape in which artificial intelligence is reshaping roles and presenting auditors with new opportunities.

19 May 2025
Deidre Diamond
Blog Post

IT/OT Convergence: An Era of Interconnected Risk and Reward

Successful IT/OT convergence comes down to aligning three distinct paradigms: IT Operations, OT Operations and Cyber Operations.

15 May 2025
Ethics, Accountability, and the Pursuit of Responsible AI
ISACA Journal Article

Ethics, Accountability, and the Pursuit of Responsible AI

Addressing accountability in AI deployment is essential to safeguarding integrity and societal well-being. This will require increased transparency within explainable AI and strengthened ethical governance.

Author: Joshua Scarpino
Netwrix podcast
Podcast

Securing Desktops and Data from Ransomware Attacks

Ransomware remains one of the most formidable cybersecurity threats facing organizations worldwide.

16 May 2025
Ope Ajibola
Blog Post

Seven Strategies Business Leaders Can Adopt to Protect Operational Technologies and Critical Infrastructure Against Sophisticated Cyber Threats

Tailored strategies to protect critical assets are needed at a time when the attack surface is expanding, putting critical infrastructure at heightened risk.

13 May 2025
VJ Srinivas
Risk Article

Vendor Risk Assessments: Do Organizations Still Need Them?

While it is acceptable and commonplace to have work completed by another vendor based on mutually agreed contracts, the overall management of related risk is a pertinent point of attention.

12 May 2025
Natasha Barnes
Blog Post

Mindfully Befriending Your Certification Exam-Day Anxiety

Certification exam day can be stressful for exam-takers, but a mindful approach can go a long way toward constructively dealing with the nerves and improving performance.

9 May 2025
Mary Carmichael and Dooshima Dabo'Adzuana
Blog Post

Six Steps for Third-Party AI Risk Management

ISACA members Mary Carmichael and Dooshima Dabo'Adzuana shared their insights in a session on third-party AI risk at RSA Conference 2025.

8 May 2025
Shamnad Shaffi
Security Article

The Zero-ETL Paradigm: Transforming Enterprise Data Integration in Real Time

Zero-ETL offers direct data movement capabilities and advanced cloud technologies and allows for the leveraging of modern architectural patterns to enable real-time data access while significantly reducing operational complexity and costs.

8 May 2025
Detecting and Mitigating APTs in Endpoints
ISACA Journal Article

Detecting and Mitigating APTs in Endpoints

Organizations relying on standard security tools may miss sophisticated APT techniques unless they implement specialized threat intelligence and proactive monitoring strategies.

Author: Hrishitva Patel
Welland Chu
Blog Post

Fortifying Digital Defenses: The Imperative of a Unified Cybersecurity Platform

A data-driven and cost-effective strategy—centered on governance, technology, and human expertise—is the approach organizations need to improve their cybersecurity posture and resilience.

6 May 2025
A sphere
@ISACA Article

ISACA Research: Quantum Computing Preparedness Lagging

Quantum computing advancements pose a massive risk to cybersecurity and business stability, but many enterprises are not yet responding accordingly, according to new research from ISACA’s global Quantum Computing Pulse Poll.

5 May 2025
Chidambaram Karthik Narayanan, CISA
@ISACA Article

The Perfect Recipe for the Homogenius Technologicus: Next-Gen Auditors

By combining curiosity, expertise and collaboration, we can prepare auditors who are not only skilled but also inspired to drive transformative change in their organizations.

5 May 2025
Carolynn van Arsdale, Content Marketing Manager at ReversingLabs
Blog Post

The 2025 Software Supply Chain Security Report: Threats Growing and Evolving

The threat landscape facing software today is changing fast! RL’s new research report explores those changes and shares key learnings and action items.

5 May 2025
2024 Annual Report
Blog Post

ISACA 2024 Annual Report Showcases Future Focus

The 2024 ISACA Annual Report provides insight into how ISACA is working to future-proof members' careers in a time of volatility and innovation across the digital trust fields.

2 May 2025
Nivathan Somasundharam
Security Article

Protecting Kubernetes Clusters and Workloads at Scale

As organizations increasingly adopt Kubernetes for its scalability and flexibility, it is imperative to prioritize the security of both Kubernetes clusters and workloads.

1 May 2025
A hand grips a bright purple light, casting a warm glow in the dark.
ISACA Journal Article

Information Security Matters: Artificial Intelligence—Ethics and Security

Any information gained by AI should be managed so that only those who are authorized to use it may do so. The use of AI systems should be monitored to ensure that it is not being abused.

Author: Steven J. Ross
Icon with a blue backdrop and a design of connected dots representing a network.
ISACA Journal Article

The Digital Trust Imperative: Building Trust Through Transparency—Addressing Digital Exhaust

Organizations have an imperative to share what data is collected and how it is going to be used. Their choices in using said data must bring value back to the customer.

Author: K. Brian Kelley
Illustration of a checklist with a magnifier over it.
ISACA Journal Article

Privacy in Practice: Rules for Thee But Not for Me

The removal of end-to-end encryption in the United Kingdom is problematic. Additionally, governments appear to have conflicting attitudes toward privacy, which ultimately can lead to the erosion of individuals’ right to privacy.

Author: Safia Kazi
An abstract representation of digital transformation with a puzzle piece
ISACA Journal Article

AI’s Evolving Impact on the IT Risk Landscape

The impact of AI will be systemic. Accordingly, significant changes to the way professionals approach risk management for AI are in order.

Author: Charles Cresson Wood
A tree sitting on top of a globe
ISACA Journal

Rethinking ESG: Balancing Profit and Purpose

There is a need to manage the tension created by the innovation–integrity dilemma in the interests of sustainable outcomes for both people and planet.

Author: Guy Pearce
Computer waves
ISACA Journal Article

The Power of Accountability in AI Governance

Establishing AI accountability mechanisms can be straightforward, especially when leveraging governance frameworks that are already available.

Authors: Kevin M. Alvero and Ramin Kouzehkanani
Abstract futuristic background featuring vibrant neon lights in various colors.
ISACA Journal Article

Examining the Ethics of the Digital Afterlife Industry

The digital afterlife is a fast-developing area of innovation. It engages sensitive matters in the realm of ethics and emerging technologies.

Author: Khadiza Laskor
Digital icons held up with a hand
ISACA Journal Article

Behind the Machines: Uncovering Occupational Fraud in Digital Banking

Somewhere a trusted employee, embedded within the core of an institution, is secretly siphoning off resources for personal gain.

Author: Terrence Cai
A hand holding a disk with a representation of several people
ISACA Journal Article

Mergers and Acquisitions: Bracing for the Information Security Aftershock

Before deciding to enter a merger or make an acquisition, it is imperative to conduct a comprehensive analysis of the target organization's cybermaturity.

Authors: Aparna Patil and Ramesh Ramani
A finger interacting with a touchscreen
ISACA Journal Article

CMMI in the AI Age: Driving Efficiency, Innovation, and Governance

CMMI provides a framework to assess, refine, and optimize capabilities. With AI-driven insights and automation, organizations can accelerate decision making and process enhancements.

Author: Jayakumar Sundaram
Bright abstract design with dynamic lines and colorful dots creating an energetic visual effect.
ISACA Journal Article

A Practical Approach to ESA Implementation at Small and Medium Enterprises

SMEs can establish an enterprise security architecture by taking a step-by-step approach emphasizing practical strategies.

Authors: Mike Brass and Robert Campbell
Finger interacting with touchscreen
ISACA Journal Article

Optimizing Crypto Custody Operations With COBIT

A leading provider of crypto asset services strengthened its data governance framework to enhance customer experiences, drive innovation, and maintain a competitive edge.

Author: Gokhan Polat
Asaf Weisberg
Blog Post

Elevating ISACA's Impact: Building a High-Performing Board for the Future

ISACA Board Director Asaf Weisberg addresses the Board's composition and varied backgrounds in this installment of Notes from the Boardroom.

30 April 2025
Rob Clyde
Blog Post

No More Excuses for Procrastinating on Quantum Preparation

We have an urgency problem when it comes to quantum computing that is rivaling even the underlying technology challenge.

28 April 2025
Donovan Cheah
Blog Post

Preparing Our Stakeholders to Navigate Quantum Computing

Within the cybersecurity space, quantum computing has often been linked to doomsday scenarios such as the cracking of RSA.

28 April 2025
Collin Beder
Security Article

Post-Quantum Cryptography: A Call to Action

While the world has been laser-focused on artificial intelligence (AI), major advancements are occurring in quantum computing.

28 April 2025
Guy Pearce
Governance Article

Strategic CIO Responses to Today’s Leadership Trends

The strategic chief information officer (CIO) must keep an eye not only on the evolving technology landscape, but also on evolving leadership and governance trends and their inevitable dilemmas, as these factors shape IT strategy and influence the way IT productively enables enterprise value creation.

25 April 2025
Ravi Ragoonanan
Blog Post

Lessons from the CCOA: Failing Forward as a Cybersecurity Leader

A failed attempt at the CCOA exam provided important lessons learned and deepened my commitment to earning ISACA's new cybersecurity credential.

24 April 2025
Mitigating the Cybersecurity
ISACA Journal Article

Mitigating the Cybersecurity Workforce Shortage With the NIST NICE Framework

There is a dire need for workers with marketable security skills, from traditional information security to modern cybersecurity.

Author: James Baird
Ola Akinsuli
Blog Post

Adaptive Access Control: Navigating Cybersecurity in the Era of AI and Zero Trust

Adaptive Access Control, an AI-driven security approach, gives organizations a better opportunity to counteract the modern, sophisticated threat landscape.

22 April 2025
Maman Ibrahim
@ISACA Article

Proven Strategies to Uncover AI Risks and Strengthen Audits

Artificial Intelligence (AI) often conjures images of futuristic concepts. Yet, it has propelled today's business innovation.

21 April 2025
Volunteer Appreciation Week
@ISACA Article

Volunteer Appreciation Week: Get Involved with ISACA

This Volunteer Appreciation Week (20-26 April) we’re celebrating our volunteers around the world.

21 April 2025
Freeman Ng
Blog Post

ISACA Career Catalyst Stories: Freeman Ng, Principal Consultant at iSystems Security Limited

A major career change meant that Freeman Ng had to prove himself all over again, and turning to ISACA played a big part in his next phase.

21 April 2025
Massimo Migliuolo
Blog Post

ISACA’s Growing Influence as a Resource for Governments

ISACA's growing policy influence with global governments will create healthier digital trust disciplines and expand opportunities for ISACA members.

18 April 2025
Chester Avey
Security Article

Debunking Cybersecurity Myths in 2025

ITis prudent to examine and debunk some of the most overt cybersecurity misconceptions and exaggerations circulating today and provide accurate information. This empowers organizations to reinforce their infrastructure and connected assets and technologies

18 April 2025
Chidambaram Narayanan
Blog Post

Welcome to the IT Audit Awards: Ctrl + Alt + Defend Night

From Phantom Access to the Longest Audit Report and beyond, these IT Audit Awards come in many categories that might not be as much of a joke as we'd like to think.

17 April 2025
Liz Kinuthia
Blog Post

Practical Strategies to Overcome Cyber Security Compliance Standards Fatigue

Elizabeth Kinuthia shares three practical strategies cyber teams can deploy to overcome compliance fatigue.

16 April 2025
The Governance Game of Chess: Mapping ISO/IEC 27001:2022 to COBIT®
ISACA Journal Article

The Governance Game of Chess: Mapping ISO/IEC 27001:2022 to COBIT®

The opening moves in the game of chess can be used to map controls specified in ISACA’s COBIT® framework to the ISO/IEC 27001:2022 standard outcomes.

Author: Christopher C. Anoruo
Mary Carmichael
Blog Post

An Overnight Wakeup Call: Coordinating Responses to Major Cyber Attacks

Gamification can be an effective approach to trust-building that will allow diverse stakeholders to be better prepared to deal with stressful and high-stakes cybersecurity incidents.

14 April 2025
Michelle Moore
Blog Post

CIO vs. CISO: The Key Differences — and Why They Matter

Discover the key differences between the CIO and CISO positions — including responsibilities, education and certifications — and why they matter.

10 April 2025
Maman Ibrahim
Blog Post

Lessons from The Art of War: A Fresh Look at Modern Auditing

Maman Ibrahim shares the lessons auditors can learn from Sun Tzu's The Art of War.

9 April 2025
Oma Martins-Okonkwo
Governance Article

Cybersecurity Governance in Digital Transformation

Digital transformation initiatives have become a major investment priority as organizations strive to leverage technology to reshape business models, drive efficiency and growth, and gain competitive advantage.

9 April 2025
The Board of Directors and the Volcano Dilemma Due Care in the Face of Enterprise Cyberrisk
ISACA Journal Article

The Board of Directors and the Volcano Dilemma: Due Care in the Face of Enterprise Cyberrisk

Recent research states that "[a]ny attempt to ‘predict’ the future is futile, which usually results in executives simply not bothering to determine how various political, regulatory changes or the manifestation of cyber risk (emphasis added) may affect their operations."

Author: Jeimy J. Cano M.
Applying Interstellar Wisdom
ISACA Journal Article

Applying Interstellar Wisdom to Navigate the Digital Age

The film Interstellar parallels the pressing issues of sustainability, the evolving role of AI, and the importance of resilience in the face of technological advancement.

Author: Abdelelah Alzaghloul
ISACA Certification-Holders Share Top Tips for Exam Success
@ISACA Article

ISACA Certification-Holders Share Top Tips for Exam Success

Preparing for a certification exam can be quite challenging, but a strategic and disciplined approach can help position certification candidates for success on exam day.

7 April 2025
Jack Freund
@ISACA Article

Governance or Guesswork? Why Cybersecurity Needs More Than Good Intentions

Cybergovernance and cybertrust go hand in hand. The evolving threat landscape demands robust governance architectures and well-defined board duties to ensure resilience against cyberthreats.

7 April 2025
Varun Prasad
Blog Post

Building AI Governance by Design

An artificial intelligence governance culture balancing safety and innovation is important to effectively deal with AI risks and enhance the trustworthiness of AI systems.

7 April 2025
Pam Nigro
Blog Post

My Transformational Journey: from Chapter Leader to the ISACA Global Board

Pam Nigro shares how her years in ISACA chapter leadership compares and contrasts to her current role on the ISACA Global Board of Directors, and what has helped her progress along the way.

3 April 2025
Jack Freund
Blog Post

A Multilayered Framework for Trusting Cyberrisk Models

A multilayered framework for evaluating trust in cyberrisk models enables organizations to effectively assess whether a model is fit for purpose and worthy of confidence in its outputs.

2 April 2025
Quantifying Adaptive Governance Success: A Mixed-Methods Analysis of 500 Organizations
ISACA Journal Article

Quantifying Adaptive Governance Success: A Mixed-Methods Analysis of 500 Organizations

The digital ecosystem has experienced unprecedented growth, with global internet users reaching 5.3 billion in 2023, representing a 66% penetration rate.

Authors: Arjun Jaggi and Aditya Karnam Gururaj Rao
Aditya Patel
Blog Post

Navigating the Future: 6 Cybersecurity Career Paths Shaped by AI

Artificial intelligence is causing organizations and practitioners to reimagine the approach to numerous roles across the cybersecurity profession.

31 March 2025
Ramona Ratiu
Blog Post

Technology as a Tool for Empowerment, Not Exclusion

Ramona Ratiu, winner of ISACA's Technology for Humanity Award, advances cybersecurity careers and empowers women in tech. Learn more about her leadership journey.

28 March 2025
Arnulfo Espinosa Domínguez
Blog Post

Extreme Auditing: Pushing the Boundaries of IT Assurance

Extreme auditing calls for the ability to jump in and assess anything, no matter how unexpected or unfamiliar, and it is a skill set that increasingly will come in handy for IT auditors.

27 March 2025
Richard Beck
Blog Post

Hackers Don’t Play by Rules: Neither Should You

As technology and the threat landscape continue to evolve and become increasingly sophisticated, organizations can no longer afford to let red vs. blue rule-bound perceptions put them at a disadvantage against hackers.

26 March 2025
Reducing Software Vulnerabilities With a Secure-by-Demand Approach
ISACA Journal Article

Reducing Software Vulnerabilities With a Secure-by-Demand Approach

A secure-by-demand approach allows organizations to drive the quality of software by stipulating strict requirements for software manufacturers.

Author: Allen Ari Dziwa
James Omorogbe
Blog Post

Four Strategies Web3 Companies Can Deploy to Cost-Effectively Improve Cyber Resilience

James Omorogbe provides five low-cost cybersecurity strategies that Web3 companies can implement to enhance their cyber resilience while keeping expenses in check.

25 March 2025
Ookeditse Kamau
Blog Post

Follow-Up Audits and Follow-Up Process: The Auditor’s Impact Litmus Tool

Structure, evaluation criteria and reporting are all key aspects of the audit follow-up process that can determine the effectiveness of IT auditors' recommendations.

20 March 2025
ER Kritka
Blog Post

Artificial Intelligence and Machine Learning: A Double-Edged Sword

While artificial intelligence tools continue to grow more effective, cybercriminals use the same capabilities to accomplish complex attacks and intrusions.

19 March 2025
The Value of Zero Trust in IoT-Enabled Healthcare Infrastructure
ISACA Journal Article

The Value of Zero Trust in IoT-Enabled Healthcare Infrastructure

Zero trust models can address the healthcare industry’s current security challenges by enforcing the default deny measure.

Author: Sixtus Daudu
Vanguard
Podcast

Cyberresilience and Cybersecurity

Cybersecurity and the role of internal audit, an urgent call to action: The forces driving business growth and efficiency contribute to a broad attack surface for cyber assaults. How is the end user protected with good service while not being compromised?

18 March 2025
The New Triad of AI Governance: Privacy, Cybersecurity, and Legal
@ISACA Article

ISACA Research Explores Retention Concerns, Stress Levels and Job Satisfaction for IT Careers

While tech careers can be highly rewarding, they can also be demanding and challenging to break into initially.

17 March 2025
Yunique Demann
@ISACA Article

The New Triad of AI Governance: Privacy, Cybersecurity, and Legal

As artificial intelligence continues to reshape industries, the challenges surrounding its governance have become increasingly complex.

17 March 2025
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

PeopleOps, Not Human Resources, for Stronger System Security

A change in perspective can allow organizations to better see the risk and value of key controls and may prevent your source code from ending up on Discord.

17 March 2025
Alex Mathew
Security Article

Will MFA Redefine Cyberdefense in the 21st Century?

MFA has the potential to revolutionize cyberdefense in the 21st century. There is value to be gained from delving into its benefits, limitations, and the possibilities it offers when integrated with emerging technologies.

17 March 2025
Niki Gomes
Blog Post

ISACA Career Catalyst Stories: Niki Gomes, Senior Internal Auditor

Niki Gomes, an audit professional and ISACA volunteer, says the relationships she has built through ISACA have made her career journey more enjoyable.

14 March 2025
Guy Pearce
Blog Post

CIO 4.0: Redefining IT Leadership

CIOs and other IT leaders have the opportunity to integrate sustainability into the core of IT operations, accentuating IT’s role as a catalyst for competitive advantage.

13 March 2025
Jamie Norton
Blog Post

Diving In: My First 90 Days on the ISACA Board

Jamie Norton, the newest addition to the ISACA Board of Directors, shares behind-the-scenes insights from his first few months in the ISACA boardroom.

12 March 2025
Beyond Compliance: The Role of Threat Models in Safeguarding Critical Infrastructure
ISACA Journal Article

Beyond Compliance: The Role of Threat Models in Safeguarding Critical Infrastructure

Securing CII goes beyond compliance. A risk picture and threat modeling enable risk practitioners to identify risk that manifests from threats to their environment.

Author: Donavan Cheah
José David Pino
Blog Post

Challenging CISA Exam Myths: A Non-IT Auditor’s Perspective

José David Pino shares his CISA experience to encourage audit professionals with non-IT backgrounds to embark on the CISA certification journey.

11 March 2025
SheLeadsTech Scholarship Winners Share Visions for the Future
Blog Post

SheLeadsTech Scholarship Winners Share Visions for the Future

SheLeadsTech scholarship winners outline their visions for the future and what the scholarship has meant to them as they work toward entering digital trust professions such as security and GRC.

7 March 2025
Jenny Tan
Blog Post

Let’s Keep the Progress Coming for Women in Tech

ISACA research shows most women are satisfied with their career progression in the tech workforce but there are still areas for more headway to be made.

5 March 2025
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

How to Measure and Prove the Value of Your AI Investments

Is your organization investing in artificial intelligence (AI) but not seeing the expected payoff?

3 March 2025
How to Measure and Prove the Value of Your AI Investments
@ISACA Article

SheLeadsTech Provides Growing Array of Resources, Opportunities

ISACA’s SheLeadsTech program continues to expand opportunity and impact for women throughout the technology workforce.

3 March 2025
Chidambaram Narayanan
Blog Post

When Harry Met SALY: A Love-Hate Story in Audit Risk Assessment

'Same As Last Year' does not cut it for IT auditors looking to successfully adapt to new risks and opportunities.

3 March 2025
Fene Osakwe
Audit Article

Control Considerations for a Data Privacy Audit

There are 5 key risk areas that could provide guidance for auditors in today’s evolving privacy landscape. By identifying and defining these key risk areas, auditors can ensure robust and comprehensive privacy oversight

3 March 2025
Isla Sibanda
Audit Article

The Role of Digital Transformation Audits: Transform While Upholding Governance Standards

Digital transformation is reshaping the landscape of industries globally. While the benefits are enormous, these transformations can also jeopardize an organization’s governance standards if not executed with rigorous oversight.

3 March 2025
A single green question mark cube stands out among numerous black question mark cubes on a dark surface
ISACA Journal Article

Information Security Matters: The Dark Arts of Managing Downtime

IT can be a sturdy midfielder and do some scoring, but businesspeople are the strikers, with security playing defense and tending the goal.

Author: Steven J. Ross
A hand holding a holographic image of a handshake, symbolizing global business partnerships and collaboration.
ISACA Journal Article

The Digital Trust Imperative: Building a Culture of Trust

If an organization wants to have a strong trust position within the digital ecosystem, it must invest in the culture to support such a position.

Author: K. Brian Kelley
Blue background, with white lines and dots scattered throughout, and in the center a bright white light is emanating from a circular object
ISACA Journal Article

The Governance Conundrum of Digital Twins

As organizations struggle to harness the power of digital twins, they face governance challenges that can undermine the technology's potential.

Authors: Yanyi Wu and Chenghua Lin
Hand interacting with a glowing network of interconnected nodes.
ISACA Journal Article

A Multilayered Framework for Assessing Trust in Cyberrisk Models

To integrate cyberrisk models into organizational decision making, stakeholders must trust in their accuracy, reliability, and transparency.

Author: Jack Freund
A pensive man wearing glasses contemplates data visualizations projected onto screen
ISACA Journal Article

Charting the Course of IT Governance

Understanding the various forces at play in IT governance is vital for organizations aiming to leverage technology effectively and achieve sustained success.

Author: Robert Putrus
Abstract illustration of a brain as a circuit board, highlighting the intricate connections of the human mind.
ISACA Journal Article

Guarding the Mind’s Frontier: The Unprecedented Challenge of Neurosecurity Governance

Governance frameworks must evolve to reflect the merging of human cognition and digital systems.

Author: Er. Kritika
Abstract digital illustration of a checkmark within a circuit board, signifying successful processing or verification
ISACA Journal Article

Accelerate AI and ML Governance With RPA Risk Management Principles

Organizations should look to RPA risk management principles to mitigate model development and data management risk associated with AI and ML.

Authors: Michael Ly and Yue Hong
Abstract digital tree symbolizing interconnectedness and technology, glowing on a dark green background.
ISACA Journal Article

Green IT and Environmental Economics Through an IT Governance Lens

Green IT should be subject to the same rigors of IT governance as regular IT to help ensure that it produces the anticipated value.

Author: Guy Pearce
Abstract digital art depicting streams of binary code flowing downwards, rendered in varying shades of blue
ISACA Journal Article

Consolidating Data Loss Prevention Tools: Good Idea, Bad Outcome

The reaction to shadow DLP is often to reduce the number of DLP tools in use. But the outcome may be a more fragmented DLP environment with higher operational costs.

Author: Dennis Sawatzki
A person's hands interact with a glowing digital network representing secure transactions
ISACA Journal Article

Case Study: Establishing a Strong Security Posture Without Sacrificing Developer Productivity

A company improved its security posture with a zero trust-based DevSecOps solution that used automation to reduce risk and increase compliance without slowing development.

Author: Mick Brady
A man's suit with a question mark in place of the head
ISACA Journal Article

The Role of the Identity Provider

Digital identity recognition demands a holistic approach that takes into account the real world as well as the digital one.

Author: Luigi Sbriz
Jeff Wade
Blog Post

Achieving Seamless Privacy by Design Through Secure by Design Practices

When organizations approach privacy as a design principle, it drives operational excellence and helps organizations to achieve regulatory compliance.

28 February 2025
Richard Beck
Blog Post

Financial Services Under Threat by Adversarial AI

Adversarial AI—the act of manipulating AI systems to function in unintended or harmful ways—is a growing, overlooked threat that will require updated frameworks in the financial sector.

27 February 2025
Gert Jan Koster
Security Article

Hybrid SAP IT Landscape: Security Challenges and Mitigations

Most organizations today have an IT environment that combines on-premises and cloud services. The preference to integrate these services has caught on widely, as it has proven flexible, scalable, and cost efficient.

27 February 2025
IT Supply Chain Cyberattacks Are About More Than the Weakest Link
ISACA Journal Article

IT Supply Chain Cyberattacks Are About More Than the Weakest Link

Supply chain management research often focuses on identifying the weakest link in the supply chain and trying to replace or repair it.

Authors: Gerald F. Burch, Jordan Burch and Joshua Brown
Cybersecurity and Sustainability: Safeguarding a Resilient Future in the Digital Age
ISACA Journal Article

Cybersecurity and Sustainability: Safeguarding a Resilient Future in the Digital Age

Organizations must recognize the role of cybersecurity in safeguarding the progress humanity has made toward a more sustainable future.

Author: Abdulrahman Alblooshi
Sampa David Sampa
Blog Post

ISACA Career Catalyst Stories: Sampa David Sampa, CISA, IGP

ISACA member Sampa David Sampa, an IT audit professional from Zambia, says ISACA continues to play a central role in shaping his career journey.

24 February 2025
Safia Kazi
Privacy Article

The Evolving Role of the Privacy Professional

The privacy profession is evolving to include multiple components of ethics, and privacy professionals must incorporate ethics-related considerations into their daily work.

21 February 2025
Subrat Mishra
Blog Post

From Theory to Practice: Real-World Risk Management, Starting with Ourselves

Training and development should be a non-negotiable element in developing an effective approach to risk management.

20 February 2025
The Rise of Deepfakes: A Deep Dive Into Synthetic Media and its Implications
ISACA Journal Article

The Rise of Deepfakes: A Deep Dive Into Synthetic Media and its Implications

Traditional approaches for detecting deepfakes are proving to be less practical and less effective, and laws and regulations have failed to keep pace with advancements in deepfake technology.

Author: Azad Mammadov
Jeff Wade
Blog Post

Accelerating Secure by Design by Meeting Teams Where They Are

By focusing on people, sharpening processes, and strategically integrating technology, organizations can achieve security by design and ensure security is embedded in their DNA.

18 February 2025
How Data Analytics is Making Traditional Audit Obsolete
@ISACA Article

How Data Analytics is Making Traditional Audit Obsolete

Data analytics are completely revolutionizing the approach to audit.

17 February 2025
Patience Ogunbona
@ISACA Article

Avoiding Career Stagnation: How to Effectively Take Inventory of Your Strengths and Weaknesses

Evaluating your strengths and weaknesses is not just an exercise in self-awareness; it is a strategic move for career advancement.

17 February 2025
How to Effectively Take Inventory of Your Strengths and Weaknesses
@ISACA Article

New ISACA White Paper Highlights COBIT’s Role in AI Governance

Organizations face mounting pressure to govern artificial intelligence (AI) systems responsibly.

17 February 2025
Eugene Leow
Blog Post

Automating Incident Response: Six Practical Steps for Faster, Smarter Cyber Defense

By prioritizing automation while also relying upon human capabilities, cybersecurity professionals can better contain incidents and reduce the time it takes to effectively respond to them.

17 February 2025
Grant Hughes
Blog Post

Developing a Cyber Strategy and the Seven Pillars of Cyber Resilience

An effective cybersecurity strategy that includes critical pillars of cyber resilience, such as embedding security into the design phase and prioritizing basic controls, can drive business success.

14 February 2025
Keri Bowman
Blog Post

SOX Audit-Ready in Minutes: Streamlined Compliance Reporting

By automating key aspects of the audit process, standardizing reports and producing actionable data, organizations' compliance efforts will go more smoothly.

12 February 2025
Refreshing IT Audit with LLMs
ISACA Journal Article

Refreshing IT Audit With LLMs

The audit process has drastically evolved over the years due to advances in technology and changes in the field.

Authors: Diego Suárez and Mario Piattini
Collin Beder
Emerging Technology Article

The Cost of Convenience: AI Adoption and Security Blind Spots

For the past few years, many believed that the race for artificial intelligence (AI) supremacy was firmly in the hands of established players such as OpenAI and Anthropic.

11 February 2025
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Just Call It a Security Incident

More honesty, accuracy and transparency is needed when it comes to organizations acknowledging and reporting security incidents.

10 February 2025
Chester Avey
Security Article

What to Know About EXIF Data, a More Subtle Cybersecurity Risk

Understanding what vulnerabilities exist, along with their potential severity and impact, can dramatically strengthen an organization’s cybersecurity posture and improve overall cyberreadiness.

6 February 2025
State of Privacy
Blog Post

Exploring the State of Privacy in 2025

ISACA’s State of Privacy 2025 report delves into the latest trends in staffing, budgets, training and obstacles from more than 1,600 global professionals.

5 February 2025
Chasserae Coyne
Blog Post

COBIT: A Practical Guide for AI Governance

To keep up with the speed of business, organizations need to move fast to stay competitive and improve their market share.

4 February 2025
Safia Kazi
Emerging Technology Article

The Tangled Web of Executive Orders on AI

The rapid shifts in the way the US executive branch addresses AI under different administrations illustrates why organizations are better positioned if they approach emerging technologies from risk-based and ethical perspectives.

4 February 2025
CCOA
@ISACA Article

ISACA Introduces New CCOA Security Credential

Early-career cybersecurity professionals often struggle to demonstrate their technical skills and qualifications to prospective employers, a challenge that ISACA is addressing with its newly launched Certified Cybersecurity Operations Analyst credential.

3 February 2025
Chris Snyder
Security Article

Healthcare’s Growing Threat Landscape

In an era where technology is deeply embedded in every aspect of daily life, the healthcare industry is no exception—and cybercriminals have taken notice.

3 February 2025
Mary Carmichael
Blog Post

Five Ways for Risk Professionals to Work More Efficiently in 2025

Work smarter, not harder.” It’s a simple idea, but in risk management, it’s a game-changer.

31 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Guidelines for Operationalization of Web Client Runtime Security

This article includes seven suggested steps or activities that organizations may find useful in operationalizing their WCRS programs or capabilities.

31 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Traditional Security Solutions Fall Short in Protecting Against Web Client Runtime Risk

This article describes the limitations of traditional security solutions in addressing WCRS risk and proposes implementation options for purpose-built security solutions.

30 January 2025
Erik Prusch
Blog Post

Kicking off 2025 with a New Mission and Vision

Input from members and chapter leaders around the world are reflected in ISACA's new mission and vision statements, which includes emphasis on how members will be supported throughout their career journeys.

29 January 2025
New CCOA Fills Gap in Technical Cybersecurity Credential Offerings
Blog Post

New CCOA Fills Gap in Technical Cybersecurity Credential Offerings

The new Certified Cybersecurity Operations Analyst (CCOA) credential is designed for security professionals with two or three years of experience who aspire to be information security/cybersecurity analysts and related roles.

29 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

An Introduction to Web Client Runtime Security

The term Web Client Runtime Security (WCRS) was coined by the authors to highlight the security or possible malicious behavior of the code executed in users' browsers during their web interactions.

29 January 2025
Maman Ibrahim
Blog Post

Positioning DORA Compliance as a Strategic Advantage for Digital Trust and Operational Excellence

If approached properly, the Digital Operational Resilience Act (DORA) can be a strategic tool to help organizations solidify operational continuity and earn stakeholder trust.

28 January 2025
Melanie Wijeratna
Blog Post

ISACA Career Catalyst Stories: Melanie Wijeratna, CISM | PROSCI

ISACA member Melanie Wijeratna draws inspiration and motivation from her father's life as she advances her career journey in cybersecurity.

27 January 2025
Yakir Golan
Risk Article

Cyberrisk Quantification: A Strategic Imperative for Financial Resilience

As enterprise risk becomes increasingly intricate, the strategic execution of addressing multifaceted threats has grown more critical than ever.

24 January 2025
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100)
Blog Post

Don’t Let Excuses Hold You Back: Ten Reasons Why the CISM Certification is Worth the Effort

The Certified Information Security Manager (CISM) certification consistently ranks among the most sought-after credentials in cybersecurity.

23 January 2025
Artificial Intelligence’s Dual Role in Phishing Attacks
ISACA Journal Article

Artificial Intelligence’s Dual Role in Phishing Attacks

AI technologies, with the ability to personalize phishing messages and improve the effectiveness of attacks, are a game changer in the cybercrime landscape.

Author: Olu Adekoya
Duane Gran
Blog Post

Reframing the Way Organizations Think About Privacy

ISACA’s State of Privacy 2025 report highlights trends in the industry around staffing, collaboration and increasing demands on privacy teams.

21 January 2025
25v1-Vital_protection
@ISACA Article

How ISACA Professionals Can Start 2025 Strong

Beginning a new year presents somewhat of a reset for digital trust professionals, providing a great opportunity to reconnect with colleagues and embrace the clean slate of the flipped calendar.

20 January 2025
How ISACA Professionals Can Start 2025 Strong
@ISACA Article

Privacy Professionals Report Increasing Stress on the Job

Rapid advancements in technology, combined with an evolving regulatory environment, are leading to increasing stress levels for privacy professionals, according to new ISACA research.

20 January 2025
Julie Chatman
Blog Post

Words Matter: Why Zero Trust Needs a New Name

Zero Trust has become a leading cybersecurity approach but the term itself can be counterproductive in organizations' efforts to gain buy-in from business stakeholders.

17 January 2025
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

Leveraging AI for Enterprise Innovation

RV Raghu previews his ISACA Virtual Conference session in which he will explore ways in which enterprises can leverage artificial intelligence for innovation and how they can best approach their AI initiatives

16 January 2025
Vital Protection in Digital Healthcare
ISACA Journal Article

Vital Protection in Digital Healthcare

The sensitive information stored in health systems, coupled with inadequate security measures, makes the healthcare infrastructure appealing to cybercriminals.

Authors: Samuel Romanov and Marlien Varnfield
Jason Lau Blog
Blog Post

Artificial Intelligence in the Boardroom: ISACA’s Approach to AI and Cybersecurity

How ISACA’s board is providing oversight around artificial intelligence’s impact on ISACA and its global membership.

14 January 2025
Safia Kazi and Justin Rende
Podcast

Cybersecurity Predictions for 2025

Cybersecurity Predictions for 2025The prevalence of ransomware and the security concerns associated with AI have made the role of cybersecurity professionals vital for enterprise success.

10 January 2025
Megan Hall
Blog Post

Five Ways to Make Better Use of Emerging Technology in the New Year

When it comes to making better use of artificial intelligence and other emerging technology, having consistent processes for staying informed and measuring risk can go a long way.

10 January 2025
Neil Harper
Blog Post

Five Ways Security Professionals Can Start the New Year Strong

By enhancing engagement with enterprise leadership and better anticipating key cyber risks, security professionals will be on their way to a great year ahead.

9 January 2025
Onur Korucu
Blog Post

Five Ways Privacy Professionals Can Start the New Year Strong

Privacy professionals must embrace change in the evolving technology and regulatory landscape, turning risks and opportunities alike into drivers of their organizations' success.

8 January 2025
Addressing the rise of AI-Driven Cyberattacks
ISACA Journal Article

Addressing the Rise of AI-Driven Cyberattacks

The advent of artificial intelligence (AI) has transformed many industries, increasing productivity, speed of decision making, and innovation.

Author: Mathura Prasad
Ramona Ratiu
Blog Post

Five Ways Risk Professionals Can Start the New Year Strong

Identifying and leveraging reliable information sources is a useful starting point for risk professionals looking to solidify their good practices for the year ahead.

7 January 2025
Goh Ser Yoong
@ISACA Article

Securing Artificial Intelligence: Opportunities and Challenges

The involvement of cybersecurity teams in AI development is essential for organizations to harness the full potential of AI while mitigating the associated security risks that it would pose throughout its lifecycle.

6 January 2025
Justin Rende
Security Article

Cybersecurity Trends to Watch in 2025

There is no crystal ball to forecast the future; however, organizations can make informed predictions about cybersecurity in the coming year.

6 January 2025
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Five Ways Audit Professionals Can Start the New Year Strong

A fresh start for IT auditors in 2025 is possible, but closing out lingering loose ends from last year likely requires attention before embracing the clean slate.

6 January 2025
Rui Feng Isaac Lee
Blog Post

The Synergy Between Generative AI and IS Audit

Applying Generative AI to the audit profession can be done more effectively when the data involved is examined carefully to ensure its quality is reliable.

3 January 2025
Graphic of blocks
ISACA Journal Article

Information Security Matters: NIST CSF 2.0 and the Cybersecurity Hierarchy

NIST CSF 2.0 calls for a hierarchy of executives, managers, and practitioners not stated in the previous version.

Author: Steven J. Ross
Person typing on a keyboard
ISACA Journal Article

The Digital Trust Imperative: Assume Breach to Gain Advantage

A breach can happen at any time and it is not always a sophisticated attack. The recommendation within cybersecurity today is to assume a “breach mentality.”

Author: K. Brian Kelley
Circle with half a globe and a key
ISACA Journal Article

Privacy in Practice: Ethics vs. Compliance

Most consumers are not privacy experts; privacy is the responsibility of enterprises, not consumers.

Author: Safia Kazi
Graphic of streaming data
ISACA Journal Article

Cybersecurity Leadership Challenges in an Evolving Threat Landscape

Cybersecurity leaders are tasked with an additional undertaking that most leaders are not: thwarting bad actors.

Authors: Kevin M. Alvero and Robert Janecek
Person holding an important sign - triangle with exclamation point
ISACA Journal Article

The Hidden Threat of the Risk Manager

In today’s evolving landscape of organizational governance, the role of the risk manager is more crucial than ever.

Author: Subrat Mishra
Globe with overlapping icons
ISACA Journal Article

Winning the Cyber War With Leadership Lessons from Sun Tzu

In the high-stakes world of cybersecurity, effective leadership is more important than ever. In 2024, global cybercrime costs are projected to reach US$9.5 trillion, underscoring the escalating severity of cyberthreats.

Author: Abdelelah Alzaghloul
Finger pointing to circle with icons
ISACA Journal Article

Employing Automation for Incident Response Planning

The ever-growing complexity and frequency of cyberattacks have forced organizations to rethink their strategies for managing security incidents.

Author: Eugene Leow
Lock with a cybersecurity shield overlapping
ISACA Journal Article

Unlocking Lessons Learned From the 2023 Microsoft Exchange Online Intrusion

The cyberthreat landscape is evolving at an unforeseen pace as attacks increase in sophistication, velocity, and volume.

Author: Ninad Dhavase
Graphical brain with a finger pointing to it
ISACA Journal Article

A Neuroscience Perspective on AI and Cybersecurity

Insights can be gained by observing the similarities between the structure of the human brain and the learning function of AI.

Author: ER. Krtika
Cybersecurity shield with lock
ISACA Journal Article

Developing a Cyberstrategy With the Seven Pillars of Cyberresilience

There are seven pillars of cyberresilience that can help define a cybersecurity strategy that is concise, clear, and aligned to business objectives.

Author: Grant Hughes
Person pointing to gears
ISACA Journal Article

Transforming an Outdated Payment System Through Process Automation

When a medical equipment provider realized that its manual payment processing system was resulting in high error rates, the need to automate was clear.

Author: Mick Brady
Kushal Walia and Karthik Mahalingam
Blog Post

Leveraging Artificial Intelligence for Enhancing Security and Privacy in Modern Computing Systems

Artificial intelligence can play a significant role in enhancing the security and privacy disciplines, but governance and ethical implications must remain top-of-mind considerations.

31 December 2024
Ryan Standbridge
Security Article

Overreliance on Automated Tooling: A Big Cybersecurity Mistake

Automation and artificial intelligence (AI) have been a positive force multiplier in the cybersecurity industry. Improved time efficiency, resources, cost, and productivity are great strides in the field and should be celebrated.

30 December 2024
Timothy R. Mcilveene, Ph.D.
Blog Post

Shedding Light on Shadow IT: Aligning Goals for Organizational Success

A disconnect between the goals of the IT team and business units can open the door to the usage of more shadow IT solutions, opening the organization to increased risk.

27 December 2024
Ravikumar Ramachandran
Blog Post

Five Key Priorities for Governance Practitioners in 2025

In the modern technology environment, governance professionals have to be attuned to much more than traditional IT governance principles to stay on top of all that is within their scope.

26 December 2024
Muhammad Usman
Blog Post

Navigating AI in Aviation: A Roadmap for Risk and Security Management Professionals

Considering the especially high security and safety stakes in aviation, risk and security professionals play a crucial role in ensuring that AI technologies in the industry are responsibly deployed.

23 December 2024
Shingi Mushangwe
Blog Post

Four Strategic Priorities for C-Suite Leaders in Big Data Transformation

Data collection, data governance, data architecture and defining success metrics are four aspects to get right when it comes to big data transformation.

19 December 2024
VB Malik
Blog Post

Navigating the Complex Landscape of Large Language Model Security

A multi-faceted approach, including robust model training, is needed to effectively deal with large language model vulnerabilities.

18 December 2024
The Modeling of Risk Evaluation, Risk Appetite, and Risk Tolerance
ISACA Journal Article

The Modeling of Risk Evaluation, Risk Appetite, and Risk Tolerance

The search for practical methods to represent and evaluate risk is undoubtedly a topic of methodological interest.

Author: Luigi Sbriz
Donovan Cheah
Blog Post

Post-Quantum Cryptography Preparedness 101

Post-quantum cryptography efforts should focus on what is within practitioners' control to implement in preparing for the arrival of Q-Day.

17 December 2024
Five Ways to Enhance Your Career in 2025
@ISACA Article

Five Ways to Enhance Your Career in 2025

As we look ahead to 2025, you may be thinking of ways you can continue growing your career and nurturing your professional development in the new year.

16 December 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Is AI Hype an Enterprise Risk? How to Manage Shiny Object Syndrome

Artificial intelligence (AI) has been celebrated as a game-changer for its transformative potential across multiple sectors, offering a value proposition of increased efficiency, innovation, and a reshaping of business operations.

16 December 2024
Five Takeaways from ISACA’s Tech Workplace and Culture Survey
Blog Post

Five Takeaways from ISACA’s Tech Workplace and Culture Survey

Gender representation in tech, pay gaps, career advancement opportunities and more are explored in ISACA's new Tech Workplace and Culture findings.

16 December 2024
Prabha Anand
Blog Post

Integrating AI with CMMI: Cognizant’s Path to Elevating Excellence

Cognizant is one of the world's leading professional services companies, transforming clients' businesses and operating and technology models for the digital era.

16 December 2024
Gokhan Polat
Blog Post

It’s Time for the Financial Sector to Experience ISACA's Digital Trust Ecosystem Framework

Digital trust is especially critical in the financial sector, where the digital banking ecosystem is expected to operate as intended at all times.

13 December 2024
Chidambaram Narayanan
Blog Post

Batman’s Guide to Mastering Password Management: An IT Auditor’s Perspective

Password management, when handled diligently, is a master class in vigilance, with some parallels that can be drawn directly from the Batcave.

12 December 2024
Alaina Lawson
Blog Post

Security by Design or Default?

Secure-by-Design and Secure-by-Default are not mutually exclusive, and both are important elements in bolstering organizations' security posture.

11 December 2024
Brainstorming for Optimal Cybersecurity Controls Starting Stringent Ending Strong
ISACA Journal Article

Brainstorming for Optimal Cybersecurity Controls: Starting Stringent, Ending Strong

Cybersecurity is an ongoing battle, and it is crucial to craft the optimal set of controls for a winning strategy.

Author: Abhishek Kushwaha
Amit Patel
Security Article

Humans Are IT Security’s Weakest Link

When thinking about what makes up IT security, high-tech firewalls, robust encryption algorithms, and advanced threat detection systems are often the first things that come to mind.

10 December 2024
Neil Harper
Blog Post

How the ISACA Board and Executive Management Address Cyber Risk

The ISACA Board takes extensive action to understand and address cybersecurity risk while aligning cyber risk management with strategic business objectives.

9 December 2024
Pablo ballarin usieto
Blog Post

AI Ethics: Navigating Different Cultural Contexts

Artificial intelligence ethics comes with plenty of nuance for stakeholders to assess, as explored in a recent Ask Me Anything discussion on ISACA's Engage online community.

6 December 2024
Shamik Kacker
Blog Post

AI Governance: Key Benefits and Implementation Challenges

ISACA's Artificial InteIligence Governance Brief explores how AI governance must be in place throughout the AI lifecycle to achieve its benefits within the enterprise business strategy and to minimize AI risks.

5 December 2024
Data Abuse in Cyberwarfare: Dissecting the Attack Model
ISACA Journal Article

Steering LLMs Toward Desired Outputs With Prompt Engineering

Large language models (LLMs) have shown exceptional capabilities in understanding and generating human-like text, underpinning major advances in natural language processing (NLP).

Author: Lalit Chourey
John P. Pironti
@ISACA Article

Five Key Considerations for Crafting Board Presentations on Information Risk and Security

Developing and carrying out effective board of director (BoD) presentations is a crucial skill for information risk and security leaders and professionals.

2 December 2024
Maman Ibrahim
@ISACA Article

Proven Strategies to Boost the Effectiveness of Your Cyber Assurance Function

Cybersecurity often gets a bad rap. It’s widely perceived as an endless parade of threats, incidents and breaches.

2 December 2024
CPE Opportunities
Blog Post

CPE Credit Opportunities: How to Earn Your Annual Continuing Education

Webinars, conferences, volunteering and the ISACA Journal are just a few of the CPE opportunities available through ISACA to fulfil end-of-year requirements and plan ahead for 2025.

2 December 2024
Yuman Chau
Security Article

Ensuring Data Security: The Importance of Cloud Backups and Drill Testing

In the organizational IT environment, system and data backup is crucial. Data backup is the last defense against downtime if data is corrupted or lost.

2 December 2024
Abdul Qayyum Mohammed
Emerging Technology Article

Innovation Is Shaping the Future of Network Engineering

Quantum computing and blockchain bolster security measures, ensuring robust protection for sensitive data in cloud environments.

2 December 2024
John de Santis
Blog Post

The Role of the Chair vs. CEO

The Board Chair and CEO both have distinct responsibilities to drive ISACA forward yet extensive collaboration and communication between the two is critical.

27 November 2024
Rob MacDonald
Blog Post

The Arrival of CMMC: Positioning Your Company for Success

The long-awaited arrival of the Cybersecurity Maturity Model Certification (CMMC) presents an opportunity for professionals to position their organizations as go-to resources for CMMC guidance and compliance.

25 November 2024
CA. Ratan Singh Tanwar, CISA, DISA, FAFD, Managing Partner- Tanwar Ratan Singh & Associates CA. Firm, Chartered Accountant
Blog Post

User Access Review Verification: A Step-by-Step Guide

Conducting a User Access Review Verification ensures that only authorized individuals are able to access an organization's key systems and data.

21 November 2024
Chirag Joshi
Blog Post

ISACA Career Catalyst Stories: Chirag Joshi, Founder and CISO, 7 Rules Cyber

On his way to success as an author, entrepreneur and cybersecurity leader, Chirag Joshi has turned to ISACA for credentialing, community and thought leadership.

20 November 2024
Digital Age Auditing
ISACA Journal Article

Digital Age Auditing: The Synergistic Effect of Machine Learning on Auditing Practices

Machine learning (ML) is becoming a crucial asset in the field of auditing.

Authors: Kgodiso Chiloane, Fatih Isik and Eugene Zita
Ramsés Gallego, ISACA Evangelist and ISACA Hall of Fame inductee, and Megan Hall, CPA, CISA, CISA, Chief Information and Infrastructure Officer
@ISACA Article

Top Takeaways from ISACA AI Innovation Workshop

Just as the internet created a sea change on the technology landscape, so, too will artificial intelligence.

18 November 2024
Luigi Sbriz
Blog Post

Adding Value with Risk-Based Information Security

It is achievable to manage multiple control frameworks at the same time, with the effort of managing only one.

18 November 2024
Alex Mathew
Governance Article

Cloud Data Sovereignty: Governance and Risk Implications of Cross-Border Cloud Storage

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

18 November 2024
Jack Freund
@ISACA Article

Growing Cyber Defenses from Seed to System

There are many different ways to approach cybersecurity. One of the most effective ways to critically approach cybersecurity is by leveraging systems thinking.

18 November 2024
Krishan Bagla
Blog Post

A Simplified Approach to Cost-Effectively Boost Security Around Digital Crown Jewels

Cybersecurity teams can protect their crown jewels more effectively by following a few critical steps and by collaborating effectively with business units and enterprise leadership.

14 November 2024
Arun Gupta
Emerging Technology Article

Revolutionizing CRM: How AI-Enhanced Security is Transforming Customer Data Protection

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

14 November 2024
Maureen O’Connell
Blog Post

Inside the Audit Committee: Roles, Responsibilities and Qualifications

Our Notes from the Boardroom blog series continues with a detailed look at the role and responsibilities of ISACA's audit committee.

13 November 2024
The Impact of 5G: Unpacking Security and Privacy Concerns
ISACA Journal Article

The Impact of 5G: Unpacking Security and Privacy Concerns

5G, or the fifth generation of cellular networks, is expected to transform wireless communication with features such as highspeed data transfer capability, extremely low latency, and higher connectivity.

Author: Mahmoud Mohamed
CrowdStrike Panel Explores Lessons Learned from Massive Outage
Blog Post

CrowdStrike Panel Explores Lessons Learned from Massive Outage

An ISACA conference panel dissected the massive CrowdStrike incident, dissecting what went wrong and lessons learned to help avoid similar incidents in the future.

11 November 2024
Keith bloomfield deweese
Blog Post

Machine Learning Knowledge Looms Large at a Time of Accelerated AI Transformation

New ISACA courses in machine learning will prepare practitioners to better understand the lifecycle of machine learning projects, large language models, neural networks, and more,

8 November 2024
Brian Odian
Emerging Technology Article

Embracing the Future: The Quantum Computing Revolution Begins Now

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

7 November 2024
Donovan Cheah
Blog Post

How Geopolitics Affects Cybersecurity Risk: A Primer

The geopolitical landscape can have a major impact on cybersecurity risk and provide alternate motivations for cybercriminals to the financial ones for which defenders tend to be more attuned.

6 November 2024
Tatum Crisp
Blog Post

ISACA Career Catalyst Stories: Tatum Crisp, ISACA Auckland Chapter President

Tatum Crisp pursued ISACA chapter leadership to grow her communication and leadership skills, and the experience has paid even greater dividends than she anticipated.

5 November 2024
Chandra Sekhar Dash
Emerging Technology Article

The Importance of AI Safety in Customer Experience Automation

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

5 November 2024
EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners
@ISACA Article

EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners

While the adoption of artificial intelligence (AI) can help enterprises operate more efficiently, there is significant risk associated with it, including lawsuits, AI misuse and biased data.

1 November 2024
Adam Grant
@ISACA Article

Five Top Takeaways from Adam Grant’s Message to ISACA Members

Adam Grant, organizational psychologist and bestselling author, recently sat down with ISACA member and moderator R.V. Raghu for ISACA’s Member-Exclusive Speaker Series.

1 November 2024
Ulrika Dellrud
Blog Post

The EU AI Act is Here: What You Need to Know and Do

Many different layers of compliance requirements are taken into consideration within the EU AI Act, including various AI use cases and models.

1 November 2024
Tori Anderson and Tracy Bordignon
Governance Article

Autopilot on Copilot: Governance Considerations and Pitfalls When Implementing Generative Artificial Intelligence

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

1 November 2024
Person checking options on a digital screen
ISACA Journal Article

Information Security Matters: Raising Standards

CSF 2.0 has a new emphasis on governance, supply chains, and smaller enterprises.

Author: Steven J. Ross
Person looking at a digital screen, thinking
ISACA Journal Article

The Digital Trust Imperative: Risk in the Shadows

Shadow IT represents a growing threat to most organizations, especially those with a digital presence.

Author: K. Brian Kelley
Digital burst
ISACA Journal Article

The Bleeding Edge: Future Proofing With Situational Awareness

Trust professionals have a reputation for being averse to new and potentially disruptive change.

Author: Ed Moyle
An open hand with a digital solar system in it
ISACA Journal Article

IS Audit in Practice: Disruptive Technology—An ESG Enabler

There has never been such a promising time for technology and environmental change.

Author: Cindy Baxter
The Encrypted Truth is Already Out There
ISACA Journal Article

The Encrypted Truth is Already Out There

Quantum computing progress will alter the dependence on current classical cryptography to safeguard data and network transmissions.

Author: Eric H. Goldman
A hand holding a compass
ISACA Journal Article

Clearing a Path: Anticipating Disruptive Innovation With an Eye Toward Compliance

Innovation vs. compliance is one of the trickier balancing acts that any organization must attempt.

Author: Kevin M. Alvero
AI under a magnifier
ISACA Journal Article

Exploring Opportunities and Challenges: An IS Audit Perspective on Generative AI Adoption

Incorporating generative AI into IS audit engagements presents new opportunities and challenges.

Author: Rui Feng Isaac Lee
Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT
ISACA Journal Article

Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT

In the rapidly evolving digital age, enterprises are grappling with shadow IT.

Authors: Timothy D. Spivey and Timothy R. Mcilveene
A digital cube
ISACA Journal Article

Demystifying Quantum

Two key quantum developments have emerged in the cybersecurity space: post-quantum cryptography and quantum key distribution.

Author: Donavan Cheah
Securing LLMs: Best Practices for Enterprise Deployment
ISACA Journal Article

Securing LLMs: Best Practices for Enterprise Deployment

LLMs offer unprecedented capabilities in natural language processing, content generation, and decision support.

Author: Vaibhav Malik
Reassessing Risk:
ISACA Journal Article

Reassessing Risk: The Move to Third-Party Management

As global regulations evolve and reliance on third parties grows, today’s organizations find themselves navigating a complex risk environment.

Author: ISACA
Dhaval Deepak Joshi, CISA, CDPSE
Blog Post

Navigating the New Frontier: Mastering ESG Audits in Modern Business

Environmental stewardship, social responsibility and governance integrity represent three critical components of ESG audits.

31 October 2024
Adeleke Ayobami
Audit Article

How Blockchain Technology is Revolutionizing Audit and Control in Information Systems

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

31 October 2024
Patrick Barnett
Blog Post

What Type of Person Will Make a Good Cybersecurity Professional?

Beyond their technical know-how, effective cybersecurity professionals tend to have a range of other characteristics, such as adaptability, integrity and curiosity.

29 October 2024
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

Behind the Scenes with Adam Grant: The Opportunity of a Lifetime

A recent ISACA Member-Exclusive Speaker Event with Adam Grant presented new mindsets and approaches that can help professionals unlock more enjoyment and creativity in their work.

25 October 2024
Innocent Atasie
Audit Article

Eight facility zones to consider while Auditing for Information, Physical, and Environmental Security Compliance

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

25 October 2024
Safia Kazi, AIGP, CIPT, and Collin Beder, CET, CSX-P, Security+
Emerging Technology Article

Safely and Responsibly Using Emerging Health Technology

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

25 October 2025
Thomas Phelps
Blog Post

Approaching Risk, Compliance and Security Through a Consistent Lens with Enterprise Training

ISACA enterprise trainer Thomas Phelps shares his perspective on how group training can help brings teams together and collectively uplevel their knowledge and performance.

24 October 2024
Lalithkumar Prakashchand
Audit Article

Beyond the Blockchain Bubble: Distributed Ledger Technology for a Resilient Audit Landscape

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

23 October 2024
Untangling the Supply Chain Web With ISO 27001
ISACA Journal Article

Untangling the Supply Chain Web With ISO 27001

Enterprises are growing more concerned that they might be attacked via their supply chain.

Author: Hannah Hunt
Osman Azab
Blog Post

How the Emerging Technology Landscape is Impacting Cybersecurity Audits

Embracing continuous auditing and focusing on risk-based approaches are among the ways to effectively deal with the increasing complexity of cybersecurity audits as the emerging technology landscape continues to evolve.

22 October 2024
Integrating Psychological Safety into COBIT 2019
@ISACA Article

Five ISACA Members Earn Inaugural Chair Fellowships

Five ISACA members have been designated as the inaugural recipients of the ISACA Chair’s Fellowship Award for the 2024-2025 Board of Directors term.

21 October 2024
Luiz Claudio Diogo
@ISACA Article

Integrating Psychological Safety into COBIT 2019: A New Horizon in I&T Governance

In a world increasingly driven by technology, organizations must balance the need for innovation and efficiency with the well-being of their employees.

21 October 2024
John de Santis
Blog Post

Introducing the Chair’s Fellowship Program

ISACA's new Chair's Fellowship Program provides awardees with the opportunity to gain board leadership skills and become well-versed in best practices for a high-performing board.

21 October 2024
Karen Franklin
Blog Post

ISACA Career Catalyst Stories: Karen Franklin, Director, Compliance Analytics with Discover Financial Services

Karen Franklin, ISACA member and participant in the Mentorship Program, calls pursuing her CISA certification 'one of the most pivotal decisions' she made along her career journey.

18 October 2024
Chester Avey
Security Article

Comparing the MITRE ATT&CK and NIST Cybersecurity Frameworks

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

17 October 2024
Daniil Karp
Blog Post

A Proactive, Continuous Approach to Automated Compliance

Automation and a compliance by design approach can empower organizations to build a more secure, compliant and efficient IT environment.

16 October 2024
Celebrating ISACA’s Cybersecurity Month Scholarship Recipients
Blog Post

Celebrating ISACA’s Cybersecurity Month Scholarship Recipients

Recipients of the ISACA Foundation's Cybersecurity Month scholarships share their aspirations for making their mark on the cybersecurity profession.

14 October 2024
John de Santis
Blog Post

Our Day in Court

ISACA prevailed in a recent court ruling, which will free up more time and resources to put the focus back where it belongs: on delivering value for members and certification-holders.

14 October 2024
Gagan Koneru
Privacy Article

The Evolving World of Data Privacy: Trends and Strategies

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

14 October 2024
Isaac Lee
Audit Article

By The Importance of IS Audit: Lessons Learned from the Evergrande Crisis

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

11 October 2024
Christian Have
Blog Post

Is NIS2 In Danger of Becoming a Paper Tiger?

NIS2 is intended to improve cybersecurity resilience, but to reach its potential, there will need to be real consequences for organizations that are simply going through the motions.

10 October 2024
Patrick Barnett
Security Article

DarkAngels Strikes Big: Record-Breaking Ransom Secured

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

10 October 2024
Managing Cyberrisk With the Help of GRC
ISACA Journal Article

Managing Cyberrisk With the Help of GRC

Managing cyberrisk using GRC technologies can help align IT activities with business goals.

Author: Hemang Mehta
Jim Lamadrid
Blog Post

From Failure to Fulfillment: My Journey in Attaining the CRISC

Eight key takeaways that helped one CRISC-holder improve upon his first exam attempt and reach his goal of attaining CRISC certification.

8 October 2024
Jack Freund
@ISACA Article

Accelerating Cybersecurity Maturity by Quantifying Risk

Organizations should embrace the benefits of modernity and avoid the assumption that they must first implement a low-fidelity qualitative risk program before transitioning to a quantitative one.

7 October 2024
Stress Levels on the Rise for Cybersecurity Professionals
@ISACA Article

Stress Levels on the Rise for Cybersecurity Professionals

Cybersecurity professionals increasingly are feeling stress, primarily in response to an escalating threat landscape, new ISACA research shows.

7 October 2024
John de Santis
Blog Post

Ready to Be a Board Director? Here are 12 Things You Should Know

Being an ISACA board director is much more than an honorary role, and requires expertise in a range of areas, including a strong command of global strategy.

7 October 2024
Arun Gupta
Governance Article

The Crucial Integration of CRM and Corporate Governance: A Key to Better Business Outcomes

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

7 October 2024
Ejona Preci
Blog Post

ISACA Career Catalyst Stories: Ejona Preci, CISO, Lindal Group

Ejona Preci, a Germany-based CISO, says she has met 'true powerhouses' through ISACA that have helped accelerate and enrich her career journey.

3 October 2024
Alex Holden
Blog Post

Choosing Your Cybersecurity Path

Building a successful career in cybersecurity can be a smoother process by identifying organizations with healthy security culture, avoiding monotonous tasks, embracing continuing education and showing an ability to learn from failure.

2 October 2024
Jenai Marinkovic
Blog Post

The Hidden Culture Crisis and Human Burden Undermining Cybersecurity Resilience

The cybersecurity industry is facing a growing internal crisis that is not rooted in technology or external threats but in the culture underpinning our current workforce.

1 October 2024
Gaya Ratham
Risk Article

Navigating Risk When Transitioning to the Cloud

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

1 October 2024
Surya Prakash
Blog Post

The Importance of Establishing an Open-Source Ingestion Policy to Mitigate Threats

Open-source software can lead to many benefits while simultaneously introducing security risks, creating the need for a substantive open-source ingestion policy.

30 September 2024
Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel
Blog Post

Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel

The ISACA China Hong Kong Chapter recently featured a panel exploring how organizations can make artificial intelligence more trustworthy and more effective.

27 September 2024
Fene Osakwe
Audit Article

The Evolution of Tech Assurance: Restructuring the IT Audit Function

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

27 September 2024
Abdelelah Alzaghloul
Blog Post

Cyber Resilience: What Shawshank Teaches Us About Security

A focus on prevention alone was not sufficient in The Shawshank Redemption and it is similarly not going to do the job in building successful, modern security programs.

26 September 2024
Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust
Blog Post

Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust

ISACA just published its Vision Paper on “Empowering Europe’s Digital Future with Cyber Resilience, Competitiveness and Digital Trust.

26 September 2024
Sergio Tringali
Blog Post

Shaping the Future of Digital Trust and Cybersecurity Policy: How ISACA Contributes to the UK

ISACA’s UK Vision Paper 2024: A manifesto for bridging the UK’s digital skills gap and improving cyber resilience.

25 September 2024
Addressing Security Concerns in a Mobile Computing Environment
ISACA Journal Article

Addressing Security Concerns in a Mobile Computing Environment

Given the sensitive nature of information stored on mobile devices, the consequences of a breach can be severe.

Author: Rachit Gupta
Jack Freund
Blog Post

From Theory to Action: Building a Strong Cyber Risk Governance Framework

Knowing your organization's risk appetite is the first step toward effectively integrating cyber risk quantification into an organization's cyber risk governance.

23 September 2024
Erik Prusch
Blog Post

A Career Journey You Won’t Want to Miss

Joining ISACA means not only becoming better equipped to succeed in your current job, but also for future opportunities throughout your career journey.

18 September 2024
Yuman Chau
Security Article

From Hollywood to Hacking: Understanding Deepfake Scams

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

18 September 2024
Chris McGowan
Security Article

Centralized Services and Their Impact on Business Continuity

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

17 September 2024
Chris McGowan and Ivan Mans
Podcast

Addressing SAP Security Gaps

SAP systems are treated differently than many other enterprise applications from a cybersecurity perspective.

17 September 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Are You Technical or Non-Technical? Time to Reframe the Discussion

There is value in exploring the problematic nature of labeling someone as technical or non-technical and how this term is overly simplistic and potentially harmful.

16 September 2024
Donovan Cheah
@ISACA Article

Is There a Market Failure in Cybersecurity?

There has never been a better time to be in the governance, risk and compliance (GRC) sector with ever-changing cybersecurity regulation.

16 September 2024
Anthony Pacilio
Blog Post

Leveraging Neurodiversity: Strategic Advantages in GRC

Recruiting and nurturing neurodiverse talent is a winning strategy for organizations looking to enhance their GRC and cybersecurity capabilities.

16 September 2024
Isla Sibanda
Emerging Technology Article

Reidentifying the Anonymized: Ethical Hacking Challenges in AI Data Training

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

16 September 2024
Maria Koslunova
Blog Post

Data Governance for AI: It Starts and Ends with Data

Understanding the relationship between artificial intelligence and data is critical for organizations as they increasingly leverage AI in their business operations.

13 September 2024
Chidambaram Narayanan
Blog Post

The Curious Case of the Complacent Commercial Chief: An Internal Auditor's Challenge

Internal auditors are not always met with open-minded attitudes from key stakeholders, but they can break down resistance by taking the right approaches.

12 September 2024
Vaibhav Malik, Global Partner Solution Architect, Cloudflare
Blog Post

AI and Risk Management: A Strategic Guide for CIOs and CISOs in Financial Services

Artificial intelligence is having a large impact on the risk landscape in the financial sector, underscoring the need for AI governance frameworks and thorough AI risk assessments.

11 September 2024
Human Risk Management: A Practical Approach
ISACA Journal Article

Human Risk Management: A Practical Approach

Cybersecurity strategies must be based on the assumption that humans will continue to make mistakes.

Author: Grant Hughes
Mukta Sharma
Blog Post

Cybersecurity Compliance Essentials: Balancing Technical and Non-Technical Skills

Technical acumen can be valuable in working toward cybersecurity compliance, but non-technical elements also play a significant role in achieving compliance.

9 September 2024
Abigail Bada
Blog Post

ISACA Career Catalyst Stories: Abigael Bada – Founder, Fortini Tech

ISACA’s Career Catalyst Stories showcase how members have been supported by ISACA throughout all stages of their careers. Today, we profile Abigael Bada, founder, Fortini Tech.

6 September 2024
Jayakumar Sundaram
Blog Post

The Never-ending Quest: Why Continuous Monitoring is Crucial for Cybersecurity

Systematically analyzing threats from the beginning of the design phase enables practitioners to build security into systems in time to make a difference amid a difficult threat landscape.

4 September 2024
Sunil Arora
Risk Article

Persuasive Technology: The Technology That Connects and Controls Us

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

4 September 2024
Muhammad Mushfiqur Rahman
@ISACA Article

Emerging Technology: Key Challenges and Opportunities

Emerging technologies are those that are still under development or are just starting to be adopted on a large scale. They have the potential to significantly change the way we live, work and interact with the world around us.

3 September 2024
Emerging Technology: Key Challenges and Opportunities
@ISACA Article

Ramifications Far-Reaching for Companies that Don’t Prioritize Digital Trust

Maintaining compliance and having strong security and privacy programs in place is good, but only goes so far if it does not add up to strong trust between organizations and their stakeholders.

3 September 2024
muneeb-imran-shaikh-blog
Blog Post

Preventing the Storage Limitation Principle from Becoming an Elusive Dream

Strengthening approaches to retention of personal data can lead to more business resilience, reducing risk of personal data exposure and sharper operational efficiency.

3 September 2024
Patrick Barnett
Risk Article

A New Threat Actor Group Emerges: Understanding Lapsus$

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

3 September 2024
Cyber Impact Analysis
ISACA Journal Article

Information Security Matters: Cyber Impact Analysis

Whether it is a theft of data or an attack that renders systems inaccessible, cyberattacks are downright bad.

Author: Steven J. Ross
A digital network
ISACA Journal Article

The Digital Trust Imperative: When Risk Becomes Reality

Once trust is lost, business is often lost as well. Therefore, organizations must look closely at digital trust.

Author: K. Brian Kelley
Office boardroom
ISACA Journal Article

IS Audit in Practice: Managing the Practical Risk Assessment

All risk is not the same. Industry dynamics, enterprise culture, and department risk tolerance all have enterprise impact.

Author: Cindy Baxter
Digital overlay of person on a laptop
ISACA Journal Article

Data Risk is Enterprise Risk: Good Data Practices as Risk Controls

There is no question that data risk equates to enterprise risk.

Author: Guy Pearce
A shield hovering above a hand
ISACA Journal Article

Adding Value With Risk-Based Information Security

Effective IT security management system design must start with top management and include the entire perimeter of the supply chain, with special attention paid to ensuring compliance with all relevant laws.

Author: Luigi Sbriz
Dice with cyber locks
ISACA Journal Article

From Measurement to Management: Integrating Cyberrisk Quantification into Risk Governance

The inclusion of the governance domain was arguably the most notable addition to the NIST CSF 2.0.

Author: Jack Freund
Cyber networks
ISACA Journal Article

Cybersecurity Risk Management Governance: An Agency Theory Perspective

An agency theory approach allows enterprises to have open dialogues and make informed cyberrisk management decisions.

Authors: Gerald F. Burch, Jordan Burch, and Mike McGarry
Forms on a digital screen
ISACA Journal Article

Continuous Auditing and Risk Monitoring: Implementation With Credit Line Management

Credit line management presents unique complexities for auditors.

Author: Terrence Cai
A digital network
ISACA Journal Article

Building a Robust Third-Party Risk Management Program in a Connected Ecosystem

Third-party risk is an evolving problem characterized by steadily increasing complexities.

Author: Visveshwar Ramasubramaniam
People looking at a tablet
ISACA Journal Article

Case Study: Achieving Greater Financial Efficiency at ISACA

When it came time to upgrade their FMS, ISACA teams had to be carefully coordinated.

Author: Katie Teitler-Santullo
Alex Sharpe
Blog Post

The Often-Forgotten Organizational Dimensions of Resilience and Digital Trust

Bits don't know borders, meaning emphasis on building digital resilience and digital trust is paramount in this era to protect organizations and their reputations.

30 August 2024
Vaibhav Malik
Emerging Technology Article

Building a Secure and Compliant AI Infrastructure: Lessons from the Trenches

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

30 August 2024
Matthew Moog
Blog Post

DORA Compliance: Navigating the New EU Regulation

New regulations such as the Digital Operational Resilience Act (DORA) are intended to improve risk management and make operational resilience easier to attain.

28 August 2024
Collaborative Cybersecurity: Unifying Functions for a Secure Future
ISACA Journal Article

Collaborative Cybersecurity: Unifying Functions for a Secure Future

The complexity of cyberthreats often mirrors the fragmentation within a cybersecurity function. As threats evolve and diversify, cybersecurity functions cannot operate effectively in silos.

Author: Vishal Sharma
Terry Ray
Governance Article

Auditors are Asking Better Questions—Organizations Should Have Better Answers

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

27 August 2024
chris dimitriadis
Blog Post

NIS2 Directive: Strengthening Public Cybersecurity and Infrastructure Across Europe

The European Union’s NIS2 Directive will align key cybersecurity practices throughout the EU, increasing member-states' ability to prevent cyber incidents and lessen their impact.

26 August 2024
Richard Clapton
Blog Post

Top GenAI Success Stories for Risk and Assurance Professionals, and the Crucial Caveats You Need to Know

Generative AI comes with several promising applications for audits and risk professionals, who also must be mindful of the environment in which they are working and diligently steer clear of potential AI pitfalls.

22 August 2024
The Value of Diversity and Inclusion in Cybersecurity
ISACA Journal Article

The Value of Diversity and Inclusion in Cybersecurity

A strategy based on diversity and inclusion in the workforce will help address the challenges around building a strong security capability in organizations.

Authors: Yuri Bobbert, Morgan Djotaroeno and Bas Van Gils
Jay Hira Blog
Blog Post

ISACA Career Catalyst Stories: Jay Hira, Director, Cyber Security – Financial Services, KPMG Australia

ISACA member Jay Hira has moved from continent to continent for various job roles, but finds his relationship with ISACA to be a constant wherever his career has taken him.

20 August 2024
Mary Carmichael
@ISACA Article

Applying Risk Appetite and Risk Tolerance in the Age of AI

The adoption of artificial intelligence—from generative AI to computer vision—has become a competitive necessity, not merely an option.

19 August 2024
Jack Freund
@ISACA Article

Material Matters: The SEC's Cyber Disclosure Reality Check

Cyber disclosures to regulatory and capital markets have become increasingly relevant in the face of ongoing ransomware threats.

19 August 2024
C. Warren Axelrod
Blog Post

‘Cyberpandemic’ Strikes a Crowd

The recent Crowdstrike incident underscored the need to reduce complexity and limit risky interdependencies to avoid widespread outages.

19 August 2024
Daniil Karp
Blog Post

A Journey Through Integrated Risk Management

When assembling the elements needed for a successful integrated risk management program, organizations should start with their end goal in mind.

16 August 2024
Arun Mamgai
Emerging Technology Article

AI Security Risk and Best Practices

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

15 August 2024
Manoj Patel
Blog Post

The Role of AI & Generative AI in Integrated Risk Management

The risk management space is undergoing big changes driven by the rise of artificial intelligence, resulting both in promising advancements and significant potential pitfalls.

14 August 2024
Protecting Enterprises From AI-Generated Deepfakes
ISACA Journal Article

Protecting Enterprises From AI-Generated Deepfakes

In recent years, deepfakes have become a potent form of social engineering when used for exploitation and to disseminate misinformation.

Author: John Evans
Dorina Hamzo
Risk Article

Securing the Digital Landscape: Organizations Must Address Third-Party Risk Head-On

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

13 August 2024
Meghan Maneval
Blog Post

For Better AI Governance, Begin with Education

AI governance expert Meghan Maneval shared best approaches for more effective AI usage on the enterprise landscape in a recent Ask Me Anything discussion on ISACA's Engage platform,

12 August 2024
Chidambaram Narayanan
Blog Post

From Chapter Engagement to Global Inspiration: How ISACA Muscat Ignited My Spark

Engagement with local ISACA chapters can be a springboard to further success both within and beyond the ISACA professional network.

8 August 2024
Donovan Cheah
Blog Post

An Introduction to Post-Quantum Cryptographic Risks

Post-quantum cryptography algorithms will increasingly become a focal point for organizations as quantum computing makes strides forward.

7 August 2024
Cyber-ESG Synergy: Protecting the 4th Industrial Revolution
ISACA Journal Article

Cyber-ESG Synergy: Protecting the 4th Industrial Revolution

It is worth exploring the nuances of stakeholder vs. shareholder capitalism, the impact of ESG on corporate creditworthiness, and the specific methodologies used by rating agencies to assess ESG criteria, with a focus on governance.

Author: Jack Freund
John P. Pironti
@ISACA Article

Five Key Considerations for Defensible and Reasonable Risk and Security

Reasonability and defensibility are common themes in audits, legal contracts, regulations, and security assessments of information risk management and security (IRMS) programs, capabilities, and controls. The term “commercially reasonable” frequently appears in contractual agreements and regulatory guidelines, signifying common standards for security capabilities and controls.

5 August 2024
ISACA Releases AI Courses on Ethics Audit and Machine Learning
@ISACA Article

ISACA Releases AI Courses on Ethics, Audit, and Machine Learning

ISACA has released an online, self-paced introductory course to AI for auditors, alongside other new courses on ethics and machine learning for business enablement.

5 August 2024
Steven Sim
Blog Post

Overcoming the Shortcomings of Modern Authentication

An ISACA white paper examining authentication challenges in the deepfake era identifies challenges organizations face and methods that can overcome them.

5 August 2024
Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends
Podcast

Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends

Traditional security questionnaires just aren't cutting it anymore.

2 August 2024
Varun Prasad
Emerging Technology Article

AI Algorithm Audits: Key Control Considerations

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

2 August 2024
The Cyber Standard Podcast | Episode 3
Podcast

The Cyber Standard Podcast | Episode 3

Welcome to Episode 3 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the essential aspects of applying for and assessing candidates in the cybersecurity field.

2 August 2024
Brian Vasquez
Blog Post

Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success

Focusing on robust communication, keeping current with the regulatory landscape and aligning with key business objectives are among the approaches that can set modern CISOs up for success.

1 August 2024
What Enterprises Need to Know About ChatGPT and Cybersecurity
Podcast

What Enterprises Need to Know About ChatGPT and Cybersecurity

Many people are pondering whether generative artificial intelligence (AI) tool ChatGPT is a friend or a foe.

31 July 2024
Integrating Cybersecurity into Project Management A Comprehensive Approach Across SDLC Phases
ISACA Journal Article

Integrating Cybersecurity into Project Management: A Comprehensive Approach Across SDLC Phases

In an era when digital transformation is at the forefront of organizational strategies, the importance of incorporating cybersecurity into project management processes cannot be overstated.

Author: Rajanikanth Potturi
Jeimy J. Cano
Blog Post

How Boards of Directors Can Better Prepare to Lead on Cyberrisk

Board directors need to be aware of key cybersecurity-related strategies and investments and make sure they are aligned with the organization's risk appetite.

30 July 2024
Larry Marks
Blog Post

Cyber Resilience Through More Effective Design

There is a saying that I expect many have heard before: “How do you eat an elephant”? “One bite, one part at a time.”

26 July 2024
Geetha Murugesan
Blog Post

AI Ethics and Why It Matters

Artificial intelligence ethics considerations must be top-of-mind for organizations when leveraging AI as trust, bias, security, privacy and other important elements should not be overlooked.

24 July 2024
Developing Trustworthy AI: Understanding the Inputs
ISACA Journal Article

Developing Trustworthy AI: Understanding the Inputs

Bad AI training data leads to bad outputs, and these bad outputs lead to distrust and skepticism of AI systems. People may be more reluctant to use AI systems that they do not find trustworthy, decreasing the return on investment associated with AI.

Author: Safia Kazi
Sarah Katz
Blog Post

The Risk of Malicious Push Notifications in Augmented Reality Apps

Push notifications in augmented reality applications carry overlooked risks, and app developers should help mitigate them by working closely with privacy and legal experts

22 July 2024
Larry G Wlosinksi
Blog Post

How to Merge AI and Robots Responsibly

When it comes to merging AI and mobile robots, standards, guidance and testing are critically important to ensure that developers and other key players in the ecosystem are operating responsibly.

19 July 2024
Patrick Barnett
Risk Article

Can Hardening Reduce Cyberrisk?

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

19 July 2024
Shingi Mushangwe
Blog Post

Three Ways for Enterprise Leaders to Make Technology Transformations More Successful

Clear scope, vetting vendors carefully and retaining key resources can position organizations for success in technology transformation projects.

17 July 2024
Are AI BOMs the Future?
ISACA Journal Article

Are AI BOMs the Future?

The rapid adoption of AI has introduced new attack surfaces that many digital trust professionals are only beginning to understand. AI BOM can help organizations better understand the provenance of AI components used to assess related risk.

Author: Ed Moyle
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

Introducing The Evolving Auditor

The world of finance is undergoing a digital revolution, and the role of the auditor is no exception.

15 July 2024
Mark Bowling
@ISACA Article

Ransomware Attacks Are Noisy. Learn How to Listen for Them.

During the initial intrusion stage of a ransomware incident, the attacker has the advantage.

15 July 2024
anna-johannson
Blog Post

Why So Many Organizations Underestimate Insider Threats

Insider threats remain overlooked by many organizations even though they are potentially more devastating than many incidents coming from external attackers.

15 July 2024
Hakan Kantas
Blog Post

Unlocking the Power of Digital Trust: Exploring ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework provides organizations with the guidance needed to build and maintain trust with customers and other organizational stakeholders.

12 July 2024
Yuman Chau
Audit Article

The Importance of Independent IT Audit

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

12 July 2024
Zechariah Oluleke
Blog Post

The Looming Threat of Unsecured IoT Devices: A Deep Dive

A secure Internet of Things ecosystem demands a multi-faceted approach, including specialized security solutions and layered defense mechanisms.

10 July 2024
Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking
ISACA Journal Article

Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking

Within the complex modern financial system, banks are the guards that protect the assets and transactions of many people. Yet it is because of this status that they are the perfect victims of competent criminals.

Author: Maduabuchi Christopher Okonkwo
Abigail Bada
Blog Post

Empowering Women in Technology: ISACA’s Commitment to Bridging the Gender Gap

Through the ISACA Scholarship Program and the Digital Trust Workforce Development Program, the ISACA Foundation helps to create equitable access to education, training, and career opportunities.

8 July 2024
Chidambaram Narayanan
Blog Post

Ten Pivotal Moments in an Internal Auditor's Career

Learning to navigate disagreements, adapting to emerging technology and keeping up to date on key regulations are among many pivotal factors in an internal auditor's career success.

3 July 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Examining the Risks of IT Hero Culture

The allure of the "IT hero" is compelling. IT heroes are individuals who, like the Avengers or Batman, seem to single-handedly save enterprises day after day.

1 July 2024
ISACA Announces 2024 Annual General Meeting
@ISACA Article

ISACA Announces 2024 Annual General Meeting

ISACA’s 2024 Annual General Meeting of the Membership will be conducted in person in Schaumburg, Illinois, USA on 24 July at 8 a.m. Central Daylight Time at the ASA Auditorium and virtually.

1 July 2024
Carving an Elephant
ISACA Journal Article

Information Security Matters: Carving an Elephant

Zero trust architecture is based on core principles including least privilege and network segmentation. But it is also based on certain assumptions.

Author: Steven J. Ross
Digital Trust: Automation and Its Impact
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—Automation and Its Impact

How we implement automation, the controls we establish, and the areas we choose for automation implementation, all influence the level of digital trust in our organizations.

Author: K. Brian Kelley
Orthopedics and Machines: It’s an Orchestra
ISACA Journal Article

IS Audit in Practice: Orthopedics and Machines—It's an Orchestra

Of all industries, medicine is a centerpiece for the hope fostered by technical innovation.

Author: Cindy Baxter
Should We Be Relying on AI-Driven Mobile Robots?
ISACA Journal Article

Should We Be Relying on AI-Driven Mobile Robots?

AI and robots were created to assist humanity in its evolution. But robots unchecked have the potential to pose a danger to humanity.

Author: Larry G. Wlosinski
When Computer Says No
ISACA Journal Article

When Computer Says No

The risk inherent in AI systems can exacerbate the phenomenon of users having blind faith in technology. As AI becomes increasingly complex and autonomous, there is greater potential for unforeseen errors, biases, or ethical lapses to occur.

Author: Richard Clapton
Beyond the Cell Walls: Cybersecurity Insights From The Shawshank Redemption
ISACA Journal Article

Beyond the Cell Walls: Cybersecurity Insights Form The Shawshank Redemption

Inspiration can be drawn from the timeless tale of perseverance in the film The Shawshank Redemption by exploring the parallels between the prison walls of Shawshank and the digital fortresses constructed to protect data.

Author: Abdelelah Alzaghloul
The Pivotal Role of AI in Navigating the Cybersecurity Landscape
ISACA Journal Article

The Pivotal Role of AI in Navigating the Cybersecurity Landscape

A holistic approach, merging AI with human expertise and robust governance, alongside continuous monitoring, is essential to effectively combat evolving cyberthreats.

Author: Robert Putrus
Security Challenges and Opportunities of Crowdsourcing for Data Annotation
ISACA Journal Article

What is Resilience and How Does It Promote Digital Trust?

Resilience means moving away from technology to mitigate cyberrisk, and this requires collaboration among technology, people, processes, and enterprises.

Author: Alex Sharpe
Security Challenges and Opportunities of Crowdsourcing for Data Annotation
ISACA Journal Article

Security Challenges and Opportunities of Crowdsourcing for Data Annotation

Many LLMs rely heavily on labeled data for training and have a high demand for annotated data, which crowdsourcing can help meet in a flexible and cost-effective manner. However, this approach also comes with several challenges.

Author: Pranav Kumar Chaudhary
Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors
ISACA Journal Article

Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors

The BoD assumes a pivotal role in the orientation and direction of organizations to select the best business strategies that not only allow them to challenge current business plans, but also inspire the necessary transformations in the executive teams.

Author: Jeimy J. Cano M.
System Overload
ISACA Journal Article

System Overload

Enterprises rely on systems, and systems sometimes fail. A system can either break down during one of its component processes or initiate processes that run smoothly but fail to produce the desired result/output.

Author: Kevin M. Alvero
From Humble Beginnings: How the CISO Role Has Evolved
ISACA Journal Article

From Humble Beginnings: How the CISO Role Has Evolved

The CISO role has undergone a considerable transformation, adapting to ever-changing technological advancements, regulatory requirements, emerging threats, and increasingly sophisticated threat actors.

Author: Brian Vasquez
CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success
Blog Post

CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success

ISACA's new Certified Cybersecurity Operations Analyst (CCOA) credential prepares early-career cybersecurity professionals for a range of in-demand roles in the field.

28 June 2024
Adeleke Ayobami
Emerging Technology Article

Leveraging AI for Information and Cybersecurity

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

28 June 2024
Jayakumar Sundaram
Blog Post

ISO 27001 Shines Bright As a Beacon of Trust

The ISO 27001 Risk Assessment is not just a standard or certification; it can serve as a beacon of trust for a range of stakeholders.

27 June 2024
AI Risk and Mitigation Tips and Tricks for Auditing in the AI Era
ISACA Journal Article

AI Risk and Mitigation: Tips and Tricks for Auditing in the AI Era

Inadequately controlled AI can make mistakes that are high-impact, yet subtle in their appearance. This can result in significant damage, especially if a human review is considered difficult or impossible.

Author: Spiros Alexiou
David Kliemann
Blog Post

Building an AI Risk Management Program: A Security & Audit Team Perspective

Implementing trustworthy artificial intelligence requires enterprises to put in place a solid governance structure and a comprehensive framework of controls.

25 June 2024
Poonam Gupta
Blog Post

European Union Artificial Intelligence Act: An Auditor’s Perspective

Organizations will need to identify the needed audit and governance resources and skill sets in order to make implementation of the EU AI Act successful.

24 June 2024
Ameet Jugnauth, Bryan Lillie, Peter Leitch
Podcast

The Cyber Standard Podcast: Episode 4

Welcome to Episode 4 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the world of cybersecurity standardization.

21 June 2024
Mathura Prasad
Blog Post

Navigating the Challenges of Cybersecurity in the Modern Data Landscape

With exponential growth in data, addressing the related privacy, risk and security implications on the data landscape needs to be a top priority for digital trust professionals.

20 June 2024
Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge
ISACA Journal Article

Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge

The transition to ISO/IEC 27001:2022 is a strategic process that requires careful planning and execution. 

Author: Jayakumar Sundaram
Megan Hall
Blog Post

Governance Key to Taming Evolving Risk Landscape

The risk landscape continues to transform, highlighting the need for cross-functional collaboration, leveraging of frameworks and effective third-party risk management.

18 June 2024
Yet Another Risk Depiction (YARD)
ISACA Journal Article

Yet Another Risk Depiction (YARD)

Whether risk presents in a new form or one that has already been observed, a precise formula for predicting it has not yet been discovered.

Author: Luigi Sbriz
Veronica Rose
@ISACA Article

How to Maintain Your ISACA Certifications

Attaining an ISACA certification is crucial to anyone’s career and, as such, you wouldn't want to lose that certification that you have worked so hard to achieve.

17 June 2024
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Integrating Climate Change Considerations into ISO Standards: A Paradigm Shift

In an era marked by growing environmental consciousness, organizations worldwide are reevaluating their business practices to align with sustainable principles.

17 June 2024
Alex Holden
Blog Post

Security Professionals Face Big Challenge in Evolving Ransomware Landscape

The shifting ransomware landscape places responsibility on security professionals to keep pace with new attack types and trends that are especially targeting vulnerable industries.

17 June 2024
Richard Marcus
Blog Post

Managing AI’s Transformative Impact on Business Strategy & Governance: Strategies for CISOs

Gain a firmer handle on AI risks, controls design, needed detection and monitoring capabilities, and best practices for AI implementations.

14 June 2024
Prabin Litto
Security Article

Cloud Security Challenges in the Pharmaceutical Industry

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

14 June 2024
Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors
ISACA Journal Article

Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors

Cybersecurity adds complexity for investors, financiers, and buyers in the acquisition market, necessitating more thorough due diligence regarding an enterprise’s technology stack. There are three methods proposed herein to relieve this burden.

Author: Yuri Bobbert
Chidambaram Narayanan
Blog Post

The Numbers Whisper, But Stories Captivate: Rethinking Audit Communication

Auditors need to go beyond the cold, hard facts and incorporate time-tested storytelling methods to make their reports resonate more deeply with stakeholders.

11 June 2024
Agile: The X Factor of Internal Auditing
ISACA Journal Article

Agile: The X Factor of Internal Auditing

There is a need to make internal audits more adaptable and iterative beyond what a linear waterfall approach allows. Enhancing the adaptability and iterative nature of audits is essential to moving beyond the constraints imposed by a linear waterfall approach.

Author: Thomas J. Bell III
Victor Fang
Blog Post

AI for Auditors: Challenges and Opportunities for Career Advancement

An ISACA training course on AI for auditors explores categories of AI algorithms that auditors will encounter, relevant regulations, how to audit third-party AI dependencies and more.

10 June 2024
Candice Jackson
Risk Article

Has the Digital Journey Added to the Risk of Using Third Parties?

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

7 June 2024
Chetan Anand
Blog Post

More Responsible Data Usage Through Privacy-Enhancing Technologies

ISACA's new white paper on privacy-enhancing technologies describes popular PETs, explores regulatory perspectives for using PETs for compliance and provides examples of how the technologies are being used.

6 June 2024
Person pointing at digital icons
ISACA Journal Article

Cryptographic Advancements Enabled by Diffie–Hellman

Symmetric key cryptography was enabled by concepts first proposed in 1976 in “New Directions in Cryptography.” The concepts proposed have evolved; however, the core ideas remain relevant and can provide valuable insights into how the research community can address security needs.

Author: Srikanth Ambatipudi
Wojciech Misiura
Blog Post

A Toolkit to Facilitate AI Governance

ISACA's AI Audit Toolkit helps auditors to verify that artificial intelligence systems meet needed benchmarks for governance and ethical responsibility.

4 June 2024
The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations
ISACA Journal Article

The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations

Enterprises must recognize and understand the virtuous circle of attackers, wherein adversaries generate asymmetries that create blind spots and enable cyberattacks, resulting in instability, uncertainty, and chaos across an organization.

Author: Jeimy J. Cano M.
State of Digital Trust 2024
@ISACA Article

Attaining Peace of Mind Under the Digital Trust Umbrella

Establishing digital trust with customers and stakeholders remains elusive for many organizations, as reinforced by new ISACA research.

3 June 2024
Biruk Worku, CRISC, Director, IT Security
@ISACA Article

Five Tips for Success on ISACA Certification Exams

Five strategies for tackling ISACA certification exams in one shot .

3 June 2024
George Goodwin and Karen Franklin
Blog Post

ISACA Member Finds Newfound Career Optimism Through Mentorship Program

ISACA member George Goodwin credits his ISACA Mentorship Program mentor, Karen Franklin, with giving him the confidence and encouragement he needed at a critical juncture of his career.

3 June 2024
Divya Aradhya
Blog Post

Security-as-Code: A Key Building Block for DevSecOps

Security-as-Code can ensure that key security protocols and good practices are automated and integrated directly into all components of the software development lifecycle.

31 May 2024
Patrick Barnett
Security Article

Understanding Sandworm, a State-Sponsored Threat Group

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

31 May 2024
Password Hygiene: The Present and Future State
Blog Post

Password Hygiene: The Present and Future State

Best practices for password hygiene remain fluid as many professionals eye a future where passwords will no longer be a fixture on the security landscape

30 May 2024
Breaking Down Operational Barriers Between IT, Information Security, and the Business
ISACA Journal Article

Breaking Down Operational Barriers Between IT, Information Security, and the Business

Effective collaboration, rooted in clear and open communication, is not only crucial for the seamless operation of the organization but also essential to instill a sense of fulfillment and the satisfaction of a job well done.

Author: Kenneth Abbott
Neil Lappage
Blog Post

Bridging the Digital Trust Gap: An Urgent Imperative

Organizations that do not prioritize building digital trust open themselves up to significant business and reputational risks, as underscored by ISACA's 2024 State of Digital Trust research.

29 May 2024
Five Key Takeaways from the 2024 RSA Conference
Blog Post

Five Key Takeaways from the 2024 RSA Conference

The growing influence of artificial intelligence on the security landscape was top of mind for many presenters and attendees at the recent 2024 RSA Conference.

28 May 2024
Finger pointing at digital globe
ISACA Journal Article

AI-Infused Foresight: Unveiling Megatrends for Strategic Adaptation

AI plays a significant role in shaping megatrends, guiding enterprises to incorporate AI into strategic planning for a competitive edge, effective risk management, and innovation potential.

Author: Robert Putrus
Rethinking Cybernetics: Why and How
Blog Post

Rethinking Cybernetics: Why and How

When it comes to the looming arrival of quantum computing, the creation of a new Turing machine will be the necessary starting point.

24 May 2024
C. Warren Axelrod
Blog Post

AI AIn’t Human

Many of the guardrails that exist in the context of human thinking are not in place for artificial intelligence, which presents a range of significant challenges.

23 May 2024
Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology
ISACA Journal Article

Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology

Secure platforms enabled by techniques such as secure multiparty computation (SMPC) allow partners to derive insights and optimize media campaigns without pooling or exposing raw data.

Author: Puneet Gangrade
Veronica Rose
Blog Post

Are We In Control of Our Digital Lives?

Technology is neither inherently good or bad, but it can be addictive, and digital trust professionals have a role to play in countering the harms that can result.

21 May 2024
Felix Muckenfuß, CIPM, CIPP/E
Governance Article

Reinforcing IT Governance in the Face of Constant Threats

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

21 May 2024
Resilience Challenges, Metrics, and Responses in Today’s Landscape
ISACA Journal Article

Resilience Challenges, Metrics, and Responses in Today’s Landscape

Although enterprises strive to take mitigating measures, the question remains: Will they be enough when—not if—a major disruption occurs?

Author: Spiros Alexiou
Artificial intelligence
@ISACA Article

ISACA Releases New AI Insights, AI Training Courses

Three in five respondents to a new ISACA survey on artificial intelligence are worried or very worried that bad actors will exploit generative AI, yet only 35 percent say AI risks are an immediate priority for their organization.

20 May 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

The 6 Key Questioning Methods for Internal Auditors

Internal auditors are vital guardians of organizational integrity, scrutinizing processes, identifying risks and suggesting solutions.

20 May 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

The Reason Why Cybersecurity is Still Everyone's Job

As a cybersecurity professional, I have sat through many years of boring, bare-bones and dry security awareness training in which I learned enough to meet compliance requirement and pass the annual training to meet business metrics.

20 May 2024
Chandrasai D.
Blog Post

Unlocking Digital Transformation in Pharma: A Least-Vendor Approach with the 3A-3C Framework

A least-vendor strategy can bring big benefits to organizations as they undergo digital transformation projects that otherwise can become complex and strain resources.

17 May 2024
Samuel Zaruba Smith, Ph.D.(c)
Blog Post

Solving the First Conversation Problem in AI

Solving The First Conversation Problem in AI can go a long way toward companies having greater impact in leveraging the promising technology.

16 May 2024
Future Ready: Utilizing OKR for Audit Engagement Planning
ISACA Journal Article

Future Ready: Utilizing OKR for Audit Engagement Planning

Embracing balanced management approaches can position internal audit as a key player in driving organizational innovation.

Author: Noam Koriat
Guy Pearce
Blog Post

The Benefits of National Digital Health in a Short Story

When properly designed and implemented, patient-centric digital healthcare brings transformative potential to healthcare patients around the world.

14 May 2024
Chidambaram Narayanan
Blog Post

Navigating the AI Maze: An IT Auditor’s Guide Utilizing ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework helps auditors and other digital trust professionals ensure that AI is implemented in a way that strengthens the organization and inspires trust with stakeholders.

13 May 2024
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

The $8,000 SOC 2 Conundrum

While the typical cost of a standard SOC 2 audit is going down, the skill level required for auditors to effectively perform them is increasing.

10 May 2024
Ivan Mans
Security Article

SAP Security Maturity: A Crash Course

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

9 May 2024
Meghan Maneval
Blog Post

A Pathway to an Actionable AI Governance Roadmap

A new ISACA course on artificial intelligence governance can help professionals learn to design, develop, implement and monitor trustworthy AI within their organization.

8 May 2024
Building a Resilient and Successful Enterprise: Key Attributes and How to Measure Them
ISACA Journal Article

Building a Resilient and Successful Enterprise: Key Attributes and How to Measure Them

A manufacturing enterprise recently experienced disruption and near collapse after a fire destroyed its main production facility.

Author: Mahmoud Mohamed
Meghan Maneval
Blog Post

A Better Path Forward for AI By Addressing Training, Governance and Risk Gaps

New ISACA survey data on artificial intelligence realities show that companies need to ramp up training and policies to deal with emerging risks from the powerful technology.

7 May 2024
Mary Carmichael
@ISACA Article

Eight Overlooked Emerging Tech Risks and How to Mitigate Them

Emerging technologies refer to rapidly evolving advancements that can transform industries and society by introducing unique capabilities, processes or products. However, these technologies.

6 May 2024
Jack Freund
@ISACA Article

The Role of the Risk Sin Eater

While cybersecurity professionals may be experts in cyberrisk and mitigation, business decision makers must weigh the pros and cons of the broader business interests against many forms of risk, of which cyber is only one.

6 May 2024
Gokhan Polat
Blog Post

Unlocking AI’s Potential: How COBIT Can Guide Your Business Transformation

The COBIT framework can help organizations implement artificial intelligence more responsibly and in ways that ultimately will create more value for the enterprise.

2 May 2024
Cybersecurity lock
ISACA Journal Article

AI and Automation in Cybersecurity: Future Skilling for Efficient Defense

The ever-evolving threat landscape poses significant challenges, requiring innovative approaches to defend against sophisticated attacks. One approach gaining traction is the integration of artificial intelligence (AI) and automation into cybersecurity practices.

Author: Singirikonda Manikanta
Zero Trust Architecture
ISACA Journal Article

Information Security Matters: The Inhibitors to Zero Trust Architecture

The essential premise of Zero Trust is that users must be verified every time they attempt to access information resources, not only at the point at which they sign in.

Author: Steven J. Ross
Building digital trust
ISACA Journal Article

The Digital Trust Imperative: To Build Digital Trust, Start With Resiliency

The ties between resiliency and both technical architecture and security make sense. So how does digital trust apply to resiliency?

Author: K. Brian Kelley
Digital Architecture
ISACA Journal Article

IS Audit in Practice: Resilient Architecture

Today resiliency still means the business continuity and backup plans, but the buzz has moved to environmental considerations when one thinks of resilience.

Author: Cindy Baxter
Person typing
ISACA Journal Article

The Bleeding Edge: Leveraging Application Service Architectures for Trust

There is often a disconnect between those of us chartered with fostering digital trust and optimizing risk and those tasked with building out the applications that service internal users, customers, partners, and other stakeholders.

Author: Ed Moyle
Person in a server room
ISACA Journal Article

Case Study: Building a Cyber Line of Defense and Empowering Team Members

Global competition, technological disruptions, economic fluctuations, geopolitical threats, and public health crises have created an imperative for enterprises to become more resilient and adaptive if they hope to survive and thrive.

Author: Katie Teitler
Digital Operational Resilience
ISACA Journal Article

European Financial Industry Shifts Toward Digital Operational Resilience

Digitalization is essential for financial institutions to remain competitive, meet evolving customer demands, and achieve sustainable growth in an increasingly digital environment.

Author: Kilian Trautman
Cyber network
ISACA Journal Article

Evaluating the Promise and Problems of Data Fabrics

The growing expanse of data makes it harder for analysts to find the right data, convert it, and archive it in a useful form using traditional database designs.

Authors: Nikos Orth and Gerald F. Burch
How to Build Digital Trust in AI
ISACA Journal Article

How to Build Digital Trust in AI With a Robust AI Governance Framework

The widespread adoption of AI brings forth multifaceted risk, including privacy breaches, data security vulnerabilities, and ethical dilemmas.

Authors: Carol Lee, Terence Law Tom Huang, and Lanis Lam
Mobile device with a security lock
ISACA Journal Article

User Susceptibility to Malicious Push Notifications in Augmented Reality at the Workplace

As studies of AR security have primarily explored privacy concerns rather than social engineering and other threats, the combined risk factors of push notifications within an AR setting warrant deeper investigation.

Author: Sarah Katz
PCI DSS Compliance in the AWS Cloud
ISACA Journal Article

Navigating PCI DSS Compliance in the AWS Cloud

PCI DSS v4.0 introduces significant changes that are particularly relevant to cloud computing. These changes reflect the standard’s adaptation to the evolving digital payment landscape and the growing use of the cloud for processing payment data.

Author: Vijay Kasibhatla
2023 Annual Report
Blog Post

2023 ISACA Annual Report Shows How ISACA is Fueling Future

The 2023 ISACA Annual Report provides updates on ISACA's finances, leadership and important progress made throughout the year by ISACA's global community.

30 April 2024
Han Jumashov
Blog Post

Three Reasons Why You Should Not Wait to Take the CISA Exam

There are several benefits for rising IT auditors to take the CISA exam even before they have the full years of experience required to complete their certification.

29 April 2024
Mathieu Gorge
Security Article

Navigating the Cyber Elephant in the Boardroom

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

29 April 2024
Aleksei Panov
Blog Post

Performing an ATM Security Audit

In preparing for an ATM security audit, auditors will need to prioritize understanding core governance and business processes impacting ATM management.

26 April 2024
Sushila Nair
Blog Post

ISACA Award-Winner Embraces Shared Vision for Safer Digital World

Sushila Nair, ISACA Technology for Humanity award-winner, sizes up the intersection of technology and humanity and what drew her to the cybersecurity field.

24 April 2024
The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century
ISACA Journal Article

The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century

In the fast-developing digital landscape of the 21st century, the deep web is a baffling hidden world where cybercriminals orchestrate a variety of illicit activities.

Author: Azad Mammadov
Prathibha Muraleedhara
Blog Post

The Need For AI-Powered Cybersecurity to Tackle AI-Driven Cyberattacks

Artificial intelligence can help security professionals counter the threats from cyberattacks that also are increasingly boosted by AI.

23 April 2024
Noelle Pickler
Blog Post

Volunteer Appreciation Week: ISACA Volunteers Share Their Stories

ISACA volunteers share their motivations and career benefits they have received through their volunteer activities.

22 April 2024
Daniel Liebau, Affiliate Faculty Member Singapore Management University and Roland Schwinn, Adviser
Blog Post

Vanity Gone Rogue: The Rise of Exploits Targeting Custom Blockchain Addresses

The Vanity Address Attack is an under-the-radar automation capable of confusing blockchain users and opening the door to digital fraud.

19 April 2024
Chidambaram Narayanan
Blog Post

Audit Career Insights: Letter to My Younger Self

Embracing change, drawing inspiration from others and staying curious are among the recipes for success and longevity in the audit profession.

18 April 2024
Art Poghosyan
Audit Article

Managing Compliance in 2024: Best Practices to Secure Cloud Access and Stay Audit-Ready

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

18 April 2024
Enabling Security Success Through IT Partnerships
ISACA Journal Article

Enabling Security Success Through IT Partnerships

Former US President Harry Truman once said, “It is amazing what you can accomplish if you do not care who gets the credit.

Author: Seth Earby
Ravikumar Ramachandran
Blog Post

Evolving Threats to Cloud Computing Infrastructure and Suggested Countermeasures

Cloud misconfigurations and insecure APIs are among the major threats to cloud computing infrastructure that need to be remediated.

16 April 2024
Policy Template Library Toolkit
@ISACA Article

ISACA Puts Forward New Policy Template Library

A policy template library from ISACA provides enterprises with the ability to build and customize the principles needed for their specific environments and compliance requirements

15 April 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

Navigating the Virtuous Path: Avoiding the 7 Deadly Sins of Internal Audit

Submitting incomplete work and auditing with an agenda are among the 'sins' that internal auditors should be sure to avoid.

15 April 2024
Brandon Burns
Blog Post

When it Comes to Controls, It’s the Little Things That Matter

Getting certain foundational, baseline control requirements right, including a tailored approach to risk management, benefits organizations of all types.

12 April 2024
Punit Bhatia
Blog Post

How Will AI Impact Our Jobs in Digital Trust Fields?

Artificial intelligence can be a constructive force on the jobs landscape, especially for those in digital trust professions, with the right approach and commitment to ongoing learning.

10 April 2024
Cybersecurity Risk of AI-Based Applications Demystified
ISACA Journal Article

Cybersecurity Risk of AI-Based Applications Demystified

The introduction of OpenAI’s ChatGPT was a tipping point in the field of artificial intelligence (AI) and, perhaps, a watershed moment in history.

Author: Varun Prasad
Mark Thomas
Blog Post

DTEF Takes Center Stage in ‘Ask Me Anything’ Conversation with ISACA Hall of Famer

Digital Trust Ecosystem Framework expert Mark Thomas recently shared his perspective on DTEF and digital trust during an Ask Me Anything conversation on ISACA's Engage community.

8 April 2024
Patrick Barnett
Security Article

Using a Functional Cybersecurity Exercise to Test Incident Response Plans

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

8 April 2024
Matthew Henshaw
Blog Post

Why You Should Get Your CRISC

The evolving risk and technology landscapes has made the knowledge and expertise of the CRISC credential all the more valuable for risk practitioners.

4 April 2024
Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement
ISACA Journal Article

Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement

Security is everyone’s responsibility. And although instilling a security culture in an organization is not always easy, it is essential.

Author: Jayakumar Sundaram
Luiz Claudio Diogo Reis, CISA, CRISC, CDPSE, COBIT 5 & 2019 Certified, Marcos Sêmola, CISM, CIPM, CDPSE, PCI/DSS, ISO27k LA, IAPP Vanguard Award LA 2023 and Paulo Sergio Pagliusi, Ph.D. in Information Security - RHUL, CISM, C|CISO, LA7799
Blog Post

Addressing Artificial Intelligence Threats and Risks from the Board of Directors Perspective Using COBIT 2019

The COBIT framework can be useful for enterprises as they look to responsibly operationalize and govern artificial intelligence.

2 April 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

Creative Approaches to Gaining Cybersecurity Experience

Volunteering, joining industry associations and finding creative ways to gain hands-on experience can all position those interested in breaking into cybersecurity for opportunities in the field.

1 April 2024
John P. Pironti
@ISACA Article

Five Key Benefits of Using a Third-Party Incident Commander for Security Incident Response

Third-party incident commanders are able to coordinate and govern incident response resources effectively, along with bolstering incident response plans and capabilities

1 April 2024
Tamim Ahmed
Blog Post

The Struggle of IT Risk Management in Micro, Small and Medium-sized Enterprises

Limited resources, misaligned priorities, lack of awareness, complexity of IT ecosystems and regulatory pressures are among the factors that make risk management especially challenging for small and medium-sized enterprises.

29 March 2024
Brian Gallagher
Blog Post

Shaping the Future with CMMI

The 2024 CMMI Conference will spotlight recent updates and improvements that position the CMMI community for increasingly high impact.

28 March 2024
Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance
Blog Post

Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance

The ISACA China Hong Kong Chapter contributed to a panel discussion with a focus on the potential impact of cyber commanders in the security governance ecosystem.

27 March 2024
A Proposed High-Level Approach to AI Audit
ISACA Journal Article

A Proposed High-Level Approach to AI Audit

Artificial intelligence (AI) has become ubiquitous in daily life, from healthcare and finance to virtual assistants and autonomous vehicles.

Author: Denis Piazzi
milova_omolara_shih_quinland-blog
Blog Post

Meet ISACA’s Women’s Month Scholarship Winners

ISACA Foundation Women's Month Scholarship Award winners share their motivations and future ambitions for making their mark on digital trust professions

26 March 2024
Isaac Kohen
Security Article

Five Steps to Secure an Enterprise Against Insider Threats

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

26 March 2024
keith-bloomfield-deweese
Blog Post

Get Grounded in AI

A new ISACA resource on artificial intelligence provides valuable insights applicable both to those beginning their journeys in AI as well as those with knowledge and experience.

25 March 2024
Maosen Cai
Blog Post

How to Instill a Culture of Data in Internal Audit Function

Asking the right questions and meaningfully addressing business challenges through analytics can set internal auditors on the right path toward establishing a culture of data

20 March 2024
Enhancing Collaboration to Improve Cybersecurity Practices
ISACA Journal Article

Enhancing Collaboration to Improve Cybersecurity Practices

The cyberthreat landscape is continually expanding as more enterprises and critical infrastructures increase their attack surfaces owing to their connectivity to the Internet.

Authors: Yasmin Nakhleh Jubran, Parsa Sadeghi, Kevin Melecio, Felipe Casabianca and Brian K. Ngac
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Quick Scoping: How to Easily Frame Your Environment from a Compliance Lens

Lessons learned from theft prevention in a retail environment have surprising relevance when it comes to compliance and access management.

19 March 2024
Varun Prasad
@ISACA Article

Best Practices for Auditable Security Controls

Strong identity and access management practices enable organizations to build a strong security posture, as cloud security expert Varun Prasad explains in this Q&A interview.

18 March 2024
Jack Freund
@ISACA Article

Common Sense Risk

Only by applying common sense can practitioners stop managing cybersecurity using the equivalent of mythology.

18 March 2024
Marcel den Hartog, CGEIT, Trend & Innovations Expert at Enable U in The Netherlands
Blog Post

Why AI Might Not Make the Best Coding Buddy

The information you upload in a public AI engine is public domain from the moment you press enter: what are the consequences for IT and corporate governance?

15 March 2024
Daniil Karp
Blog Post

How AI Is Transforming Audit, Risk and Compliance

Whether optimizing coverage in your compliance program, identifying similar risks across various business units or seeking more efficient risk management, AI-driven insight can help to connect the dots.

14 March 2024
Safia Kazi
Privacy Article

Optimize Enterprise Data and Uphold Privacy With ISACA’s DTEF

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

14 March 2024
The Ethical Challenge of IT Silos
ISACA Journal Article

The Ethical Challenge of IT Silos

Enterprise governance of information and technology (EGIT) and business-IT alignment are crucial to create value and achieve the goals and objectives of IT. 

Author: Rajesh Srivastava
Industry News
Privacy Article

Achieving Ethical Protection of Data Privacy

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

12 March 2024
BInita Patel
Blog Post

The Symbolic Dance: Exploring the Role of AI in Cloud Computing

The convergence of artificial intelligence and cloud computing offers big opportunities for organizations alongside potential security and privacy risks.

11 March 2024
Noelle Pickler
Blog Post

Refreshed Mission, Renewed Energy Around SheLeadsTech Program

ISACA's SheLeadsTech program has a refreshed focus and renewed commitment to offering expanded opportunities for women to make their mark on digital trust professions.

8 March 2024
Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships
@ISACA Article

Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships

A new framework from ISACA positions organizations to build more trustworthy relationships with customers while simultaneously operating more cost-efficiently and making better use of emerging technology.

6 March 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Do You Overthink? How to Avoid Analysis Paralysis in Decision Making

Establishing clear decision-making criteria can help organizations from becoming bogged down by regularly over-analyzing decisions.

6 March 2024
Tara Kissoon
Blog Post

Countering Identity Takeover Incidents

Protecting individuals' identities in the aftermath of a privacy incident begins with important communication from banking, credit, government and employment organizations.

5 March 2024
Mark Thomas, president of Escoute Consulting, Greg Witte, CISM, Security Engineer and Cybersecurity Instructor, and Rolf von Roessing, partner & CEO at Forfa Consulting
Blog Post

Digital Trust Ecosystem Framework a Valuable Complement to COBIT, Other Frameworks

The Digital Trust Ecosystem Framework and COBIT work well in tandem, with each playing a significant role in allowing organizations to build a stronger foundation for success.

4 March 2024
Connected network graphic
ISACA Journal Article

Assertion-Based Financial Audit Procedures Related to Crypto Assets

Auditors must learn practical approaches and procedures for auditing crypto assets to manage the audit risk associated with such assets effectively.

Author: Kilian Trautmann
Graphic with security symbol
ISACA Journal Article

Information Security Matters: Information Security Architecture—From Access Paths to Zero Trust

Zero Trust Architecture will not stop all cyberattacks, but it can ensure that organizations do not fall victim to the easiest of attacks or fail to discover a breach for months or even years.

Author: Steven J. Ross
Person in front of computer screens
ISACA Journal Article

IS Audit in Practice: How Managers Can Help Employees Thrive in Today’s Data Environment

No one faces the challenges of the data environment more than the front-line contributors in the audit and compliance professions.

Author: Cindy Baxter
Graphic of computer code
ISACA Journal Article

The Digital Trust Imperative: The Data Bare Minimum Is Not Enough

If an organization has competitors willing to show that they go beyond the bare minimum, the organization doing just enough to be compliant is going to find it hard to compete.

Author: K. Brian Kelley
Graphic of computer data network
ISACA Journal Article

The Bleeding Edge: Planning for the New Data Ecosystem

The rules of what we think we know about data are being rewritten. Several converging trends represent a seismic shift in our understanding of the technology ecosystem.

Author: Ed Moyle
Person working on a tablet with healthcare data
ISACA Journal Article

Data Interoperability: Addressing the Challenges Placing Quality Healthcare at Risk

The data interoperability challenge in global digital health, as experienced in the context of the variety of national electronic health record (EHR) deployments around the world, should have been avoidable.

Author: Guy Pearce
Laptop with overlying financial building and cloud graphics
ISACA Journal Article

Financial Clouds on the Horizon: Reassessing the Economics of Public Cloud Adoption for Financial Institutions

In an era characterized by rapid technological advancement and evolving customer demands, financial institutions face new challenges to remain competitive.

Author: Matthew Ryan
Light burst over computer code
ISACA Journal Article

Addressing the Privacy, Security, Risk, and Operations Aspects of the Data Ecosystem

Data privacy, security, risk management and operations are complex aspects of the global data ecosystem, and enterprises should address them with solutions based on research and best practices.

Author: Mathura Prasad
Graphic of globe
ISACA Journal Article

Building Compliance Resilience Amid a Patchwork of Data Protection and Privacy Laws

Organizations operating across multiple states or countries must contend with multiple privacy laws and regulations consisting of nuanced, divergent or even conflicting obligations and requirements.

Author: Corlane Barclay
Graphic with money symbols
ISACA Journal Article

Key Considerations To Effectively Plan And Determine The Scope Of An ATM Security Audit Based On PCI DSS

ATMs have become more evolved self-service platforms, helping people pay bills, transfer funds, and exchange currencies. The increase in the number of services offered by ATMs also increases their risk.

Author: Aleksei Panov
Computer code burst
ISACA Journal Article

Rethinking Cybernetics

The goal is by no means to reject the Turing machine, but rather to integrate it with a machine made more complex by the phenomenal advances in modern technology.

Authors: Jean Fayot,  Claude A. Laborde and Jean Claude Célestin
Finger pointing at network ring
ISACA Journal Article

Blockchain Smart Contracts, Part 4: How to Audit

Traditional financial auditing practices must evolve as blockchain technology and Web 3.0 technology become standard.

Authors: Samuel Zaruba Smith and Andy Garcia
Oleksii Baranovskyi
Blog Post

ISACA Award-Winner Stands at Crossroads of Theoretical and Practical

Oleksii Baranovskyi, of Ukraine, recipient of the ISACA Educational Excellence Award, is proud to simultaneously be a security professional and an educator.

29 February 2024
Jayakumar Sundaram
Blog Post

Harmony in Cyberleadership: Navigating the Gen Z Rhythm

Cybersecurity leaders should be mindful of the composition of their security teams, including common characteristics of Gen Z cyber professionals, when devising their approaches to leadership.

28 February 2024
A Factory Model Approach to Technology Control Testing
ISACA Journal Article

A Factory Model Approach to Technology Control Testing

Technology control testing is a comprehensive evaluation of an enterprise’s technological infrastructure, systems and processes.

Author: Michael Powers, PH.D., CRISC
Mukta Sharma
Blog Post

Third-Party Termination: Understanding Technology and Information Security Risks

Mitigating the technology and information security risks from terminating third parties calls for organizations to formulate nuanced security strategies.

27 February 2024
Aparna Agarwal
Security Article

The Top 5 Cybersecurity Threats and How to Defend Against Them

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

27 February 2024
Pablo Ballarin Usieto
Blog Post

Fallout from Viamedis, Almerys Attack Does Not End with the Data Leak

A major breach in France reinforces the need for sharpened security practices and the overarching imperative to drive toward strengthening digital trust.

26 February 2024
A Cybercriminal is Sentenced. Will It Make a Difference?
Blog Post

A Cybercriminal is Sentenced. Will It Make a Difference?

Ransomware often targets small-to-medium enterprises, so security teams need to take action to be more prepared for this potentially devastating line of attack.

23 February 2024
Ali Pabrai
Blog Post

CMMC: A Global, Resilient Cyber Supply Chain Standard

The Cybersecurity Maturity Model Certification standard helps businesses to examine their computing ecosystem and enhance capabilities for stronger supply chain resilience.

22 February 2024
Nandita Rao
@ISACA Article

Strategies to Prepare for US State Privacy Law Compliance

Absent a major breakthrough on a federal privacy law, more US states are likely to enact privacy laws that will add to an already complex policy patchwork.

21 February 2024
The Commoditization of Ransomware-as-a-Service
@ISACA Article

The Commoditization of Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) is posing new, difficult challenges for organizations and law enforcement organizations alike.

21 February 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

The Skills Combination We Need to Address the Global Cybersecurity Skills Gap

Embracing the right blend of hard and soft skills can position professionals to find opportunity in the cybersecurity profession.

21 February 2024
Shini Menon
Blog Post

Broad, Regulatory Frameworks Needed to Responsibly Harness AI

As regulatory frameworks for the AI era continue to evolve, governments around the world will need to find a shared sense of purpose and collaborate on the best way forward.

21 February 2024
The Three Lines Model in Cybersecurity Governance and Risk Management
ISACA Journal Article

The Three Lines Model in Cybersecurity Governance and Risk Management

A solid cybersecurity governance structure (inclusive of cyberrisk management) should entail clear accountability for cybersecurity and unequivocal authority for cyber decision making within an organization.

Authors: Ivano Bongiovanni, PH.D., Sergeja Slapniičari, PH.D., CPA, Micheal Axelseni, PH.D., CPA and David Stockdalei, PH.D.
Ravikumar Ramachandran
Blog Post

The Key Steps to Successfully Govern Artificial Intelligence

Accounting for key characteristics of trustworthiness and considering perspectives from a range of stakeholders are among the needed ingredients to strengthen AI governance.

19 February 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100)
Blog Post

Eight Things NOT To Do When Preparing for the CISA

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

16 February 2024
Jessica Burnett
Blog Post

The Digital Trust Game-changer: Get Ready for the Digital Trust Ecosystem Framework

Trust reigns supreme in this digital era. And as technologies like AI revolutionize industries, the importance of trust continues to skyrocket.

15 February 2024
Jagdish Mohite
Blog Post

The Surge in AI Development: Boon or Bane

Responsible development of artificial intelligence that recognizes the need for a balance between AI and human capabilities is the path to ensure the powerful technology's good outweighs the bad.

14 February 2024
Ricky Hamilton
Blog Post

Auditing Social Engineering: A Practical Approach

By asking the right questions around people, processes and technical controls, auditors can gather the evidence and documentations they need to successfully audit social engineering.

13 February 2024
Guy Propper
Security Article

Navigating the Shifting Ransomware Landscape

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

13 February 2024
Ramona Ratiu
Blog Post

Securing the Future: Enhancing Cybersecurity in 2024 and Beyond

Prioritizing comprehensive cybersecurity strategy in support of overarching enterprise goals can position enterprises for success, even amid challenging threat and regulatory environments.

12 February 2024
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

AI and Patents: More Questions Than Answers

Court rulings that AI cannot be granted patents provided needed short-term clarity but there are still many open questions about how AI should be viewed in legal, ethical and practical contexts.

9 February 2024
Board room setting
ISACA Journal Article

Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model

Organizations across a variety of industries can benefit from a well-planned GRC strategy.

Author: Robert Putrus
Derek Melber
Podcast

A View into CTEM Exposure Management: Reducing your Attack Surface 3x

Organizations can no longer rely on legacy vulnerability management solutions to protect against even basic attacks.

7 February 2024
Guy Pearce
Blog Post

Digital Proficiency: Not Only for Individuals

Technology-minded countries around the world can learn a lot from Rwanda, which, despite limited resources, has become a digital benchmark through an impressive set of initiatives and ingenuity.

6 February 2024
Goh Ser Yoong
@ISACA Article

Five AI Priorities for Digital Trust Professionals to Put on Their 2024 To-Do List

Greater awareness of potentially unethical AI usage and adapting to evolving AI regulations are some of the considerations that should be top-of-mind for digital trust professionals in 2024.

5 February 2024
US Congressman Visits ISACA for CMMI Update, AI Policy Discussion
@ISACA Article

US Congressman Visits ISACA for CMMI Update, AI Policy Discussion

A recent visit by a United States congressman to ISACA's office in Schaumburg included discussion of artificial intelligence policy and updates on how CMMI is sharpening enterprise performance.

5 February 2024
Divya Aradhya
Blog Post

Threat Modeling and Secure-By-Design Applications

Identifying the flows, assets and vulnerabilities are among the key building blocks when threat modeling for software applications.

5 February 2023
Jo Stewart Rattray
Blog Post

Taking Action to Create a Future Where AI Benefits Us All

Artificial intelligence is a human creation that reflects the people who developed it, meaning we must guard against humans' shortcomings and biases resulting in AI furthering inequality and other societal harms.

2 February 2024
Arun Mamgai
Security Article

How CISOs Can Take Advantage of the Balanced Scorecard Method

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

2 February 2024
Jay Hira
Blog Post

Global Experts Weigh in On Australia’s ‘Six Cyber Shields’ – Sharing Insights on Achieving a Safe Digital World

Global cybersecurity practitioners share their perspectives on Australia's new cyber shields strategy to provide more robust protection of digital assets in the coming years.

31 January 2024
Strengthening SIF Detection
ISACA Journal Article

Strengthening SIF Detection: Leveraging Social Media Footprints

SIF is a growing problem for financial institutions. At the same time, the monetary losses from SIF are difficult to quantify, with estimates ranging between US$20 billion and US$40 billion.

Authors: Mario Bojilov, PH.D, CISA, Kishore Singh, PH.D and Peter Best
Mike Boutwell
Risk Article

Navigating the Treacherous Waters of IT Risk

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

30 January 2024
ookeditse-kamau
Blog Post

‘Just for Control’: the True Power of Controls

Ill-designed controls can waste organizations' time and resources, so make sure implementing controls is more than just a power move.

29 January 2024
Nina Bryant and Susana Esteban
Blog Post

Responsible AI Governance in Traditional and Emerging Ecosystems

Organizations implementing artificial intelligence into their operations will need strong governance in place to ensure transparency and trust in their AI usage.

25 January 2024
Anthony Oteri
Blog Post

Executing A Well-Executed Risk and Control Self-Assessment

When executed properly, risk and control self-assessments become enablers for organizations to more effectively navigate the risk management landscape.

24 January 2024
Digital security shield
ISACA Journal Article

Securing the First Line of Defense

Cybersecurity awareness for employees is nonnegotiable. It helps protect both individuals and organizations by mitigating cyberthreats and protecting sensitive information, which strengthens the overall security posture of an organization.

Author: Hadi Manasrah
Valerie Lyons
Blog Post

The Top 10 Things Every Cybersecurity Professional Needs to Know About Privacy

As the intersection between cybersecurity and privacy increases, security professionals can benefit from gaining a solid understanding of core privacy terminology and privacy principles.

22 January 2024
Nandita Rao Narla, Head of Technical Privacy and Governance at DoorDash
Blog Post

Privacy in Practice: Dissecting the Global Trends That are Shaping the Profession

Challenges on the privacy landscape can be successfully addressed through upskilling, privacy by design principles and solid training and awareness programs.

18 January 2024
New Timing for ISACA Newsletter
@ISACA Article

New Timing for ISACA Newsletter

The @ISACA newsletter will distribute on the first and third Mondays of the month in 2024, while a new monthly digest of top ISACA content will make its debut.

17 January 2024
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Projecting 2024 Cybertrends and C-Suite Responsibilities

Anticipated trends on the 2024 cybersecurity landscape provide opportunities for C-suite leaders to position their organizations to effectively and securely leverage emerging technology.

17 January 2024
Noelle Pickler
Blog Post

Mentorship: The Missing Ingredient in Your 2024 Goals?

The ISACA Mentorship Program has proven to be rewarding for mentors and mentees alike, allowing for valuable connections to propel ISACA members' careers to new heights.

17 January 2024
Cybersecurity locks
ISACA Journal Article

Increasing Security and Improving Performance With Network Managed Service Providers

Managing enterprise networks to meet increasing business requirements in the face of consistent cost reduction pressures can be demanding

Author: Oluwafemi Adeyemo Adeleke
Robin Lyons and Amanda Tucker
Podcast

Leveraging Agile Concepts for Neurodiverse Auditors

In this ISACA Podcast episode, we’ll explore how leveraging Agile concepts can mitigate common workplace challenges for neurodiverse auditors.

17 January 2024
Ravikumar Ramachandran
Blog Post

Post-Quantum Cryptography: Are We Ready for Q Day?

Focusing attention on understanding and building confidence in post-quantum cryptography now can save the security community major problems in the years to come.

16 January 2023
Ozman Azab
Audit Article

Six Benefits of a Cybersecurity Audit (and 6 Steps to Perform One)

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

16 January 2023
Sergio Tringali
Blog Post

Nurturing Responsible Innovation: ISACA’s DTEF Recognized for Advancing Trust in AI Environments

ISACA’s Digital Trust Ecosystem Framework (DTEF) empowers organizations to build and sustain digital trust in the age of artificial intelligence and other impactful technological advancements.

12 January 2024
Luigi Sbriz
Blog Post

Modeling Identity Trust

An identity system based on trust in a third party could better protect personal data and improve trust throughout the digital ecosystem.

10 January 2024
Computer room
ISACA Journal Article

Fog Computing and Edge Computing as Alternatives to the Cloud

Fog computing and edge computing have great potential to play major roles in the real-time processing of data.

Author: Kishan Sathyanarayanan
Fouad Mulla
Security Article

Building Cybersecurity Resilience With the Power of Habit

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

9 January 2024
Erik Prusch
Blog Post

ISACA’s Exciting 2024 is Underway

New ISACA digital trust resources, thought leadership, and upcoming events, both in-person and virtual, are among the coming attractions in 2024 for the ISACA community.

8 January 2024
Hakan Kantas
Blog Post

Workforce Resilience: A Critical Asset for Organizations in Today’s Dynamic World

Promoting a culture of ongoing learning and upskilling is part of the equation for organizations looking to develop a more capable and resilient workforce

5 January 2024
Grant Hughes
Blog Post

Building a Great Security Operations Center

Defining and articulating a clear strategy for a security operations center (SOC) will make it much more likely that organizational leaders and other key stakeholders will support the SOC on an ongoing basis.

4 January 2024
Cultivating Digital Trust and Sustainability in IoT Devices
@ISACA Article

Cultivating Digital Trust and Sustainability in IoT Devices

Explore strategies to secure your IoT devices in the aftermath of the holidays, in alignment with ISACA’s goal of ensuring digital trust.

3 January 2023
Jack Freund
@ISACA Article

Emotional Cyberrisk Management Decisions

Emotions can complicate or even impair organizations' need for rational approaches to cyberrisk but that does not mean there is no place for emotion in the equation.

3 January 2024
Carol Lee
Blog Post

The Intersection of Change Management and Cybersecurity: A Paradigm Shift in Protection

Given its focus on human behavior in an organizational change context, change management can lead to a fresh and valuable perspective on cybersecurity

2 January 2024
Minimizing Risk and Audit Requests
Podcast

Minimizing Risk and Audit Requests

With the increasing demand for audits and risk assessments, artifact requests will not be going away anytime soon. However, the burden these activities bring to the organization can be drastically reduced when audit and risk work together.

3 January 2024
Digital biometric fingerprint
ISACA Journal Article

Information Security Matters: Who Put the Zero in Zero Trust?

Zero trust is quite supportive of digital trust; they overlap to a great extent.

Author: Steven Ross
Digital micro chip
ISACA Journal Article

IS Audit in Practice: A Collaborative Approach to Assessing AI Risk

Ethical AI occurs when the business, risk and compliance teams not only evaluate the business opportunity that AI brings but carefully consider its impact by sitting in the shoes of users, policymakers and financial market managers.

Author: Cindy Baxter
Finger pointing to gears and a handshake
ISACA Journal Article

The Digital Trust Imperative: AI’s Impact on Digital Trust

Given the proliferation of AI/ML solutions, it is important to understand potential areas of concern, especially ones that affect the reputation and trustworthiness of organizations and individuals within the digital ecosystem.

Author: K. Brian Kelley
Person looking at their cell phone
ISACA Journal Article

The Bleeding Edge: Free Resources for Hardening AI and ML

If your organization is exploring ways to derive business value from AI and ML, even just maintaining an awareness of the space and becoming educated about the security, assurance, risk, and governance implications is helpful.

Author: Ed Moyle
Finger pointing at digital brain
ISACA Journal Article

Harnessing the Power of Large Language Models

Organizations must understand how to use these new large language models without creating negative societal impacts.

Authors: Meike Hofmann, Gerald Burch and Jana Burch
Security lock
ISACA Journal Article

Securing the Future: Mitigating Data Security Concerns in Artificial Intelligence Models

Although AI can save time and effort, many users remain unaware of the potential risk to an enterprise’s sensitive data.

Author: Sharad Verma
Network of digital neurons
ISACA Journal Article

Deploying Responsible AI

With the impending adoption of regulations such as the EU AI Act, organizations must adopt holistic responsible AI programs.

Author: Joshua Scarpino
Digital globe map
ISACA Journal Article

The Potential Impact of New AI Regulations

There is a need for impactful regulations as well as a general awareness on how these regulations can positively improve the field of AI.

Author: Shini Menon
Finger pointing at digital wave
ISACA Journal Article

Subverting AI's Intellect: How to Thwart Data Poisoning

As AI systems proliferate and gain more widespread adoption, safeguards to thwart data poisoning attacks and ensure decisions that reflect human values become more important.

Author: Prithiv Roshan Sudhakar
Digital globe
ISACA Journal Article

Filling AI’s Cybersecurity Best Practice Gap

There are fundamental considerations necessary to creating a security and privacy risk management baseline for any AI implementation or deployment.

Authors: Joe Cozzupoli and John Salomon
Finger pointing at biometric fingerprint
ISACA Journal Article

Help Wanted: Evolving Privacy Roles and the Widening Privacy Skills Gap

This growing importance of privacy in organizations has led to a shift toward more technical privacy roles, where demand for such roles exceeds talent supply.

Author: Nandita Rao Narla
Kristi Hedges
Blog Post

Cultivating a Culture of Inspiration: ISACA’s Member-Exclusive Speaker Series

Kristi Hedges, a Fortune 500 leadership coach and author, shared her perspective on how to inspire others during the ISACA Member-Exclusive Speaker Series.

29 December 2023
Greg Shieds
Blog Post

Supporting Privacy, Security and Digital Trust Through Effective Enterprise Data Management Programs

Organizational silos, poor data quality and improper data storage are among the challenges enterprises need to overcome to build effective data management programs and strengthen digital trust.

28 December 2023
ISACA Award Winner
Blog Post

ISACA Award Winner Advocates for ‘Life or Death’ Matter of Information Management

Castlepoint Systems, an Australian organization focused on data protection, compliance and risk management, was recognized with the 2023 ISACA Innovative Solutions Award.

27 December 2023
Globe with networking icons
ISACA Journal Article

Securing the AI-Enabled Supply Chain With Vendor Management

Securing the AI-enabled supply chain will enable organizations to gain a competitive edge by ensuring a secure and reliable supply chain ecosystem.

Author: Anuj Choudhary
Adam Kohnke
Blog Post

Top Management Considerations for Zero Trust

A new zero trust audit program from ISACA can help organizations transition from traditional network security architectures to ones that are better equipped to handle the modern threat landscape.

26 December 2023
Justin Rende
Security Article

Track These 7 Trends for Proactive Cybersecurity in 2024

As 2024 looms near, digital threats are expected to increase in sophistication. Consequently, the tools and strategies cyberprofessionals use to counter them must also adapt.

26 December 2023
Ravikumar Ramachandran
Blog Post

API Security: An Internal Auditor’s Quick Reference

Effective usage of Application Programming Interfaces (APIs) calls for diligence in related security controls and audit considerations.

21 December 2023
Jack Freund
@ISACA Article

Defective CISOs: Lock Them Up?

The possibility of legal exposure for CISOs in the current climate reinforces the perils of an already stressful and difficult role.

20 December 2023
Rahul Pandey
@ISACA Article

The Window of Exposure: A Critical Component of Your Cybersecurity Strategy

Understanding the nuances of the window of exposure when systems are at risk and is critical for security professionals to effectively protect their organizations.

20 December 2023
phoenix-defense-case-study
Blog Post

Significantly Improving Security Posture: A CMMI Case Study

Adopting CMMI has led to performance improvements across the board for Phoenix Defense, including a significant reduction in network attacks.

20 December 2023
Group of people around an office table
ISACA Journal Article

Understanding CISO Management Styles

CISOs and CIOs can adopt a variety of management styles, depending on the individual’s personality and personal preferences, leadership styles, the organizational culture and context, and the specific needs of the enterprise.

Author: Jayakumar Sundaram
Brian Levine
Blog Post

Protecting Your Organization from Cybersquatting

Registering and trademarking your internet domain, and monitoring for registrations with confusingly similar domain names, are among the ways organizations can protect themselves from cybersquatting.

19 December 2023
Chris McGowan
Security Article

Quishing: The Invisible Threat in QR Code Technology

When quishing occurs, unsuspecting individuals are lured into scanning malicious QR codes that link to fraudulent websites or malware downloads. Awareness surrounding this new threat must be raised to protect personal data and digital safety.

19 December 2023
How Business Leaders Can Responsibly Embrace Generative AI
Blog Post

How Business Leaders Can Responsibly Embrace Generative AI

A Forbes article by Phillimon Zongo lays out how enterprise leaders can help their organizations responsibly leverage generative artificial intelligence.

18 December 2023
Guy Pearce
Blog Post

Five Things for Governance Professionals to Put on Their 2024 To-Do List

In an era of increased complexity, formalizing data governance frameworks and data management protocols should be increasingly top-of-mind for governance professionals.

15 December 2023
Gary Carerra
Blog Post

Five Things for Privacy Professionals to Put on Their 2024 To-Do List

Gaining a better understanding of fast-evolving privacy regulations is a good starting point for privacy practitioners who are looking to position themselves for success in 2024.

14 December 2023
Serving Up Your 2024 To-do L
@ISACA Article

Serving Up Your 2024 To-do List

ISACA experts provide 2024 to-do lists for professionals looking to update their skill sets and expertise in the fields of IT audit, risk management, cybersecurity, privacy and IT governance.

13 December 2023
Sandeep Godbole
Blog Post

Five Things for Cybersecurity Professionals to Put on Their 2024 To-Do List

Incorporating artificial intelligence capabilities and sharpening the ability to architect security solutions in cloud settings can help cybersecurity professionals thrive in 2024.

13 December 2023
Person typing on a laptop
ISACA Journal Article

Using Security Controls to Mitigate Privacy Risk When Employees Use ChatGPT

If employees use generative AI, employers should implement effective information security controls and data protection measures and then monitor and assess the design and operating effectiveness of those controls to ensure compliance with security policies, contractual obligations and privacy regulations.

Author: Oluwafemi Adeleke
Mary Carmichael
Blog Post

Five Things for Risk Professionals to Put on Their 2024 To-Do List

Embracing the role risk management can play in supporting the strategic growth of the business is among the items risk professionals should place on their 2024 to-do lists.

12 December 2023
Sadiq Nasir
Security Article

Rethinking Cybersecurity Training to Build a Resilient Workforce

There is much to be gained by exploring various approaches to ensuring benefits realization for any cybersecurity training program.

12 December 2023
Veronica Rose
Blog Post

Five Things for Audit Professionals to Put on Their 2024 To-Do List

Prioritizing upskilling, participating in mentoring programs and authentic engagement with stakeholders are among the approaches that can get IT auditors off to a good start in 2024.

11 December 2023
Glenda Suarez Cabrera
Blog Post

Secure Software Development Lifecycle Cannot Achieve its Purpose Without Third-Party Risk Management

Treating security as a core element of the design, build and implementation of software products takes intentional action, and understanding the impact that third parties play in achieving the desired level of product security is a step that not everyone is prepared for.

8 December 2023
Vishal Sharma
Blog Post

Adapting Leadership for the Changing Technology and Cybersecurity Landscapes

The increasing prominence of technology in today's digital ecosystem calls for different approaches to organizational leadership, including creating an environment where innovative mindsets are encouraged.

7 December 2023
ISACA’s Top 10 Content Resources of 2023
Blog Post

ISACA’s Top 10 Content Resources of 2023

Discover 10 ISACA resources from 2023 that resonated at a high level with our professional community

6 December 2023
Caitlin McGraw
@ISACA Article

Lions and Tigers and Office Politics – Part 2: How to Successfully Join a New Organization, Team or Function

Insights on addressing the learning of politics of a new organization and how to ensure you don’t make mistakes.

6 December 2023
Liz Fosslien and Molly West Duffy
Blog Post

The Leadership Benefits of Emotional Fluency and Vulnerability: ISACA’s Member-Exclusive Speaker Series

A recent installment of the ISACA Member-Exclusive Speaker Series focused on vulnerability and managing emotions in a workplace and leadership context.

6 December 2023
Person typing on a laptop with a digital security overlay
ISACA Journal Article

Lessons Learned From the Bangladesh Bank Heist

This cyberheist serves as a reminder that financial institutions worldwide need to rethink their cybersecurity strategies, risk management protocols and collaborative efforts to protect against similar cyberthreats.

Author: Mohammad Sami A Kabir
Ramona Ratiu
Blog Post

The Essentiality of Cybersecurity for Small Businesses: Applying Zero Trust Principles

Applying zero trust principles can be every bit as essential for smaller businesses to protect themselves as for large enterprises.

5 December 2023
James Allman-Talbot
Security Article

The Grim Reality of a Cyberattack: From Probability to Certainty

The outlook is grim for organizations that wish to keep their data secure. It is necessary to understand practical methods for reducing the impact of suffering from an attack.

5 December 2023
John de Santis
Blog Post

Diverse, Experienced Board a Must for ISACA to Be at its Best

Nominations and applications are being accepted for the ISACA Board of Directors for the 2024-25 term

4 December 2023
Dalitso Tony Phiri
Blog Post

The Yellow Brick Road to Certifications: ISACA’s Mentorship Program and Exam Success

Finding a mentor through ISACA's Mentorship Program can help certification candidates on their path toward passing their exam, among a range of other benefits.

1 December 2023
How to Create a Healthy Security Culture
Blog Post

How to Create a Healthy Security Culture

Incentivizing reporting, collaborating on solutions and reframing teaching points in positive fashion are all elements that can improve an organization's cybersecurity culture.

30 November 2023
Andres Ricardo Almanza
@ISACA Article

Cybersecurity and Burnout: The Cybersecurity Professional's Silent Enemy

The demands on cybersecurity professionals can lead to mental health challenges, making it important that practitioners integrate mindfulness and proactively find ways to reduce burnout.

29 November 2023
Naomi buckwalter
Blog Post

The Benefits of Hiring Entry-level Cybersecurity Professionals

Many organizations are reluctant to hire relatively inexperienced people for cybersecurity roles but that approach is often misguided, according to recent ISACA Ask Me Anything expert Naomi Buckwalter.

29 November 2023
Wall of computers
ISACA Journal Article

How to Build a Great SOC

It is imperative for the purpose, scope and objectives of an SOC to be clearly defined and communicated from the start, otherwise the investment in the SOC can be difficult to demonstrate and the SOC may not support the organization’s objectives.

Author: Grant Hughes
Emily Bastedo and Sergio Tringali
Blog Post

ISACA Advocacy Partnering with Policymakers to Work Toward More Trustworthy Digital Ecosystem

The ISACA Advocacy team spent recent months engaging with influential policymakers, with a focus on bolstering the cybersecurity workforce and creating a healthier digital ecosystem.

28 November 2023
Michalis Kamprianis
Risk Article

Third-Party Risk Management: The Security Blind Spot No One Wants to Discuss

Third-party risk analysis services and customer security questionnaires are no longer sufficient for risk management. Trust professionals must explore alternative solutions for mitigating risk.

28 November 2023
Larry Alton
@ISACA Article

Three Proactive Measures to Prevent Accounts Payable Fraud

As businesses grapple with complex transactions and multiple vendor relationships, the risks of accounts payable fraud grow, threatening both financial health and organizational reputation.

22 November 2023
‘Tsunamis’ to Change Course of Security Workforce
@ISACA Article

‘Tsunamis’ to Change Course of Security Workforce

Emerging technologies, changes in the global economy and workforce transformations accelerated by the pandemic are reshaping the outlook for professionals in security and other digital trust fields.

22 November 2023
Karen Heslop
Blog Post

ISACA Advisory Groups Help Shape Programs

A range of volunteering opportunities through ISACA provide professionals meaningful opportunities to strengthen the profession while also earning CPE credits.

22 November 2023
Person working at a laptop
ISACA Journal Article

The Risk and Control Self-Assessment

Risk and control self-assessments offer a vital framework for organizations to proactively identify, assess and mitigate risk.

Author: Anthony Oteri
Arunava Banerjee
Risk Article

Optimizing Risk Transfer for Systematic Cyberresilience

As security professionals navigate the present cyberthreat horizon, it is crucial to understand the emerging dangers and fortify digital defenses with cyberinsurance to ensure a secure digital future.

21 November 2023
Susan Snedaker
Blog Post

Renovating Healthcare IT (or any IT): Building the Foundation for Digital Transformation

Modern systems, architectures and technologies, in addition to staff expertise in cloud, hybrid and on-premise solutions, are all important for organizations aiming to digitally transform, but getting there often requires an IT renovation.

20 November 2023
Carol Lee, CISM, CRISC, CDPSE, C|CISO, CCSP, CEH, CIPM, CSSLP; Terence Law, CISA, CFA, CISSP, CPA, Certified Banker; Tom Huang, CISA, PMP, Prince2; Lanis Lam, CISA, AWS (SAP), CPA
Blog Post

New Measures in Mainland China for Generative AI and Implications for Global AI Governance

New measures on generative AI in Mainland China have substantial implications for the evolution and use of generative AI not only in China but elsewhere around the world.

17 November 2023
Noam Koriat
Blog Post

Incorporating Agile Audit: Practical Tips

Establishing clear expectations and customizing the approach are among the steps that can facilitate a successful Agile audit implementation.

16 November 2023
Lauren Strope
Podcast

Scaling Your Threat Modeling Program

Understanding product security risk starts before a single code line is written. Teams can discover threats to the architecture of a system early in the development life cycle with Threat Modeling.

16 November 2023
Abstract squiggles on blue background
ISACA Journal Article

The Benefits of Achieving Workforce Resilience

Organizations would benefit from focusing on how to use relevant frameworks and upskill their teams to build a resilient workforce.

Author: Hakan Kantas
Tak Wah Kwan
Blog Post

Navigating Security Threats with IT Inventory Management

An efficient, current IT inventory is a foundational component of effective IT management and puts an enterprise in position to better leverage threat intelligence.

14 November 2023
Fene Osakwe
Audit Article

Three Skills for Succeeding as an IT Auditor in the 21st Century

There are 3 skills that a modern IT auditor must possess to add value to the technology teams being audited and to avoid being seen through a negative lens by senior leadership.

14 November 2023
Wilson Tang
Blog Post

Using Machine Learning to Help Detect Sensitive Information

Leveraging machine learning has enabled Adobe to detect categories of sensitive documents and put in place automated real-time detection and response to properly flag any detected documents.

13 November 2023
abigael-bada
Blog Post

Sustainability in Emerging Technologies: A Focus on Blockchain, AI

Implementations of artificial intelligence, blockchain and other emerging technologies should be done with sustainability considerations in mind.

10 November 2023
Vanessa Revilla
Blog Post

Raising Security Awareness in Cross-Cultural Work

In an increasingly complex and global security landscape, chief information security officers need to be in regular contact with the board and other key enterprise stakeholders to drive effective security culture and collaboration.

9 November 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 2

Log management, malware defense, data recovery, security training and incident response are among the security areas for which organizations have to have solid approaches in place.

8 November 2023
Anna Johannson
@ISACA Article

How to Build Trust in a Distrustful Digital Era

Consistent and transparent communication, remaining committed to your brand values, and promoting the good things your company is doing can all help create trust in a distrustful digital era.

8 November 2023
Digital globe with hand pointing at target
ISACA Journal Article

Modeling an Identity Trust System

Basing digital identity recognition on trust is possible if the actors who request access and those who provide a service have the availability of a usable, secure and transparent mechanism.

Author: Luigi Sbriz
Luigi Sbriz
Blog Post

Is the CIO Just an IT Manager?

In a time when the rapidly evolving technology landscape is recalibrating business models, the CIO must balance internal IT activities with those that are outsourced, and map the needed controls accordingly.

7 November 2023
Sunil Arora
Security Article

From Chaos to Confidence: The Indispensable Role of Security Architecture

Similar to a high-rise building, a cybersecurity defense needs a solid foundation to avoid putting long-term stability at risk.

7 November 2023
Anuj Choudhary, Risk and Forensics Professional, CA, CFE, CISA, CISM, CS and Mary Carmichael, CRISC, CISA, CPA, Member of ISACA Emerging Trends Working Group
Blog Post

DogeRAT: The Disturbing Malware Disguised as Your Favorite Apps

DogeRAT malware reinforces the growing sophistication and multi-faceted nature of cyberthreats, through its camouflage techniques, social engineering components, and its ability to imperil privacy and financial security.

6 November 2023
Meghan Maneval
Privacy Article

What the Past Tells Us About the Future of Privacy in the United States

Because information can be replicated, exfiltrated or deleted in a matter of seconds, consumers and organizations need to implement steps to prevent, detect, respond to and remediate data breaches.

6 November 2023
Scott Fogarty
Blog Post

Cyber Advisors, Security Services Providers Can Use Zero-Sum Game Theory Framework to Benefit Clients

The zero-sum game theory is worth considering for organizations, who should rethink the costs they face relative to the cybercriminals that often inflict damage without taking on any real risk.

3 November 2023
Benjamin Bartz
Blog Post

IT Risk and IT Audit: A Partnership

Providing leadership with pertinent data can go a long way toward building support for the cross-functional collaboration between the audit and risk functions that can put organizations in a much stronger position to succeed.

2 November 2023
Jack Freund
Security Article

What Is Considered a Material Cyberrisk Under the New US SEC Rules?

The cyberevent disclosure rules introduced by the US SEC in July 2023 have sparked a wave of concern among cybersecurity professionals and BoDs.

2 November 2023
Learning while earning - person working in front of computers
ISACA Journal Article

Learning While Earning: A New Way to Upskill the Workforce

Organizations must prioritize training and reskilling their workforces by implementing learning and development initiatives.

Author: Arjun Gopalakrishna
Mary Carmichael
@ISACA Article

Key Considerations for Developing Organizational Generative AI Policies

Few organizations have comprehensive policies in place on the usage of generative AI, which could prove perilous with increasing usage of the powerful and popular technology.

1 November 2023
Caitlin McGraw
@ISACA Article

Lions and Tigers and Office Politics – Oh My

The term 'office politics' often makes people think about toxic or unethical workplace behavior, but office politics are actually a necessity that, if handled artfully, can boost people's careers and help drive progress.

1 November 2023
Digital Trust World
Blog Post

ISACA's Digital Trust World Europe Conference

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more.

1 November 2023
Finger pointing at cyber galaxy
ISACA Journal Article

Three Top Cybersecurity Trends for the Next Decade

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more

Author: Shankar Nishant
Security - A person typing on a laptop with overlaying security symbols
ISACA Journal Article

Information Security Matters: A Little Security

Small enterprises need to adopt security at scale, consiering minimum security requirements first and additional tactics commensurate with level of risk.

Author: Steven J. Ross
Future Skills - person typing on laptop
ISACA Journal Article

IS Audit in Practice: Future Skills Needed in Audit, Cybersecurity, Privacy and Emerging Technology

Technology advances rapidly and practitioners must adopt a learning mentality to keep pace with change.

Author: Cindy Baxter
SDLC - gears
ISACA Journal Article

The Bleeding Edge: Embracing SDLC Controls and the Inevitability of Automation

Acceleration and automation of software development and release processes necessitates changes to how practitioners assure and secure the output of these processes.

Author: Ed Moyle
Skill training - peg board
ISACA Journal Article

The Digital Trust Imperative: Skills Training—A Prerequisite for Digital Trust

One often overlooked aspect of digital trust is the appropriate skilling of staff and whether they are poised to succeed in an ever-changing technology landscape.

Author: K. Brian Kelley
Lifelong Learning - person typing on laptop with overlaying symbols
ISACA Journal Article

Lifelong Learning: An Essential Attitude for Career and Life Success

The seeds and roots of lifelong learning should be planted and established so that people at all stages of their careers can embrace the lifelong learning journey.

Author: Grace Johnson
Lifelong learning - digital brain
ISACA Journal Article

Developing Lifelong Learners to Ride the AI Wave

Taking advantage of the AI revolution benefits will require organizations to provide the necessary culture and resources that encourage individuals to become self-directed lifelong learners.

Authors: Katharina Schlembach, Norman Csavajda, Gerald Burch and Jana Burch
Emotional Intelligence - wood blocks with IEQ
ISACA Journal Article

Emotional Intelligence Outweighs Technology Skills for Cybersecurity Teams

Prioritizing emotional intelligence over technology skills can help organizations identify the right talent for the right job and thus gain better visibility into their threat landscape.

Author: Christine Whichard
Optimizing a career - hand drawing steps
ISACA Journal Article

Optimizing a Career Trajectory Through Personal Accountability

GRC and cybersecurity professionals must demonstrate strength with regard to personal accountability to effectively manage their careers and ensure that they keep pace with technological advancements, associated risk factors and new techniques employed by bad actors.

Author: Adam Kohnke
To fear or not - person writing on a tablet with security symbols
ISACA Journal Article

To Fear or Not to Fear: How to Create an Optimal Security Culture

It is important to understand the different levels of employee fear, the factors that contribute to it at each level and the implications for security to effectively manage fear to create a culture of security within an organization.

Authors: John Batchelor, Timothy Spivey and Timothy McIlveene
Future Ready - digital hand writing
ISACA Journal Article

Future Ready: Toward a Sound Agile Audit Framework

Agile is an essential practice to adopt and a critical competency that cultivates digital business agility, enabling internal audit to be highly aware, make informed decisions and act promptly.

Author: Noam Koriat
Launching an SOC - two people working in front of computers
ISACA Journal Article

Case Study: Launching an SOC to Improve Cyberthreat Detection

Raython Missiles and Defense needed to build out a security operations center (SOC) alongside the technology used to prevent physical threats, with RMD’s cybercapabilities matching the level of security required for physical assets.

Author: Katie Teitler
Safeguarding enterprises - person writing on a tablet with security symbol
ISACA Journal Article

Safeguarding Enterprises from Cyberrisk with ESG

Cybersecurity is a critical element of ESG and can be used to measure the maturity of the governance of an organization; thus, cybersecurity must be added to the ESG reporting framework.

Author: Rima Bose
Gamify - person typing on laptop with overlaying graduation cap and book graphics
ISACA Journal Article

How to Gamify Cybersecurity Learning on a Budget

Gamification makes cybersecurity learning more interactive and enjoyable because it adds elements of competition, rewards and progression, which can enhance motivation and engagement.

Author: an Soon Chew
Intricate Web - person typing on laptop with overlaying security symbols
ISACA Journal Article

The Intricate Web of Third-Party Cybersecurity Risk

IT security and risk management professionals must prioritize cybersecurity within their organizations by constantly advising management on best practices for protecting their organizations’ sensitive information and strategies to manage risk effectively.

Author: Jacob Peng
Aaron Turner IANS Faculty, and Shannon Lietz Founder and CEO of ThirdScore
Blog Post

Sizing Up Some of the Spookiest Cybersecurity Incidents of 2023

2023 has been another frightful year on the cybersecurity landscape - explore some of the most perilous incidents and what security professionals can learn from them

31 October 2023
Oliver Kling
Security Article

The Importance of Security Logistics in Software Development

Organizations must understand how security measures work, are implemented and behave—and under which circumstances they fail.

31 October 2023
Safia Kazi
Privacy Article

Legally Permissible Does Not Mean Ethical

Treating compliance as an aspiration and collecting excessive amounts of information is harmful to consumers; privacy professionals must help their enterprises’ privacy practices be more ethically focused.

30 October 2023
mwangi-bunde-rajarathna
Blog Post

Saluting ISACA Foundation's Cybersecurity Month Scholarship Winners

ISACA Cybersecurity Month Scholarship recipients share what motivated them to pursue careers in cybersecurity and how they see their futures in the field taking shape.

27 October 2023
realigning-goals-enterprise-training
Blog Post

Re-aligning Employees to Strategic Goals with Enterprise Training

An ISACA enterprise training instructor provides insights on some of the main benefits of team trainings and how enterprise training can enable organizations to elevate their performance.

26 October 2023
How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech
Emerging Technology Article

How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech

Companies increasingly are on the lookout for new professionals with skills and background in emerging technologies and how to implement them in the enterprise setting.

26 October 2023
Raef Meeuwisse
Blog Post

ISACA AI Survey Results: What Do Infosec Professionals REALLY Need to Know?

It is quite hard to find quality information about artificial intelligence (AI) right now, especially when it comes to how AI should and is being approached in the field of cybersecurity. Thankfully, ISACA has just completed a survey of thousands of members of the global infosec and digital trust community.

25 October 2023
person working on a laptop
ISACA Journal Article

Improving Information Security Through Organizational Change

To effectively combat cybercrime, CISOs must report to the highest level of the organizations they serve to ensure they are heard and their message is taken seriously by all stakeholders.

Author: Scott Rosenmeier
Alan Gouveia
Blog Post

Risk Quantification 101: The Fundamentals to Getting Started

Tapping into existing risk data can enable organizations to build the needed infrastructure to put in place an effective cybersecurity risk management process.

24 October 2023
Collaborative Mindset Change from Compliance to Risk
Blog Post

Collaborative Mindset Change from Compliance to Risk

Transitioning from a compliance-based focus to a risk-based approach is useful as enterprises aim to best align resources in the modern business and regulatory environments.

23 October 2023
Ignatius Ravi
Blog Post

Best Practices for Navigating Emerging Technologies: My Journey as an Auditor

Proactively learning about emerging technologies and understanding them in a business context can go a long way toward making auditors more effective in their engagements.

20 October 2023
Ranjit Bhaskar
Blog Post

In Cybersecurity, to Err Is Human, But to Err for No Reason Is a Shame

Organizations would be well-served to be more intentional about designing systems and processes with human factor engineering in mind, lessening the probability of people making mistakes that lead to cybersecurity incidents.

19 October 2023
Ravikumar Ramachandran
@ISACA Article

Internal Auditors as Catalysts in DevSecOps

Internal auditors have an important part to play for organizations to implement DevSecOps successfully.

18 October 2023
Abdul Rafeq
@ISACA Article

Using COBIT and Google Maps to Integrate Any Framework, Standard or Model With Enterprise Apps

Mapping the functionality of popular applications can allow organizations to better understand how to make frameworks, standards and models support their apps and improve user experience.

18 October 2023
Hakan Kantas
Blog Post

Proactive IT Risk Management in an Era of Emerging Technologies

As emerging technologies and new business models transform the business landscape, the need for proactive risk management practices should be top of mind for enterprise leaders.

17 October 2023
Zachary Folk
Security Article

What Enterprises Need to Know About ChatGPT and Cybersecurity

It is the responsibility of security professionals to act now to determine how to safely leverage AI—if they wish to do so at all.

17 October 2023
Joseph Cortese
Blog Post

How Cybersecurity Best Practices are Evolving to Manage Ongoing Threats

Regular penetration testing and a culture of proactive threat analysis and management can help organizations evolve their cybersecurity programs in a difficult climate for cyber defenders.

16 October 2023
Arun Mamgai
Emerging Technology Article

Generative AI With Cybersecurity: Friend or Foe of Digital Transformation?

Generative AI requires significant training and cultural change to ensure confidential data is not compromised, and the security data model training infrastructure requires significant investment and strong business support.

16 October 2023
Steven Sim Kok Leong
Blog Post

Quantum-Resistant Cryptography Not a Matter of ‘If’ but ‘Right Now’

Establishing crypto-agility should be a major priority for organizations as advancing quantum computing capabilities are changing the paradigm of the threat landscape.

13 October 2023
Guy Pearce
Blog Post

Data Management Proficiency: Practical Insights for Quality, Security and Trust

Evaluating quality, security and trust in the context of emerging technologies and current business practices is critical for organizations to have effective data management and governance.

12 October 2023
Esanju Maseka
@ISACA Article

Artificial Intelligence: Privacy and Information Security Risk Considerations

Gaining business benefits from artificial intelligence while also mitigating the related risks requires a holistic, multidisciplinary approach that draws upon the expertise of professionals from several disciplines.

11 October 2023
Jack Freund
@ISACA Article

The Value of Near Misses in Risk Management

Like it or not, sometimes it takes a harrowing near miss for enterprises to learn what can become highly valuable lessons in risk management.

11 October 2023
Simona Rollinson
Blog Post

CMMI Offers New Credentialing Pathway and Enhanced Flexibility, Resources

New CMMI credentialing pathway aligns with ISACA’s tools, systems and best practices.

11 October 2023
Raising Security Awareness in Cross-Cultural Work and Collaboration
ISACA Journal Article

Raising Security Awareness in Cross-Cultural Work and Collaboration

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Vanessa Britt Perez Revilla
Scott Fogarty
Blog Post

Victory by Surveillance Isn’t Possible—To Win, Engage the Adversary

Traditional approaches to cybersecurity have not been enough to protect companies, so it's time to make attackers face real consequences for their malicious behavior.

10 October 2023
Ivan Mans
Security Article

Profiling a SAP Hacker

To mitigate the risk of cyberattacks, organizations must keep their SAP systems up-to-date with the latest security patches and updates.

10 October 2023
jenai-marinkovi
Blog Post

The Shifting Importance of Soft Skills in a Time of AI Systems, Large Language Models and Global AI Regulations

Integrity, decision-making capabilities, communication and other so-called 'soft skills' should not be overlooked in organizations' ongoing efforts to bolster their cybersecurity teams.

9 October 2023
Mary Carmichael
Blog Post

Beyond Barbie’s Dreamhouse: Navigating Glass Barriers in the Tech Workforce

Many of the themes that made the Barbie movie so resonant are also relevant to the tech workforce, where underrepresentation from women and minority groups remains a major liability.

6 October 2023
information security
Emerging Technology Article

The Human and AI Partnership: Collaborating for Enhanced Cybersecurity

Both generative AI and precision AI hold promise in helping organizations defend against ever more sophisticated cyberattacks.

6 October 2023
Adobe logo
Podcast

Secure your Supply Chain with an Effective Vendor Security Program

Security risks introduced by vendors have become a top-of-mind concern for executives today, driven by recent supply chain incidents that have exposed organizations to operational and reputational risks.

6 October 2023
Future of Technology
Blog Post

IT Certification: A Powerful Career Catalyst

IT, cybersecurity, privacy, risk, audit and related digital trust professionals are looked to for the latest knowledge and insights on the impacts of emerging technology; however, they must have reliable resources to ensure they have updated and accurate information about these topics.

5 October 2023
Sarantos Kefalas
Blog Post

How To Comply with Multiple Security Standards and Frameworks

Complying with every standard or requirement in the current regulatory environment is no easy task, but implementing a global information security management system can provide a sound foundation.

4 October 2023
Reducing Barriers to Adoption of CCM Through Alarm Management
ISACA Journal Article

Reducing Barriers to Adoption of CCM Through Alarm Management

Continuous controls monitoring has the potential to save time and free internal audit teams to undertake more strategic and value-adding audits, and a key component of this is the management of alarms.

Authors: Peter Best, Kishore Singh, Ph.D., and John Halliday
Kristi Hedges and Megan Moritz
Podcast

Cultivating Inspired Leaders with Kristi Hedges

In this ISACA Podcast, Kristi Hedges, executive coach, and leadership development consultant, speaker, and author, gives a sneak peek of her upcoming member-exclusive 'Cultivating Inspired Leaders, a CPE-eligible event. At the event, Kristi Hedges will provide a roadmap for building an inspired mindset for leaders, teams, and individuals.

4 October 2023
State of Cybersecurity 2023
@ISACA Article

ISACA’s State of Cybersecurity 2023 Report Pinpoints Pressing Workforce Gaps

ISACA's 2023 State of Cybersecurity Report spotlights the skills most needed to strengthen the cybersecurity workforce and the extent to which hiring and retention remain a challenge across the industry.

2 October 2023
Caitlin McGraw
@ISACA Article

Protecting and Improving Your Career: Time for A Career Check-up!

Performing periodic career check-ups through simple steps such as updating goals and professional profiles can go a long way toward sustaining career success over the long-haul.

2 October 2023
Kane Porter
Blog Post

Common Privacy Dark Patterns and Ways to Improve Digital Trust

ISACA’s Eliminating Deceptive Privacy Practices white paper explores what dark patterns are in a privacy context and what organizations should do to address these trust-eroding tactics.

2 October 2023
Jason Lau
Blog Post

State of Cybersecurity 2023: Navigating Current and Emerging Threats

ISACA's 2023 State of Cybersecurity report shows substantial workforce challenges remain and brings into focus the skills and backgrounds that are most heavily in demand.

2 October 2023
Forensic Investigations and Computer Forensics in the Age of Blockchain
ISACA Journal Article

Forensic Investigations and Computer Forensics in the Age of Blockchain

As more enterprises adopt blockchain technology, these professionals must stay up to date with the latest developments and create new tools and techniques to investigate crimes committed on blockchain.

Author: Anuj Choudhary
Jon Brandt, Rex Johnson and Tony Angelo
Podcast

Exploring the Benefits of Neurodiversity within Cybersecurity

Neurodiversity within cybersecurity offers many benefits but requires organizations and hiring managers to re-evaluate hiring practices and job descriptions typically structured for neurotypical applicants.

29 September 2023
Naomi buckwalter
Blog Post

Six Things DevOps Wants from InfoSec

By working more openly and intentionally with developers, information security professionals can build a strong relationship that will be a win-win situation for all involved.

28 September 2023
Where Does Zero Trust Fall Short? Experts Weigh In
@ISACA Article

Where Does Zero Trust Fall Short? Experts Weigh In

Security experts weigh in on potential shortcomings in zero trust security, whether real or perceived, and what enterprises should keep in mind if implementing zero trust approaches.

27 September 2023
The Career-Elevating Impact of CISA
Blog Post

The Career-Elevating Impact of CISA

CISA credential-holders share how becoming CISA-certified has shaped their career advancement and made them more effective in their roles

27 September 2023
Assessing the Shortfalls of DeFi Platforms
ISACA Journal Article

Assessing the Shortfalls of DeFi Platforms

Considering the significantly increasing crimes and scams targeting DeFi platforms, financial services regulators should start enforcing exclusive financial crime prevention controls and coding standards.

Author: Vimal Mani
Binita Patel
Blog Post

Lessons Learned from Microsoft’s Massive Data Exposure Incident

The need for meticulous cloud configurations was among several key takeaways in the aftermath of the recent data breach involving Microsoft AI researchers.

26 September 2023
Deneen Richard, CISA, CRISC, CRMA
Audit Article

Internal Audit Data Analytics for Beginners

There are 2 phases and associated steps that auditors can take to begin the journey of utilizing data analytics.

26 September 2023
David Sampa
Blog Post

Are AI Chatbots a Weak Security Link?

Enterprises increasingly are making use of AI chatbots, but related security risks and the potential to undermine customer trust when they do not function as intended must be accounted for.

25 September 2023
Tarnveer Singh
Blog Post

How to Mitigate Emerging Technology Risk

Understanding the business strategy and conducting risk assessments are among the building blocks for successfully mitigating enterprise risk from emerging technology.

21 September 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 1

Implementing a cybersecurity framework is a useful starting point for enterprises seeking to establish a sturdier foundation on which to build their cyber defenses.

20 September 2023
The Promise and Peril of the AI Revolution
@ISACA Article

Organizations Need Sense of Urgency in Dealing with AI Risks

A new ISACA white paper provides analysis of the risks and opportunities stemming from artificial intelligence and why enterprises need to gain swift alignment on their AI goals and policies.

20 September 2023
Dina Numan, Head of Advanced Governance and Management Services, ScanWave C.T.S. COBIT Lead Assessor, ITIL, CDPSE, CRISC, and Dr. Ramzi Sunna, Chairman, Founder, ScanWave C.T.S. PCI DSS QSA, BSI ISO LA, LI, ISACA CRISC, ISACA CDPSE ISACA COBIT Lead Assessor
Blog Post

Achieving Digital Trust Through IT Governance and Cybersecurity

Developing a cybersecurity strategy and governance program that supports digital trust provides a solid starting point for organizations seeking to strengthen their trustworthiness.

20 September 2023
Harnessing the Potential of Blockchain and AI - graphical AI brain
ISACA Journal Article

Harnessing the Potential of Blockchain and AI for Process Performance Management With COBIT

Blockchain offers a secure and transparent way of managing IT transactions, and AI can automate routine IT processes, improve decision-making and predict potential IT risk.

Author: Ahmet Efe
Salary Premiums Reflect IT Skills in Hot Demand
Blog Post

Salary Premiums Reflect IT Skills in Hot Demand

Skills associated with ISACA's Information Technology Certified Associate credential are in-demand, as reflected by pay premiums for several of the skills covered by the certification.

19 September 2023
James Huang
Security Article

Improving Security While Enabling Market Access With a CCF

Cloud service providers should consider creating a common cloud controls framework—a central information security compliance and certification methodology that can include certifications such as SOC 2, ISO 27001, C5, ENS, ISMAP, IRAP, and more.

19 September 2023
Scott Gould
Blog Post

The Secrets to Successful Engagement: ISACA’s Member-Exclusive Speaker Series

In a recent installment of ISACA's Member-Exclusive Speaker Series, Scott Gould shared insights on audience engagement, creating a welcoming community and more.

18 September 2023
ShanShan Pa
Blog Post

Balancing the Risks and Rewards of AI

Many enterprises understandably are taking a cautious approach when it comes to establishing their approach toward artificial intelligence, but delaying on meaningful action comes with its own set of risks.

15 September 2023
Kayne Mcgladrey
Blog Post

What to Know About the SEC’s New Disclosure Requirements

New disclosure requirements from the Securities and Exchange Commission likely will leave cybersecurity, risk and compliance professionals in the US with some key questions that need to be addressed.

14 September 2023
Safia Kazi
Privacy Article

The Privacy Pros and Cons of Anthropomorphized AI

There are privacy-related pros and cons to anthropomorphized AI, and certain considerations need to be made for enterprises that leverage consumer-facing generative AI.

14 September 2023
Larry Alton
@ISACA Article

The Importance of Connections in the Tech Industry

The complexity of today’s technology landscape dictates that technology professionals should look to a variety of sources to become better prepared for the evolving challenges that they will face.

13 September 2023
Alina Archibald, CISA, CITP, CPA, and Josh Ditto, CC, CISSP
Blog Post

Subservice Organization Controls Management

Not all vendors are subservice organizations, whose operations have a clear impact on the organizations with which they collaborate.

13 September 2023
Understanding Top Cybersecurity Technology Trends
ISACA Journal Article

Understanding Top Cybersecurity Technology Trends

By analyzing the status of existing technology as it is developed and deployed, future trends in technology development can be predicted.

Author: Yunchuan Wei
Examining the Effectiveness of Recent Privacy Laws on Big Tech
Blog Post

Examining the Effectiveness of Recent Privacy Laws on Big Tech

While the United States does not have a comprehensive privacy regulations like the EU does with GDPR, there are signs that more mature privacy policy is beginning to take shape that could limit the harms from data misuse by big tech companies.

12 September 2023
Patrick Barnett
Security Article

Seventy Questions to Assess Cybersecurity Risk on a Rapidly Changing Threat Landscape

There are 70 questions that can be asked to determine whether an enterprise has most defensive principles covered and has taken steps to reduce risk (and entropy) associated with cybersecurity.

12 September 2023
Thomas Bell
Blog Post

Internal Auditing with an Agile Scrum Approach

By utilizing an Agile Scrum approach to internal audit, organizations can empower the audit function for more effective performance.

11 September 2023
Luigi Sbriz
Blog Post

Using Near-Miss Incidents as Risk Indicators

Oftentimes organizations fail to give risks the proper consideration until it is too late.

8 September 2023
Yoshimasa Masuda
Blog Post

Driving Digital Transformation Through Innovative Solutions and a Practical Framework

Yoshimasa Masuda, Ph.D., CISM, CGEIT, shares the history of his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation from innovative solution to practical framework, and its connections across industries, healthcare and academia.

7 September 2023
Anand Venkatraman and Sabiha Hetavkar
@ISACA Article

Are We Ready for a World Without Passwords?

The degree of ease with which cybercriminals are able to swipe online credentials brings into focus a future in which passwords will no longer be a routine method of authentication.

6 September 2023
Caitlin McGraw
@ISACA Article

New Job. Red Flags. How Long Do You Give It?

Starting a new job is often challenging, but how can new job-starters determine whether the unease is part of the normal adjustment period or if legitimate red flags exist that might mean it's time to move on quicker than they had planned?

6 September 2023
Noam Koriat
Blog Post

Nine Practical Tips for Using Internal Audit to Drive Organizational Innovation

Internal auditors can help to spur innovation at their organizations by taking a forward-looking mindset, embracing agile culture and keeping up to date on evolving forces on the technology landscape.

6 September 2023
Jai Sisodia
Governance Article

Understanding the EU AI Act

By examining the nuanced details of the EU AI Act, IT auditors and other information security professionals can better understand how it might affect their future work.

6 September 2023
Measuring and Evaluating the Effectiveness of Security Awareness Improvement Methods
ISACA Journal Article

Measuring and Evaluating the Effectiveness of Security Awareness Improvement Methods

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Eszter Diána Oroszi
Allen Ari Dziwa
Blog Post

Governance and Board Oversight Do Matter

Boards of directors have a growing set of responsibilities in today’s business climate, including keeping abreast of evolving technology trends and how the organization is preparing for a growing set of cybersecurity risks.

5 September 2023
Alex Holden
Blog Post

Contending with Artificially Intelligent Ransomware

Artificial intelligence is already impacting the ransomware landscape, with greater potential for AI to significantly impact the pace and complexity of ransomware threats in the near future.

1 September 2023
Erik Prusch
ISACA Journal Article

Letter From the CEO

It is rare to find a group of people as connected, involved, passionate and dedicated as this one.

Author: Erik Prusch
Organizing for Cyberresilience - people reviewing chart on tablet
ISACA Journal Article

Information Security Matters: Organizing for Cyberresilience

There is a need for a committee to oversee both the development and execution of plans to keep an organization going should it be attacked.

Author: Steven J. Ross
Outsourcing vs. In-House Getting the Most Out of the Business Case and RFP - hand with pen
ISACA Journal Article

IS Audit in Practice: Outsourcing vs. In-House Getting—the Most Out of the Business Case and RFP

How do you find a trusted vendor and build the monitoring steps that will ensure a successful project?

Author: Cindy Baxter
Digital Trust and an Eye on Reliable Operations - laptop with AI infographic
ISACA Journal Article

The Digital Trust Imperative: Digital Trust and an Eye on Reliable Operations

Any operational issue can affect an organization’s digital trustworthiness; therefore, neglect operations at your own peril.

Author: K. Brian Kelley
Digital Trust and Adopting Generative AI - cloud icon
ISACA Journal Article

The Bleeding Edge: Digital Trust and Adopting Generative AI

Large Language Models and other AI tools have tremendous promise and potential, but care and forethought are required to ensure that organizations optimize risk while maximizing value.

Author: Ed Moyle
Future Fitting Operational Compliance - illustration of servers
ISACA Journal Article

Future Fitting Operational Compliance

By embracing technology, fostering a forward-looking compliance culture and building a diverse team, operational compliance can ensure it is well positioned to handle emerging regulations, work collaboratively with operations teams and stay critical contributors to its success.

Author: Kevin Alvero
A Risk-First Approach to Setting an Information Security Budget - Security lock
ISACA Journal Article

A Risk-First Approach to Setting an Information Security Budget

Information security managers can use a risk-first approach to make informed decisions based on where the organization's greatest risk lies.

Authors: Peter Grosser and Gerald Burch
Extended Accountability of the CIO - hands typing on keyboard
ISACA Journal Article

Extended Accountability of the CIO

If the CIO's role is limited to compliance with technology objectives and cost containment, not all current business expectations will be appropriately or sufficiently addressed.

Author: Luigi Sbriz
IT Risk and IT Audit Working Together to Reduce the Burden on the Business - people reviewing document
ISACA Journal Article

IT Risk and IT Audit Working Together to Reduce the Burden on the Business

To decrease duplication of efforts and let the business do what it does best, the third line of defense (internal audit) and the second line (risk) must work together.

Author: Benjamin Bartz
Incident Response Automation Through IRP Implementation - security lock
ISACA Journal Article

Case Study: Incident Response Automation Through IRP Implementation

To improve incident response and, thus, cybersecurity and risk management, IT asset management, localization automation and incident repsonse platform functionality were implemented.

Authors: Katie Teitler and Aleksandr Kuznetcov
How to Elevate the SOC to the Next Level - hallway with servers
ISACA Journal Article

How to Elevate the SOC to the Next Level

SOC analysts must enhance their skills in these emerging technologies, integrate them into the SOC framework and establish specific detection methods to effectively identify and counter threats to this diversified infrastructure.

Author: Shweta Kshirsagar
Harmonizing Cybersecurity Practices - security lock
ISACA Journal Article

Harmonizing Cybersecurity Practices: The Requirements and Challenges of the EU NIS2 Directive

Enterprises in the eurozone must understand the NIS2 Directive challenges and be proactive in complying with the incident notification requirements to enhance their cybersecurity posture and protect critical infrastructure and digital services.

Authors: Antonio Villamor and Yianna Danidou
Avoiding a Compliance-First Mindset and Choosing a Risk-First Attitude - Person typing on keyboard
ISACA Journal Article

Avoiding a Compliance-First Mindset and Choosing a Risk-First Attitude

Moving from a focus on compliance to developing a risk-first attitude results in improved security, better decision-making and senior management support and investment in security controls that reduce risk.

Author: Karen MacDougall
Muhammad Ali Malik
Blog Post

A Cybertransformation Program to Secure Broadcast Media Networks

Fixed start dates, a skills shortage and insufficient security maturity of broadcast devices are key challenges that broadcast media networks face in securing high-profile broadcasts.

31 August 2023
Blueprint for Ransomware Defense
@ISACA Article

ISACA Offers Blueprint for Ransomware Preparations and Defense

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Sandra Whitehead
Blog Post

Sustainability, Inclusivity and Team Bonding Through Volunteering: CommunITy Day 2023

ISACA’s 2023 CommunITy Day is upcoming on 7 October, and the Auckland, New Zealand, chapter, has a pair of events in its sights, with a focus on sustainability and nature.

30 August 2023
Three Lessons From 100 Years of Data Management
ISACA Journal Article

Three Lessons From 100 Years of Data Management

Ninety-three percent of enterprises believe that collecting, managing, storing and analyzing data must improve, confirming that major efforts are needed to address the global state of data management.

Author: Guy Pearce
Busting the Top 5 CMMI Myths
@ISACA Article

Busting the Top 5 CMMI Myths

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Erik Prusch
Blog Post

Ramping Up for Greater Impact

A laser focus on the products, programs and resources the ISACA community finds the most value from is coming into sharper focus.

29 August 2023
Eric Peck
Risk Article

Tools and Best Practices for Improving IT Issue Management

It is worth exploring the importance of IT issue management and highlighting best practices and tools that organizations can use to understand, measure and mitigate IT risk.

29 August 2023
Dooshima Dapo Oyewole
Blog Post

Four Mistakes to Avoid When Taking Your First Certification Exam

By avoiding some common mistakes, certification exam-takers can increase their chances for success on exam day and smooth their path to attaining valuable industry credentials.

28 August 2023
Anuj Choudhary
Blog Post

Cyber Fraud on the India Business Landscape: A Growing Threat

A recent escalation of cyber incidents in India highlight the urgent need for comprehensive, updated cybersecurity strategies on the Indian business landscape.

25 August 2023
anna-johannson
Blog Post

Six of the Best Cybersecurity Blogs

Regularly reading industry blogs can be an entertaining and useful way to keep up to date on the latest happenings and defense techniques on the cybersecurity landscape.

24 August 2023
Five Ways to Fund Your Information Technology Certifications Journey
@ISACA Article

Five Ways to Fund Your Information Technology Certifications Journey

Certifications are a worthwhile career investment, and there are several ways certification candidates can make the costs associated with gaining their credential more affordable.

23 August 2023
Abdul Rafeq
@ISACA Article

Seven Steps to Empowerment With Data Analytics

Data analytics is becoming a must-have capability for technology professionals, enabling them to be more efficient and impactful with their time, knowledge and skills.

23 August 2023
Diana Calderon
Blog Post

Building a Strong Security Culture for Resilience and Digital Trust

Cultivating a robust security culture can enable organizations to mitigate cyber risk, strengthen trust with customers and sharpen organizational compliance posture.

23 August 2023
The Role of Human Factors Engineering in Cybersecurity
ISACA Journal

The Role of Human Factors Engineering in Cybersecurity

Incorporating human factors engineering early into the design process of systems and processes will lead to fewer errors in the use of the product in the field.

Author: Ranjit Bhaskar
ChatGPT and IT Auditing: Opportunities, Threats and Challenges
Blog Post

ChatGPT and IT Auditing: Opportunities, Threats and Challenges

ChatGPT presents opportunities for IT auditors to be more efficient and productive, but a variety of security, privacy and ethical considerations should be addressed as part of auditors' approach

22 August 2023
Industry News
Security Article

An Executive View of Key Cybersecurity Trends and Challenges in 2023

To more effectively defend against attacks, it is important for cyberprofessionals to understand current trends and challenges that exist in the field of cybersecurity.

22 August 2023
Robin Lyons
Blog Post

Digital Trust Enhancing Identity Access Management in Cloud Environments

ISACA's Google Cloud Audit Platform Program explores issues of identity and access management, and connection points between cloud audit and digital trust.

21 August 2023
Ron Lear
Blog Post

Four New CMMI Adoption Pieces Available for Community

Several new adoption pieces will enable CMMI to be even more effective at helping organizations across numerous industries rapidly and effectively build capability and improve their performance.

18 August 2023
Jay Hira
Blog Post

You Made the Team, But Are You Really in the Game? Exploring Differences Between Diversity and Inclusion

Diversity, equity and inclusion, when properly prioritized and implemented, can be a major difference-maker in cybersecurity and other fields that struggle with underrepresentation, both in terms of performance and the ability to attract and retain talented professionals.

17 August 2023
Safia Kazi
Privacy Article

Lessons Learned From a Controversial Terms of Service Update

Enterprises are obligated to have clear and up-to-date terms of services in place.

17 August 2023
Robin Lyons and Thomas Bell
Podcast

Internal Audits That Create Stakeholder Value Adopting an Agile Mindset

Agile Scrum is a lightweight framework that promises to significantly improve internal audits by creating a mindset that generates stakeholder value through adaptive solutions for complex auditing problems.

17 August 2023
Nandita Rao
@ISACA Article

Balancing Privacy with Businesses’ Need for Data

Nandita Rao Narla provides her perspective on timely trends and challenges on the privacy landscape, including the need to strike a balance between supporting businesses' need for data with implementing sound privacy practices.

16 August 2023
Jack Freund
@ISACA Article

The Risk of Quantifying Cyberrisk

Cyberrisk quantification is designed to alleviate communication problems and translate technology for executives but leveraging it effectively can be a challenge for many organizations.

16 August 2023
The Business Benefits of Becoming an ISACA ATO
Blog Post

The Business Benefits of Becoming an ISACA ATO

By becoming an ISACA Accredited Training Organization, enterprises gain access to a robust community of global learners seeking highly in-demand certifications in fields such as security, risk, IT audit, privacy and governance.

16 August 2023
Subservice Organization Management—IT Controls for Peace of Mind
ISACA Journal Article

Subservice Organization Management— IT Controls for Peace of Mind

Enterprises must address the minimum controls an enterprise and subservice organization should consider implementing; these can then be customized to better suit specific operational needs.

Authors: Alina Archibald and Josh Ditto
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

Compliance and Information Security: Collaborating to Enable the Business

Compliance and information security functions can each make the other stronger, including by collaborating on making business cases and shared budgetary priorities.

15 August 2023
Amanda Tucker
Audit Article

How IT Auditors Can Embrace Neurodiversity in the Workplace With Agile

With the right environment and a handful of changes, neurodivergent individuals can be assets to any audit team.

15 August 2023
Robin Lyons and Dr. Elena Klevsky
Podcast

Strategies for Avoiding Burnout

Chronic workplace stress can lead to burnout, which poses a significant risk to the mental health of busy professionals, such as auditors. But how can these professionals protect themselves from burnout? And how can their employers help them do so?

15 August 2023
Sumedha Adavade
Blog Post

How to Assess Workplace Culture

Workplace culture can be difficult to measure, but factors such as the organization's risk habits, the tone at the top, attrition rates and employee feedback can provide useful indicators for those charged with assessing culture.

14 August 2023
Carol Lee, Terence Law, Tom Huang and Lanis Lam
Governance Article

Navigating Regulatory Trends and Best Practices for Ethical AI Governance in Mainland China

It is essential for organizations and technology risk professionals to understand the evolving AI regulatory landscape shaping the future of AI in Mainland China.

14 August 2023
Wanbil W. Lee
Blog Post

Is ESG Auditable?

Auditing ESG transcends the traditional dimensions of financial efficiency, legal matters and technical effectiveness to deal with increasingly recognized areas of importance such as environmental protection, corporate social responsibility and governance of business behavior.

11 August 2023
Elena Klevsky, Ph.D., CPA, and Melissa Walters, Ph.D.
Blog Post

How Organizations Can Help Auditors Avoid Burnout

Organizations have several measures they can take to help auditors avoid burnout on the job and improve their mental health, including allowing them to focus on the parts of the job that add the most value.

10 August 2023
Google Cloud Platform Audit Program
@ISACA Article

New Audit Program Focuses on Google Cloud Platform

A new audit program from ISACA sets up auditors who are tasked with assessing the Google Cloud Platform for success.

9 August 2023
Caitlin McGraw
@ISACA Article

New Job? Here’s How to Start Off On the Right Foot

The ISACA community provides a wealth of tips for new hires on how they can better acclimate and build strong relationships when starting their new job.

9 August 2023
Masosen Cai
@ISACA Article

Supercharging Internal Auditors with Data Science: Lessons and Takeaways

Auditors and data scientists interested to make the best use of data science in internal audit can benefit from deeper and more intentional collaboration between the areas.

9 August 2023
Neil Lappage
Blog Post

The Role of Deepfake Technology in the Landscape of Misinformation and Cybersecurity Threats

Deepfake technology creates new urgency to revisit and reinforce security protocols, including multi-factor authentication and behavioral biometrics, which can be challenging to replicate.

9 August 2023
Jeimy J Cano
Blog Post

Embracing the ‘Pedagogy of Error’ in Cybersecurity Education

Jeimy J. Cano, the 2023 ISACA Educational Excellence Award for his educational work that empowers students to pursue careers advancing technology, shares his story and motivations in this Q&A interview.

8 August 2023
Lisa Levy
Privacy Article

Afraid of Leaking Business Data? Sit Down. We Need to Have "The Talk" About Data Management and Access Control

Data management and access control measures should be integrated into every aspect of an organization's operations, creating robust defenses against data leaks.

8 August 2023
Josh Hamit
Blog Post

Top 3 Cyberthreats Facing the Financial Sector

Ransomware, supply chain threats and phishing attacks are among the leading cybersecurity challenges faced by organizations in the financial sector.

4 August 2023
Person typing on keyboard - Addressing Emerging Audit Challenges
ISACA Journal Article

Addressing Emerging Audit Challenges

Traditional audit methods may no longer be adequate; auditors must keep up with new developments and challenges and adapt their audit approach as needed.

Author: Ignatius Ravi
Erik Prusch
Blog Post

The More I Learn, the More Excited I Am to be at ISACA

In his first 50 days, new ISACA CEO Erik Prusch has been doing a lot of studying, listening and preparing to gain a deeper understanding of how to best serve the ISACA community in the months and years to come.

3 August 2023
Collin Beder and Sarah Katz
Podcast

The Danger of Distraction in Augmented Reality

While users of technology are becoming more educated in how to avoid cyberattacks such as phishing, a distracted user might be more prone to missing signs of social engineering.

3 August 2023
Larry Alton
@ISACA Article

Eight Ways to Streamline IT Ops Despite Staffing Challenges

There are numerous ways to improve your IT operation that are not time-intensive but could make a big difference in improving the IT department's efficiency and productivity.

2 August 2023
Patrick TrierWeiler
@ISACA Article

Steps New IT Audit Professionals Can Take Before Earning a CISA

Newcomers to the IT audit field have an array of steps they can take to advance their careers as they accumulate the needed professional experience to pursue the CISA.

2 August 2023
Erika Hamden
Blog Post

Building a New Way to Look at the Universe

Dr. Erika Hamden, the closing keynote speaker at GRC Conference 2023, visits with the ISACA Now blog to share stories from her career, and her passion for science and innovation.

2 August 2023
Decoding Log4j Vulnerability Lessons Learned
ISACA Journal Article

Decoding Log4j Vulnerability Lessons Learned

Organizations and vendors alike struggled to discover where they used Log4j, and hackers compounded the problem by combining vulnerabilities, which contributed to confusion and response fatigue.

Author: Ninad Dhavase
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA, Part 3: 6 Months Forward and the Continuous Game

Having a plan and communicating it to others can set up early-career professionals for success as they prepare to accelerate their career development.

1 August 2023
Chris McGowan
Emerging Technology Article

Generative AI and the Potential for Nefarious Use

Organizations must be aware and ready to combat the possibility of generative AI being used to conduct cyberattacks.

1 August 2023
Bassel Kablawi
Risk Article

Reviewing the 2023 OWASP API Top 10

To ensure that enterprises are not subjected to the nightmare that is an API security breach, the updated OWASP API Top 10 list is worth examining.

1 August 2023
david-mazula_casper-lamprecht
Blog Post

How to Conquer Your Cloud Governance Maturity Journey

The speed of cloud adoption is continuing to increase. Organizations worldwide are rapidly migrating on-premise IT infrastructure, software and other technology to cloud services. In addition, software solution providers are building native cloud systems and converting existing offerings to the cloud.

31 July 2023
Navigating Digital Transformation While Cultivating a Security Culture
Blog Post

Navigating Digital Transformation While Cultivating a Security Culture

Scott Reynolds, senior director of enterprise cybersecurity at ISACA, and John Richards, head of developer relations at Paladin Cloud, explore the cloud landscape and its impacts on digital transformation.

28 July 2023
Lisa Cook and Chris Madeksho
Podcast

Managing Human Risk Requires More Than Just Awareness Training

This podcast discusses the comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

28 July 2023
Renu Bedi
@ISACA Article

Navigating Supply Chain Challenges in Audit, Risk and Governance

Supply chain attacks are top-of-mind for organizations, and professionals in audit, risk and governance have important parts to play in mitigating growing threats throughout the supply chain.

26 July 2023
Top Benefits Upskilling
@ISACA Article

Top Benefits of Upskilling and Training Your Team

Enhancing your team's credibility with key stakeholders and strengthening organizational alignment are among the major benefits enterprises can reap from group training.

26 July 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

What We Can Learn from Australia’s 2023-2030 Cybersecurity Strategy

New cybersecurity policy being implemented in Australia provides several useful insights for the global security community.

26 July 2023
John de Santis
Blog Post

ISACA: The Right Place to Do the Right Thing

ISACA’s network of digital trust professionals is uniquely positioned to help organizations around the world do the right thing at a time when “the right thing” is much easier said than done.

26 July 2023
Safia Kazi
Privacy Article

Protecting Children and Privacy Is Not a Zero-Sum Game

Privacy professionals who can be advocates for privacy and encourage people to think more critically about what is posted online can help create an online experience that protects children and preserves privacy.

26 July 2023
Privacy lock
ISACA Journal Article

Analyzing Privacy Policies as Data

Text mining allows enterprises to improve controls related to privacy policies by considering the proper use of privacy terms, developing a common vocabulary for a particular industry or sector and observing the use of relevant terms prescribed by regulators.

Author: Thiago De Oliveira Teodoro
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA Part 2: Setting Up Your Foundation for Success

Engaging with a local ISACA chapter, seeking out a professional mentor and pursuing the IT Audit Fundamentals Certificate are among the steps early-career audit professionals can take while waiting until they meet the experience requirements for the CISA.

25 July 2023
Hollee Mangrum-Willis and guest
Podcast

Preparing for Interruptions, Disruptions and Emergence Events

This podcast speaks about how an Information Systems (IS) Auditor can prepare for the Interruptions, Disruptions and the Emergence events that happen to the business and to technology.

21 July 2023
Grant Hughes
Blog Post

The Value of Following a Methodical Approach for SIEM Implementation

Despite many organizations having invested in SIEM solutions, data breaches and other cybersecurity impacts continue to wreak havoc on the enterprise landscape.

24 July 2023
Shawn Kanungo
Blog Post

GRC Keynote Speaker: Time to Go Bold

Shawn Kanungo, author and opening keynote speaker at GRC Conference 2023, shares his views on disruptive technologies, innovation and the importance of being bold in this Q&A with the ISACA Now blog.

21 July 2023
Binita Patel
Blog Post

Emerging Cloud Security Threats: Fileless Attacks on the Rise

A sharp climb in fileless attacks has added to the challenge enterprises face in securing their cloud environments.

20 July 2023
David Sampa
@ISACA Article

ChatGPT and Digital Trust: Navigating the Future of Information Security

The rise of ChatGPT gives information security professionals even more to account for while also underscoring critical connection points between security and the overarching need for digital trust.

19 July 2023
CMMI-case-sudy
Blog Post

The Commitment to Continuous Improvement: A CMMI Case Study

ISACA's CMMI maturity model practices have helped Avantare focus on capabilities like ensuring quality, delivering and managing services, sustaining habit and persistence, and more, as a recent case study illustrates.

19 July 2023
A Candid Look at the Shifting Landscape of Change Management for Audit
ISACA Journal Article

A Candid Look at the Shifting Landscape of Change Management for Audit

For automated systems to operate effectively and achieve the desired outcomes, it is essential to have more sophisticated change management controls.

Author: Kishan Sathyanarayanan
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA: Part 1, Understanding the CISA and Its Requirements

ISACA’s Certified Information Systems Auditor (CISA) certification requires several years of experience, but there are several steps newcomers to the IT audit and assurance field can take to position themselves for success in the meantime.

18 July 2023
Chris Madeksho
Risk Article

Managing Human Risk Requires More Than Awareness Training

A comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

18 July 2023
Ramona Ratiu
Blog Post

Strengthening Collaboration for Cyber Resilience: The Key to a Secure and Resilient Organization

Ongoing communication and strong relationships between the security and audit functions can lay an important foundation in an organization's efforts to strengthen its cyber resilience.

17 July 2023
Guy Pearce
Blog Post

From Sci-Fi to Reality: AI At All Stages of Your Career

Artificial intelligence is not just impactful for rising professionals in digital trust fields: AI has an increasingly important part to play at all levels of the career cycle.

14 July 2023
Alex Tray
Blog Post

Top Effective 10 Data Governance Tools

Effective data governance software helps businesses guarantee the availability and safety of their data. However, most data management tools are complex and can require rigorous training to use.

13 July 2023
Hollee Mangrum-Willis and Cindy Baxter
Podcast

IS Audit in Practice: Data Integrity On Demand

On this podcast, ISACA's Hollee Mangrum-Willis and special guest Cindy Baxter discuss the disparities between American communities and access to electronic health records.

13 July 2023
Lisa Mckee
@ISACA Article

The Challenges and Rewards of Zero Trust Privacy

Privacy expert Lisa McKee lays out the rationale for zero trust privacy implementation while sizing up related challenges and the need for cross-functional support.

12 July 2023
Stephanie Oyler-Rankin & Shayna Davitt
Blog Post

Compliance Tips for SaaS Startups

SaaS organizations getting started with compliance can benefit from some key tips that will help them successfully navigate the compliance landscape.

12 July 2023
Chris McGowan
Security Article

The US SEC’s Proposed Cybersecurity Crackdown

The SEC has proposed amendments aimed at bolstering and standardizing the disclosure requirements related to cybersecurity risk management, strategy, governance and incident reporting for public companies.

12 July 2023
Person holding a phone - Mitigating Emerging Technology Risk
ISACA Journal Article

Mitigating Emerging Technology Risk

To mitigate the risk associated with the speed of technological change, organizations can invest in technology foresight and monitoring efforts to stay informed about emerging technologies and their potential risk.

Author: Tarnveer Singh
Future of CyberSecurity Assessments
Blog Post

The Future of Cybersecurity Assessments

Data-driven security assessments are gaining momentum and are shaping up to become a valuable component in the future of security assessments.

11 July 2023
Raef Meeuwisse
Blog Post

Decoding AI: Insights and Implications for InfoSec

Artificial intelligence is reshaping the cybersecurity landscape, but considering the technology is clueless in some important ways, humans' capacity for intuition, empathy and understanding remain key components of the equation for effective security.

10 July 2023
Adeline Chan
Governance Article

The EU AI Act: Adoption Through a Risk Management Framework

The AI Act is an important step in the development of an effective and responsible regulatory framework for AI in Europe.

10 July 2023
Yunique Demann
Blog Post

A New Way to Keep Pace with Privacy

ISACA's Privacy Regulatory Lookup Tool can help practitioners keep pace with a privacy landscape that increasingly is being shaped by new regulations taking effect around the globe.

6 July 2023
Keri Bowman
Governance Article

The Interplay of IGA, IAM and GRC for Comprehensive Protection in Cloud Transitions

It is critical that organizations pay attention to the significance of governance, risk and compliance in their identity and access management journey.

6 July 2023
Caren Shiozaki
@ISACA Article

Achieving Digital Trust in an AI Economy

Businesses operate over long waves of innovation cycles. In each cycle, companies must reckon with disruptions brought about by the technologies of the time.

5 July 2023
ISACAs New Privacy Regulatory Lookup Tool
@ISACA Article

ISACA’s New Privacy Regulatory Lookup Tool

In a quickly evolving regulatory environment, it is important that privacy professionals stay abreast with the latest legislation that may affect them and their businesses.

5 July 2023
Caitlin McGraw
@ISACA Article

Resume Ethics in Digital Trust

How do hiring leaders perceive a lapsed certification that is not identified as such; the inclusion of a degree that isn’t quite finished without that additional detail; experience that is not what it is stated to be; and other untruths?

5 July 2023
Simon Backwell
Blog Post

What Do Cybersecurity Analysts Do?

Cybersecurity analysts work in security operations centers, where they review alerts and logs in search of suspicious activities, among many other tasks to protect the enterprise.

5 July 2023
Chris McGowan
Risk Article

Where Data and Behaviors Meet: The Internet of Behaviors

As is the case with any new technology, IoB has both benefits and risk

5 July 2023
Person typing on a laptop
ISACA Journal

Log Management as an Enabler for Data Protection and Automated Threat Detection

A proposed framework can be used to fast-track a log management program, which will ultimately improve the overall security and risk posture of any organization.

Author: Grant Hughes
Selling Security’s Value Proposition - person typing on computer
ISACA Journal Article

Information Security Matters: Selling Security’s Value Proposition

We have been valuing and evaluating security based on the absence of breaches. A much more positive approach is to project the value of security in terms of quality, reliability and value to the customer.

Author: Steven Ross
John De Santis
ISACA Journal Article

The Network: Balancing Risk and Innovation

As the incoming chair of the ISACA Board of Directors, how do you see ISACA growing and adapting to the constantly changing workplace and needs of its constituents over the next year?

Author: John De Santis
Digital Trust, An Enterprise Approach
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—An Enterprise Approach

The DTEF spans all parts of the enterprise, as can be clearly seen by examining either the Culture or Architecture domains.

Author: K. Brian Kelley
Making the Software Supply Chain Practical - hands typing on keyboard
ISACA Journal Article

The Bleeding Edge: Making the Software Supply Chain Practical

A look at the software supply chain through the lens of an SBOM—what it is, how it can help you, and how you can adapt your own program to practically incorporate it.

Author: Ed Moyle
Effective Governance and Board Oversight in a Globalized Information Environment - people sitting at conference table
ISACA Journal Article

Effective Governance and Board Oversight in a Globalized Information Environment

Board committees focused on technology and cybersecurity, when properly constituted, have a better ability to provide effective governance and critical scrutiny, which guides management in identifying and mitigating cyberrisk.

Author: Allen Ari Dziwa
Solving Standards Implementation Issues With a Global ISMS - security lock
ISACA Journal Article

Solving Standards Implementation Issues With a Global ISMS

To make compliance efficient and effective, all neccessary requirements must be combined, baselines established and one global information security management system developed.

Author: Sarantos Kefalas
Internal Audit as a Driver of Innovation - person in front of laptop
ISACA Journal Article

Internal Audit as a Driver of Innovation

To remain innovative, the internal audit function needs to adjust its activities and value propositions to align with the demands of the 4IR era.

Author: Noam Koriat
An Evolutionary Strategy for Leveraging Data Risk-Based Software Development for Data Integrity
ISACA Journal Article

An Evolutionary Strategy for Leveraging Data Risk-Based Software Development for Data Integrity

Updating the traditional software development methodology to include data risk-based development enables organizations to avoid any penalties that may be imposed due to a lack of controls and noncompliance with regulations and laws.

Author: Sasidhar Duggineni
Cooperating With Fear - digital lock
ISACA Journal Article

Cooperating With Fear

By acknowledging the complexities of security and cooperating with the element of fear, enterprises are empowered to focus on their most critical sources of risk.

Author: Jacob Zwicki
Bank’s CyberOps Team Wins EDR Buy-In - person touching icon on screen
ISACA Journal Article

Case Study: Bank’s CyberOps Team Wins EDR Buy-In

The Israeli government’s new demands on financial institutions tasked a cyber operations manager employed at one of the largest financial institutions in Israel with establishing a new cyberops team within the infosec department to develop a plan for achieving compliance, among other responsibilities.

Author: Mick Brady
Using Near Miss Incidents as Risk Indicators - security lock
ISACA Journal Article

Using Near Miss Incidents as Risk Indicators

Performance and risk indicators are essential sources for measuring the effectiveness of the protection measures adopted.

Author: Luigi Sbriz
The Digital Twin Advantage in Automotive Manufacturing Systems
ISACA Journal Article

The Digital Twin Advantage in Automotive Manufacturing Systems

Digital twin technology using AI and ML in the automotive industry can enhance the overall design and efficiency of automotives; however, these technologies pose cybersecurity risk.

Authors: Karthik Trichur Sundaram and Divya Karthik
Rebecca Herold
Blog Post

Protecting Phones, Data, and Your Business from Juice Jacking Risks

Recent warnings about the security risks of using public charging stations, such as at airports, hotels and hospitals, reinforces the value of juice jack blockers and using personal charging devices.

29 June 2023
Hands holding a digital globe
ISACA Journal Article

Convergence of the Physical and Digital Worlds: The Metaverse and AR/VR for Training and Education

The education sector has embraced new technological advancements such as AR and VR technologies as they can be used to change teaching and learning methodologies to improve learners’ understanding.

Author: Brigitte Collier
Chiaka Ben-Obi
Blog Post

Laying the Groundwork for the Future of Girls and Women in STEM

Chiaka Ben-Obi, who earned the 2023 ISACA Technology for Humanity Award for serving as a mentor for young women seeking careers in STEM fields, shares her motivation and vision for a more equitable tech workforce.

29 June 2023
John P. Pironti
@ISACA Article

Five Ways AI is Likely to Change How Organizations Approach Information Risk and Security

Existing and emerging AI technology will recalibrate the enterprise risk and security landscapes in some promising ways

28 June 2023
Auditing the Unauditable - person typing on laptop
ISACA Journal Article

Auditing the Unauditable: Ethics and Culture

Internal audit functions can play a role in evaluating several factors that are indicative of presence and proper implementation of good organizational policies related to work ethics and culture.

Author: Sumedha Adavade
leveraging-technology
Blog Post

Leveraging Technology to Help Enhance Trust in Internal Controls Amid Rising Material Weaknesses and Resource Constraints

The rise of material weaknesses leads to significant risks for enterprises and can diminish trust from key stakeholders. Understanding the causes of material weaknesses is an important precursor to developing the needed mitigation strategies.

27 June 2023
Rachel Botsman
Blog Post

Trust is Not Being Destroyed – Just Changing Form

ISACA Europe Conference: Digital Trust World keynote speaker Rachel Botsman explains why she thinks trust is not being destroyed but rather changing form.

26 June 2023
Ashok Kumar Padmaraju CISM, CCSK, AWS Security Specialist and Six Sigma Blackbelt
Blog Post

Fortifying Zoom Phone Security: A Comprehensive Threat Modeling Analysis

Zoom Phone has emerged as a robust communications tool but utilizing threat modeling and arriving at a better understanding of the attack surface is needed for the tool to reach its potential.

23 June 2023
Megan Moritz and Scott Gould
Podcast

Processes of Engagement with Scott Gould

Scott Gould is the author of 'The Shape of Engagement: The Simple Process Behind how Engagement Works.' In this podcast, Scott will discuss the essential frameworks for understanding and operationalizing engagement and building enduring connections with your networks and communities.

23 June 2023
Building effective defenses
Blog Post

Building Effective Defenses Against Social Engineering

By understanding how social engineering works and developing targeted defenses, cybersecurity practitioners can mitigate this perennially damaging threat.

22 June 2023
Jean Carlos
@ISACA Article

Switching the Blame for a More Enlightened Cybersecurity Paradigm

Placing blame on users for security mistakes can be both unfair and counterproductive - it's time to embrace a new cybersecurity paradigm

21 June 2023
David Foote
Blog Post

Pay for ISACA Certifications is on the Rise

Pay for several ISACA certifications in 2023 tells a promising story for certification-holders, according to recent salary data from Foote Partners LLC.

21 June 2023
Internal Audits That Create Stakeholder Value - person typing at laptop with overlying checkmark
ISACA Journal Article

Internal Audits That Create Stakeholder Value

The Agile Scrum mindset places a strong emphasis on stakeholder engagement by actively involving stakeholders in the internal audit process and seeking feedback, which can improve communication and collaboration, resulting in better audit outcomes.

Author: Thomas J. Bell III
The Top 5 Benefits of Becoming an ATO
Blog Post

Top Benefits of Becoming an ISACA Accredited Training Organization

ISACA Accredited Training Organizations provide a range of benefits, including increased credibility and access to unique training materials and programs.

20 June 2023
Rethinking IT Asset Valuation
Risk Article

Rethinking IT Asset Valuation, Risk Assessment and Control Implementation

Risk management and evaluation are critical to every enterprise’s strategic planning for information security.

20 June 2023
Anuj Choudhary
Blog Post

Ransomware Attacks on the Rise in India: The Need for a Global Culture of Crisis Management

Growing instances of ransomware attacks in India are instructive both of the extent of this threat around the world and the measures that organizations need to put in place to mitigate the risks.

16 June 2023
Nandita Rao Narla, Head of Technical Privacy and Governance at DoorDash
Blog Post

TSA’s Plans to Expand Facial Recognition at Airports: A Privacy Perspective

The advancement of facial recognition technology raises an array of privacy concerns, as underscored by the recent expansion of a program through the US Transportation Security Administration.

15 June 2023
Chris McGowan and Gurpartap “GP” Sandhu
Podcast

Delivering Security Value to Product Teams Using the Power of Data

In security, aligning with product teams has never been more important, especially when outmaneuvering adversaries.

15 June 2023
Lisa R. Young
@ISACA Article

Getting More Value from Risk Assessments

Conducting IT risk assessments is valuable for enterprises but the variance in how frequently enterprises conduct them shows more awareness-building is needed about how they fit into the risk management equation.

14 June 2023
Abdul Rafeq
@ISACA Article

Seven Steps for Digital Trust Professionals to Develop Analytical Thinking

Exploring different angles and dimensions of a problem and learning to ask the right questions are solid starting points for digital trust professionals to take to develop analytical thinking skills.

14 June 2023
Luigi Sbriz
Blog Post

Using Agile Practices for Internal Audit

The value in modern audit is timely data that can be leveraged to improve operating processes and business continuity, tied heavily to the enterprise risk lifecycle

14 June 2023
two people working in front of laptops
ISACA Journal Article

Mitigating Auditor Burnout With an Energy Management Mindset

Auditors need to change their mindsets and focus on managing energy rather than time to avoid burnout.

Authors: Elena Klevsky and Melissa Walters
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

IT Risk Assessments: A Process Your CIO or CISO Will Thank You For

Identifying and quantifying risk can be made more straightforward by following six key steps for IT risk assessments.

13 June 2023
Beatrice Nepoti and Cristiano Passerini
Emerging Technology Article

AI Systems Training Pause Sought

The decision of the GPDP to inhibit the use of an innovative tool based on generative AI, such as ChatGPT, may seem questionable; therefore, it is important to understand the motivation.

13 June 2023
Michael Rebultan
Blog Post

Common Cybersecurity Risks to ICS/OT Systems

Organizations need to protect their industrial control and operational technology systems from cyberthreats, including through regular vulnerability assessments, network segmentation and providing ongoing training on cybersecurity best practices.

12 June 2023
Erik Prusch
Blog Post

Join Me in Welcoming ISACA CEO Erik Prusch!

Erik is the right person to lead ISACA into the future. It is clear that he has a values-driven approach, a steady presence, the right vision and a clear focus to take us forward.

12 June 2023
How ATO and Chapter Training Can Help You Pass Your Certification Exam
Blog Post

How ATO and Chapter Training Can Help You Pass Your Certification Exam

ISACA's chapters and Accredited Training Organizations (ATOs) offer prime opportunities for certification candidates to prepare for success on their certification exams.

8 June 2023
Aaron Turner
@ISACA Article

A Security Globetrotter’s Lessons Learned from Boots on the Ground in Over 100 Countries

Aaron Turner has investigated and researched security incidents on the ground in more than 100 countries during his career.

7 June 2023
Caitlin McGraw
@ISACA Article

How to Manage Job Offers Like a Pro

Landing a job offer is naturally the goal of candidates who are engaged in the hiring process, but when it's offer time, there's much more to the back and forth between candidate and prospective employer than just saying yes or no.

7 June 2023
An MDDAP Use Case: How a Medical Device Manufacturer Increased Production by 62% and Reduced Staff Turnover by 70%
Blog Post

New Use Case Highlights Promising MDDAP Results

A new case study demonstrates a successful, real-life application of ISACA’s Medical Device Discovery Appraisal Program (MDDAP).

7 June 2023
Securing Next-Generation Broadcast Media Enterprises Against Cyberthreats
ISACA Journal Article

Securing Next-Generation Broadcast Media Enterprises Against Cyberthreats

It is essential for broadcast media enterprises to develop a cyberresilience strategy when broadcasting high-profile live events and determine what are cybersecurity challenges the enterprise faces specifically related to core broadcast business services.

Author: Muhammad Malik
Disaster Recovery and Business Continuity Preparedness for Cloud-based Start-ups
Blog Post

Disaster Recovery and Business Continuity Preparedness for Cloud-based Start-ups

Business continuity plans for start-up companies prepare them for unexpected events that may disrupt operations and can protect critical data, as well as the company's reputation.

6 June 2023
Laura Zannucci
Audit Article

The Increasing Importance of IT Audits to the BoD

How can the BoD ensure that it is adequately meeting requirements? One of the best ways to identify gaps in what an organization is doing vs. what it is expected to do is to conduct a thorough IT audit.

6 June 2023
Mary Carmichael
Blog Post

ChatGPT’s ‘Perfect Storm’: Managing Risk and Eyeing Transformational Change

Organizations looking to make ChatGPT implementations successful need to be mindful of interdisciplinary collaboration that taps technological expertise, regulatory compliance, risk management and operational understanding of the powerful AI chatbot.

5 June 2023
Gopikrishna Butaka
Blog Post

Understanding and Implementing Digital Trust Effectively

As the world has become more hyperconnected and digital interactions between systems, devices and people become more complex and complicated, digital trust has become an increasingly discussed concept.

2 June 2023
Chris McGowan and Ray Payano
Podcast

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

Organizations today struggle with vulnerability management. More specifically, remediating vulnerabilities in a timely manner poses a challenge.

1 June 2023
Europe Sets the Stage for AI Regulations
@ISACA Article

Europe Sets the Stage for AI Regulations

While the topic of regulating artificial intelligence is gaining traction around the globe, Europe is showing leadership in this area with a new proposal that could become the global standard

31 May 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Unpacking the World’s First AI Act

The European Union's proposed Artificial Intelligence Act takes a risk-based approach toward AI systems and applications while establishing legal requirements for high-risk AI systems.

31 May 2023
Digital Trust as a Differentiator: Insights from ISACA Digital Trust World
Blog Post

Digital Trust as a Differentiator: Insights from ISACA Digital Trust World Panel

A recent ISACA conference panel in Boston explored how digital trust can become a competitive advantage and how the entire organization must rally around the concept for trust to be delivered.

31 May 2023
Man typing in front of computers
ISACA Journal Article

Risk in the Digital Era and the Skills Required for a New Environment

Creating a specialized safety and security culture is essential to protect customer data and develop plans to prevent and mitigate IT and cybersecurity risk.

Author: Pierina Guizado
Matthew J Scott
Blog Post

Defensive Programming for Industrial Control Systems

Modern industrial control systems are exposed to the internet, making a proper code environment, defining rule sets and conducting verification increasingly important to protect these critical systems.

30 May 2023
Chandrasai D.
Blog Post

The 3A-3C Approach to Digital Solutions in the Pharmaceutical and Healthcare Sector

The digital health market is expanding, and cost, compliance and user comfort are essential elements to ensure related digital transformations are going to plan.

26 May 2023
Naomi buckwalter
Blog Post

Digital Trust World Conference: A Fabulous Convergence of Security, Emerging Tech and Lobster Rolls

ISACA's Digital Trust World conference in Boston left me excited about the future of the security profession despite many open questions about how AI and other emerging tech will reshape the profession.

25 May 2023
Meng Fai Chan
Emerging Technology Article

Navigating the Hype and Risk of Emerging Technologies

By taking a risk-informed approach, security and risk professionals can navigate the path forward in a way that balances the potential benefits of emerging technologies with the risk they may pose.

25 May 2023
Identity as a New Security Perimeter
@ISACA Article

Identity as a New Security Perimeter

The rapid shift towards global digitalization has brought inherent risk to people, things and systems that traditional security perimeters cannot keep up with, which is why embracing identity as a new security perimeter is crucial.

24 May 2023
Improving Governance at a National Bank With COBIT
ISACA Journal Article

Improving Governance at a National Bank With COBIT

Employees organizationwide can harness the potential of I&T for value creation—not merely the IT department.

Author: Bruno Horta Soares
Anamika Roy
Blog Post

Identity as a Service Audit Implications and Best Practices

Identity as a Service can have major implications for audit by dictating the way that organizations manage user identities and access their applications and IT workloads.

23 May 2023
Varun Prasad
Blog Post

Securing an AI Ecosystem: The Next Big Cybersecurity Challenge

As artificial intelligence becomes an increasingly prominent part of our professional and personal lives, security and control protocols must keep pace with the evolving ecosystem.

24 May 2023
Daniel Dobrygowski
Blog Post

Where Does Digital Trust Begin? An AMA with World Economic Forum’s Daniel Dobrygowski

Daniel Dobrygowski, the head of governance and trust for the World Economic Forum, was featured in a recent Ask Me Anything discussion on ISACA's Engage community, with a focus on building digital trust and its key implications in business and civil society.

22 May 2023
Denise Owens
Audit Article

Managing Data Privacy and Information Security With IT Audits

Ensuring that data are protected and secured in the most efficient and economical manners possible are constant battles due to the increasing sophistication of cybersecurity threats and the amount of data protection regulations.

23 May 2023
Safia Kazi, Natalie Jorion and Jack Freund
Podcast

The True Cost of a Data Breach

Guests Jack Freund and Natalie Jorion discuss the need for additional data for quantitative risk analyses and methods to derive that data when it does not exist. They cover how this was done in the past and their updated method for interpolation of such data from record losses and other firmographic data.

23 May 2023
Jon Stanford
@ISACA Article

The AI Revolution is Already Here

The artificial intelligence revolution is already here, meaning enterprises that are strategic in their use of AI and diligent about mitigating related risks and navigating ethical concerns will be well-equipped for this new era of business.

17 May 2023
Jack Freund
@ISACA Article

The Role of Hanlon’s Razor in Cybersecurity

The Hanlon's Razor adage, 'Never attribute to malice that which can be adequately explained by stupidity,' might be more applicable to the world of cybersecurity than you think.

17 May 2023
Chris Fraker
Blog Post

Five Tips to Prepare for ISACA’s CDPSE Exam

Top CDPSE exam scorer Chris Fraker shares his tips for success and how the certification benefits privacy professionals and their organizations.

17 May 2023
Understanding the Risk of Robotic Process Automation
Blog Post

Understanding the Risk of Robotic Process Automation

Reviewing vendor-provided scripts and testing systems in contained environments are important measures in dealing with risk stemming from robotic process automation.

17 May 2023
A Framework for SIEM Implementation - person typing on a laptop
ISACA Journal Article

A Framework for SIEM Implementation

An SIEM solution consumes information in the format of event logs from many different source systems and provides a consolidated view of security activities within an enterprise.

Author: Grant Hughes
Welland Chu
Blog Post

Maintaining Sovereignty in the Cloud: Controlling Your Digital Future

Cloud users' desire for for control over their data calls for digital sovereignty measures in collaboration with cloud providers.

16 May 2023
Lisa Cook and Kayne McGladrey
Podcast

2023 IT Compliance and Risk Benchmark Report

This podcast asks, are you wondering about the ever-changing landscape of IT compliance and risk management? Look no further. Hyperproof, a leading SaaS compliance operations provider, conducts an annual survey of over 1,000 IT risk, compliance, and security professionals to uncover their top challenges.

16 May 2023
Todd Harper
Blog Post

Using Tabletops and Simulations to Build Better Incident Responders

Incident simulations can be highly effective at pinpointing gaps in monitoring and detection processes, and better understanding how to go about catching bad actors.

15 May 2023
Chris McGowan and Jonathan Tomek
Podcast

What Is Your IP Address Cybersecurity IQ? The Role of IP Address Data in a Digital World

There are literally thousands of VPN services on the market. Some are undeniably benign, but others offer a slate of features that are friendly to cyber criminals.

15 May 2023
Steven Sim Kok Leong
Blog Post

Credential Hacking: The Dark Side of Artificial Intelligence

Artificial intelligence is capable of helping cybercriminals crack passwords, but the good news is cybersecurity professionals can leverage AI to fight fire with fire.

11 May 2023
Lisa Cook and Megan Maneval
Podcast

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

In this episode, we’ll assess risk management myths and discuss how to establish scalable, quantifiable, and always-on risk management for the future.

11 May 2023
ISACA Board Approves 2023 24 Board Slate De Santis to be Board Chair
@ISACA Article

ISACA Board Approves 2023-24 Board Slate; De Santis to be Board Chair

The upcoming slate for the 2023-24 ISACA Board of Directors was recently approved by the board, with John De Santis to become ISACA's next board chair.

10 May 2023
ISACA’s New Report Reveals Value, Benefits of Digital Trust
@ISACA Article

ISACA’s New Report Reveals Value, Benefits of Digital Trust

ISACA's State of Digital Trust 2023 research explores how organizations view digital trust, its top benefits, major obstacles, how it is measured and more

10 May 2023
Jon Brandt
Blog Post

Digital Trust: Focus on the Forest Rather Than the Trees

Digital trust does not come about through any one product or technology but increased transparency in how technology is being developed and deployed would be a good starting point to strengthening trust in the digital ecosystem.

10 May 2023
BCP and Corporate Social Responsibility in the Event of Union Strikes
ISACA Journal Article

BCP and Corporate Social Responsibility in the Event of Union Strikes

In the event of a union strike, it is essential to not only have a business continuity plan, but to have one that balances with corporate social responsibility .

Author: Jason Jiao
Mark Thomas
Blog Post

Taking Digital Trust from a Lofty Goal to a Measurable Reality

Organizations can turn digital trust into an important competitive advantage, as reinforced by the major takeaways from ISACA's State of Digital Trust 2023 report.

9 May 2023
Diego Fratus, CISA, CIA, CCSA, CRMA and Cedric Blotin, CISA
Audit Article

What the Post-Pandemic Future Holds for IT Auditors

COVID-19 acted as a catalyst that accelerated digital transformation, modified how brands interact with their customers and disrupted IT audit practices.

9 May 2023
Marc Randolph
Blog Post

ISACA Virtual Conference Keynoter: Never Lose the Spark of a Startup

Marc Randolph, a national bestselling author, executive mentor, angel investor, and the co-founder and first CEO of Netflix, will be the opening keynote speaker at the ISACA Virtual Conference: Digital Trust World.

8 May 2023
Chris McGowan and Pat Barnett
Podcast

How Organizations Can Consistently Reduce Cyberrisk

Cyber threats are now a “clear and present danger” to most organizations, companies and governments of the world. A good cyber defense involves many, intricate layers. You can never have enough layers, just like you can never remove all the risk.

8 May 2023
Kilian Truatmann
Blog Post

The Evolution of Cloud Computing and Distributed Ledger Technology

Enterprises need to have significant trust before they can move forward with delegating data control, storage and application execution to cloud providers.

5 May 2023
Embarking on the Journey Toward Digital Trust
Blog Post

Embarking on the Journey Toward Digital Trust

Dealing with adversity in a trustworthy and transparent way can turn a problem into a big opportunity for a company to strengthen its relationship with customers.

4 May 2023
Jon Brandt
Emerging Technology Article

Generative AI: The Future Is Now, and It’s Risky

Far too many users are starstruck by AI capabilities and are putting enterprises at substantial risk.

4 May 2023
2022 Annual Report
@ISACA Article

Annual Report Dives into ISACA’s Growth, Digital Trust Impact

ISACA's newly released 2022 annual report spotlights the organization's growing focus on digital trust as well as other highlights from the year, plus a recap of ISACA's finances.

3 May 2023
Chris St Clair
@ISACA Article

Cyber Versus IT Security in a Permanently Connected World

Before there was cybersecurity, there was IT security: contrasting the two terms reinforces the importance of going back to the security basics.

3 May 2023
Caitlin McGraw
@ISACA Article

It’s Personal: You Define What Success and Work-Life Balance Mean for You

Finding work-life balance can be challenging, especially in demanding digital trust fields, but there are several tactics that can help professionals find the right blend of personal and professional.

3 May 2023
Devharsh Trivedi
Blog Post

Privacy-Preserving Security Analytics

Preserving privacy while outsourcing is a challenge, especially when factoring in considerations such as how to preserve the security and privacy of data at rest.

3 May 2023
Robin Lyons and Sandra Kuyengwa
Podcast

Key Considerations for Conducting Remote IT Audits

Conducting adequate preparation including risk assessments, assessing resource requirements and ensuring ongoing communication to harness both the benefits and to address the potential challenges faced when conducting hybrid or fully virtual audits.

3 May 2023
Mary Carmichael
Blog Post

Developing Collective Risk Leadership Through CRISC

The interconnected nature of risks in today's environment calls for a holistic approach to risk management, which can be reinforced through the principles of the CRISC credential.

2 May 2023
2022 Annual Report
Blog Post

ISACA’s Digital Trust Vision Highlighted in 2022 Annual Report

ISACA's newly released 2022 annual report highlights the digital trust resources that the organization put forward along with other key organizational progress from the year.

1 May 2023
Cybersecurity lock shield
ISACA Journal Article

Information Security Matters: CISOs at Risk

Many of the readers of this Journal are or may someday be IT directors or chief information security officers. Sadly, your jobs may be on the line, should there ever be a cyberattack on your watch.

Author: Steven Ross
Laptop and man looking at papers
ISACA Journal Article

IS Audit in Practice: Advantages of Technology in Achieving Diversity

The CIO was convinced not only that technology could drive diversity in positive ways, but that the process itself could foster better collaboration from the team.

Author: Cindy Baxter
Infinity symbol
ISACA Journal Article

The Bleeding Edge: Advancing Sustainability Goals With DevOps

There are multiple things that we can do to support, either directly or indirectly, sustainability goals in and through the controls, procedures, processes and countermeasures that we work with every day.

Author: Ed Moyle
Several security locks
ISACA Journal Article

The Digital Trust Imperative: Cybersecurity Is Still Critical

Cybersecurity is not all there is to digital trust, but it is a key component that should not be ignored or undervalued.

Author: K. Brian Kelley
Person working in front of computer
ISACA Journal Article

Navigating the New Distributed Enterprise

Now that a hybrid or distributed workforce has become the new normal, it is imperative to ensure the digital trust, security and integrity of users, devices and assets, no matter where they physically reside.

Author: Timothy Liu
Cloud
ISACA Journal Article

Redefining Enterprise Cloud Technology Governance

Cloud computing is a key enabler of digital transformation and is an important consideration in digital governance; therefore, it is important that greater emphasis is placed on cloud governance to ensure that it is aligned with future business requirements.

Authors: David Mazula and Casper Lamprecht
Security lock graphics over people pointing at a laptop
ISACA Journal Article

Building Cyberresilience From Collaborative Culture

Overall, collaboration allows enterprises to better understand the threat landscape, effectively deploy resources to deter threats, respond to attacks more effectively and recover more quickly.

Author: Joseph Cheng
Cyber security lock
ISACA Journal Article

The Illusion of Control and the Challenge of an Adaptable Digital Enterprise

Enterprise risk management should be positioned to address uncertainties by shifting attention from avoiding failure to understanding control as a dynamic balance between decreasing uncertainties and amplifying novel emerging behaviors.

Author: Jeimy Cano
Cyber brain
ISACA Journal Article

Reducing Human and AI Risk in Autonomous Systems

To mitigate risk attributed to semiautonomous and fully autonomous systems, it is necessary to ensure that autonomous systems are designed and built to allay such fears by considering biases, ethics, fairness and trustworthiness as they apply to AI systems.

Author: C. Warren Axelrod
Ecommerce connectedness over cityscape
ISACA Journal Article

Case Study: Pivoting to Ecommerce During COVID-19 With SAP Commerce Cloud

For an organization to be successful in its business and become a leader in the market, it needs to be willing to use technology to initiate an effective digital transformation.

Author: Dhruv Aggarwal
Digital data
ISACA Journal Article

Data Are the Lifeblood of Business: To Thrive Governance Must Drive Insight

This new reality of data as the lifeblood that flows through all aspects of an organization presents an unprecedented opportunity to create new business benefits, innovate and work more effectively.

Authors: Nina Bryant and Susana Esteban
Robin Lyons, Frans Geldenhuys and Gustav Silvo
Podcast

Seven Things to Know Before Automating IT General Control Audits

This podcast is a practical discussion with two IT Internal Auditors, Frans Geldenhuys and Gustav Silvo, that have automated IT General Controls across their highly diversified and decentralized group.

2 May 2023
Ravikumar Ramachandran
Blog Post

The Science of Cybersecurity and its Future Challenges

Cybersecurity is a sub-discipline of computer science and a rigorous scientific approach should underpin the work of cybersecurity leaders and practitioners.

28 April 2023
Adeline Chan
Emerging Technology Article

Can AI Be Used for Risk Assessments?

To produce risk assessments with more accuracy, artificial intelligence (AI) can be used because one of its core competencies is data aggregation and interpretation.

28 April 2023
Kayne Mcgladrey
Blog Post

How the Relationship Between CISOs and Legal Teams is Changing

A closer relationship between CISOs and enterprise legal teams can help CISOs deal with increasing regulatory burdens, how to approach cybersecurity insurance and addressing liability in the event of data breaches.

27 April 2023
Tim Wallen
@ISACA Article

How Security Leaders Should Approach a Challenging Budgeting Environment

Tim Wallen, Regional Director, UKI & BeNeLux, for Logpoint, shares his perspective on current budgeting priorities and challenges for security leaders, AI security tools and more in this Q&A interview.

26 April 2023
Tan Soon Chew
Blog Post

Risk Assessment for Technical Vulnerabilities

Regardless of local regulations, risk assessment for technical vulnerability should supplement an organization’s existing comprehensive security risk assessment, not serve as a substitute.

26 April 2023
The Future of Cybersecurity Assessments Is Here
ISACA Journal Article

The Future of Cybersecurity Assessments Is Here

Data-driven security assessments are the next generation of cybersecurity assessments that organizations need to adapt to augment existing, traditional security assessments.

Authors: Karthik Sridharan, Jyothsna Chalasani and Pradeep Sekar
Chris McGowan
Blog Post

Pentagon Leak Case Shows that Insider Threats Remain a Prominent Risk

The recent high-profile Pentagon leak in the United States underscores the importance of defending against insider threats.

25 April 2023
Kurt Markley
Risk Article

Data Recovery Pitfalls to Avoid

There are 4 common false beliefs that should be dispelled to better protect organizations and their data.

25 April 2023
Jo Stewart Rattray
Blog Post

United Nations Meeting on the Status of Women Reveals True Gender Parity is Centuries Away

Women across the globe are finding ways to fast-track change and counteract concerning projections for how long it will take to truly erase gender disparities in the tech workforce and society as a whole.

24 April 2023
Sunil Bakshi
Blog Post

Gaining More Than I’ve Given Through ISACA Volunteering

Sunil Bakshi, of India, has relished sharing his expertise and exchanging ideas with members of ISACA's global community through his ISACA volunteer activities.

21 April 2023
Joyce Chua
Blog Post

ISACA Volunteer Starts Slow, Seizes Opportunities to Grow

A self-described introvert, Joyce Chua, of Singapore, says her volunteer activities with ISACA helped her build her speaking and collaborating skill set.

20 April 2023
Sophia Bekele
Emerging Technology Article

Breaking Through the Barriers of Leadership

Although traditional gender dynamics and systemic inequality create substantial obstacles that are preventing women from achieving parity in leadership roles within the metaverse, there are also ways for women to break through barriers.

20 April 2023
Celebrating ISACA Volunteer Appreciation Week 2023
@ISACA Article

Celebrating ISACA Volunteer Appreciation Week 2023

ISACA’s global community is made up of digital trust professionals and highly engaged volunteers who enable ISACA to be responsive to rapidly evolving industry trends.

19 April 2023
Abdul Rafeq
@ISACA Article

Seven Tips for Achieving Dynamic Professional Transformation with Framework Modeling

Combining micro and macro perspectives and developing an architect's mindset are among the keys to becoming proficient at framework modeling.

19 April 2023
Chetan Anand
Blog Post

Volunteer Finds Resources He Needs ‘All Under One Roof’

Chetan Anand says ISACA has provided many of the knowledge resources he is looking for "all under one roof," and he gives back through extensive volunteering.

19 April 2023
ENISA’s Threat Landscape and the Effect of Ransomware
ISACA Journal Article

ENISA’s Threat Landscape and the Effect of Ransomware

The blurred lines between cyberespionage and cybercrime, especially if state-sponsored actors carry out the attack, confirm that ransomware is a national security issue.

Author: Antonio Villamor
Julia Hermann
Blog Post

Volunteer Work Provides Fresh Perspectives for InfoSec Professional

Germany-based ISACA volunteer Julia Hermann says her volunteer work with ISACA has exposed her to new perspectives that have furthered her professional growth.

18 April 2023
Han Jumashov
Blog Post

Volunteering Pays Quick Dividends for Recent University Graduate

Han Jumashov has become an active ISACA volunteer after relocating to the United States from Turkmenistan to pursue his university degree and the beginning of his professional career.

17 April 2023
Ramona Ratiu
Blog Post

Award-Winner Creates a Culture of Innovation, Adaptability and Inclusion

ISACA Chicago Chapter President Ramona Ratiu reflects on her recent ISACA Inspirational Leadership Award and shares her leadership goals going forward.

14 April 2023
Chris McGowan and Justin Rende
Podcast

Eight Cybersecurity Trends to Watch for in 2023

With the start of a new year, it is a key time for all organizations, small through enterprise, to examine their IT infrastructure and review cybersecurity policies.

14 April 2023
Mike Hughes
Blog Post

Why Team Training Leads to Big Business Benefits

Enterprise training can ensure team members are aligned in their decision-making and approaches for more effective team performance and communication with stakeholders.

13 April 2023
John P. Pironti
@ISACA Article

Five Key Considerations When Developing a Collaboration Strategy for Information Risk and Security

The key to success for CISOS, their organizations, and their information risk and security programs is collaborating with leaders, stakeholders, and individuals on common goals.

12 April 2023
Patrick Sullivan
Blog Post

How Automation Can Streamline Your Compliance Journey

Usage of compliance automation technology is rising as organizations that implement it experience a range of benefits.

12 April 2023
The Impact of Blockchain Technology on Accounting and Auditing
ISACA Journal Article

The Impact of Blockchain Technology on Accounting and Auditing

If the adoption of new technologies such as blockchain changes the process of conducting transactions, accountants and auditors should understand the changes to correctly reflect them in their work.

Author: Mohammad K. Elshqirat
Julia Kanouse and Amanda Raible
Podcast

Industry Spotlight - Julia Kanouse

Get to know Chief Membership and Marketing Officer Julia Kanouse as she sits down with childhood best friend and ISACA VP Amanda Raible. The duo discuss everything from leadership to motherhood while competing in Mario Kart! Tune in!

12 April 2023
Gina Yarcone
Blog Post

Interactive Tabletop Scenarios: A Comprehensive Approach to Strengthen and Assess Your Incident Response Strategy

Interactive tabletop scenarios, incorporating gamification, can make a big difference in sharpening organizations' incident response preparedness.

11 April 2023
Patrick Barnett
Security Article

How Organizations Can Consistently Reduce Cyberrisk

Cyberrisk is an ever-changing parameter that requires constant analysis and is difficult to quantify.

11 April 2023
Ron Lear
Blog Post

CMMI Updates Take Performance Improvements to the Next Level

The latest iteration of the CMMI model includes security, safety, data management, people management, and managing virtual workforce best practices.

10 April 2023
Auditing and Digital Transformation Are at a Crossroads - zeros and ones digital graphic
ISACA Journal Article

Auditing and Digital Transformation Are at a Crossroads

To help organizations sustain this fast-paced growth, the performance and resilience of enterprises‘ IT systems and controls must be assured through internal and external audit and assurance partners.

Author: Vimal Mani
Michael Rebultan
Blog Post

Introduction to ICS/OT Systems and their Role in Critical Infrastructure

Industrial Control Systems/Operational Technology must be understood and secured effectively to avoid potentially disastrous impacts on critical infrastructure.

6 April 2023
Caitlin McGraw
@ISACA Article

How to Help a University Student Excel on the Internship Front

University students interested in internships need to be proactive to position themselves for the experiences they need to effectively jump-start their careers.

5 April 2023
Guy Pearce
@ISACA Article

What Detrimental Outcomes Might ChatGPT and AI-Powered Bing Unleash?

While ChatGPT and Bing AI have both been prominent examples of promising technology based on OpenAI, the related risks will require vigilance from digital trust professionals.

5 April 2023
Brian Fletcher
Blog Post

How CMMI Cybermaturity Platform (CCP) can help your organization implement Zero Trust

ISACA's new eBook is a free resource to guide you on how to simplify the implementation of a Zero Trust strategy in your organization with the CMMI Cybermaturity Platform (CCP).

5 April 2023
Combatting Social Engineering - cloud network connected graphic
ISACA Journal Article

Combatting Social Engineering

Although ransomware, data breaches and other large-scale cyberattacks are frequently in the headlines, it is too easy to overlook the common thread that runs through many of these incidents: social engineering.

Author: Chun Li
Kim Kaplan
Blog Post

The Exciting Benefits of ISACA’s MDDAP VIP Portal

ISACA's Medical Device Discovery Appraisal Program (MDDAP) Voluntary Improvement Program (VIP) Portal launched to collaborators and stakeholders with exciting features and updates.

4 April 2023
Security Awareness
Blog Post

Security Awareness Training: A Critical Success Factor for Organizations

Reducing chances of a data breach, supporting existing systems and increasing customer confidence are among the leading benefits of effective security awareness training programs.

31 March 2023
Frances Haugen
Blog Post

‘There is Hope’: Facebook Whistleblower Takes On Misinformation, Addresses Digital Trust

Facebook whistleblower Frances Haugen, who will be a keynote speaker at ISACA's upcoming Digital Trust World Boston conference, addresses misinformation and digital trust.

30 March 2023
Conference Chats with Chelsey & Robyn
Podcast

Conference Chats with Chelsey & Robyn

Tune in to listen to ISACA’s very own Chelsey Byrd and Robyn Franko as they discuss the upcoming fun at ISACA Conference North America 2023: Digital Trust World. 

30 March 2023
Tracking the Evolving Cybersecurity Jobs Landscape for 2023
@ISACA Article

Tracking the Evolving Cybersecurity Jobs Landscape for 2023

Given a challenging economic environment, hiring in the cybersecurity field might focus more on strategic and critical roles in the coming months.

29 March 2023
Samuel Zaruba Smith
Blog Post

Crypto Collapse and Democratizing Auditing

The proliferation of emerging technologies across domains and throughout all layers of an organization is leading to a democratization movement that is not yet well-understood, with IT audit playing a significant part.

29 March 2023
User Susceptibility to Social Engineering in AR Environments - hand holding an AR phone
ISACA Journal Article

User Susceptibility to Social Engineering in AR Environments

The cutting-edge technology augmented reality has seen increasing use but the potential cybersecurity risk facing users of this technology remains a point of concern.

Author: Sarah Katz
Michelle Dennedy
Blog Post

Insights from a Privacy Jedi

Privacy expert Michelle Dennedy recently shared her insights on emerging privacy trends and key industry challenges in an Ask Me Anything session through ISACA's Engage platform.

28 March 2023
Chris McGowan
Risk Article

Social Media as a Growing Threat to the Workplace

Failing to prioritize the security and privacy of a social media account can result in negative consequences spanning both the personal and professional worlds.

28 March 2023
Belinda Mueller
Emerging Technology Article

Understanding and Mitigating the Risk of AI vs. Traditional Software

It is crucial to understand what makes AI so different from traditional rule-based systems and how to address these differences.

27 March 2023
Raef Meeuwisse
Blog Post

The Biggest AI Moment Ever for Cybercrime Just Happened

Cybersecurity professionals, beware: the theft and repurposing of powerful AI models is within cybercriminals' reach, and it could be a game-changer.

24 March 2023
Safia Kazi and Steven Ross
Podcast

Advertising Information Security

In this episode, executive principal at Risk Masters International’s Steven Ross discusses why vendors of IT products and services are advertising information security...

24 March 2023
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

Compliance Automation Journey: Five Steps to Streamline Efforts, Identify Risks, and Improve Team Workflows

When implemented effectively, compliance automation can make a big difference in allowing teams to dedicate their time toward more impactful priorities.

23 March 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 2

The updated versions of the ISO/IEC 27001 and ISO/IEC 27002 standards mean organizations have work to do to align their methods, protocols and workflows with the latest guidelines.

22 March 2023
Rahul Pandey
@ISACA Article

The Urgent Need for AI in GRC and Security Operations: Are You Ready to Face the Future?

The growing prominence of artificial intelligence is surfacing new opportunities for GRC and security professionals but also calls for specialized technical expertise.

22 March 2023
Luigi Sbriz
Blog Post

Solutions for Digital Identification

While a universal solution for digital identification of internet users might not be realistic, finding solutions that are suitable in various situations is realistic and a worthwhile goal.

22 March 2023
Agile Manifesto - hands in front of a laptop
ISACA Journal Article

Agile Manifesto for Internal Audit

The internal audit process must be responsive to internal enterprise changes to easily align with the evolution of the business and guarantee the effectiveness of audit operations.

Author: Luigi Sbriz
C. Warren Axelrod
Blog Post

A Collaborative Approach to Cybersecurity

Since attackers often benefit from cooperative measures, it only makes sense for organizations to collaborate in their efforts to thwart cyberthreats, even if that has historically proven to be challenging.

21 March 2023
Jeff Champion and Beth McKenney
Podcast

The Future of Technology Risk: 4 Ways to Build Stakeholder Trust in the Technology Risk Imperative

Today, the pace of change across industries is quicker than ever before. Economic, political, and social unrest and a global climate crisis have placed unprecedented disruption and pressures on organizations looking to navigate a rapidly changing environment.

21 March 2023
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Five Habits to Make Compliance Smoother for Lean Teams

Smaller organizations might find keeping on top of compliance activities to be challenging but there are several key habits that can help lean teams meet compliance responsibilities without feeling overburdened.

20 March 2023
Guy Pearce
Blog Post

As in Life, Digital Trust Is a Two-Way Street

It is not only organizations that have eroded trust – people have played a role, also, and both people and organizations need to be a part of fixing what is broken.

17 March 2023
Karthik Kaligotla
Blog Post

Software-Defined Networking: The Future of Networking

Software-defined networking provides a modern solution to evolving access challenges that can be problematic for network administrators.

16 March 2023
Adobe logo
Podcast

Measuring Security Resilience from the Lens of the Adversary Community

In a world where adversaries are constantly adapting to improve tactics, techniques, and procedures (TTPs), it is crucial to understand the unique traits and goals of various types of adversaries that actively seek to cause harm to an organization.

16 March 2023
Jack Freund
@ISACA Article

Yes, Business Process Maps Are Boring

Documenting business processes and how money flows through the organization might not be glamorous but it is well worth the effort for security teams.

15 March 2023
Veronica Rose
@ISACA Article

IT Audit Buzzwords That Have Become Buzzkills to Clients and Process Owners

IT auditors can manage their engagements more effectively by ditching common buzzwords in favor of less combative language.

15 March 2023
Person writing on electronic tablet
ISACA Journal Article

Application of the Nudge Theory for Improving Information Security Awareness Campaigns

Study findings provide strong evidence for the applicability of the nudge theory in improving the effectiveness of information security awareness posters.

Author: Sudeep Subramanian
Top Risks and Rewards of Moving to the Cloud
Blog Post

Top Risks and Rewards of Moving to the Cloud

Enterprises increasingly are moving to the cloud and seeing major benefits along the way, but it is important to weigh those gains against numerous cloud risks that need to be managed.

14 March 2023
Paul Philips
Risk Article

A Road Map to Breaking Down Zero Trust Barriers

Zero trust provides an enterprise the opportunity to create a more robust and resilient security posture, simplify security management, improve the end user experience and enable modern IT practices.

14 March 2023
Maria Sommerhalder
Emerging Technology Article

Standardization and Audit in the Blockchain Space

Standardization and audits play a crucial role in in mitigating the risk that organizations potentially face when implementing blockchain emerging technology.

14 March 2023
Astrid-Bailey
Blog Post

Influencing Security Decisions with Effective Communication

Effective communication makes a big difference in bolstering leadership buy-in for security programs.

13 March 2023
Yunique Demann
Privacy Article

Separating Privacy Awareness From Security Awareness Training

Having a privacy and security awareness training program is better than not having one at all, but having two focused programs addressing high-risk topics is beneficial to not only organizations, but employees as well.

13 March 2023
Mark Tarallo
Blog Post

Assessing Culture With Help From the US Surgeon General

The importance of organizational culture is now understood to be a major factor in an organization’s overall success.

9 March 2023
Jon Brandt and Ryan Cloutier
Podcast

Risky Business – Jon Brandt

For the average person, life moves quickly. But for business leaders and anyone involved in any aspect of IT, the pace at which technology is changing is overwhelming.

9 March 2023
Abby Zhang
@ISACA Article

‘Dream Big and Dare to Try’

ISACA Auckland Chapter board member Abby Zhang shares her perspectives on her role as a SheLeadsTech ambassador, needed progress for women in the digital trust fields and her areas of interest as a security researcher.

8 March 2023
Masood Ahmed
@ISACA Article

Key Security Features for SAP Analytics Cloud

SAP Analytics Cloud offers a wide range of security features and best practices to ensure the protection of data and functionality from unauthorized access.

8 March 2023
ISACA Foundation
Blog Post

ISACA Foundation Takes Equity Message to White House Office of National Cyber Director

ISACA Foundation recently took its message of equity and inclusion to the White House.

8 March 2023
RPA Is Evolving but Risk Still Exists - robotic hand and gears
ISACA Journal Article

RPA Is Evolving but Risk Still Exists

There are many benefits and uses of robotic process automation, and the newest addition of command-and-control centers; however, implementing these tools can also lead to risk.

Author: Larry Wlosinski
Muneeb Imran Shaikh
Blog Post

Data Privacy: A Public Policy Challenge

Data privacy is not just about information security, governance or customer trust - it also is a public policy challenge.

7 March 2023
Industry news
Governance Article

Why Are Regulations Demanding SBOM Adoption?

With the rise of software-based products, regulators have quickly implemented new standards to help manage the complexities of the software supply chain.

6 March 2023
Jouke Albeda
Blog Post

Improved IT Frameworks

Frameworks and IT general control guidance should be reviewed periodically to keep up with industry best practices.

3 March 2023
Frank Downs
Blog Post

LastPass Hack Highlights Importance of Applicable Acceptable Use Policies.

The recent LastPass breach reinforces that Acceptable Use Policies should not be overlooked or underestimated.

2 March 2023
Artificial Intelligence The Future of Information Security Awareness
@ISACA Article

Artificial Intelligence: The Future of Information Security Awareness | ISACA

Artificial intelligence will be the wave of the future when it comes to effective information security awareness training.

1 March 2023
Caitlin McGraw
@ISACA Article

Interviews. Pitch. Audition. Marathon! (Part 2)

A thoughtful, strategic approach to interviews will dramatically improve a candidate's chances to land job offers.

1 March 2023
Mohamed Sadat
Blog Post

Five Factors That Turn CISOs into Firefighters

Chief information security officers often find themselves doubling as firefighters - can it be avoided?

1 March 2023
Considerations for Developing Cybersecurity Awareness Training - woman writing on a note pad
ISACA Journal Article

Considerations for Developing Cybersecurity Awareness Training

it is important to implement effective cybersecurity awareness training to help employees understand proper cyberhygiene, recognize the security risk factors associated with their actions and identify cybersecurity incidents they may encounter in their work.

Author: Tan Soon Chew
Who Leads Cyberresilience?
ISACA Journal Article

Information Security Matters: Who Leads Cyberresilience?

Resilience is an enterprisewide undertaking and all functions must work together to achieve it.

Author: Steven Ross
Applying Lessons Learned From Election Processes to Data Integrity for Business Innovation
ISACA Journal Article

IS Audit in Practice: Data Integrity On Demand

As a risk manager or audit professional, how does one assess data integrity for new and innovative business when time is of the essence?

Author: Cindy Baxter
API Sprawl and Emergence
ISACA Journal Article

The Bleeding Edge: API Sprawl and Emergence

Unforeseen outcomes represent a blind spot in our ability to plan and can undermine security or privacy, make it harder to provide validation, or decrease the effectiveness of governance.

Author: Ed Moyle
The Impact of Relationships on Trustworthiness
ISACA Journal Article

The Digital Trust Imperative: The Impact of Relationships on Trustworthiness

An organization's relationships, and the quality of those relationships, may be the keys to surviving an unexpected disruption.

Author: K. Brian Kelley
Is Detrimental Unexpected - security locks
ISACA Journal Article

Is Detrimental Unexpected IT Emergence Inevitable?

Given the increasing pace of global IT development, it is important to understand if detrimental, unexpected IT emergence is in organizations’ control.

Author: Guy Pearce
The Potential Impact of the European Commission’s Proposed AI Act on SMEs
ISACA Journal Article

The Potential Impact of the European Commission’s Proposed AI Act on SMEs

The use of artificial intelligence (AI) technology has been consistently growing in popularity; therefore, many countries are designing and implementing policy frameworks to address the use of AI with regard to its ethical and security-related impacts.

Authors: Jakob Gassauer and Gerald Burch
Identifying and Preparing for Interruptions, Disruptions and Emergence
ISACA Journal Article

Identifying and Preparing for Interruptions, Disruptions and Emergence

It is important for information systems auditors to understand the nature of these interruptions, disruptions and emergence events to help their organizations to mitigate the adverse impact.

Author: Anantha Sayana
Cloud Computing Evolution - warning sign
ISACA Journal Article

Cloud Computing Evolution and Regulation in the Financial Services Industry

It is crucial for financial institutions to understand the role played by cloud computing in the increasingly digitized banking world, how to mitigate the risk of depending on cloud services and the further development that may materialize through the rise of distributed ledger technology.

Author: Kilian Trautmann
Taming Unruly Data to Improve Compliance
ISACA Journal Article

Case Study: Taming Unruly Data to Improve Compliance

Through a very modest investment and reliance on the ingenuity of its problem-solving team, the on the ingenuity of its problem-solving team, the bank prevented its fictitious records problem from morphing into a big data disaster.

Author: Mick Brady
Digital Trust and the Audit Function
ISACA Journal Article

Digital Trust and the Audit Function

With the ever-increasing use of and reliance on the Internet, big data and disruptive technologies, digital trust has become a necessity due to its ability to measure confidence in an organization's ability to protect, store and secure data and personal information.

Author: Gopikrishna Butaka
Protecting ICS Software
ISACA Journal Article

Protecting Industrial Control System Software With Secure Coding Practices

The best way to ensure secure ICS software is to apply a security perspective throughout the software development life cycle—from design to code development through verification and operation.

Author: Matthew Scott
Future of Technology
Blog Post

The Future of Technology Risk

Consider four ways to build stakeholder trust in the technology risk imperative.

28 February 2023
Mary Carmichael
Privacy Article

The Difference Between Data Privacy and Data Security

When it comes to data privacy, most people think about recent events such as TikTok’s data harvesting activities, Cambridge Analytica’s use of Facebook data without consent and new privacy regulations being introduced globally.

28 February 2023
Patrick Barnett
Security Article

Prepare for Success by Planning for Threat Actor Eviction

Before returning to business as usual after a breach, enterprises must ensure that all threat actors have been evicted from the network and are not able to enter again

28 February 2023
Five Powerful Quotes on the Black Experience in IT
Blog Post

Five Powerful Quotes on the Black Experience in IT

Despite historically being underrepresented in many IT fields, Black professionals have made a huge impact on digital trust disciplines.

27 February 2023
The Competitive Advantages of Privacy and Trust
Blog Post

The Competitive Advantages of Privacy and Trust

Sound practices in managing privacy and emerging technology implementations pays off for enterprises in creating trust with customers.

24 February 2023
Anastasiia Konoplova
Blog Post

Mindfulness Amid the Chaos

Anastasiia of the ISACA Kiev Chapter reflects on the difficult last year and the support the chapter has received from ISACA's global community.

23 February 2023
ISACA Ukraine Community Standing Strong
@ISACA Article

One Year Later: ISACA Ukraine Community Standing Strong

One year after their country went under attack, members of the ISACA Kyiv (Ukraine) Chapter continue to show great resiliency and garner support from ISACA chapters around the world.

22 February 2023
Abdul Rafeq
@ISACA Article

Seven Habits of Highly Skilled Digital Trust Professionals

The same habits that are associated with highly successful people can be applied to successful digital trust professionals, with a few additional twists to consider.

22 February 2023
The True Cost of a Data Breach
ISACA Journal Article

The True Cost of a Data Breach

For chief information security officers looking to convey how serious data breaches could be to their organizations, translating them into economic impact is critical.

Authors: Natalie Jorion and Jack Freund
Lisa Cook and Alex Bovee
Podcast

Rethinking Identity Governance

SaaS is eating the world even more than we think. Companies are dealing with SaaS sprawl: hundreds of apps distributed across different owners that store sensitive data and which are used to orchestrate critical business workflows.

21 February 2023
Patrick Offor
Blog Post

Examining Information Privacy Realities Contradiction Theory

Allowing our information privacy violation tendency to outweigh our protection tendency because of our self-interests can prove problematic to ourselves and others.

21 February 2023
Mary Carmichael
Blog Post

Making Risk Management for Agile Projects Effective

ISACA’s Incorporating Risk Management into Agile Projects white paper provides guidance for conducting risk assessment in an agile project context.

20 February 2023
Five Overlooked Benefits of Having an IT Certification
Blog Post

Five Overlooked Benefits of Having an IT Certification

Some benefits to attaining certifications are obvious but there are many other benefits beneath the surface.

17 February 2023
Tracey Dedrick
Blog Post

Smoothing the Path for an Even Brighter Future for ISACA

ISACA continues to deliver on its digital trust vision while finding new ways to serve its global community.

16 February 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 1

IT auditors and security practitioners should familiarize themselves with the updated ISO/IEC 27002:2022 Standard.

15 February 2023
Agile Methodologies Require Adjustments to Risk Management
@ISACA Article

Agile Methodologies Require Adjustments to Risk Management

A new ISACA white paper explores how Agile methodologies can benefit and help shape enterprise risk management.

15 February 2023
Beyond the Buzzwords: Specific Controls You Can Use: Ricky Hamilton
@ISACA Article

Beyond the Buzzwords: Specific Controls You Can Use

Industry buzzwords are commonplace, but what are the actual controls that audit professionals need to be familiar with to excel in their roles?

15 February 2023
Hakan Kantas
Blog Post

Building Resilience with ISACA

Resilience has become top-of-mind throughout the digital trust fields since the pandemic. The ISACA community can be a great place to sharpen resilience on a number of fronts.

15 February 2023
NIST’s Privacy Framework for Proposed US Federal Privacy Law
ISACA Journal Article

NIST’s Privacy Framework for Proposed US Federal Privacy Law

Governments around the world are enacting data security and data privacy rules and regulations at an increasing pace that is forcing enterprises to react, respond and realign their businesses to meet these challenges.

Author: Valdez Ladd
Jeff Champion and Kayne McGladrey
Podcast

2023: The Year of Risk

A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation-state APTs.

15 February 2023
Rupert Brown
Blog Post

Data Protection and Its Impact on the Older Population

Impacts of GDPR and other data protection policies on the elderly population should not be overlooked.

14 February 2023
Jannie Wentzel and Elissa Mckinley
Risk Article

Integrated Risk Management in an Interconnected World

In this integrated world, it is no longer enough for an enterprise to manage risk strictly within its own borders.

14 February 2023
Tony Bai
Blog Post

FedRAMP for ISVs: How Out-of-Scope Organizations Can Demonstrate Federal Compliance

Some software vendors don’t fall within the scope of FedRAMP and must identify alternate paths to compliance.

13 February 2023
Safia Kazi and Caitlin McGaw
Podcast

Career Coach Advice: How to Launch Your IT Audit Career

Career coach Caitlin McGaw will share her top tips for young professionals and career changes on how to launch a successful career in IT audit—from acing your first interview and landing your first job to career resources to help your career continue to grow and thrive.

10 February 2023
Paul Phillips and Linda Thielova
Podcast

How to Mature Your Privacy Compliance Program: A Conversation With OneTrust DPO Linda Thielova

Compliance with the world’s ever-increasing list of privacy laws can be a tricky undertaking for any organization, but by taking a few simple steps...

10 February 2023
Chris McGowan, Rex Johnson and Hamlet Khodaverdian
Podcast

Improving Cyber Resilience in an Age of Continuous Attacks

We live in the age of continuous compromise. This podcast dives into why so many organizations continue to be breached even after spending money on cybersecurity point solutions.

10 February 2023
Brian Fletcher
Blog Post

Governance, Processes and Planning: Three Significant Countermeasures to Being Hacked

Governance, processes and planning are three components of cybersecurity management that can address the people vulnerability.

9 February 2023
Kayne McGladrey
Blog Post

Three Key Predictions for 2023: The Year of Risk

The rise in importance of internal risk assessments is among the key trends that could shape the risk landscape in 2023.

9 December 2022
Implementing an Emerging Risk Analysis Process
@ISACA Article

Implementing an Emerging Risk Analysis Process

Emerging risk analysis is an area more enterprises should prioritize, and it might be less difficult to implement than many realize.

8 February 2023
The Future of Cryptography
ISACA Journal

The Future of Cryptography: Performing Computations on Encrypted Data

Fully homomorphic encryption allows organizations to ensure their customers' privacy without undermining their ability to gain insights from their data.

Author: Devharsh Trivedi
Ray Payano
Risk Article

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

By calculating vulnerability risk, enterprises can prioritize vulnerabilities based on risk level to help determine the order in which vulnerabilities are addressed.

7 February 2023
Tamim Ahmed
Blog Post

Major Challenges Ahead for GRC Professionals in 2023

GRC professionals will need to remain attuned to changes impacting the technology, regulatory and security landscapes to be effective in the year to come.

2 February 2023
Caitlin McGraw
@ISACA Article

Interviews. Pitch. Audition. Marathon!

Digital trust professionals typically remain in-demand even at times when economic conditions are not ideal.

1 February 2023
IT Certifications That Are Best for Beginners
@ISACA Article

IT Certifications That Are Best for Beginners

Credentials aimed at boosting early-career professionals can equip digital trust professionals to successfully break into IT fields.

1 February 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Projecting Cybersecurity in 2023

2023 shapes up as another challenging - and interesting - year for security professionals

1 February 2023
Sai Mohan and Ranganath Lyengar
Blog Post

Data Protection in Enterprises

Data protection is maturing toward a more holistic approach, with emphasis on meaningful datasets to enterprises and regulations.

1 February 2023
HelpSource
ISACA Journal Article

Help Source Q&A

How can the effectiveness of security awareness programs be measured?

Author: Sunil Bakshi
Meghan Maneval
Risk Article

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

The beginning of a new year is the perfect time to reflect on the past year and assess any industry trends or upcoming events that could impact organizations.

31 January 2023
Charles Cresson Wood
Blog Post

Third Party Audit Reports as the New Trust Currency

The compliance audit process can give third parties confidence in an organization’s ability to manage and govern information security and privacy.

30 January 2023
Michael Kelly
Blog Post

Assessing the Risk of Emerging Technology: Will Early Assessments Match Reality?

Implementation of emerging technologies requires organizations to rethink their approaches to risk assessment.

26 January 2023
Entering a New World of Digital Trust
@ISACA Article

Entering a New World of Digital Trust

A new conference series from ISACA will bring digital trust professionals together in 2023 in the US, Europe and virtually.

25 January 2023
The Intersection of Trust and Employee Productivity
@ISACA Article

The Intersection of Trust and Employee Productivity

New research from Cerby suggests that by adopting zero trust principles and trust-positive initiatives, organizations can build digital trust with employees and consumers.

25 January 2023
Ron Lear
Blog Post

CMMI Performance Continues to Impress, Improve

The CMMI Performance Report captures encouraging insights in business capability and performance objectives.

25 January 2023
Blockchain Smart Contracts, Part 3
ISACA Journal Article

Blockchain Smart Contracts, Part 3: Deployment and Integration With Existing Information Technology Systems

It can be challenging to integrate blockchain smart contracts with existing (legacy) IT systems.

Authors: Samuel Smith and Andy Garcia
Neha Sharma
Blog Post

Categorizing and Handling Sensitive Data

Organizations need to be intentional and diligent about how they classify and handle both regulated and unregulated sensitive data.

24 January 2023
Patrick Barnett
Security Article

Common Misconceptions About Modern Ransomware

There are many misconceptions about ransomware attacks, often due to enterprises’ failure to adapt to changes in threat group tactics, techniques and procedures (TTPs).

24 January 2023
Wanbil W. Lee
Blog Post

Recognizing the Hidden Risk and Quantifying Ethical Analysis When Governing Data

Data bias is a hidden risk in data governance. It can creep in during data collection, storage and use, and via applications used by a human or in an AI algorithm created by a human.

23 January 2023
Komitas Stepanyan
Blog Post

Modern Complexities of Cybersecurity

Can an organization be 100% protected against cyberattacks? While trying to answer this question, former US FBI Director Robert Mueller’s words can be considered: “There are only two types of companies: those that have been hacked and those that will be.”

20 January 2023
Betsie Estes and Kevin Keh
Podcast

ISACA Live: Advancing Digital Trust Through IT

On National IT Professionals Day, ISACA's Kevin Keh explains how IT professionals can advance digital trust in their organizations and in their industries.

19 January 2023
Privacy in Practice 2023
@ISACA Article

New ISACA Report Spotlights Privacy Benefits, Challenges

A new ISACA privacy report highlights key challenges and opportunities for practitioners in 2023.

18 January 2023
Abdul Jaleel
Blog Post

ChatGPT and Leveraging Artificial Intelligence in Auditing

ChatGPT is the latest example of how artificial intelligence can make a substantial impact for IT audit professionals.

18 January 2023
Why Enterprises Need Trust Assurance
ISACA Journal Article

Why Enterprises Need Trust Assurance

To ensure that quality services and products are being delivered and to identify any partners who may be behaving unethically, enterprises need trust assurance.

Author: Vimal Mani
Safia Kazi and Dr. Patrick Offor
Podcast

Information Privacy Contradiction: Interest-Based Posture of Compliance and Violation?

Why do individuals, organizations, institutions, nations, or responsible agents work hard to preserve their personal and enterprise data, personnel information, trade secrets, intellectual properties...

18 January 2023
Noelle Pickler
Blog Post

ISACA Mentorship Program Galvanizing Connections

The ISACA Mentorship Program is leading to new connections and professional growth around the globe.

17 January 2023
Guy Pearce
Blog Post

Sizing Up the Global State of Privacy

ISACA's Privacy in Practice 2023 report showcases areas for improvement when it comes to executive support, skills and staffing in the privacy field.

17 January 2023
Antonio Rocha
Blog Post

Where Privacy Stands Five Years After GDPR

Five years after the GDPR regulation came onto the privacy scene, there is still much progress to make on the people, process and technology fronts for enterprises to be on sturdier ground.

17 January 2023
Sandra Kuyengwa
Audit Article

Key Considerations for Conducting Remote IT Audits

While remote auditing is nothing new, the COVID-19 pandemic and resulting need for social distancing fast-tracked the adoption of remote and hybrid audits.

17 January 2023
Hakan Kantas
Blog Post

How to Ensure Your IT Objectives Align with Organizational Goals

Aligning IT initiatives to overarching enterprise business goals is important and measurable.

12 January 2023
Deep Seshadri
@ISACA Article

How to Resource the CISO

The CISO position is challenging enough. It must be resourced properly to set up the CISO for success.

11 January 2023
Jack Freund
@ISACA Article

Learning From Other People’s Mistakes

Sharing information about what is working and what is not working can be an overlooked ingredient for success for risk management professionals.

11 January 2023
Five Reasons to Make 2023 the Year to Pursue a Certification
Blog Post

Five Reasons to Make 2023 the Year to Pursue a Certification

Validation of knowledge and keeping pace with the fast-moving technology landscape are among the leading motivations to pursue an IT certification in 2023.

11 January 2023
Mitigating Technical Vulnerabilities With Risk Assessment
ISACA Journal Article

Mitigating Technical Vulnerabilities With Risk Assessment

A risk assessment can prioritize which technical vulnerabilities are most critical, allowing an enterprise to allocate the appropriate resources to fix or patch these vulnerabilities in a timely manner.

Author: Tan Soon Chew
Billy Anglin
Blog Post

Ransomware Looms Large on Third-Party Risk Landscape

Due diligence and sound risk management are essential to help enterprises prepare for ransomware and other threats involving third-party relationships.

10 January 2023
Justin Rende
Security Article

Eight Cybersecurity Trends to Watch for in 2023

As 2023 approaches, it is an opportune time for organizations of all sizes to examine their IT infrastructure and review their cybersecurity policies.

10 January 2023
Saravanan Gurumurthy
Blog Post

The Importance of Embedding a Culture of Privacy by Design

Organizations can gain a competitive advantage by taking deliberate measures to implement privacy by design.

9 January 2023
Gaelle Koanda
Blog Post

How I Survive Imposter Syndrome

Dealing with imposter syndrome can be even more challenging for those living and working in countries in which they are not native speakers.

6 January 2023
Guy Pearce
Blog Post

In Search of Great Data Candidates

Identifying the best candidates for data-focused roles can go a long way toward improving an organization's risk profile.

5 January 2023
Candidates Beware: Red Flags to Avoid when Preparing for and Taking an ISACA Exam
@ISACA Article

Candidates Beware: Red Flags to Avoid when Preparing for and Taking an ISACA Exam

Creating trust in the exam process and results is crucial for certification candidates to demonstrate their accomplishments.

4 January 2023
Ransomware Readiness Audit Program
@ISACA Article

ISACA Puts Forward Ransomware Audit Program | ISACA

ISACA’s ransomware audit program provides foundational information, practical guidance and approaches to preparing for and recovering from a ransomware-related incident.

4 January 2023
Caitlin McGraw
@ISACA Article

The Perennial New Year’s Question: Should I Stay or Should I Go?

The start of a new year for some professionals means time to think about whether they intend to stick with their current job or pursue a new opportunity.

4 January 2023
Jamal Elmella
Blog Post

How Cyber Pathways Can Help Your Career

The Cyber Pathways Framework could have a significant impact in resolving the ongoing skills crisis in the cybersecurity field.

4 January 2022
Understanding, Assessing, Aligning and Transforming Organizational Culture
ISACA Journal Article

Understanding, Assessing, Aligning and Transforming Organizational Culture

Culture is crucial for nearly every enterprise; a strong culture can lead to a successful organization and a lack of culture can cause an organization to be unsuccessful.

Author: Mark Tarallo
Jonathan Tomek
Security Article

What Is Your IP Address Cybersecurity IQ?

Now more than ever, security professionals need a thorough understanding of the IP addresses that seek to access their networks.

3 January 2023
Lisa Villanueva and Guy Pearce
Podcast

Beware the Traps of Data Governance and Data Management Practice

Guy Pearce joins ISACA’s Lisa Villanueva for a conversation about the traps of Data Governance and management.

3 January 2023
Robin Lyons and Mike Tomaselli
Podcast

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Numerous laws and regulations have been passed to protect sensitive information, both at the federal and state level, creating a patchwork of requirements for companies to comply with.

3 January 2023
Rinki Sethi
ISACA Journal Article

Guest Editorial: Dear Readers

As a long-time member, I am excited to see ISACA commit to digital trust to help organizations and individuals build and benefit from a safer and more secure digital world.

Author: Rinki Sethi
Information Security Matters: Advertising Information Security
ISACA Journal Article

Information Security Matters: Advertising Information Security

I am concerned that people at large will come to believe that information security can be achieved simply by buying it. Yes, tools are important, but the program that chooses and uses those tools is paramount.

Author: Steven Ross
IS Audit in Practice: Building Digital Trust Through Advocacy
ISACA Journal Article

IS Audit in Practice: Building Digital Trust Through Advocacy

Growing skills through formal programs in hopes of increasing the talent pool of qualified professionals would institutionalize consistent learning for the profession and assist in standard and repeatable digital trust attributes.

Author: Cindy Baxter
The Bleeding Edge: Infrastructure as Code—Digital Trust Enabler?
ISACA Journal Article

The Bleeding Edge: Infrastructure as Code—Digital Trust Enabler?

In situations where there is new technology in the offing, it is incumbent upon the practitioner to both objectively analyze that risk and also evaluate that technology for its potential in reduction of risk and to help enable trust.

Author: Ed Moyle
The Digital Trust Imperative: Defining, Establishing and Measuring Digital Trust
ISACA Journal Article

The Digital Trust Imperative: Defining, Establishing and Measuring Digital Trust

Given that digital trust is an abstract concept, we do need to define it as clearly as possible. We also need some means of determining how trustworthy an organization is in the digital ecosystem.

Author: K. Brian Kelley
Reality Check: The Use of Big Data and Predictive Data Models
ISACA Journal Article

Reality Check: The Use of Big Data and Predictive Data Models

The power, precision and affordability of predictive models are increasing based on the increasing volume and availability of data in general and the computing power of the cloud.

Author: Kevin Alvero
Toward Rebuilding Data Trust
ISACA Journal Article

Toward Rebuilding Data Trust

Poor data management in general, and poor data quality in particular, can have negative impacts on data trust and, thus, on digital trust.

Author: Guy Pearce
How to Digitally Verify Human Identity: The Case of Voting
ISACA Journal Article

How to Digitally Verify Human Identity: The Case of Voting

The excess of information used for identification is contrasted with the need to respect the fundamental rights and freedoms of people’s privacy and in particular their right to protect their personal data.

Author: Luigi Sbriz
Extending Zero Trust to the End User Ecosystem
ISACA Journal Article

Extending Zero Trust to the End User Ecosystem

There are significant gaps in current approaches to achieving digital trust, and to address these gaps, organizations need to expand security perimeters to fit into a digital trust framework.

Author: Gideon Hazam
Looking Inside the Magical Black Box
ISACA Journal Article

Looking Inside the Magical Black Box: A Systems Theory Guide to Managing AI

With the widespread use of AI, this technology affects most of humanity; therefore, it may be time to take a systemwide view to ensure that this technology can be used to make ethical, unbiased decisions.

Authors: Simona Aich and Gerald Burch
Case Study: Performing a Cybersecurity Audit of an Electric Power Transmission Systems Operator
ISACA Journal Article

Case Study: Performing a Cybersecurity Audit of an Electric Power Transmission Systems Operator

Most countries in the world consider electricity transmission and distribution infrastructure and services fundamental parts of their critical infrastructures. 

Authors: Bostjan Delak and Miroslav Kranjc
Business and Technology Drivers for Decentralized Cloud Systems
ISACA Journal Article

Business and Technology Drivers for Decentralized Cloud Systems

Decentralized cloud systems offer a remedy for lack of data ownership and control, data breaches and security risk, increasing storage costs and low transmission speed.

Author: Robert Putrus
Ravikumar Ramachandran
Blog Post

The New, Emergent CISO

The CISOs of the future will have to combine a wide range of technical and business skills to rise to the many challenges they will face.

30 December 2022
David Adams
Blog Post

The Main Challenges of Effective Risk Management

Risk management can be a tremendous asset for organizations when the right processes and methodologies are applied to overcome key challenges.

28 December 2022
Are IT General Controls Outdated?
ISACA Journal Article

Are IT General Controls Outdated?

When testing IT general controls, additional controls related to security assessments, data asset protection, secure data transit, endpoint protection, vulnerability monitoring, security monitoring and secure disposal should be considered for the relevant application, database, operating system and network components in the IT environment.

Author: Jouke Albeda
Information Security
Blog Post

Addressing Selective Compatibility

Today's methods of authentication are likely to become less reliable going forward, making selective compatibility all the more relevant.

22 December 2022
Chris McGowan and Cindy Baxter
Podcast

Do Data Go To Waste

The Impact of SOX on the Industry 20 Years Ago and Today. Opponents of Sarbanes Oxley, (SOX) contend the law is too costly for companies to operationalize given the small benefit that SOX regulation provide.

22 December 2022
Facial Recognition Technology and Privacy Concerns
@ISACA Article

Cybersecurity: What is Changing and What Isn’t

ISACA member Sourya Biswas shares his perspective on how the cybersecurity and risk professions are evolving, the role security can play in advancing digital trust and what challenges the future will present.

21 December 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Facial Recognition Technology and Privacy Concerns

Privacy and security risks need to be addressed as facial recognition technology becomes more prevalent and usages for the technology expand.

21 December 2022
Raef Meeuwisse
Blog Post

Top Cyberattacks of 2022: Lessons Learned

Major 2022 data breaches involving Optus, Uber and Neopets led to many lessons learned for security practitioners and business leaders.

21 December 2022
When Data Protection Is a Hindrance Rather Than a Facilitator
ISACA Journal Article

When Data Protection Is a Hindrance Rather Than a Facilitator

Data protection has become a catch-all excuse for poor service—a problem that can only be solved with a mixture of transparency (both governmental and organizational) and regulatory initiatives.

Author: Rupert Brown
Frans Geldenhuys and Gustav Silvo
Audit Article

Seven Things to Know Before Automating IT General Control Audits

There are 7 major takeaways from an audit automation process.

20 December 2022
Ravikumar Ramachandran
Blog Post

The Future of Skills: Preparing for Industry 4.0 and Beyond

Industry 4.0 brings great potential to transform the IT professional landscape.

16 December 2022
Julie Ebersbach and Michael Powers, Ph.D., CRISC
Blog Post

Quantifying the Qualitative Risk Assessment: Using Data to Inform Judgment

The technology field is ripe for quantification support for qualitative judgments.

15 December 2022
50 Years and an Impactful Future for the ISACA Journal
@ISACA Article

50 Years and an Impactful Future for the ISACA Journal

The ISACA Journal is wrapping up its 50th anniversary year while remaining committed to providing key guidance for the ISACA community in the future.

14 December 2022
Sunil Bakshi
@ISACA Article

Addressing Professional Ethical Dilemmas

Stakeholders prefer to do business with reputable enterprises that conduct themselves ethically, meaning digital trust professionals must keep ethical considerations top-of-mind as they conduct their work.

14 December 2022
How Digital Trust Professionals Can Thrive in a Challenging 2023
@ISACA Article

How Digital Trust Professionals Can Thrive in a Challenging 2023

2023 shapes up as a challenging year for digital trust professionals, who can face a dynamic and fast-changing set of circumstances in fields such as IT audit, risk management, privacy and cybersecurity.

14 December 2022
Sean Renshaw
Blog Post

All systems are GO!

Enterprises need to shift their mindset from 'cyber incident' to 'crisis management,' especially in an era when ransomware and other threats are present dangers.

14 December 2022
The Information Privacy Contradiction
ISACA Journal Article

The Information Privacy Contradiction

Information privacy policies, regulations and enforcement mechanisms would better serve society if information privacy realities contradiction considerations were integral to policy formulation and legislative enactment from the onset.

Author: Patrick I. Offor
Rex Johnson and Hamlet Khodaverdian
Security Article

Improving Cyberresilience in an Age of Continuous Attacks

It is now more important than ever to constantly develop and mature cybersecurity readiness. A holistic and integrated approach with the right tools can provide a better chance of surviving a cyberattack.

13 December 2022
Safia Kazi and Christina Luttrell
Podcast

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation, and a looming recession, it is clear that the world has entered a new era of risk.

13 December 2022
Information Security
Blog Post

Talent Transformation Strategies for Security Leaders to Address the Cybersecurity Workforce Challenges

Investing in a strong security culture and adopting a growth mindset are among the approaches that can help organizations transform their strategy for dealing with cybersecurity talent shortages.

12 December 2022
Kerris Lee
Blog Post

Five Actionable Success Tips for Risk Professionals in 2023

What organizational risks should risk management professionals be sure to keep in mind as we head toward 2023? Kerris Lee provides tips for the new year for risk practitioners.

8 December 2022
ISACA Fielding 2023-24 ISACA Board of Directors Nominations
@ISACA Article

ISACA Fielding 2023-24 ISACA Board of Directors Nominations

ISACA is seeking new directors for upcoming board term.

7 December 2022
Rahul Pandey
@ISACA Article

The Unheard Story of Lost Anonymity

If there are so many benefits of removing anonymity from the internet, then why not do so? The answer to this question is directly related to the meaning of the internet itself.

7 December 2022
Lisa Mckee
Blog Post

Five Actionable Success Tips for Privacy Professionals in 2023

More and more organizations are realizing that privacy programs must be appropriately prioritized and resourced, a reality that will only become more striking in 2023.

7 December 2022
Using FLOSS to Implement COBIT for I&T Governance
ISACA Journal Article

Using FLOSS to Implement COBIT for I&T Governance

Free/libre open source software (FLOSS) can be used to achieve greater freedom along with vendor independence and financial benefits in enterprise software portfolios.

Authors: Laura Jaime and João Barata
Samantha Hart
Blog Post

Five Actionable Success Tips for Security Professionals in 2023

Creating a personal incident response plan is a good place to start when security professionals consider how they can thrive in 2023.

6 December 2022
Jai Sisodia
Audit Article

AI Ethics and the Role of IT Auditors

It is critical that ethics be given careful consideration when designing, operating and auditing AI systems.

6 December 2022
Varun Prasad
Blog Post

Five Actionable Success Tips for Audit Professionals in 2023

Looking toward 2023, IT audit professionals will need to increasingly focus on cloud environments and privacy engineering to keep pace with the changing technology and regulatory environment.

5 December 2022
Paul Thompson
Blog Post

Dialing in the Data

Building cyber resilience can be an uphill battle for many organizations given the proliferation of data and the fast-evolving threat landscape.

2 December 2022
Adobe logo
Podcast

Meeting Attackers Where They Are

The world's largest software companies leverage modern-day Red Teams to protect against real-world attacks. Many companies focus on vulnerability management, compliance, and patching to secure themselves, but this is only a tiny part of the big picture.

2 December 2022
Information Security
Blog Post

Achieving Resilience at ASEAN-Japan’s Cybersecurity Capacity Building Centre

Much can be learned from the way the ASEAN-Japan’s Cybersecurity Capacity Building Centre deployed several procedures to reduce the COVID-19 pandemic’s effects on operations.

1 December 2022
Preventing Privacy by Design from Becoming a Privilege
@ISACA Article

Preventing Privacy by Design from Becoming a Privilege

Privacy risks are on the rise due to the proliferation of data, putting greater emphasis on privacy by design.

30 November 2022
Robin Lyons
Blog Post

Identity and Access Management: The Nonhuman View

As digital transformation sweeps across organizations, the technologies that are the foundation of that transformation need access.

30 November 2022
Establishing Enterprise Roles for Data Protection
ISACA Journal Article

Establishing Enterprise Roles for Data Protection

There are clear challenges associated with how specific types of data need to be safeguarded, stored and shared on a need-to-know basis, and data governance mechanisms provide guidelines for these practices.

Authors: Sai Krishnan Mohan and Ranganath Iyengar
Information Security
Blog Post

Which Cybersecurity Roles Pay the Best?

Cybersecurity talent remains highly in-demand, leading to several roles that command high salaries.

29 November 2022
Patrick Barnett
Security Article

How Cyberprofessionals and Threat Actors Have Changed Over the Decades

As threat actors get bolder and more creative, cybersecurity professionals must attempt to stay 1 step ahead.

29 November 2022
Brian Fletcher and Tim Liu
Podcast

Taking Security Strategy to the Next Level: The Cyber Kill Chain vs. MITRE ATT&CK

In an era of rampant ransomware and other malicious cyberattacks, it’s mandatory to double down on cybersecurity analysis and strategy to ensure an optimal security posture and the protection of critical assets and data.

29 November 2022
Ashief Ahmed
Blog Post

Five Mistakes to Avoid When Preparing for a Certification Exam

Avoiding some common mistakes can make for a more successful certification exam experience.

28 November 2022
John P. Pironti
@ISACA Article

Five Key Components of an Application Security Program

An effective application security program can significantly reduce the presence of new vulnerabilities, which, in turn, enhances application security.

23 November 2022
The Board’s Role in Advancing Digital Trust
@ISACA Article

The Board’s Role in Advancing Digital Trust

Board role in digital trust article: Digital trust is a topic that requires ongoing tone-setting, backing and direction from the board of directors.

23 November 2022
Cliff Huntington
Blog Post

What Do the ISO 27001 Updates Mean for Your Business?

"After nine years of certifications, ISO has released an updated version for one of the most popular frameworks in the cybersecurity environment."

23 November 2022
Adding a New KPI to Determine Whether Directors and Officers Have Met Their Legal Duties
ISACA Journal Article

Adding a New KPI to Determine Whether Directors and Officers Have Met Their Legal Duties

Information security and privacy teams need an easy-to-adopt, readily deployed, inexpensive and fully scripted compliance audit process to arrive at a new key performance indicator.

Author: Charles Cresson Wood
Guy Pearce
Blog Post

Digital Native Organizations Are Energizing Organizational Design

Digital native organizations are ahead of the curve when it comes to enabling digital transformation and modernization.

22 November 2022
Patrick Barnett
Risk Article

How to Use Cyberthreat Intelligence to Proactively Reduce Cyberrisk

The ability to proactively learn about the tactics and capabilities of an attacker provides an excellent opportunity to prevent the attacker from entering the fort or doing any damage to the fort’s walls.

22 November 2022
Robin Lyons and Steve Jackson
Podcast

Auditee Buy-In—A Key Component of Effective Audits

As you plan and execute your audit, do you take time to invest in the stakeholder relationship? This can be an often-overlooked element but essential in an effective audit.

23 November 2022
Dr. Blake Curtis, Sc.D, CISA, CRISC, CISM, CGEIT, CDPSE, COBIT
Blog Post

5G Privacy Implications

Enterprises must consider the risk of 5G adoption on the front end and be proactive about working through potential privacy and security implications.

21 November 2022
Ravikumar Ramachandran
Blog Post

How Knowledge Workers Can Convince Employers to Sponsor IT Certifications and Professional Growth

Employers can support their employees' professional development by sponsoring their professional certifications and providing ongoing training resources.

18 November 2022
5G Privacy: Addressing Risk and Threats
@ISACA Article

ISACA White Paper Highlights 5G Privacy Landscape

Privacy threats related to 5G must be addressed to ensure the technology's transformative potential is not counterbalanced by unintended problems.

16 November 2022
Tom Schneider
Blog Post

Applying Enterprise Risk Management to Cyberrisk

The rise of ransomware has increased the stakes for enterprise risk management and cyber risk.

16 November 2022
Benefits and Challenges of Implementing Cross-System SoD Monitoring Using SAP GRC
ISACA Journal Article

Benefits and Challenges of Implementing Cross-System SoD Monitoring Using SAP GRC

Cross-system user-level segregation of duties risk analysis between SAP and non-SAP systems provides insight into the access risk that prevails in the user base and helps remediate it through appropriate mitigation controls or the removal of conflicting access.

Author: Snedhal D. Pandya
How to Mature Your Privacy Compliance Program
Blog Post

‘Putting Out Fires’ and Maturing Your Privacy Compliance Program

As privacy regulations continue to take effect, enterprises must mature their privacy compliance programs.

15 November 2022
Deepa Seshadri
Security Article

What Makes a Good Cybersecurity Professional?

A shift into a cyber career can be part of an impactful journey into helping protect the world around us.

15 November 2022
Sushma Uniyal
Blog Post

Audit Essentials for Driving Efficiency and Value

Each audit has a lifecycle, from planning to execution to conclusion, and each phase in the audit lifecycle requires multiple steps to be executed effectively.

14 November 2022
What is the Connection Between IT Certifications and Salaries?
@ISACA Article

What is the Connection Between IT Certifications and Salaries?

IT certifications can help digital trust professionals qualify for a job with a higher salary across IT audit, cybersecurity, risk management, data privacy and related fields.

9 November 2022
Tim Liu
Blog Post

The Impact of a Hybrid Workplace on Security

Although the shift to the hybrid workplace has been a sea change for IT and security teams, new advances in security concepts and solutions hold the potential to smooth out the transition.

9 November 2022
Optimum Security Cognizance Through People, Process and Behavior Transformation
ISACA Journal Article

Optimum Security Cognizance Through People, Process and Behavior Transformation

The importance of cybersecurity in enterprise ecosystems is constantly being communicated to the workforce to create awareness, which helps enterprises reduce their attack surfaces.

Author: Vimal Mani
Tony Anscombe and Collin Beder
Podcast

Breaking Down the ESET T2 2022 Threat Report

In this ISACA Podcast episode, ESET’s Chief Security Evangelist, Tony Anscombe, joins ISACA’s Principal, Emerging Technology Professional Practices, Collin Beder to discuss ESET’s recently released T2 2022 Threat Report.

9 November 2022
Caitlin McGraw
@ISACA Article

Generosity: Good as Gold, in Your Life and Career

Being generous with your time and talent can lay the foundation for a successful and rewarding career.

7 December 2022
Shini Menon
Blog Post

Solving Security and Privacy Concerns in Emerging Technology

Personal data are more exposed than ever in the evolving emerging technology landscape but are often insufficiently protected from being stolen.

7 November 2022
Mark Thomas
Blog Post

Seven Key Steps to Build Digital Trust

The path to stronger digital trust includes key steps such as understanding customer expectations and going beyond checking boxes.

4 November 2022
Safia Kazi and Mary Carmichael
Podcast

Enabling Digital Trust through Canada's Digital Charter

Data are the lifelines of a digital economy. They drive innovation, enabling cutting-edge research and next-generation technologies, including artificial intelligence (AI)...

4 November 2022
Information Security
Blog Post

Five Quick Tips for Taking ISACA Certification Exams

ISACA certification-holders share their tips and guidance for success on ISACA certification exams.

3 November 2022
Jack Freund
@ISACA Article

Building (or Improving) a Risk Assessment Program

There are essential considerations with which a risk assessment program must be designed to help an enterprise achieve its security posture goals.

2 November 2022
Using Risk Tolerance to Support Enterprise Strategy
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

A new white paper from ISACA provides guidance on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

2 November 2022
Caitlin McGraw
@ISACA Article

Plan to Make 2023 Your Best Career Year Yet

Now is the time to begin planning in earnest for career success in 2023.

2 November 2022
Osama Abbas
Blog Post

A Pilot’s Lofty Goal of Building Trust Through Audit

ISACA member Osama Abbas is a champion for digital trust in his role as head of audit while finding time for his aviation passion in his free time.

2 November 2022
Rowdha Mohammed
Security Article

Cybersecurity Strategies to Enable Digital Trust

Cybersecurity is an enabler of digital trust and a key success factor of the digital transformation journey.

2 November 2022
Trustworthy Tactics for Unlocking the Value of Genetic Data
ISACA Journal Article

Trustworthy Tactics for Unlocking the Value of Genetic Data

An enterprise that manages a large amount of sensitive information is subject to a complex patchwork of laws and regulations, including privacy regulations, laboratory regulations, human subject protection requirements and ethical considerations.

Author: Mick Brady
Collin Beder and Steven Ross
Podcast

It's About (Down) Time

In this ISACA Podcast episode, Risk Masters International's Steven Ross tells ISACA's Collin Beder that organizations should start focusing on hours of unavailable systems and data when measuring the cost of a cyber-attack.

2 November 2022
Veronica Rose
Blog Post

Keep Your Dream of Becoming a CISA Alive

Candidates who struggle on their first try to pass the CISA certification exam can still reach their goal with perseverance and some tweaks to their preparation.

1 November 2022
Bassel Kablawi
Privacy Article

Preparing Organizations for Saudi Arabia’s New Data Protection Law

Technologies are constantly evolving, more devices are being connected to the worldwide network, data are becoming more important than ever, and countries are taking data privacy more seriously, putting data into consideration in jurisdiction strategies.

1 November 2022
DAVID SAMUELSON
ISACA Journal Article

Letter From the CEO

As the ISACA Journal concludes its 50th anniversary year, it is a great time to both reflect on the past and get excited about the future...

Author: David Samuelson
Information Security Matters: Convergence: Where Next?
ISACA Journal Article

Information Security Matters: Convergence—Where Next?

Does this convergence of specialties enhance or vitiate the effectiveness of each of them individually? The answer depends on whether IT control is a zero-sum...

Author: Steven J. Ross
IS Audit in Practice: Do Data Go to Waste?
ISACA Journal Article

IS Audit in Practice: Do Data Go to Waste?

Data management is built on accuracy and relevance, and both characteristics are the mainstay of an IS auditor’s inspection criteria.

Author: Cindy Baxter
Innovation Governance: Balancing Innovation With Data Protection
ISACA Journal Article

Innovation Governance: Balancing Innovation With Data Protection

Innovation does not give license to bypass the usual questions that are asked when we have more time. It requires us to answer or evaluate them more quickly.

Author: K. Brian Kelley
Essential Assumptions for Effective Data Security
ISACA Journal Article

Essential Assumptions for Effective Data Security

For data security efforts to be effective, it is critical that people in all areas and levels of the enterprise operate under five key data security-related assumptions.

Authors: Kevin Alvero and Brian Alvero
Scaling the Future of Collecting Internal Audit Interview Evidence
ISACA Journal Article

Scaling the Future of Collecting Internal Audit Interview Evidence

New technology offers the potential to cost effectively collect large interview data sets using an automated auditing interview process with virtual interviewers.

Authors: Matthew D. Pickard and David A. Wood
Beware the Traps of Data Governance and Data Management Practice
ISACA Journal Article

Beware the Traps of Data Governance and Data Management Practice

Data-driven decision-making can never entirely be about making decisions based on hard data as opposed to intuition, observation or guesswork because most data are never in a perfect state...

Author: Guy Pearce
The Future of Privacy: Insights From the EU Digital COVID Certificate
ISACA Journal Article

The Future of Privacy: Insights From the EU Digital COVID Certificate

The development of the EU Digital COVID Certificate (EUDCC) offers some insights into what the future may hold for managing individual privacy while supporting the effective use of information.

Authors: Till Mueller and Gerald F. Burch
To Stay Relevant, InfoSec Must Strengthen Its Business Partnerships
ISACA Journal Article

Sponsored: To Stay Relevant, InfoSec Must Strengthen Its Business Partnerships

To effectively manage digital risk, InfoSec professionals and business leaders must work in tandem to increase their mutual risk understanding and mitigation efforts.

Author: John Wheeler
An Ethics-Based Algorithm for Governing Data
ISACA Journal Article

An Ethics-Based Algorithm for Governing Data Ethics

Data quality is a crucial issue to data protection, and data bias is a hidden nuance to protecting that quality—data governance is needed.

Author: Wanbil W. Lee
Case Study: Driving Digital Transformation Through COBIT
ISACA Journal Article

Case Study: Driving Digital Transformation Through COBIT

Based on a foundation of COBIT, CBN has achieved synergy across the organization as it relates to IT projects and their place in enterprise risk and strategy as a direct result of improvements and...

Author: Katie Teitler
Performing Risk Assessments of Emerging Technologies
ISACA Journal Article

Performing Risk Assessments of Emerging Technologies

Emerging technologies represent a major source of risk, and their complexities make those risk areas especially difficult to assess.

Authors: Michael Kelly and Adeline Chan
Larry Alton
Blog Post

How to Safely Share Your Business’s Online Videos

Finding the right balance between security and convenience is key for businesses when it comes to sharing their videos online.

28 October 2022
Mike Tomaselli
Blog Post

Finding or Building the Right Framework for Your Organization

Organizations face a challenge in understanding which framework will deliver the most value in an era of increased regulatory and business challenges.

27 October 2022
Kevin Keh and Allen Dziwa
Podcast

How Social Engineering Bypasses Technical Controls

We are subjected to phishing scams almost daily, and even the most seasoned professional must examine an email to ensure the links included are safe.

27 October 2022
Jon Brandt and Naomi Buckwalter
Podcast

ISACA CyberPros – Naomi Buckwalter

Executive Director of Cybersecurity Gatebreakers Foundation, Naomi Buckwalter, joins ISACA’s Jon Brandt to discuss burnout.

27 October 2022
Podcast
Podcast

What Makes Risk Assessments So Unpleasant and How to Change That

Ryan Cloutier's child came home from school one day and told him that he had figured out the staff Wi-Fi password. Frustrated that the security wasn't better for a school network, Ryan decided to do something about it.

27 October 2022
Anna Johannson
@ISACA Article

Top Three Mistakes IT Security Teams Still Make

Common mistakes that limit security teams' effectiveness include piecemeal patch management, a lack of incident response plans and insufficient monitoring.

26 October 2022
Jack Freund
Blog Post

Cyber Ratings as Measures of Digital Trust

As the profession of cybersecurity continues to mature, it inevitably will borrow from other disciplines that have developed mature practices. The credit rating profession has much to offer cybersecurity as it attempts to support the overarching need for the creation of digital trust.

26 October 2022
Graciela Braga
Governance Article

How Responsible for IT Governance Is the BoD?

With a fresh look at the importance of the role of the BoD and other stakeholders in IT governance, it is time for boards to take advantage of the opportunity offered by IT governance to create value in their organizations.

26 October 2022
The Changing Information Systems Landscape Creates New IT Risk
ISACA Journal Article

The Changing Information Systems Landscape Creates New IT Risk

Audit needs to evolve to address the technological advances and changes in the information systems landscape.

Author: Sriram Balalsubramanian
Audit and Assurance
Blog Post

Smarter Testing Equals Safer Digital Experiences

Tighter alignment of testing with the software development lifecycle and better modeling of real-world adversary threats has allowed Adobe to become more DevSecOps-minded in its application security testing.

25 October 2022
Mary Carmichael
Blog Post

Risk Appetite vs. Risk Tolerance: What is the Difference?

By demystifying the risk appetite and risk tolerance terms, it is easier to explain and integrate these concepts within enterprise risk management frameworks.

4 October 2022
Eszter Diána Oroszi
Risk Article

Taking a Risk-Based Approach to Pen Testing

The results of penetration (pen) tests are also worth examining using a risk-based approach.

24 October 2022
Luma Badran
Blog Post

How Risk Transformation Enables Enterprise Success

Risk expert Luma Badran recently led an ISACA Engage community discussion of topics including risk transformation, best practices for the three lines of defense, internal audit, operational risk management and cybersecurity insurance.

21 October 2022
Menny Barzilay
Blog Post

‘Privacy Is Not Dead, But It Is Dying’

Menny Barzilay will be a keynote speaker for ISACA Conference Asia 2022, to take place virtually 16-17 November, presenting on “The Dark Future of Privacy.” Barzilay, an internationally recognized cybersecurity expert and CTO of the Interdisciplinary Cyber Research Center at Tel-Aviv University, recently visited with ISACA Now to discuss privacy mining, deep fakes, digital trust and more.

20 October 2022
Sri Mallur
Security Article

How to Create an Enterprise OT Cybersecurity Program

As the importance of cybersecurity grows in the public eye, many organizations are considering leveling up their security postures with operational technology (OT) cybersecurity programs.

20 October 2022
Veronica Rose
@ISACA Article

A Proactive Plan to Shore Up the IS Audit Talent and Skills Gap Early

Effectively addressing the skills gap among IT auditors will require new approaches on the part of HR teams, hiring managers and across the organization.

19 October 2022
Sunil Bakshi
@ISACA Article

How Important Is Source Code Escrow?

When escrow is required, organizations should ensure that system documentation and source code are comprehensively covered.

19 October 2022
Top Five Reasons to Upskill Your Team Together
@ISACA Article

Top Five Reasons to Upskill Your Team Together

Across the digital trust professions, organizations can upskill their teams, improve retention and demonstrate to employees that they value their professional development by participating in enterprise training programs.

19 October 2022
Exploring the Relationship Between IT Certifications and Salaries
Blog Post

Exploring the Relationship Between IT Certifications and Salaries

Certifications can have a big impact on IT professionals' salaries and career advancement opportunities.

19 October 2022
5G Innovations and Cybersecurity Risk
ISACA Journal Article

5G Innovations and Cybersecurity Risk

It is critical for practitioners to understand 5G’s risk factors such as unique identifiers, software-defined networking (SDN) vulnerabilities, and interoperability’s impact on strong access control.

Author: Blake Curtis
Tulika Ghosh
Blog Post

Cloud Governance and Security Imperatives

Organizations that can strike a balance between their strategic objectives and security needs will be well equipped for success in their cloud implementations.

18 October 2022
Jeff Champion, Julie Ebersbach and Mike Powers
Podcast

Quantifying the Qualitative Risk Assessment

In this ISACA podcast episode, IT Risk Director and Senior Vice President Mike Powers and IT Segment Risk Manager Julie Ebersbach discuss using the qualitative risk assessment as part of an organization's enterprise risk framework, focusing on using data to inform subjective judgments.

18 October 2022
Michael Argast
Blog Post

The Cybersecurity Skills Gap: Dispelling Misconceptions

The workforce challenge organizations often perceive as a cybersecurity skills gap is more accurately a failure to take advantage of the people and resources that should be better utilized.

17 October 2022
Mark Thomas
Blog Post

What is the ROI from Enterprise Training?

The return on investment from enterprise training extends well beyond the financial to areas such as mitigating risk and helping organizations become more agile and resilient.

14 October 2022
Kathleen Martin
Risk Article

Higher Education, the Pandemic and the Need to Strengthen the Risk Framework

There is a need for oversight and controls to be revisited in certain higher education institutions.

13 October 2022
Adobe logo
Podcast

Gaining More Actionable Intelligence Using a Smarter Security Data Lake

In today’s dynamic world of distributed computing and cloud-scale systems, traditional security data platforms and tools such as SIEM typically fall short of actually delivering the intelligence needed to better adapt to the rapidly changing threat landscape.

13 October 2022
Using Risk Tolerance to Support Enterprise Strategy
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

New guidance from ISACA provides context on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

12 October 2022
Caitlin McGraw
@ISACA Article

Mentor Magic: How To Make Mentorship Work for Your Career

Mentorship can play a valuable role in advancing digital trust professionals' careers, but being mentored effectively is not as simple as just showing up to have coffee.

12 October 2022
Shifting the Paradigm for Women in Tech
@ISACA Article

Shifting the Paradigm for Women in Tech

ISACA member Esanju Maseka recently attended a Women in STEM conference organized by the Zambia National STEM Foundation. Maseka visited with the @ISACA newsletter to recap what she learned and provide her perspective on efforts to address the gender disparity in the tech workforce.

12 October 2022
David Shavgulidze
Blog Post

A COBIT 2019 Use Case: Financial Institutions in Georgia

The COBIT framework has some key applications in the financial sector as demonstrated by a recent use case in Georgia.

12 October 2022
Michael Williams and Babur Kohy
Privacy Article

Detecting Insider Threat Behaviors Using Social Media Platforms

It is important for IT professionals to understand the availability of social media data and methods that can be used to identify possible insider threats using machine learning and the privacy and policy implications pertaining to it.

12 October 2022
A Step-by-Step SoD Implementation Guide
ISACA Journal Article

A Step-by-Step SoD Implementation Guide

Segregation of duties is central to achieving compliance with laws and regulations and assuring shareholders that proper governance is applied, and it is included as an activity in COBIT.

Author: Stefano Ferroni
Information Security
Blog Post

How to Transition from General IT to Cybersecurity

For IT professionals looking to transition to a cybersecurity career, there are several promising pathways to position themselves for success in cybersecurity.

11 October 2022
Vikram Venkateswaran
Security Article

Cybersecurity Is a Top Priority for Pharmaceutical Organizations

The pharmaceutical industry is taking critical measures to enhance its cybersecurity posture.

11 October 2022
Hollee Mangrum-Willis and Ali Pabrai
Podcast

Industry Spotlight with Ali Pabrai

There is no denying the passion that ecfirst's CEO, Ali Pabrai has for cybersecurity. In this ISACA Podcast, Ali tells ISACA's Hollee Mangrum-Willis that after all his years in the industry, he is still more excited than a two-year-old at the entrance to Disneyland.

11 October 2022
Blaise Woo
Blog Post

Securing Patient Data Is Paramount in the Post-Pandemic Era

Securing patient data and complying with HIPAA laws may seem like a challenge, but there are several steps your organization can take to combat a cyber incident.

10 October 2022
Joao Souza Neto
Governance Article

How to Conclude Governance System Design

The dynamics of the external and internal effects on organizations demand a flexible and customized governance system adapted to the specific needs of the organization.

10 October 2022
Joseph Cheng
Blog Post

The Social and Psychological Consequences of Ransomware Attacks

Organizations focus on the financial loss and disruption to services caused by ransomware attacks, but there are significant social and psychological effects that are often overlooked.

7 October 2022
Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat
Audit Article

Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat

As a purposeful partnership with internal or external resources, co-sourcing simultaneously meets enterprise objectives and facilitates upskilling.

7 October 2022
Alonzo Longshore
Blog Post

How To Apply Process Mapping Synergy Gains for Business Continuity and Disaster Recovery

Process mapping from disaster recovery and business continuity planning can help improve enterprises' overall business resiliency.

6 October 2022
Robin Lyons and Cindy Baxter
Podcast

Audit in Practice - Auditing Culture

What’s The Risk LLC’s Cindy Baxter sits down with ISACA’s Robin Lyons to discuss auditing culture, which can be one of the most interesting areas to audit.

6 October 2022
Managing Cybersecurity Risk as Enterprise Risk
Podcast

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity incidents like ransomware can potentially bring operations to a standstill. Recent regulatory changes by the FTC and proposed changes by the SEC show that both agencies are drafting cybersecurity rules similar to ERM concepts.

6 October 2022
Audit and Assurance
@ISACA Article

Top ISACA Cybersecurity Content from 2022

October is Cybersecurity Month and a great time to catch up on some of the top cybersecurity content ISACA has produced so far in 2022.

5 October 2022
Rebecca Herold
Blog Post

Navigating Privacy and Compliance Post-Dobbs Ruling

A variety of healthcare, data privacy and security issues have emerged since the recent Dobbs ruling that have impacted and will continue to impact both businesses and individuals in the United States.

5 October 2022
Addressing the Complexities of Cybersecurity at Fintech Enterprises
ISACA Journal Article

Addressing the Complexities of Cybersecurity at Fintech Enterprises

Fintech organizations can become significant players impacting the entire financial system, and regulators cannot afford to let them fail.

Author: Komitas Stepanyan
Collin Beder and Ivy Munoko
Podcast

Implementing Artificial Intelligence: Capabilities and Risk

University of Florida's Ivy Munoko is passionate about AI and has plenty to share regarding implementation and usage, but ISACA's Collin Beder asks, "is it ethical"?

4 October 2022
Collin Beder and Relebohile Kobeli
Podcast

Incident Report & Continuous Control Monitoring

This episode of the ISACA Podcast is all about incident reporting. Lesotho Postbank's Relebohile Kobeli talks to ISACA's Collin Beder about mitigating risk, minimizing losses from events, and good communication.

4 October 2022
New ISACA Paper Enables Enterprises to Use Cyberrisk Quantification to Improve Approach to Cybersecurity Risk
Blog Post

The Impact of Cybersecurity on Consumer Behavior

New ISACA data on consumer attitudes about cybersecurity reveal there is much work to be done for enterprises to earn the trust of customers and stakeholders.

3 October 2022
Kim Pham
Blog Post

Five Major Auditing Challenges in Cloud Computing and How to Overcome Them

Top challenges for auditing the cloud start with identifying cloud usage and controlling and monitoring user access.

30 September 2022
David Samuelson
Blog Post

Advancing Digital Trust on Capitol Hill, in Parliament and Beyond

ISACA leaders recently have taken their digital trust message to government officials from the UK, Ireland and the United States.

29 September 2022
Paul Phillips and Lisa Young
Podcast

Industry Spotlight with Lisa Young

Netflix's Lisa Young started as a bank teller that learned tech by fixing and servicing ATMs, which transitioned to her joining the network ops field and leading her to...

29 September 2022
Jeff Costlow
@ISACA Article

Internet-Exposed Protocols Remain Easy Entry Point for Attackers

To help IT leaders assess their risk posture and attack surface visibility, new research has been conducted about network protocols that are exposed to the public internet.

28 September 2022
Angelina Kahn-Dubois
Blog Post

A CISA Top Scorer’s Tips to Feel Prepared for the CISA Certification Exam

Angelina Kahn-Dubois, the top Certified Information Systems Auditor (CISA) certification exam scorer for 2021, offers tips for success on the CISA exam.

28 September 2022
Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design - image of lock
ISACA Journal Article

Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design

Organizations should take the lead to follow the privacy by design approach by proactively embedding privacy into the design and operation of technology systems, infrastructure and business practices.

Author: Saravanan Gurumurthy
‘Piecemeal Approach’ Insufficient to Create Digital Trust
Blog Post

‘Piecemeal Approach’ Insufficient to Create Digital Trust

Matt Chiodi, chief trust officer at Cerby and a member of ISACA's Digital Trust Advisory Council, and Karen Heslop, ISACA's vice president of content development, provide their perspectives on ISACA's State of Digital Trust 2022 report.

27 September 2022
Podcast
Podcast

Defending Data Smartly

Some industry watchers estimate that by 2025 the collective data of humanity will reach 175 Zettabytes. ISACA's Jon Brandt invites Dr. Chase Cunningham (aka Dr. Zero Trust) to discuss how to defend the ever-growing amount data...

27 September 2022
Kevin Keh
Blog Post

The Importance of Organizational Resilience in an Age of Immense Change

Organizational resilience has become increasingly top-of-mind for enterprises in the era of The Great Resignation.

26 September 2022
audit and assurance
Blog Post

Audit Approaches for Enterprise Databases

Ensuring enterprises can achieve their business objectives without concerns about sensitive data security is a value-add proposition for internal audit departments looking to perpetuate their role as trusted advisors to executive management.

23 September 2022
Ivan Mans
Security Article

Addressing SAP Security Gaps

SAP requires high-level consideration, or critical elements of the business will be vulnerable to malicious cyberactors—with no apparent response.

22 September 2022
Safia Kazi
Privacy Article

Privacy Considerations During Mergers and Acquisitions

When news was announced that Amazon acquired iRobot, the enterprise that makes Roomba robot vacuums, many privacy advocates expressed concern.

22 September 2022
Podcast
Podcast

Ethical AI Shifting the Conversation Left

Many organizations prioritize goals such as gains and profits, which often require rich data sets, but fail to consider the eventual impact of their data handling methodologies on foundational social justice issues.

22 September 2022
Ed Moyle
@ISACA Article

The Three Lines of Defense as a Means to Foster, not Inhibit, Collaboration

To the extent that digital trust practitioners draw upon the three lines of defense as a support or discussion point, we need to be ready to explain it in a way that doesn’t make others feel like their role in the risk management equation is diminished.

21 September 2022
Addressing Intentional Threats picture of lock
ISACA Journal Article

Addressing Intentional Threats Using Risk Assessment

Cyberspace must be considered a hostile environment. Although it has enormous potential, threats are always present, even in the most protected virtual worlds or within home networks.

Author: Luigi Sbriz
State of Digital Trust 2022
Blog Post

Five Key Takeaways from ISACA’s State of Digital Trust 2022 Report

Key takeaways from ISACA's State of Digital Trust report show how organizations must prioritize, measure and collaborate to make strengthening digital trust a reality.

20 September 2022
Podcast
Podcast

Why (And How to) Dispose of Digital Data

Bassel takes us on a deep dive into digital data with ISACA's Safia Kazi on the five stages of data disposal in this ISACA podcast episode.

20 September 2022
governance
Blog Post

Giving Data Integrity Its Place on the Podium

Data integrity, one of the key technology risk factors identified in recent IT audit research conducted jointly by ISACA and Protiviti, is crucial to the decisions that enterprises make in the course of routine business.

19 September 2022
MDDAP
Blog Post

How MDDAP Improves Product Quality

By helping medical device manufacturers better understand and sharpen their capabilities, ISACA’s Medical Device Discovery Appraisal Program (MDDAP) is advancing device quality and patient outcomes by driving toward a culture of continuous improvement.

16 September 2022
David Samuelson
Blog Post

Digital Trust: The Key to Successful Transformation

Today’s digital economy is driven by innovation. The companies that are able to find new ways to serve their customers, often enabled by implementation of emerging technologies, are the ones best positioned to thrive.

15 September 2022
Richard Hollis
Security Article

The Circle of Failure: Why the Cybersecurity Industry Does Not Work

The cybersecurity industry has failed. The evidence is everywhere and overwhelming. Anyone who understands that the industry was founded on the fundamental objective of preventing IT systems from breaches and data theft can surely agree that it has failed. Those who do not agree are not paying attention.

15 September 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Johann Dettweiler, Part II

In part 2 of this ISACA podcast episode, we connect with TalaTek Director of Operations Johann Dettweiler to discuss his almost two decades of experience across multiple industry fields, his involvement in FEDRAMP compliance, and why the next generation should focus on adding certifications to their resumes.

15 September 2022
Yunique Demann
@ISACA Article

Digital Trust: The Convergence of Privacy and Security

ISACA's recent State of Digital Trust survey reinforces that privacy and security should complement each other to help organizations advance digital trust.

14 September 2022
Person working on a laptop
@ISACA Article

ISACA Foundation Scholarship Program to Help Bridge Talent Gap

ISACA Foundation is helping support underrepresented professionals in digital trust fields through its scholarship program.

14 September 2022
Steve Jackson
Audit Article

Auditee Buy-In—A Key Component of Effective Audits

In business, auditors are often portrayed as the bad guys. From an external audit perspective, auditors enter an organization with no true relationship with, or connection to, the auditee. The

14 September 2022
Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts
ISACA Journal Article

Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts

The rapid development of blockchain technology and cryptocurrency has influenced the financial industry by creating a new crypto economy, which has been compounded by next-generation decentralized applications that do not involve a trusted third party.

Author: Pinkal Shah
Courtney Chatterton
Blog Post

How To Communicate Risk in a Way Leadership Can Understand

The key to effectively communicating risk is aligning risks to the company's business objectives.

13 September 2022
Premkumar Subramanian Subha
Blog Post

How Secure is Your Data? A New Way of Looking at Data Privacy Compliance

Recent data privacy compliance regulations, along with existing ones, present a whole new dimension in the world of regulatory compliance requirements for banks/financial services across the globe.

12 September 2022
Jai Sisodia CISA, CCP, ITIL V3, and Mohammed Khan, CISA, CRISC, CDPSE, CIPM, Six Sigma Certified Green Belt
Blog Post

The Customer’s Responsibility in the Cloud Shared Responsibility Model

The cloud shared responsibility model model can help relieve customers’ operational burdens as the cloud service provider operates, manages and controls the host operating system, infrastructure components and actual physical security of the facilities.

9 September 2022
Caitlin McGraw
@ISACA Article

Rookie Success Factors: Career Advice from the ISACA community

Career Corner columnist Caitlin McGaw compiles a treasure trove of early-career tips and guidance for rising digital trust professionals.

7 September 2022
Abdul Rafeq
@ISACA Article

Strategies to Customize and Implement COBIT Best Practices

The COBIT framework is often most valuable for organizations when it is customized to address the specific business challenges the user is addressing.

7 September 2022
Safia Kazi
Blog Post

Privacy: A Key Component of Building Digital Trust

The key relationship between privacy and advancing digital trust was explored in a recent ISACA Live episode with Safia Kazi and Betsie Estes.

7 September 2022
Mary Carmichael
Risk Article

Enabling Digital Trust With Canada’s Digital Charter

Data are the lifelines of a digital economy. They are driving forces for innovation, enabling cutting edge research and next generation technologies including artificial intelligence (AI), robotics and the Internet of things (IoT).

7 September 2022
Managing Cybersecurity Risk as Enterprise Risk
ISACA Journal Article

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity risk is a critical enterprise concern. Cybersecurity incidents such as ransomware have the potential to bring an organization’s operations to a standstill.

Author: Tom Schneider
Guy Pearce
Blog Post

AI Ethics and eXplainable AI (XAI): Much Easier Said Than Done

More artificial intelligence (AI) proponents are proposing that integrating ethics with AI will result in better customer engagement with the technology

6 September 2022
Podcast
Podcast

Achieving Effective Cloud Risk Management

Cloud is ubiquitous now. From small enterprises to large companies, all are moving a part of their technology operations to cloud. Initial reluctance is now nowhere to be seen.

6 September 2022
Varun Prasad
Blog Post

A Fan of Diverse Experiences

ISACA member Varun Prasad works with tech companies of varying sizes to help build digital trust by addressing the security and privacy compliance requirements of customers and other stakeholders.

2 September 2022
Information security
Security Article

Taking Security Strategy to the Next Level

In an era of rampant ransomware and other malicious cyberattacks, it has never been more important to double down on cybersecurity analysis and strategy.

2 September 2022
Shannon Donahue
ISACA Journal Article

Letter From the SVP of Publishing

The ISACA Journal is consistently cited by ISACA members as one of the most valued benefits of their membership package.

Author: Shannon Donahue
Information Security Matters: It’s About (Down) Time
ISACA Journal Article

Information Security Matters: It’s About (Down) Time

It is important that we stop measuring the cost of cyberattacks only in the number of records breached and start focusing on hours of unavailable systems and data.

Author: Steven J. Ross
IS Audit in Practice: Auditing Culture
ISACA Journal Article

IS Audit in Practice: Auditing Culture

Is there a way that the risk management and audit professions can get through the soft, unquantifiable information to produce actionable recommendations?

Author: Cindy Baxter
HelpSource
ISACA Journal Article

Help Source Q&A

What are the essential personal skills IS auditors should possess to effectively carry out audit work?

Author: Sunil Bakshi
Auditing Your Organizational Culture
ISACA Journal Article

Auditing Your Organizational Culture

How does an internal audit team conduct a culture audit, especially when the subjectivity of culture can take auditors out of their comfort zones?

Author: Kevin M. Alvero
How Social Engineering Bypasses Technical Controls
ISACA Journal Article

How Social Engineering Bypasses Technical Controls

When the widespread availability of information is enhanced by the excessive compulsion by some people to engage in excessive sharing on social media, social engineers can have a field day.

Author: Allen Ari Dziwa
Case Study: Adopting RiskOps to Streamline Governance and Risk Management
ISACA Journal Article

Case Study: Adopting RiskOps to Streamline Governance and Risk Management

This case study provides insight into Highmark Health’s transition to RiskOps and highlights some of its immediate process improvements, including capacity creation to address emerging risk...

Authors: Chuck Donina and Kathleen S. Hartzel
Against the Quantum Threat: Selective Compatibility
ISACA Journal Article

Against the Quantum Threat: Selective Compatibility

Selective compatibility is achieved through a set of technical tools, processes and protocols that allow a conditional connection between several information systems...

Authors: Jean Jacques Raphael, Jean Claude Célestin, and Eric Romuald Djiethieu
Quantifying the Qualitative Technology Risk Assessment
ISACA Journal Article

Quantifying the Qualitative Technology Risk Assessment

Some risk assessments may be entirely quantitative, but most enterprises find an exclusively mathematical approach flawed and subject to manipulation and bias.

Authors: Julie Ebersbach and Michael Powers
Should Cybersecurity Be Subject to a SOX-Type Regulation?
ISACA Journal Article

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Could cybersecurity implementation benefit from a US Sarbanes-Oxley Act of 2002 (SOX)-type approach?

Author: Mike Tomaselli
Building Resilient Security in the Age of the Great Reshuffle
ISACA Journal Article

Building Resilient Security in the Age of the Great Reshuffle

Enterprises should revisit their strategies for managing the cybersecurity workforce and build resilient environments with a focus on learning and development, job rotation, security culture and investment in people.

Authors: Prakash Renduchintala, Rohitha Chowdhary and Pradeep Sekar
Industry Spotlight Podcast
Podcast

Industry Spotlight with Dr. Blake Curtis, Part II

In part 2, author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

1 September 2022
Defending Data Smartly
@ISACA Article

Better Approaches for Protecting Data

A new ISACA white paper provides guidance on how organizations can evolve their approach to data protection to keep up with the threat landscape.

31 August 2022
Kim Pham
Blog Post

Cloud Computing — What IT Auditors Should Really Know

Given the growing reliance on cloud computing, internal audit should adopt a proactive approach to cloud initiatives and position the department as a trusted advisor.

31 August 2022
Faith Wawira
Blog Post

ISACA Kenya Chapter to Support Vulnerable Children in CommunITy Day 2022

ISACA's annual CommunITy Day of global volunteering is coming up on 1 October, with chapters around the world preparing to make their impact at the local level.

30 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Dr. Blake Curtis, Part I

Author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

30 August 2022
Jeff Burke
Blog Post

IT Audit Field Provides ‘So Many Options’ for Early-Career Professionals

Jeff Burke shares his experience as a new IT auditor and describes why IT audit is a promising career path for rising professionals.

29 August 2022
Roderick Chambers
Governance Article

GRC Programming: The Third-Party Security Web

Governance, risk management and compliance (GRC) are growing disciplines with continuously changing identities.

29 August 2022
Bias and Ethical Concerns in ML
ISACA Journal Article

Bias and Ethical Concerns in Machine Learning

Artificial intelligence (AI) has evolved rapidly over the past few years. A decade ago, AI was just a concept with few real-world applications, but today it is one of the fastest-growing technologies, attracting widespread adoption.

Author: Niral Sutaria, CISA, ACA
Tuan Phan and Chad Friedman
Blog Post

Mapping a Serial Rug Pull Scammer on Binance Smart Chain

Rug pull events can be detected and analyzed using publicly accessible blockchain explorers, online analytical tools and data repositories.

26 August 2022
Risk
Risk Article

The Key(s) to Writing Good Risk Statements

To effectively manage risk at an organization, risk must be identified and analyzed by an information systems professional.

26 August 2022
Brian Fletcher
Blog Post

Shifting the Paradigm to Protect Your Data

ISACA's new white paper, "Defending Data Smartly," goes beyond solutions for protecting your organization’s data, also exploring challenges across information technology, compliance, privacy and governance.

25 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part II

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry. Having realized the value of information at an early age, Arnulfo has forged his path within the IT community.

25 August 2022
The Quantum Computing Threat: Risks and Responses
@ISACA Article

The Quantum Computing Threat: Risks and Responses

An ISACA expert panel shares their views on quantum computing threats and the related implications for cybersecurity practitioners.

24 August 2022
Max Shanahan
Blog Post

International Standards: ISACA Update on ISO Governance and Management Standards Initiatives

ISACA recently participated in meetings to review and update several ISO governance and management standards.

24 August 2022
ASEAN’s Resilience in Capacity Building
ISACA Journal Article

ASEAN’s Resilience in Capacity Building

In 2018, the Government of Japan and the Association of Southeast Asian Nations (ASEAN), agreed to establish the ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC)1 to train at least 700 cybersecurity personnel to counter cyberthreats and close the cybersecurity skills gap.

Authors: Thongchai Sangsiri, Araya Sawasdichai, Issara Amornkraisee and Kamonchanok Chaiyakun
Career and Leadership
Blog Post

Breaking Into the IT Industry: IT Degree and Certification

Earning IT certifications can make a big difference in both salary and job opportunities for early-career professionals, and can also serve as a strong complement to IT degree programs.

23 August 2022
Josh Scarpino
Blog Post

Ethical Artificial Intelligence and Machine Learning By Design: A New Standard to Doing Business

Several foundational steps can be taken for organizations by adopting an ethical artificial intelligence and machine learning lifecycle to move toward standardizing ethical technology implementations.

22 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part I

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry.

22 August 2022
Veronica Rose
Blog Post

Approach to Auditing a Core Banking System

Auditing core banking systems successfully requires due diligence on a wide range of control tests.

19 August 2022
Information Security
Risk Article

Does Your Organization Need a Security Risk Assessment?

The enterprise risk assessment and enterprise risk management processes comprise the heart of the information security framework.

19 August 2022
Sumedha Adavade
Blog Post

A Five-Step Process to Help Organizations Achieve Operational Resilience

Operational resilience is far more than having business continuity planning in place and conducting disaster recovery drills; it requires strategic decision-making when planning, identifying, defining, working, testing, monitoring and re-defining multiple parameters.

18 August 2022
Alex Sharpe
@ISACA Article

Digital Trust Takes a Village

Digital trust is a team sport, requiring engagement throughout the organization at all levels. Digital trust also extends outside of the organization to business partners and vendors.

17 August 2022
Mentorship Program Making Valuable Connections
@ISACA Article

Mentorship Program Making Valuable Connections

The ISACA Mentor Program facilitates one-to-one mentorship connections and brings together ISACA members at all stages of their careers who want to give or receive professional development support.

17 August 2022
Bruce R. Wilkins
@ISACA Article

The Evolution of Bots and How to Defend Against Them

Bots have become more sophisticated over time, upping the degree of difficulty for practitioners to ensure they do not undermine digital trust.

17 August 2022
Dr. Blake Curtis, Sc.D, CISA, CRISC, CISM, CGEIT, CDPSE, COBIT
Blog Post

Title Bias – The New Form of Bigotry in The Workplace

Title bias occurs when someone treats another person differently because they don’t hold a specific title or position in an organization, and it can badly damage workplace culture.

17 August 2022
Jeffrey Champion
Security Article

Improved Visibility Means More Effective Security Tools

When it comes to evaluating the efficacy of security tools, the first question many people ask is “How do I know if my enterprise’s security tools are protecting sensitive data?”

17 August 2022
Matching Microsoft Security Tools With the Cyber Kill Chain
ISACA Journal Article

Matching Microsoft Security Tools With the Cyber Kill Chain

Among the many security tools and products Microsoft provides, there are a number of mechanisms that are built into the operating systems and enterprise software.

Author: Aleksandr Kuznetcov
Podcast
Podcast

Current State of Cybersecurity in K12

ISACA's Director of Professional Practices and Innovation Jon Brand hosts Doug Levin, co-founder and National Director of K12 Security Information eXchange (K121 SIX), a national non-profit dedicated solely to helping schools protect themselves from emerging cybersecurity threats.

16 August 2022
Naomi buckwalter
Blog Post

Burned Out: InfoSec Professionals Sound the Alarm

According to a recent survey, almost a third of infosec professionals want to quit the cybersecurity profession due to burnout within the next 12 months. Can we save our industry from a mass resignation before it’s too late?

15 August 2022
Stefan Hyttfors
Blog Post

Creating, Not Predicting, the Future

ISACA Europe Conference keynote speaker Stefan Hyttfors visited with ISACA Now to discuss some of his favorite themes—the future, emerging technology and trends in globalization and sustainability.

12 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Todd Fitzgerald

Cybersecurity leader, author, and host of the CISO Stories podcast, Todd Fitzgerald sits down with ISACA’s Chelsey Byrd to discuss his extensive career journey in security...

12 August 2022
Laura Zannucci
Blog Post

My CISM Exam Journey

Laura Tate Zannucci shares her experience preparing for the CISM certification exam, including tips and guidance on what proved to be successful tactics.

11 August 2022
ISACA live tile
Podcast

ISACA Live: Advancing Digital Trust Through Audit and Assurance

A strong audit and assurance function is critical to achieving digital trust in an organization. This conversation spotlights audit's role in digital trust and outlines key priorities. It also shares new ISACA resources for auditors.

11 August 2022
Jack Freund
@ISACA Article

Cyberinsurance Is Still Expensive

There are certain immutable laws of economics, though not all of them are well received. One such law is the mechanism by which organizations price their products and services.

10 August 2022
Man standing in front of wall of computers
@ISACA Article

New Credential Prepares Early-career IT Audit Professionals

A new credential from ISACA gives those seeking a strong foundation in IT audit knowledge the chance to accelerate their early-career prospects.

10 August 2022
Code Your Dreams
Blog Post

Advancing Technology as a Human Right

Code Your Dreams was recognized with the ISACA Technology for Humanity Award for leadership in empowering the next generation of civic-minded technologists.

10 August 2022
Blockchain Smart Contracts, Part 2
ISACA Journal Article

Blockchain Smart Contracts, Part 2: Applications and Recommendations

Media attention on blockchain exploded in 2021, with major news outlets reporting on governments’ adoption of blockchain and associated smart contract systems such as central bank digital currencies (CBDCs) and egovernment

Authors: Samuel Zaruba Smith and Andy Garcia
Joseph Burt-Miller
Blog Post

My Path to a Career in Cybersecurity

Dr. Joseph J. Burt-Miller Jr. says experience, certifications and degrees form the "cyber triangle" to spark career growth in the cybersecurity field.

9 August 2022
Christina Luttrell
Risk Article

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation and a looming recession, it is clear that the world has entered a new era of risk.

9 August 2022
Podcast
Podcast

Managing Security Across Disparate Database Technologies

We usually think about the most efficient way to do things while working in production environments. Still, often employees forget about an insecure environment once the work has been completed and they have moved on to another project.

9 August 2022
Auditors in a ‘Perfect Position’ to Further Digital Trust
Blog Post

Auditors in a ‘Perfect Position’ to Further Digital Trust

IT auditors are an important part of the digital trust equation since they are able to give organizations confidence in the processes and business relationships that they have in place.

8 August 2022
Matt Moog
Blog Post

Eight Steps to Manage the Third-Party Lifecycle

Managing third parties is a relationship that must be managed throughout the third-party management lifecycle, from identification and screening to offboarding.

5 August 2022
Priya Mouli
Blog Post

Advancing Digital Trust Through Collaboration

To address the biggest challenges in the technology field, Priya Mouli, Director at PwC’s Cybersecurity Consulting practice yhinks there needs to be more collaboration and cooperation among the public and private sectors and groups globally.

4 August 2022
Podcast
Podcast

Implementing Emerging Technologies: Agile SDLC Still Works

AI is a part of our everyday life. What's The Risk LLC's Cindy Baxter gives ISACA's Kevin Keh examples of modern media like the movies Free Guy, Ron’s Gone Wrong and The Matrix...

4 August 2022
Caitlin McGraw
@ISACA Article

Rocket Fuel for Your Career: Stories that Inspire, Influence and Build Your Brand

“My boss tells amazing stories. I could listen to her for hours.” I was talking with an IT audit manager at a global pharma company when she made that comment.

3 August 2022
Veronica Rose
@ISACA Article

Do Your Policy Documents Represent Current Practices?

Process owners are subject matter experts who understand processes, procedures and controls in place, whether documented or not. However, auditors usually go by the maxim that “If it’s not documented, it does not exist.”

3 August 2022
Risk Scenarios Starter Pack
@ISACA Article

New Member Benefit: Risk Scenarios Starter Pack

Well-developed risk scenarios providing a realistic and practical view of risk that may prevent an enterprise from achieving its business objectives are especially valuable in today’s fast-moving and often volatile business landscape.

3 August 2022
Tammy Moskites
Blog Post

Sharpen Your Machine Identity Management

New technologies are regularly implemented into IT infrastructure in this era of digital transformation, placing increased importance on sound machine identity management (MIM).

3 August 2022
Blockchain Smart Contracts, Part 1
ISACA Journal Article

Blockchain Smart Contracts, Part 1: Introduction for Accounting and Auditing Professionals

Blockchain smart contract technology is having and will continue to have a significant impact on accounting and auditing.

Authors: Samuel Zaruba Smith and Andy Garcia
Luigi Sbriz
Blog Post

How Much Trust Should You Give Digital Identity Identification?

Digital identity is a necessity. It should be simple and accurate as well as easily eliminable. Users should be able to expect control over the dissemination of their personal data.

2 August 2022
Maosen Cai
Blog Post

How to Build a Data Science Team Within the Internal Audit Function

Data science is a growing and evolving force in different functional areas of business, and the internal audit function is no exception.

1 August 2022
Mark Thomas, Sr. Cybersecurity Analyst & Threat Hunter, and Sandeep Bachhas, Sr. Cybersecurity Analyst & Threat Hunter
Blog Post

Building Our Security Coordination Center (SCC) Hunting Program

When many companies think about network security, they usually think in terms of firewalls, anti-virus software, intrusion detection systems, and multi-factor authentication (MFA).

29 July 2022
ISACA live tile
Podcast

ISACA Live: Managing Supply Chain Risk with Richard Hollis

ISACA's risk expert Paul Phillips and Richard Hollis, CEO of Risk Factory and an ISACA Conference Europe speaker, examine top cyber risks impacting the supply chain, steps organizations...

29 July 2022
Paul Phillips and Richard Hollis
Blog Post

Supply Chain Security: Where Do We Go from Here?

ISACA risk expert Paul Phillips and CEO of Risk Factor Richard Hollis discussed key challenges influencing supply chain security in an episode of ISACA Live last week. Their conversation was supported by insights from ISACA’s recent survey, Supply Chain Security Gaps: A 2022 Global Research Report.

28 July 2022
Frank Wei
Security Article

The Power of Provenance

While next-generation firewalls, extended detection and response (XDR) and other security solutions do a great job of detecting and thwarting cyberattacks, it is all too common for a sneaky or camouflaged threat to slip through into the network.

28 July 2022
Sunil Bakshi
@ISACA Article

Insider Threats: What Needs to Be Done?

In the information and cybersecurity domain, it is well-documented and much discussed that the most significant threat to an organization often stems from its own employees.

27 July 2022
Mark Bowling
@ISACA Article

The Midgame Could Be Beginning of End for Ransomware Perpetrators

The growing impact of ransomware attacks on organizations has been staggering in recent years.

27 July 2022
Guy Pearce
Blog Post

Data Resilience Is the Cornerstone of Digital Resilience

Digital resilience is the outcome of organizational action taken to rapidly deploy or modify digital technologies to address the negative impact of shocks—such as the pandemic—in the interests of maintaining organizational sustainability.

27 July 2022
Governance of Key Aspects of System Patch Management
ISACA Journal Article

Governance of Key Aspects of System Patch Management

When a pop-up notification prompts a user to update their system with the latest patch, the response is often to click on the Remind Me Later option.

Author: V. J. Srinivas
Rebecca Herold
Blog Post

Changes Needed to US Federal Privacy Proposal for Effective Implementation

My Privacy & Security Brainiacs team has been tracking US federal bills proposed by Congress that mention privacy in some way.

26 July 2022
Ejona Preçi and Peter H. Gregory
Security Article

SaaS Security Risk and Challenges

The hybrid work model imposed by organizations during the height of the COVID-19 pandemic triggered many enterprises to accelerate moves to cloud-based services for better resilience and efficiency.

26 July 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Pam Nigro

On this episode of Industry Spotlight, ISACA's outgoing Board Chair, Greg Touhill, introduces the 2022-23 Board Chair, Pam Nigro.

26 July 2022
Ejona Preçi and Curtis Simms
Blog Post

Addressing Security Risks to Medical IoT Devices

The Internet of Things (IoT) enables millions of smart devices worldwide that are connected to the internet to collect, process and share data.

25 July 2022
Mea Clift
Blog Post

Mea Clift: ‘A Force of Nature’

ISACA member Mea Clift advances digital trust in her work but also makes time for some old-fashioned personal pursuits.

22 July 2022
Ryan Cloutier
Risk Article

What Makes Risk Assessments So Unpleasant and How to Change That

“I would love to complete a security risk assessment,” said no one, ever. Many people would agree that performing and reviewing security risk assessments are not particularly enjoyable, especially for IT and security teams that are already overworked, understaffed and burned out.

22 July 2022
Podcast
Podcast

The Impact of People on Information Technology Landscape

In this episode, ISACA’s Jon Brandt chats with Thomas Lenzenhofer, Business Development Manager at Cisco, about his new ISACA article titled, “The Impact of People on Today’s Information Security Landscape.”

22 July 2022
Paul Thompson
Blog Post

Know Your Risks – and Your Friends’ Risks, Too

In today’s globally connected world, organizations are finding themselves at a greater risk than ever of a supply chain compromise.

21 July 2022
Chris Clements
Blog Post

Purple Teaming: The Next Gen Pen Test

It’s pen test time again. Time to get updated quotes from vendors and put something on the schedule ahead of the compliance deadline, but will this year’s results be any different than last time?

20 July 2022
Rob McDonald
@ISACA Article

Stop Losing Cyber Talent and Start Leading with Why

At a time when 60 percent of cybersecurity firms report difficulty retaining cyber talent, I would like to introduce a new method for increasing employee engagement and retention. In this article, you’ll learn to apply techniques from agile to guide your organization in connecting their work to the company’s overall purpose.

20 July 2022
The Top-Five Audit Essentials for Driving Efficiency and Value - people in front of a computer
ISACA Journal Article

The Top-Five Audit Essentials for Driving Efficiency and Value

Audit teams often struggle to determine why projects get delayed, and they fail to understand resulting client concerns

Author: Sushma Uniyal
Podcast
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

In part 2, Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

20 July 2022
Career and Leadership
Blog Post

Persevering Through a Seismic Industry Shift

Eventcombo was recognized this year with the ISACA Innovative Solutions Award “for enabling community connections and continuing education virtually during a global pandemic through innovative EventTech solutions.”

18 July 2022
Podcast
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

18 July 2022
Audit and Assurance
Blog Post

What Can Internal Auditors Do to Increase Cybersecurity Audit Effectiveness?

Cybersecurity has topped the list of critical risk for organizations for the fifth time in both the European Confederation of Institutes of Internal Auditing’s (ECIIA’s) 2022 Risk in Focus report and the Institute of Internal Auditor’s (IIA’s) OnRisk 2022 report.

15 July 2022
Piyush Bajpai
Emerging Technology Article

Mitigating Cryptocurrency’s Carbon Footprint

In today’s rapidly evolving finance industry, organizations can either change and thrive or fall behind the market competition. One of the most discussed evolving trends in finance is cryptocurrency.

15 July 2022
Podcast
Podcast

Smarter Testing = Safer Digital Experiences

Application testing is a critical component of a software development lifecycle. A complete testing battery for any application includes not only functionality and usability testing but security and reliability testing as well.

13 July 2022
John Pironti
@ISACA Article

Five Key Considerations When Developing a Security Strategy for IoT and OT

The Internet of Things (IoT) and operational technologies (OT) significantly expand the threat and vulnerability landscape for organizations that choose to adopt them. The notion of “You are only as strong as your weakest link” took on a new meaning when IoT and OT devices and capabilities were introduced.

13 July 2022
A host at the International Cybersecurity Challenge with a bunch of contestants behind him
@ISACA Article

ISACA Sponsors the First International Cybersecurity Challenge

The European Union Agency for Cybersecurity (ENISA), together with sponsors including ISACA, created and hosted the first International Cybersecurity Challenge (ICC) in Athens, Greece from 14-17 June this year. This challenge was designed to attract young talent in the cybersecurity community and to bring global attention to the education and skills needed in cybersecurity professions.

13 July 2022
Dr. Lisa McKee
@ISACA Article

Stop Passing the Privacy Hot Potato

The privacy function remains relatively new at most organizations. While the implementation of major regulations such as GDPR and CCPA in recent years helped elevate privacy’s stature, many organizations are still in the mode of, “I have to do this thing, but I don’t really know what this thing is, or how it will impact my organization.”

13 July 2022
Hunter Sekara
Blog Post

Characterizing System Security Engineering Using a Business Impact Analysis

As adversaries continuously seek to disrupt, cause harm and wreak havoc on complex digital assets, enterprises must strategically plan, design and build secure, trusted systems.

13 July 2022
Biju Nair
Audit Article

The Evolution of Internal Audit in a Digital-First Environment

When leaders at a new digital bank were putting together a job description for their first chief audit executive (CAE), they knew they were looking for more than a candidate who could perform conventional internal audit functions.

13 July 2022
A Standardized Approach for Peer Review of Internal Audit
ISACA Journal Article

A Standardized Approach for Peer Review of Internal Audit

The quality of enterprise governance and the questionable judgment and roles of internal auditors have resulted in some financial reporting irregularities, fraud and various forms of malpractice such as insider trading.

Authors: Gaurav Priyadarshi, Abhishek Anand and Ishika Shukla
Deepa Seshadri
Blog Post

Cyber Incident Reporting: From Guidance to Enforcement

Imagine a day when the stock markets suddenly begin to crash, contrary to market movements, and your equity holding nosedives from a healthy green to an alarm bells-blaring red.

12 July 2022
Curtis Simms and James Paul Kakembo
Blog Post

Digital IT Forensics Evolution Through Digital Transformation

According to the National Institute of Standards and Technology, “Digital forensics is the field of forensic science that is concerned with retrieving, storing, and analyzing electronic data that can be useful in criminal investigations. This includes information from computers, hard drives, mobile phones, and other data storage devices.”

11 July 2022
Relebohile Kobeli
Risk Article

How Enterprises Can Leverage Incident Reporting

Incident reporting plays a vital role in strengthening the internal controls necessary for an organization to operate properly. An incident is defined as “[A] nonstandard operation which causes interruption or reduction in quality of service.”

11 July 2022
Fortune Onwuzuruike
Blog Post

Cybersecurity Workforce Advancement

Cybersecurity education and training is important in the cybersecurity workforce and provides students and recent graduates with information on how to find what path to take. Paths include formal education from universities and institutions that provide programs to better equip the student who desires to be a cybersecurity professional (e.g., bachelor’s, master’s and doctoral degrees) and cybersecurity training such as boot camps, certifications preps and certificate programs.

8 July 2022
Podcast
Podcast

Cyber Decisions Only Executives Can Make

One of ISACA’s most popular Journal columnists joins us to discuss his most recent release, “Cyber Decisions Only Executives Can Make.” Steven Ross chats with ISACA’s Safia Kazi about cyber recovery plans...

8 July 2022
Carissa Veliz
Blog Post

AI and Digital Ethics: ‘There Could Not Be More Overlap’

Véliz recently visited with ISACA Now to share her perspectives on AI, digital ethics and more.

7 July 2022
Chetan Anand
Audit Article

Preparing Your First Supplier Audit Plan

Organizations outsource processes and services for a variety of reasons: to cut costs, preserve resources, make room for growth and remain competitive in their industries.

7 July 2022
Ravikumar Ramachandran
Blog Post

Quantum Computing and the Role of Internal Audit

Quantum computing is a very exciting discipline formed by the combination of computer science, physics and mathematics, which uses some of the mysterious aspects of quantum mechanics to enable unprecedented computational performances.

6 July 2022
ISACA CEO - David Samuelson
@ISACA Article

Digital Trust: Atop the Technology Pyramid

I recently attended an IDC analyst presentation analyzing emerging trends in the cybersecurity realm, and one slide in particular caught my attention.

6 July 2022
Caitlin McGraw
@ISACA Article

Job Descriptions Falling Down on the Job: What Hiring Managers Can Do to Fix This Calamity

Most hiring managers never thought they would have to master the art of copywriting. Documentation – yes. Report writing – yes. Ad copy – not so much.

6 July 2022
Fiber optic cables
@ISACA Article

Top Takeaways from New IT Audit Technology Risks Survey

Cybersecurity is the leading risk area for IT audit departments, with related risks such as privacy and data also ranking among the top concerns, according to a new study from ISACA and Protiviti.

6 July 2022
Quantum Disruption for Defensive and Offensive Cybersecurity
ISACA Journal Article

Quantum Disruption for Defensive and Offensive Cybersecurity

Since the idea of applying the principles of quantum physics to classical computing originated in the early 1980s, many prototypes, simulations and research efforts have been carried out in attempts to put the idea into practice.

Author: Balaji Swaminathan M.
Brian Fletcher
Blog Post

Ensuring You Have the Right Governance in Place for Physical and Environmental Controls

Physical and environmental controls are more than gates, guards, generators and HVAC monitoring. Getting physical and environmental controls right is a big step forward in reducing your enterprise’s risk and protecting critical assets in an unpredictable world. So how do you determine that you have the proper controls and governance oversight in place?

5 July 2022
Michael Podemski
Audit Article

Now Is the Time for IT Auditors to Perform Advisory Pre-Implementation Reviews

Demand for digital transformation is increasing as enterprises endeavor to offer more innovative products or services and modernize legacy IT environments.

5 July 2022
Podcast
Podcast

Real-World Data Resilience

Join ISACA's Lisa Villanueva as she talks with Guy Pearce about his recently released ISACA Journal article "Real-World Data Resilience". Guy has a deep knowledge of the movement of data and says "it’s about change and nothing is stable."

5 July 2022
Kevin E. Jackson
Emerging Technology Article

The Case for Outcome-Based Cybersecurity: A Data-Focused Shift in Cybersecurity Management

The challenges faced by today’s cybersecurity practitioners are well documented, however, the situation may be worse than described.

1 July 2022
Pam Nigro
ISACA Journal Article

Letter From the Incoming Board Chair: Dear Readers

As a technology professional, I have borne witness to a technology evolution from sneakernet to ethernet to Internet.

Author: Pam Nigro
Cyber Decisions Only Executives Can Make
ISACA Journal Article

Information Security Matters: Cyber Decisions Only Executives Can Make

Cybersecurity is not simply a technical problem.” I have heard and read this many times (and have said it a few times, as well).

Author: Steven J. Ross
Implementing Emerging Technologies—Agile SDLC Still Works
ISACA Journal Article

IS Audit in Practice: Implementing Emerging Technologies—Agile SDLC Still Works

It was a big deal scheduling network operation center (NOC) tours for customers when I was a client account director in network services...

Author: Cindy Baxter
Charting the Course for Quantum Computing
ISACA Journal Article

Innovation Governance: Charting the Course for Quantum Computing

Once upon a time, I was an undergraduate physics major studying a subject called quantum mechanics.

Author: K. Brian Kelley
Focal Points for Auditable and Explainable AI
ISACA Journal Article

Focal Points for Auditable and Explainable AI

Artificial intelligence (AI) is a branch of computer science that originated, at least academically, almost 75 years ago.

Author: Guy Pearce
Making and Breaking Data Security With Quantum Machines
ISACA Journal Article

Making and Breaking Data Security With Quantum Machines

The characteristics of the quantum universe are not very intuitive when based on observations of everyday physics, which may explain why even theoretical physicist Albert Einstein found the phenomena “spooky."

Author: Dalia Khader
Evaluating Ethical Challenges in AI and ML
ISACA Journal Article

Evaluating Ethical Challenges in AI and ML

In general, privacy, bias and discrimination are currently receiving a lot of attention. However, it is common for them to be underprioritized in technology implementations and treated as isolated issues...

Author: Joshua Scarpino
Managing Security Across Disparate Database Technologies
ISACA Journal Article

Managing Security Across Disparate Database Technologies

Enterprise databases present several unique challenges for security and audit professionals. They are paradoxical, as they must securely store vast amounts of sensitive data...

Author: Adam Kohnke
Eliminating the Embedded Malware Threat at the Binary Level
ISACA Journal Article

Case Study: Eliminating the Embedded Malware Threat at the Binary Level

Attack methods that evade enterprise security controls are understandably favored among cybercriminals, and the growing trend toward embedding malware in documents is evidence of the difficulty of...

Author: Mick Brady
Rethinking the Effectiveness of Controls in the Digital Age
ISACA Journal Article

Rethinking the Effectiveness of Controls in the Digital Age

In the midst of international geopolitical turbulence, organizations must mobilize to keep their businesses dynamic and establish long-term strategic postures that define ways forward amid instabilities.

Author: Jeimy J. Cano M.
Privacy, Security and Bias in Emerging Technologies
ISACA Journal Article

Privacy, Security and Bias in Emerging Technologies

Emerging technology is an obvious and oft-repeated term, usually referring to digital technology recently developed. The first use of social messaging tools to make calls or send messages was approximately...

Author: Shini Menon
Implementing Artificial Intelligence
ISACA Journal Article

Implementing Artificial Intelligence: Capabilities and Risk

During the last decade, there has been exponential growth in artificial intelligence (AI) adoption. Total global enterprise AI investments grew from US$12.75 billion to US$67.85 billion between 2015 and 2020.

Author: Ivy Munoko
Kevin Keh
Blog Post

Arts vs. Sciences in IT: How UX Design Can Bridge the Gap

As professionals in IT-related fields, our jobs can seem very explicit: Binary 1s and 0s and Boolean true or false is baked into much of what we do. There are exceptions of course, but often there is a right answer or a wrong answer, and little space in between.

30 June 2022
Larry Wlosinski
Security Article

Writing a Charter for an Enterprise Security Operations Center

The security operations center (SOC) is the heart of information security for medium- to large-sized organizations. It ensures organizational cyber well-being by monitoring the infrastructure and managing its cyberhealth.

30 June 2022
Podcast
Podcast

Breaking Down the ESET T1 Threat Report

ESET, a global leader in cybersecurity, has released its T1 2022 Threat Report, which summarizes the most notable trends that shaped the threat landscape from January to April 2022.

30 June 2022
Kim Kaplan
Blog Post

MDDAP Helps Achieve Fast, Sustainable Solutions for Medical Device Quality

MDDAP’s successful development is due in part to the Case for Quality (CfQ) being launched from FDA’s own research with a wide variety of stakeholders, which revealed a problem in the industry: compliant manufacturers were still having similar types and frequency of issues as non-compliant manufacturers. While compliance was important, it alone wasn’t going to drive the desired quality outcomes.

29 June 2022
Jack Freund
@ISACA Article

How the Rise of the Chief Trust Officer Role Can Shape Digital Trust in Organizations

It’s often said that trust is hard to earn and easy to lose. It undergirds most everything we do, yet is so fragile that, without it, nothing works.

29 June 2022
Bruce R. Wilkins
@ISACA Article

The Need for Job Rotation

On the surface, job rotation may seem straightforward or even outright boring. But this business process can be interesting when you peel back the layers.

29 June 2022
HelpSource Security Lock
ISACA Journal Article

Help Source Q&A

Privacy by design is a methodology originally developed in 1995. It takes a broad view of a system and its data relative to seven principles.

Author: Sunil Bakshi
Reducing Security Vulnerabilities in a Hybrid Workplace Keyboard
ISACA Journal Article

Reducing Security Vulnerabilities in a Hybrid Workplace

The lockdowns and other precautions instituted based on the COVID-19 pandemic have fundamentally changed the way society lives, works and plays.

Author: Timothy Liu
Kashifu Inuwa Abdullahi
Blog Post

ISACA Member’s Impact in Nigeria Recognized on the Global Stage

Kashifu Inuwa Abdullahi, Chief Information Technology Officer, National Information Technology Development Agency in Nigeria, was recognized this year with the ISACA Inspirational Leadership Award “for leadership in bridging the digital divide by providing computers and other IT infrastructure to rural areas and schools and for providing virtual libraries.”

28 June 2022
Podcast
Podcast

Where Privacy Meets Security

Jo Stewart-Rattray, the Director of Technology & Security Assurance for BRM Advisory, believes privacy is a team sport. Every organization needs to be responsible for asking, “what data is being collected,” “where is the information held,” “what purpose is the information being collected for,” and “how is the information being protected.”

28 June 2022
Anna Johannson
Blog Post

How the Right Help Desk Processes Can Strengthen Security

The IT help desk might seem like a simple portal for helping end users manage their issues. But in reality, it represents one of the first (and best) filters for identifying potential cybersecurity problems that may arise.

27 June 2022
Ajay Wadhwa
Blog Post

Next-Generation CISO: Business, Technical or Mix of Both?

Before we get to the answer to the question posed in the title, let’s look at the typical job responsibilities of a CISO.

23 June 2022
Post-breach Lessons Learned from SolarWinds CISO Tim Brown
@ISACA Article

Post-breach Lessons Learned from SolarWinds CISO Tim Brown

SolarWinds CISO Tim Brown spoke with ISACA Board Director Rob Clyde at the ISACA Conference North America last month about lessons learned from the high-profile software supply chain incident in 2020.

22 June 2022
Zanele Njapha
Blog Post

Lessons in Change and Leadership from ‘The UnLearning Lady’

Zanele Njapha recently visited with ISACA Now to discuss her quirky nickname, her views on entrepreneurship and organizational change, and more.

22 June 2022
Bassel Kablawi
Security Article

Why (and How to) Dispose of Digital Data

The stakes are too high for organizations not to comply with data privacy regulations. For example, noncompliance with the EU General Data Protection Regulation (GDPR) can result in a fine of up to €10 million or up to 2% of the organization’s worldwide annual revenue from the preceding financial year, whichever is higher.

22 June 2022
The Human Consequences of Ransomware Attacks
ISACA Journal Article

The Human Consequences of Ransomware Attacks

The Internet’s impact on daily life is unquestionable. It provides a platform for communication, ecommerce and interactions between individuals and enterprises around the world.

Author: Joseph Cheng | CISA, CRISC, CPA
Rob McDonald
Blog Post

Reach and Teach: An Effective Way to Market and Advertise Cybersecurity Services

Now is the time for cybersecurity professionals to get in front with their message.

21 June 2022
Yiannis Pavlosoglou
Blog Post

Introducing the Principle of Need to Have Available

The principle of need to have available can be summarized as having only the permissions you need for your next set of tasks.

21 June 2022
Podcast
Podcast

How To Build A Following Around Your Ideas

In this talk based on her book Stand Out: How to Find Your Breakthrough Idea and Build a Following Around It, Dorie Clark explains how to build a following around your ideas.

21 June 2022
The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce
Blog Post

The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce

While much has been said and written about the difficult cybersecurity skills and hiring landscape, one key characteristic that is typically overlooked in cybersecurity professionals is empathy.

17 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Jan Anisimowicz

Jan Anisimowicz is an experienced senior IT manager with over 23 years of experience in GRC, data analysis, broad business, and technical perspective in telco, banking, pharma, and insurance.

17 June 2022
audit and assurance
Blog Post

Foundational Understanding of Databases Boosts Auditors’ Value

With all the areas under an IT auditor’s purview, it is challenging, perhaps impossible, to be as proficient as we would like to be in all areas.

16 June 2022
Podcast
Podcast

Climate Resiliency and Regulation

Climate resiliency and green innovations are of worldwide interest today, but what is the best way to use skills and expertise that will make a difference?

16 June 2022
The Business Impacts of COVID-19: A Post-Pandemic Approach to IT Security and Data Privacy Risks
@ISACA Article

The Business Impacts of COVID-19: A Post-Pandemic Approach to IT Security and Data Privacy Risks

The business impacts of COVID-19 went far beyond a workforce used to sweatpants and slippers in lieu of their former business casual clothing, said speaker Ralph Villanueva at ISACA Conference North America 2022.

15 June 2022
Hollee Magrum- Willis and Belinda Enoma
@ISACA Article

Authentic Allyship and Intentional Leadership

Hollee Mangrum-Willis, Senior Program Manager of ISACA’s One In Tech foundation, sat down with Belinda Enoma, data privacy and cybersecurity leader, to discuss authentic allyship and intentional leadership.

15 June 2022
Improving Security Across the Software Supply Chain
@ISACA Article

Improving Security Across the Software Supply Chain

Today’s software development needs to take a comprehensive approach to be secure. Security needs to be considered at every step of the software supply chain.

15 June 2022
Hussam Khattab
@ISACA Article

Privacy Paradox: Digital Transformation and Governance

A few months ago, my young son wanted to watch videos on YouTube. I let him use my phone, and he started watching one video after another.

15 June 2022
Binita Patel
Blog Post

Perimeter-less Security

“Never trust, always verify” have been the buzzwords ever since the term “zero trust” was coined. According to Pulse, 87% of decision-makers believe that zero trust security strategy will simplify their organization’s security architecture.

15 June 2022
Paul M. Perry
Audit Article

The Repetitive History of IT Audit Outcomes

While the term “IT audit” may be defined differently across organizations based on industry requirements and their applicable frameworks, the outcomes of such audits are often fairly predictable.

15 June 2022
Reducing Cybersecurity Security Risk From and to Third Parties
ISACA Journal

Reducing Cybersecurity Security Risk From and to Third Parties

A major lesson from the COVID-19 pandemic is that protecting oneself is only part of the solution that will put a stop to the virus.

Author: C. Warren Axelrod
Brian Gallagher
Blog Post

Reaching Objectives and Enabling Success: How CMMI Creates Habit Persistence

During ISACA Conference North America 2022, ISACA launched a new initiative focusing on the pursuit of digital trust, which means that this topic was present in several discussions throughout the conference.

14 June 2022
Podcast
Podcast

Gaining Digital Trust by Eliminating Privacy Dark Patterns

With the growing emphasis on consent for collecting and processing data, some enterprises have turned to tricking data subjects into giving their consent by using privacy dark patterns.

14 June 2022
Jingcong Zhao
Blog Post

Making Continuous Controls Monitoring Work for Everyone

As a security assurance professional, you know the importance of controls testing. After all, only organizations that thoroughly test and prove their controls’ effectiveness can be confident that they’ve sufficiently mitigated their security and data privacy risks.

13 June 2022
Larry Alton
Blog Post

Customs Goes Digital: Exploring the Latest Trends

It’s been amazing to watch how almost every aspect of global life has been digitized in some shape or form over the past several years – and customs is no different. The question is, which aspects are changing? And is it for the better?

10 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Mark Thomas

Mark and Jessica dive deep into his career journey and their shared history of developing ISACA training content.

9 June 2022
China's Personal Information Protection Law
@ISACA Article

China’s Personal Information Protection Law Highlighted in New ISACA Resource

Enterprises around the world could feel the consequences of China’s Personal Information Protection Law (PIPL), which recently went into effect.

8 June 2022
ISACA Supply Chain Security Report Spotlights Major Vulnerabilities
@ISACA Article

ISACA Supply Chain Security Report Spotlights Major Vulnerabilities

Less than half of respondents to a new ISACA survey have high confidence in the security of their organization’s supply chain as supply chain risks have become increasingly top-of-mind for enterprises and consumers alike throughout the pandemic.

8 June 2022
Jack Freund
@ISACA Article

The Future of Quantitative Cyberrisk Reporting

An increasing number of boards of directors (BoDs) are paying greater attention to their cyberrisk exposure, which has placed pressure on security teams to provide BoDs with what they need.

8 June 2022
Career and Leadership
Blog Post

The Great Resignation & Employee Retention in Digital Trust Professions: Closing Critical Workforce Gaps

ISACA Conference North America 2022 last month featured the launch of ISACA’s new initiative focusing on the pursuit of digital trust, which was a recurring theme throughout many of the event’s presentations.

8 June 2022
Process Mapping Synergy Gains From BCP and DR
ISACA Journal Article

Process Mapping Synergy Gains From BCP and DR

Understanding how processes work and where controls are needed is crucial for organizations to improve their efficiency. Process mapping is a common place to start.

Author: Alonzo Longshore
Evan Wheeler
Blog Post

Give Your IT Risk Program a Jump-start

I’m constantly fielding questions about how to start building a modern-day IT risk management program, and a quick Google search reveals that there are many differing opinions on the best approach.

7 June 2022
Podcast
Podcast

Cybersecurity in a COVID-19 World: Insights on How Decisions Are Made

In the early days of the Covid-19 pandemic, all organizations pivoted to remote work.

7 June 2022
Mea Clift
Blog Post

Supply Chain Risk Management: Where Do We Start?

Mea Clift examines how to climb the mountain of evaluating vendors to ensure they're meeting security standards.

6 June 2022
Andrea Tang
Blog Post

Demystifying China’s Personal Information Protection Law: PIPL vs. GDPR

On 20 August 2021, the National People’s Congress (NPC) passed the final version of the Personal Information Protection Law of the People’s Republic of China (PIPL), a comprehensive privacy law that covers multiple facets of personal information protection.

3 June 2022
Kevin Keh
Security Article

The Digital Gold Rush: Football, Ransomware and the Bottom Line

The San Francisco 49ers team, one of the NFL’s 32 professional football teams, was hit by a Ransomware-as-a-Service (RaaS) faction called BlackByte.

3 June 2022
Raymond Ito
Risk Article

The New Global Risk Profile

The Russia–Ukraine War has plunged the entire world into a new risk landscape, especially organizations that already faced high levels of risk.

2 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Caitlin McGaw

Caitlin McGaw answered an ad in the newspaper in 1997 for a position with an Executive Search Firm and she was instantly hooked.

2 June 2022
Risk Starter Kit
@ISACA Article

New Resource Helps Tailor Risk Management Programs

ISACA has released a Risk Starter Kit to aid enterprises in creating their own tailored risk management program.

1 June 2022
Caitlin McGraw
@ISACA Article

Ready to Crush Interviews? Add This Superpower to Your Career

Is there a secret sauce to interviewing? In a word, yes.

1 June 2022
Todd Fitzgerald
@ISACA Article

The CISO Evolution

Let’s travel back in time a bit to 1995. Michael Jordan returned to the NBA, DVDs were invented, and—most importantly, for the purposes of this article—the first CISO was hired.

1 June 2022
Ravi Shankar Vemuri
Blog Post

How Best to Protect Your Assets

How do you typically protect a special or expensive piece of jewelry? You may keep it in a bank locker or in an electronic safe in your home.

1 June 2022
Pam Nigro
Blog Post

In a World of Technology, ISACA Makes the Difference

At the beginning of this year, ISACA took on a bold new vision for the future: Be the standard-maker for digital trust everywhere.

1 June 2022
How Effective Is Your Cybersecurity Audit?
ISACA Journal Article

How Effective Is Your Cybersecurity Audit?

Cybersecurity is becoming an increasingly important focus for organizations, and the COVID-19 pandemic has only accentuated cyberrisk for every type of enterprise.

Authors: Matej Drašček, Sergeja Slapničar, Tina Vuko and Marko Čular
Shingi Mushangwe
Blog Post

The Governance, Assurance and Automation that Financial Services Organizations Need

In response to the recent Russian invasion of Ukraine, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a set of expansive economic measures designed to incapacitate the Russian financial system.

31 May 2022
Gopikrishna Butaka
Blog Post

The Future of Audit in the World of Interconnected Business

The COVID-19 pandemic had changed many things; one among them is the perception of the audit process as business processes have become more interconnected and interdependent.

27 May 2022
Naomi Buckwalter
Blog Post

Five Cybersecurity Memes and What They Say About Cybersecurity Today

Cybersecurity memes on social media are often good for a laugh, but several of the more popular ones have gained resonance with security professionals for a reason...

26 May 2022
Deepa Seshadri
@ISACA Article

Cultivating a Cyber Culture at Your Organization

Simon Sinek has said, “Corporate culture matters. How management chooses to treat its people impacts everything – for better or for worse.”

25 May 2022
Justin Henkel
@ISACA Article

How CISOs Can Uplevel the Security Conversation

Chief information security officers (CISOs) are becoming the most senior executive leader responsible for trust inside an enterprise.

25 May 2022
Sunil Bakshi
@ISACA Article

How Much Enough Is Enough?

Recently, due to the nature of my work, I was made aware of a cyberincident that was not widely publicized, wherein an attacker used social engineering techniques to manipulate a person into revealing their banking credentials, namely user ID and password.

25 May 2022
Jason Sechrist
Blog Post

Separating Fact from Fiction: Debunking Myths Around CMMC 2.0

With more than 220,000 companies supporting the US Department of Defense, the defense industrial base presents an enticing target for hackers, nation-states, and cybercriminals.

25 May 2022
Computer Brain with blue background
ISACA Journal Article

Real-World Data Resilience Demands an Integrated Approach to AI, Data Governance and the Cloud

The real-world rate of change affecting almost everything to do with data is what separates the theory of enterprise data resilience from its practice.

Author: Guy Pearce
Dr. Kimberlee Ann Brannock
Blog Post

Cybersecurity and Consumers

As a cybersecurity leader and scientist, I find it interesting that as I observe events all around me that all are seemingly unconnected, they are in fact connected, at times with exciting and favorable outcomes.

24 May 2022
Luigi Sbriz
Blog Post

Combining the Risk Register and the Maturity Model to Increase Total Value

Communicating the results of business controls to top management is never an easy process, especially if we want to ensure concrete information based on risk and effectiveness of controls is communicated. Generally, risk and controls rely on different methodologies; this is not ideal. Instead, we need flexible methodologies, collaboration between business processes and adequate tools.

23 May 2022
Digital Trust Requires All Hands on Deck—But the ROI Is Worth It
Blog Post

Digital Trust Requires All Hands on Deck – But the Payoff Is Big

The fields in which ISACA’s professional community works – such as audit, risk, security, privacy and governance – feed into the more encompassing realm of digital trust.

20 May 2022
Sundaresan Ramaseshan
Security Article

Performing User Access Reviews to Improve Enterprise Security

Security leaders can enhance security at their enterprises by conducting frequent and thorough user access reviews.

20 May 2022
Podcast
Podcast

Cyber (Business) Recovery

Steven talks to ISACA's Safia Kazi about how to prepare for a cybersecurity Event and how to recover. Steven discusses the types of attacks to watch out for, Business Continuity Planning and how to recover from a cybersecurity event.

20 May 2022
Safia Kazi
Privacy Article

Fostering Trust by Eliminating Dark Patterns

With the growing number of privacy laws and regulations that require consumer consent before collecting or processing data, some enterprises have turned to tricking consumers into giving their consent through the use of dark patterns, which are practices that deceive users into acting in a way in which they did not intend.

18 May 2022
Adham Etoom, CISM, CRISC, PMP, GCIH, FAIR, Government of Jordan, National Cyber Security Center, Jordan, and Ejona Preci, CISM, CRISC, ITIL, Information Security Risk Manager
Blog Post

COVID-19: An Ignitor in Information Risk Management

This makes one think about risk subconsciously as we are uncertain about when pandemics will happen as well as how we should be prepared to contain and reduce their impact.

18 May 2022
Andre Pitkowski and Daniel Bispo de Jesus,
Risk Article

Performing an Information Security and Privacy Risk Assessment

Enterprise information security and privacy professionals are responsible for identifying information security and privacy gaps in information management systems and processes.

18 May 2022
Better Cybersecurity Awareness Through Research
ISACA Journal Article

Better Cybersecurity Awareness Through Research

In the last few years, information security professionals have faced tremendous challenges. Just in 2021, there were more than two billion malware attacks and trillions of intrusion attempts.

Author: Ranjit Bhaskar
Matt Moog
Blog Post

Three Reasons Your Third-Party Management Program is Struggling

Building trust throughout an organization requires working collaboratively across lines of the business and gaining interdepartmental, cross-functional visibility.

16 May 2022
Understanding the Full Digital Trust Ecosystem
Blog Post

Understanding the Full Digital Trust Ecosystem

A Google search of “digital trust” turns up 5.73 billion results, and hundreds of recent trade press articles have covered the topic.

13 May 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A PDCA Approach to Conducting a DPIA

Since their inception, much has been written and discussed about Data Privacy Impact Assessments (DPIAs), a term introduced by the EU General Data Protection Regulation (GDPR).

11 May 2022
Veronica Rose
@ISACA Article

Survival Toolkit for Information Systems Auditors

Nobody starts out as an expert in their field, and work can become even scarier when switching from one career to another.

11 May 2022
Welland Chu
Blog Post

The Needed Societal Response to Cybersecurity Risk in the COVID Era

COVID-19 has transformed how business is conducted with the acceleration of cloud adoption and remote working. Organizations’ data is no longer kept within the perimeter of the office’s or data center’s boundary.

11 May 2022
Syed Salman
Governance Article

Maximizing the Benefits of DevOps Using COBIT

If adopted properly, Agile and DevOps practices can result in improvements in objective software development metrics such as deployment frequency, lead time for changes, change failure rate and mean time to recover (MTTR).

11 May 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Niki Gomes

Everyone starts somewhere and for Niki Gomes, it was at the front desk of a hotel where she worked her way up to hospitality management, before pivoting to accounting and finally to the American Red Cross...

11 May 2022
Andre Pitkowski
Blog Post

Award Winner Weaves ISACA Into Academic Curriculum

Andre Pitkowski recently visited with ISACA Now for a Q&A interview, reflecting on his award. The following is a transcript of the interview.

10 May 2022
Zero Trust in Data Privacy Operations
ISACA Journal Article

Zero Trust in Data Privacy Operations

Following the onset of the COVID-19 pandemic, the rapid expansion of remote work created new opportunities for cybercriminals.

Author: Valdez Ladd
Bhanu Jagasia
Blog Post

Zero Trust Does Not Imply Zero Perimeter

Typically, when we hear “zero trust” these days, folks generally hear the common example of remote employees not having to VPN (Virtual Private Network) back to their enterprise network to access the cloud resource.

9 May 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Ed McCabe

One of Ed McCabe's first childhood memories was taking apart his grandparent's heirloom grandfather clock to find out why it wasn't working.

27 May 2022
Anantha Sayana
Blog Post

Should Information Systems Audit Evolve to Information Systems Continuous Monitoring?

Nothing in this world is static. Everything evolves, and improvements often happen when things evolve.

6 May 2022
Advancing trust in a digital world
Blog Post

2021 Annual Report Spotlights ‘Inspiring Work’ of ISACA Community

Through new learning and credentialing opportunities, enterprise resources and its ever-growing global community, ISACA was in pursuit of digital trust throughout 2021 on multiple fronts.

5 May 2022
Digital Trust: A Modern-Day Imperative
@ISACA Article

Importance of Digital Trust Highlighted in Latest ISACA Report

Building digital trust is more important than ever before, according to ISACA’s latest free report, “Digital Trust: A Modern-Day Imperative.”

4 May 2022
Advancing trust in a digital world
@ISACA Article

ISACA 2021 Annual Report Released

ISACA’s 2021 Annual Report, with a theme of how ISACA is working to advance digital trust, is now available on the ISACA website.

4 May 2022
Pam Nigro
@ISACA Article

ISACA Announces 2022-23 Board Slate

Pamela Nigro will be the next chair of the ISACA board of directors when the 2022-23 ISACA board is installed on 1 June.

4 May 2022
Caitlin McGraw
@ISACA Article

Job Change and Buyer’s Remorse: Minimize Risk and Maximize Opportunity

It seemed like the perfect thing. The amazing gadget, the miracle face cream, the cool designer shoes – finally on sale.

4 May 2022
Brian Fletcher
Security Article

Basics for Improving the Safety of Your Organization's Data

The world is currently experiencing the Fourth Industrial Revolution (4IR), a result of which has been the innovation of big data.

4 May 2022
David Samuelson
Blog Post

Building a More Trustworthy Digital World

Technology is truly driving global innovation and the world economy.

3 May 2022
Michael P. Cangemi
Blog Post

In 50 Years, the ISACA Journal Has Had and Seen it All

Congratulations to the ISACA® Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA® members, their organizations, the IT governance community and society at large.

3 May 2022
Integrating MITRE With COBIT
ISACA Journal Article

Integrating MITRE With COBIT

Protecting enterprises from malicious code and software requires that governance and cybersecurity practitioners take a comprehensive approach.

Author: Blake Curtis
Spiros Alexiou
Blog Post

Practical Advice for Agile Audit

Agile audit is in right now, and it looks like even the people who were doing everything agile opposes are now ardent supporters and push for going agile.

2 May 2022
The Pitfalls of Supply Chain Risk Management
ISACA Journal Article

The Pitfalls of Supply Chain Risk Management

Many organizations have progressively increased their reliance on a growing number of global suppliers.

Author: David Podeswik
Operational Resilience Preparing for the Next Global Crisis
ISACA Journal Article

Operational Resilience: Preparing for the Next Global Crisis

Although resilience in business operations has been a priority for organizations since before the onset of the COVID-19 pandemic, the ongoing global pandemic has made resilience more critical than ever.

Author: Sumedha Adavade
Is Business Continuity Management Still Relevant?
ISACA Journal Article

Is Business Continuity Management Still Relevant?

Business continuity refers to the ability of organizations to minimize losses and keep functioning and fulfilling their missions, even under extremely adverse circumstances. But this is costly and, in current times, where cost cutting is a key concern, there is...

Author: Spiros Alexiou
Case Study Cloud-Native Security Using Security Using Zero Trust
ISACA Journal Article

Case Study: Cloud-Native Security Using Zero Trust

For most organizations, cloud usage is now the norm. Much like the adoption path of many technologies, the road to cloud normalization started with an initial reluctance and has only recently begun to gain wider acceptance.

Author: Ed Moyle
Incident Response During the Global COVID-19 Crisis
ISACA Journal Article

Incident Response During the Global COVID-19 Crisis

Since March 2020, the global COVID-19 pandemic has affected the characteristics of incident response (IR) in the cybersphere. These unprecedented times have forced some enterprises to deal with their most severe business crises to date and to cope with the pandemic’s impact on the threat landscape.

Author: Ofir Eitan
Understanding the Shared Responsibilities Model in Cloud Services
ISACA Journal Article

Understanding the Shared Responsibilities Model in Cloud Services

The world of on-premises technology was practical when cloud services were not available.

Authors: Jai Sisodia and Mohammed Khan
Meeting the Demand for Zero Trust Talent
ISACA Journal Article

Meeting the Demand for Zero Trust Talent

Implementing a zero trust architecture creates a more adaptable security platform that is not designed around a static, perimeter-based network defense strategy, which can help further protect critical systems and data from attacks based on confidentiality, integrity and availability.

Authors: Fortune Onwuzuruike and Kenneth Myers
Giving IT Governance Its Real Value
ISACA Journal Article

Book Review: Creating a Virtual-First Line of Defense for Secure Software Development

Creating functioning software is a challenge at the best of times, but ensuring that it is also secure is time consuming, requires fairly scarce skills and, frequently, is not effective.

Author: Robert Findlay
Michael Cangemi
ISACA Journal Article

Letter From a Past Editor: Dear Reader

Congratulations to the ISACA Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA...

Author: Michael P. Cangemi
Cyber (Business) Recovery
ISACA Journal Article

Information Security Matters: Cyber (Business) Recovery

The last of the five core functions of the US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is Recover. It comes last because this function only comes into play if the previous four—Identify, Protect, Detect and Respond...

Author: Steven J. Ross
Resilience and Regulation
ISACA Journal Article

IS Audit in Practice: Resilience and Regulation

My evenings are usually quiet three weeks out of the month, but at least one week is packed with community meetings and city public hearings. The pandemic may have impacted in-person gatherings, but government and community action continue online.

Author: Cindy Baxter
The Impact of Cryptocurrency and Its Carbon Footprint
ISACA Journal Article

The Bleeding Edge: The Impact of Cryptocurrency and Its Carbon Footprint

In recent years, cryptocurrency has played an increasingly important role in the financial market. From July 2020 to June 2021, the popularity of global cryptocurrency increased by more than 880 percent.

Author: Jiewen Wang
Planning for Failure to Ensure Resilience
ISACA Journal Article

Innovation Governance: Planning for Failure to Ensure Resilience

Even prior to the COVID-19 pandemic, the technology world was in the midst of a fundamental shift in how we operate. DevOps and cloud computing adoption growth was the vanguard of this change.

Author: K. Brian Kelley
Help Source Q&A
ISACA Journal Article

Help Source Q&A

What is resilience and how it is related to business continuity? Simply put, “resilience” means the ability to withstand an adverse situation and return to normal.

Author: Sunil Bakshi
Frank Downs
Blog Post

Failure to Patch and the Rare Case of the Java Crypto Hack

One of the often-accepted truisms in cybersecurity is to ensure that all systems supporting and protecting business operations are up-to-date and current.

29 April 2022
Security
Blog Post

Living off the Land (LotL) Classifier Open-Source Project

In security, “Living off the Land” (LotL or LOTL)-type attacks are not new. Bad actors have been using legitimate software and functions to target systems and carry out malicious attacks for many years.

28 April 2022
Krishna Das Manghat
Emerging Technology Article

Benefits of Adopting Secure Access Service Edge for Operational Technology Security

Traditional operational technology (OT) networks are built based on the rigid 6-level (level 0 to level 5) hierarchical Purdue model, which has worked well for the last few decades.

28 April 2022
The Makings of a Cybersecurity Leader
@ISACA Article

The Makings of a Cybersecurity Leader

Phil Zongo, recently visited with @ISACA to discuss cybersecurity leadership, cyber strategy and his new memoir.

27 April 2022
Jack Freund
@ISACA Article

Understanding the Distinction Between Cyberwar and Espionage

“May you live in interesting times” is an apocryphal curse that is purported to be of Chinese origin. On the surface, it sounds like a good thing: one would think everyone would want to live in interesting times.

27 April 2022
Certified Information Security Manager
Blog Post

Twenty Ways Information Security Has Become More Challenging in the Past 20 Years

To mark the anniversary of ISACA’s Certified Information Security Manager (CISM) we spoke with 20 CISM-holders to collect their commentary on the biggest challenges that have emerged in infosec since CISM came on the scene in 2002.

27 April 2022
A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2: Identity Trust Service Implementation

Identifying a physical person on a network using their digital name (username) is a task made possible by the authentication system.

Author: Luigi Sbriz
ISACA live tile
Podcast

ISACA Live: Risk Scenarios

Paul Philips and Lisa Young will discuss how risk scenarios help decision-makers understand how certain events can impact organizational strategy and objectives

27 April 2022
CISM 20th Anniversary Infographic
Blog Post

Twenty Ways Information Security Has Changed for the Better in the Past 20 Years

ISACA’s Certified Information Security Manager (CISM) certification is now in its 20th year and to mark the anniversary, we spoke with 20 CISM-holders to collect their commentary on what has changed for the better.

26 April 2022
Brian Fletcher
Blog Post

How CISOs Can Score Some Quick Wins

Brian Fletcher, recently visited with ISACA Now to discuss how chief information security officers (CISOs) can start off by achieving some quick wins for their organizations and how organizational cyber maturity enters the equation.

25 April 2022
Ali Pabrai
Security Article

Decoding CUI—a Highly Valued Data Type at Risk

Governments often create or own information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and governmentwide policies. In the United States, this type of information is referred to as Controlled Unclassified Information (CUI).

25 April 2022
Brad Rhodes
Blog Post

Malicious Trends: What You Need to Know

According to the recent Cybersecurity Ventures 2022 “Cybersecurity Almanac,” organizations will spend approximately US$1.75 trillion on cybersecurity between 2021 and 2025.

22 April 2022
Industry Spotlight Podcast
Podcast

Managing Data Privacy Risks and Compliance with a Distributed Workforce

Data now includes, consumer's social media, news, view and even browser searches. From 2010-2020, the amount of data created, captured, and copied in the world increased from 1.2 trillion GB to 59 trillion GB and the amount created in the next 5 years is projected to double

22 April 2022
David Shavgulidze
Blog Post

Supply Chain Security: Analysis of the Georgian Ecosystem

According to the European Union Agency for Cyber Security (ENISA): “In cybersecurity, the supply chain involves a wide range of resources (hardware and software), storage (cloud or local), distribution mechanisms (web applications, online stores), and management software.

21 April 2022
Caitlin McGraw
@ISACA Article

The Layer Cake Paradigm Part II: Great Interview Questions that Make You Memorable

Recapping quickly, our focus in this article is how to ask questions during job interviews that “get the job done.”

20 April 2022
Tracking Two Decades of Changes in Information Security
@ISACA Article

Tracking Two Decades of Changes in Information Security

For the past 20 years, the Certified Information Security Manager® (CISM®) has served as the global credential that ensures alignment between an organization’s information security program and its broader strategic goals.

20 April 2022
A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1: Identity Trust Abstract Model

The identity of an Internet citizen, or netizen, is generally determined by asking the digital citizen to share personal data with the authentication system to obtain credentials to access data.

Author: Luigi Sbriz
Alex Holden
Blog Post

Proven Methodologies to Fight Ransomware

Though the topic of ransom and ransomware is extremely popular, a lot of discussions center around a few topics: prevention, insurance and recovery.

19 April 2022
Liz Pisney
Blog Post

Saluting Our Global Volunteers

When ISACA certification candidates take an exam, the content of that exam was created and reviewed by ISACA volunteers.

18 April 2022
Kurt Markley
Risk Article

How to Develop and Execute a Rigorous Data Backup and Recovery Strategy

When approximately 22 terabytes (TB) of Dallas Police Department (DPD) (Texas, USA) data were accidentally deleted during a cloud migration in March 2021, ultimately only 14 TB could be recovered, affecting myriad case files and prosecutorial actions.

18 April 2022
Podcast
Podcast

CMMC and CUI: Rocket Fuel

Join ISACA's Senior Manager, CMMI Professional Practice, Kileen Harrison as she talks with ecfirst's Chief Executive Officer, Ali Pabrai about his recently released articles, “What Cyberprofessionals Should Know About CUI”, and “US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework”.

18 April 2022
Joanna Karczewska
Blog Post

Celebrating Women in Cybersecurity

Joanna Karczewska, a longtime ISACA member from Poland, recently visited with ISACA Now to discuss the book and her views on progress made by women in the cybersecurity field. The following is a transcript of the interview:

15 April 2022
Muhammad Asif Qureshi
Blog Post

The Evolution of GRC

Back in the day, manual processes were dominant, with telex and fax being the most common mode of communication. As a result, risk governance was also focused on these ways of business processing.

14 April 2022
David Samuelson
@ISACA Article

Continuous Learning Commitment: The Path Forward in a Volatile Labor Market

It’s no secret that companies currently face an acute talent crunch. Between the pandemic, The Great Resignation and economic inflation – not to mention turbulent world events – we’re in a highly volatile labor market.

13 April 2022
John P. Pironti
@ISACA Article

Five Key Considerations for Improving IT Supply Chain Security

Most organizations have historically focused their information risk and security efforts on what they can control and often ignore their IT supply chains, which they can only influence.

13 April 2022
Rob Clyde, ISACA board director, Executive Advisor, ShardSecure, and Chris Dimitriadis, Chief Global Strategy Officer, ISACA
Blog Post

The Trans-Atlantic Data Privacy Framework: A Significant Step Toward Reinforcing Transatlantic Cooperation, Setting a New Standard for Personal Data Protection

Global trade has been growing for decades, as most economies accelerated their globalization since the 1990s, using digital technology as a key catalyst that helped industries interconnect further and innovate.

13 April 2022
Upesh Parekh
Risk Article

Achieving Effective Cloud Risk Management

Cloud technology has leaped to the forefront of the technological world in the last 2 decades. One would be hard pressed to find an enterprise that has not implemented cloud technology in some form or another.

13 April 2022
Kelly Hood
Blog Post

Level Up Your Governance to Drive Business Growth

When you search for the term “cybersecurity” online, you get approximately 17 billion images of padlocks and shields – but what is this trying to communicate?

12 April 2022
Cybersecurity in a COVID-19 World
ISACA Journal Article

Cybersecurity in a COVID-19 World

The COVID-19 crisis has created a cyberpandemic that is due, in large part, to decisions made by organizational leaders and stakeholders.

Authors: Maik Fichtenkamm, Gerald F. Burch, Ph. D and Jordan Burch
Jo Stewart Rattray
Security Article

Where Privacy Meets Security

In a world where data are pervasive and increasingly connected, for security professionals, protecting the privacy of individuals and organizations could be compared to trying to put an octopus into a string bag: a constantly changing, wriggly challenge.

11 April 2022
Joseph Cortese
Blog Post

What Business Leaders Need to Know About Cybersecurity Preparedness

Many cybersecurity incidents occur when organizations think they’re doing the right thing.

8 April 2022
Elastos Chimwanda
Audit Article

Essentials for an Effective Cybersecurity Audit

Cybersecurity has become a pressing issue worldwide, thereby necessitating robust auditing procedures to provide assurance to senior management and boards of directors (BoDs).

8 April 2022
Sandipan Gangopadhyay, CGEIT, and Stuart McGuigan
Blog Post

The Future of Complex Legacy Enterprise Transformation

The process of manual programming has never been a perfect or exact science, and the resulting defects that occur along the way have long plagued the software development lifecycle and are therefore perpetuated in legacy systems.

7 April 2022
Guy Pearce
@ISACA Article

Explainable Artificial Intelligence (XAI): Useful But Not Uncontested

Artificial intelligence (AI) has been referred to as a “black box” technology given the difficulty organizational management, and even specialists, have in explaining what the technology does with its data input.

6 April 2022
Information Security
Blog Post

Using SWIFT as a Lesson for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the Society for Worldwide Interbank Financial Telecommunication’s (SWIFT) communication system, were compromised.

6 April 2022
Donnie Carpenter
Risk Article

Concepts to Consider When Acquiring “The Little Guy”

Throughout the last decade, there has been an increase in cyberattacks targeting small- and medium-size enterprises with a myriad of techniques and payloads, and more than 80% of enterprise owners know they are at risk.

6 April 2022
Helpsource Q&A
ISACA Journal Article

Help Source Q&A

Before the pandemic, most organizations worldwide believed that offices were essential to their business and productivity deteriorates when employees work from home. 

Author: Sunil Bakshi
Binita Patel
Blog Post

Addressing the Biggest Challenges in Cloud Security

Gartner has predicted that by 2026 the public cloud expenditure will exceed 45 percent of all enterprise IT.

5 April 2022
Caitlin McGraw
@ISACA Article

The Layer Cake Paradigm: Strategies for Asking Great Questions at Each Interview Stage

This is the first of a two-part article on how to ask questions during interviews that “get the job done,” meaning they help you stand out from the competition, and they get you the valuable information you need to do excellent due diligence in the job search process.

6 April 2022
Karen Heslop
Blog Post

ISACA Seeks Input to Digital Trust Ecosystem Framework

If you do a Google search for digital trust, you’ll receive over 5.5 billion results; indeed, digital trust is a popular topic these days! Definitions of digital trust, however, vary widely.

4 April 2022
Deepa Seshadri
Privacy Article

Data Privacy: From Compliance to Trust

Organizations are looking to prioritize their users’ privacy notices and policies not just to protect their value and to be compliant with existing laws, but also to provide something that is the holy grail for a product: trust.

4 April 2022
Silvina Moschini
Blog Post

Technology and the Democratization of Opportunity

Silvina Moschini visited with ISACA Now to discuss digital transformation, cloud adoption, corporate social responsibility and more.

1 April 2022
Nasir Ali
Risk Article

Cybersecurity and Third-Party Supplier Risk

Enterprises today are being driven to adopt technology at an unprecedented pace as society witnesses what could be referred to as the Fourth Industrial Revolution (4IR). This technological adoption has been driven by factors such as the quest for efficiency, technology...

1 April 2022
Isabel Aguilera
Blog Post

Embracing the Possibilities of the Modern Business Landscape

Isabel Aguilera recently visited with ISACA Now to provide her perspective on technology’s role in shaping today’s business environment.

31 March 2022
Podcast
Podcast

CyberPros: Evolution of Interconnectivity of Cyber and Warfare with Fred Carr

In this episode, ISACA’s CyberPro, Jon Brandt chats with Founder and CEO of Anchor Systems, Fred Carr about the current threat landscape, challenges, and misalignment between public and private sectors, and impacts on national and global security.

31 March 2022
Gary Carrera
@ISACA Article

Zero Trust as Security Strategy to Prevent Data Exfiltration in the Cloud

Before diving into how zero trust security can factor into cloud security, it is worth clarifying that zero trust is not a new concept, nor is it a new technology that you can simply implement in your infrastructure to enhance the security of your data.

30 March 2022
Joanne Joseph
Blog Post

The Pandemic Era: A Period of Business Resilience

COVID-19 has markedly impacted the mitigation measures for business continuity and IT disaster recovery adopted by businesses over the last two decades.

30 March 2022
Donnie Carpenter
Security Article

The NATO Cyberresponse Dilemma

It should come as no surprise that the North-Atlantic Treaty Organization (NATO) finds itself in a bit of a legal and procedural dilemma regarding response efforts and capabilities to the Russian invasion of Ukraine.

30 March 2022
Understanding the Importance of the Turkish Information and Communication Security Guide on Cybersecurity
ISACA Journal Article

Understanding the Importance of the Turkish Information and Communication Security Guide on Cybersecurity

Countries around the world are looking to invest in infrastructure that will allow for the use and dissemination of innovative technologies.

Author: Tolga Mataracioglu
Lukas Werner
Blog Post

What to Consider When Making the Step to the Cloud

Organizations that decide to take their entire IT landscape, or parts of it, to the cloud need to consider the different factors that need to be prioritized according to their needs.

29 March 2022
Podcast
Podcast

A Security Awareness Program for PCI-DSS Compliance

People are considered the weakest link in any organization’s cybersecurity defenses.

29 March 2022
Hand typing on a keyboard
Blog Post

Edwards: From a Compliance Mindset to a Performance Mindset

Edwards was an early adopter of the MDDAP program. The company’s Draper, Utah facility completed its first MDDAP appraisal in 2017 as part of the program pilot.

25 March 2022
Dave Schmoeller
Blog Post

Using InfoSec Compliance Programs for Proactive IT Risk Management

Proactive IT risk management is crucial to maintain a successful business. This means implementing measures to identify and mitigate potential risks, continuously and reliably, before those risks can cause material (or worse, permanent) damage.

24 March 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Jo Stewart-Rattray

In this episode of Industry Spotlight, Robyn Franko, Manager of Event Operations and Services at ISACA, chats with Jo about her background and career path, hobbies, and some interesting challenges the industry faces.

24 March 2022
State of Cybersecurity Infographic
@ISACA Article

Hiring Challenges Linger and Loom Large on Cybersecurity Landscape

Longstanding talent gaps on the cybersecurity landscape have been compounded in the era of The Great Resignation. ISACA’s free State of Cybersecurity 2022 report shows most companies have significant work to do to find and retain the cybersecurity talent they need.

23 March 2022
Zero Trust: How to Beat Adversaries at Their Own Game
@ISACA Article

New ISACA Zero Trust Resource Shows How to Beat Adversaries at Their Own Game

With the acceleration of remote working and employee use of personal devices for business purposes, enterprises need to develop a Zero Trust strategy to defend against threats.

23 March 2022
Kate O'Neill
Blog Post

Aligning Business Objectives and Human Outcomes in Digital Transformation

Kate O’Neill, recently visited with ISACA Now to provide her view of human-centric digital transformation, how data should be integrated into companies’ business models and more.

23 March 2022
Naomi Buckwalter
Blog Post

Cyber Workforce: Out of the Ashes and Into the Fire

ISACA’s State of Cybersecurity 2022 report was published earlier this week, and it’s not looking too good for us good guys. For the third year in a row, the cybersecurity labor shortage looms large as the main focal point, casting its long, grim shadow across most of the report’s 40-plus pages.

23 March 2022
Chad Martin
Audit Article

An Integrated Approach to Security Audits

A cyberattack can be devastating to any organization because it compromises sensitive data and, as a result, the financial position, strategic vision, and more important, the trust and credibility that the enterprise has built over the years.

23 March 2022
The Future of Govtech
ISACA Journal Article

The Future of Govtech

The average Internet user spends almost seven hours online every day, which equates to two days a week. Meanwhile, the Internet is used by approximately 4.9 billion people, which is more than 60 percent of the global population.

Author: Chetan Choudhury
Collin Beder
Emerging Technology Article

Digital Realities: Future Potentials and Use Cases

Humans are a curious species, and it is part of our nature to ponder the future. We are hardwired to find patterns, so we often use the past to predict what will emerge in the future.

22 March 2022
Raef Meeuwisse
Blog Post

Essential Tips for Staying Current on Cybersecurity Terminology

Navigating the language of cybersecurity is like trying to win an argument with someone you love. You must be open-minded, kind-hearted and committed.

21 March 2022
Veronica Rose
Blog Post

Don’t Let Collaboration Tools Become a Red Carpet for Black-Hat Hackers

2020 was a unique year and most of us couldn’t wait to call an end to it for so many reasons, including the increased trends in cyberattacks – some of which targeted collaboration tools such as in the example I noted above.

18 March 2022
Podcast
Podcast

The Transformative Power of Mobility

It's hard to believe the quarter century mark has almost arrived! Have you thought about what you would like your work world to be in 2025?

18 March 2022
Adam Kohnke
Blog Post

How Auditors Fit into the Zero Trust Journey

"Zero Trust” is one of those security buzzwords making the rounds on the inter-webs recently, but what does it mean and why should security or IT audits teams start caring about this term? Traditionally, enterprises concern themselves with forming a layered defensive...

17 March 2022
Strong Cyber Accountability at Board Level a Must
@ISACA Article

Strong Cyber Accountability at Board Level a Must

Accountability and oversight are the two key reasons why a company’s board exists. Everything that the board does can be subsumed into these two buckets.

16 March 2022
Lisa Villanueva
Blog Post

Evaluating Governance Over DevOps Practices

Auditors and related practitioners are always learning and prepared to pivot as new technologies and modes of software delivery are introduced.

16 March 2022
A Unified Response to Cyberattacks, Fraud and Financial Crime
ISACA Journal Article

A Unified Response to Cyberattacks, Fraud and Financial Crime

These days, virtually all aspects of public life are visible online. With this trend comes abundant risk. Organizations are negatively affected more frequently by cyber-related issues, including cybersecurity intrusions, fraud and financial crimes (e.g., money laundering, bribery, tax evasion).

Author: Vishal Chawla
Industry Spotlight Podcast
Podcast

Industry Spotlight with Raven David

Listen as Raven recaps the success of his cybersecurity awareness program, gives thoughtful advice to the next generation of young professionals, and discusses his current self-educating project, 3D printed chess set with Arduino-powered actuators and a Python chess engine.

16 March 2022
Larry Wlosinski
Blog Post

Improving Cybersecurity Incident Response

Incident response handling procedures could use some improvement. By utilizing and practicing incident response exercises, organizations can put in place a strong and integrated response to incidents of varying types.

15 March 2022
Podcast
Podcast

Privacy for Sale

Is Privacy a commodity? This episode explores the future direction of privacy and the demise of privacy in the digital age. Could privacy become something that people cannot afford, creating a two-tier system of internet users — those who can afford privacy and those who cannot?

14 March 2022
Donald Tse
Blog Post

Embedding Digital Trust in Fintech: Seven Practical Steps

There has long been debate about whether innovation and risk management can coexist. For some digital pioneers, risk and compliance are synonymous with being a roadblock to innovation.

11 March 2022
Molly Mullinger, CPA, Manager of Solutions Advisory Services at AuditBoard, and Shehan Jayakody, Senior Manager of Product Solutions, AuditBoard
Blog Post

Vulnerability Management: Addressing Your Weaknesses Before They Can Be Exploited

As businesses continue to extend their digital footprints to support remote workers and deliver the products and services customers demand, the risk of a breach grows exponentially.

10 March 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

The Business Risk Posed by Artificial Intelligence

Artificial intelligence (AI) is no longer a new concept. Much has been written about this emerging technology and new articles and research are published online every day. Organizations have started to learn and understand its full potential.

9 March 2022
Rahul Pandey
Blog Post

Exploring HackTown: A College for Cybercriminals

It’s becoming simpler for wannabe cybercriminals to catch a portion of the billions of dollars lost through fraud happening every year. All you really need is some Bitcoin knowledge, some free tools and no moral qualms taking from others.

9 March 2022
Safia Kazi
Privacy Article

Educated and Empowered Data Subjects: A Privacy Prerequisite

US lawmakers recently introduced a bill seeking to improve transparency of terms of service agreements.

9 March 2022
A Strategic Risk-Based Approach to Systems Security Engineering
ISACA Journal Article

A Strategic Risk-Based Approach to Systems Security Engineering

In the 21st century, the backbones of business, trade, economy and critical infrastructure for public- and private-sector enterprises are information systems and the data they store, process and transmit.

Author: Hunter Sekara
Podcast
Podcast

Ensuring that Cybersecurity is Everyone’s Job

In this podcast, we join ISACA’s Performance Based Training Engineer, Collin Beder as he speaks with Tom Schneider, Senior Associate of Proactive Advisory for Cyber Defense Labs as they discuss Tom’s recently released article “Ensuring that Cybersecurity is Everyone’s Job”.

9 March 2022
Reshma Devi
Blog Post

Taking a Clear-Eyed View of the Road Ahead for Women in Security

ISACA member Reshma Devi recently visited with the ISACA Now blog to discuss her mindset about volunteering, her views on progress for women in the security industry and more.

8 March 2022
Sharda Shetty
Blog Post

My New Career Connection Through ISACA Mentorship Program

I have been a member of ISACA for over 10 years, and it has touched my life in many ways. When I first acquired the CISA certification in 2012, an avalanche of job offers followed!

7 March 2022
Podcast
Podcast

Zero Trust: How to Beat Adversaries at Their Own Game featuring Dr. Zero Trust

ISACA’s Jon Brandt welcomes Dr. Chase Cunningham aka Dr. Zero Trust to the ISACA CyberPros podcast. You may know Chase from his own podcast, Dr. Zero Trust, or book series, Cynja.

4 March 2022
Adham Etoom
Blog Post

Good Enterprise Governance Needs CGEIT: My Journey to Pass the Exam

I earned ISACA’s CRISC and CISM certifications in 2019 and 2020, respectively. I always feel a professional obligation to give back to ISACA global community through sharing my lessons learned after passing each exam – hopefully providing practical guidelines will be beneficial to professionals who are preparing to obtain these industry-recognized credentials worldwide.

3 March 2022
Avoiding the Chaotic 5G Rollout at US Airports
@ISACA Article

Avoiding the Chaotic 5G Rollout at Airports

5G rapid rollout is a high priority around the world because its adoption can generate high revenue in both the public and private sectors thanks to its greater speed, capacity, and quicker response, which can positively increase businesses’ productivity and efficiency.

2 March 2022
Caitlin McGraw
@ISACA Article

The Great Resource Roundup

A fact of modern life: We love curated lists and recommendations. Yelp, Wirecutter, Rotten Tomatoes, Amazon, and so many more … we all have our go-tos. Recommendations make life easier and more interesting.

2 March 2022
Tensions Shine Spotlight on Protecting Critical Infrastructure
Blog Post

Tensions Shine Spotlight on Protecting Critical Infrastructure

Given the tense security environment caused by Russia’s current attacks on Ukraine, threats to critical infrastructure are top-of-mind throughout the cybersecurity community.

2 March 2022
A Five-Layer View of Data Center Systems Security
ISACA Journal Article

A Five-Layer View of Data Center Systems Security

The data center is the central nervous system for any organization. As the hub of servers that host business-critical data, the data center needs special attention. There are some basic checks required for keeping IT systems safe in the data center. It is imperative for IT...

Author: Ravi Shankar Vemuri
GREGORY J. TOUHILL
ISACA Journal Article

Letter From the Board Chair: Dear Reader

The volume you are reading is the ISACA Journal’s second in its 50th anniversary year. The topic of the workforce is one that has evolved significantly over time—and one that continues to change rapidly.

Author: Gregory J. Touhill
Privacy for Sale
ISACA Journal Article

Information Security Matters: Privacy for Sale

On 16 September 2021, I was perusing my morning newspaper (well, actually, my morning news website) and was struck by this headline: “The Battle for Digital Privacy Is Reshaping the Internet.”

Author: Steven J. Ross
Transformative Power of Mobility
ISACA Journal Article

IT Audit in Practice: The Transformative Power of Mobility

It is hard to believe the quarter century mark is just a few years away. The pace of technology has been frenetic since the turn of the century, and the upcoming milestone that 2025 represents is an opportunity to reflect upon what it means for a workforce that has gone from dotcoms to Zoom.

Author: Cindy Baxter
Helpsource Q&A
ISACA Journal Article

HelpSource Q&A

Our organization is contemplating hiring a virtual CISO. How does the role work and how do we ensure that it will be effective and meet business objectives?

Author: Sunil Bakshi
Mindset Matters
ISACA Journal Article

Mindset Matters

On 11 March 2020, just two months after the initial cases were uncovered in Wuhan, China, the World Health Organization officially declared COVID-19 a pandemic. Eight days later, the US State of California became the first state to issue a stay-at-home order, requiring...

Author: Kevin M. Alvero
Bringing Enterprise Security Home
ISACA Journal Article

Bringing Enterprise Security Home

The May 2021 Colonial Pipeline ransomware attack that crippled fuel delivery for several days in the southeast region of the United States was not the first time US enterprises have been held hostage by criminal hackers—and it will not be the last.

Author: Pranav Kumar
The Cyberrisk Quantification Journey
ISACA Journal Article

The Cyberrisk Quantification Journey

Many organizations suffer from being unaware of their levels of cyberrisk and lack business engagement in cybertechnology in general.

Author: David Vohradsky
The Crucial Principle of Need to Have Available
ISACA Journal Article

The Crucial Principle of Need to Have Available

When confidentiality, integrity and availability (CIA) were established as the main information security attributes in the 1990s, employees around the world were not working from home due to a global pandemic.

Author: Yiannis Pavlosoglou
Growing a Technology Company Using a Secure-by-Design Approach
ISACA Journal Article

Case Study: Growing a Technology Company Using a Secure-by-Design Approach

In 2018, Trigo Vision was founded by brothers Michael and Daniel Gabay to help grocery stores embrace digital transformation and innovate toward a checkout-free experience for customers. The start-up, based out of Herzliya, Israel, built a technology predicated...

Author: Katie Teitler
Ensuring That Cybersecurity Is Everyone’s Job
ISACA Journal Article

Ensuring That Cybersecurity Is Everyone’s Job

Employees focus on the responsibilities that are listed in their job descriptions. If cybersecurity and privacy responsibilities are not documented in job descriptions, then it is likely that staff members will assume that cybersecurity is not a primary responsibility for them...

Author: Tom Schneider
Taking IT Operations From Phoenix to Hydra Dragon
ISACA Journal Article

Taking IT Operations From Phoenix to Hydra Dragon

If there is a choice between being a phoenix or a hydra dragon, which option would be better? Both are ancient mythical creatures with supernatural powers.

Author: Abdelelah Alzaghloul
Facts and Fallacies of IoT-Driven Workplace Transformation
ISACA Journal Article

Facts and Fallacies of IoT-Driven Workplace Transformation

Due to the fast-paced, IT-enabled industrial revolution, new and innovative technologies have become more deeply ingrained in business operations and society in general.

Author: Vimal Mani
Podcast
Podcast

Breaking Down the ESET T3 2021 Threat Report

Tune in as ISACA’s Kevin Keh talks with the Chief Security Evangelist of ESET, Tony Anscombe about the latest released report from ESET.

1 March 2022
Shannon Donahue
Blog Post

Volatile Times Call for Heightened Cybersecurity Preparedness

The recent attacks on Ukraine are a daunting reminder that today’s battles occur on two fronts: the physical world and the digital one.

28 February 2022
Allen Ari Dziwa
Blog Post

A Lesson for the Cybersecurity Community

With the numerous cyberattacks being reported in the news almost daily, I find it helpful to think of some words of wisdom from my grandfather.

25 February 2022
Luis Gorgona
Blog Post

Getting Creative with Maturity Models and COBIT 2019

Maturity models have become an area of personal interest in my professional practice. Maturity models can act as a common language that serves as a bridge between the business and the IT function.

24 February 2022
Capability Maturity Model
ISACA Journal Article

Capability Maturity Model and Risk Register Integration: The Right Approach to Enterprise Governance

The total number of active controls in an enterprise is always extremely high. Part of the normal functioning of any process or activity is to define an objective, map the rules to achieve it, put them into practice and then constantly check their alignment with the defined objective.

Author: Luigi Sbriz
Bruce R. Wilkins
Security Article

Improving Cybersecurity Training to Protect Your Enterprise and Yourself

Security is everyone’s responsibility. Whether it is viewed as a burden, an obstruction to business goals or part of doing a good job, achieving effective security requires each and every individual to participate.

23 February 2022
Improving Cybersecurity Training to Protect Your Enterprise and Yourself
@ISACA Article

What Cyberprofessionals Should Know About CUI

It has been said that data are the new oil, and personally identifiable information (PII), personal data (PD) and protected health information (PHI) are being drilled for in the new data-based economy.

23 February 2022
Gurneet Kaur
Blog Post

Why Collecting the Right Metadata is Crucial for Scaling a Security Program

At Adobe, security is a critical priority for us, and we believe in defense-in-depth, which begins with monitoring — from collecting event logs and configuration data made available by public cloud providers, to logs from EDR systems and vulnerability scanning pipelines.

23 February 2022
Jonathan Brandt
Security Article

Courage Under Fire

Most people recognize that humans are fallible, but this fact can have dire consequences for those whose jobs entail protecting life or assets. Within the cyber realm, insiders are often responsible for cybersecurity incidents, resulting in a US billion-dollar security awareness computer-based training market.

23 February 2022
Wole Davis
Blog Post

Auditing in a Virtual Universe

The Industrial Revolution in the 18th and 19th centuries came with a lot of transformations and innovations that gave rise to the use of machines and fundamentally changed the ways humans live.

22 February 2022
Data and AI Management in Smart Agriculture
ISACA Journal Article

Data and AI Management in Smart Agriculture Using Soil and Crop Data

With smart agriculture using soil and crop data gaining traction around the world, the importance of data management is also being increasingly recognized. As in any other business, the products produced (in this case, crops in agriculture) need to be safe and environmentally and socially friendly.

Authors: Mitsuhiko Maruyama, Taiji Ayabe, Yotaro Sato and Alexander Vinson
Podcast
Podcast

Building Digital Trust in a FinTech Start Up

Today's Page to Podcast features ISACA's Kevin Keh and Donald Tse, the Head of Cyber & Technology Risk at Mox Bank and author of "Cybersecurity and the Technology Risk in Virtual Banking", as they dive into the virtual banking scene in fintech.

22 February 2022
Journal 50 Years
Blog Post

Celebrating Five Decades of the ISACA Journal

The ISACA Journal is more than just a print and digital publication – for 50 years, it has served as a reflection of ISACA’s membership, in the view of Steven Ross.

18 February 2022
Podcast
Podcast

Lessons Learned from a Year of Remote Work

Working from alternate work sites using unsecure networks may be here to stay, but there is much to learn from 2020 that can help improve cybersecurity capabilities for remote staff.

18 February 2022
Cat Coode
Blog Post

Drilling Down on Data Protection and DPO Reporting

Cat Coode, founder of Binary Tattoo and an expert in global privacy regulation compliance, recently participated in a privacy-themed Ask Me Anything thread on ISACA’s Engage platform.

17 February 2022
The Role of Technology in SOX and ICFR Compliance Programs
ISACA Journal Article

The Role of Technology in SOX and ICFR Compliance Programs

After several major accounting scandals, the US Sarbanes-Oxley (SOX) Act of 2002 was enacted in the United States to protect investors from fraud, improve reliability of financial reporting and restore investor confidence.

Author: Nneoma Okorie
Who Is Ultimately Responsible for Your Organization’s Security?
@ISACA Article

Who Is Ultimately Responsible for Your Organization’s Security?

Being a telecom engineer by profession, most of my time is spent in technical areas where most of the people are usually of the opinion that network security is the responsibility of the security team (Security Operations Center) and the security auditors only.

16 February 2022
Jo Stewart Rattray
Blog Post

How to Navigate the Perfect Storm: Cyberthreats and Skills Shortages

Over the past two years in particular, the importance of cybersecurity has been globally recognized, and sophisticated cyberattacks have made international headlines.

15 February 2022
Pablo Ballarin
Emerging Technology Article

Ethical Emerging Technologists

Cybersecurity professionals aim to help organizations protect their information and IT infrastructures. Their main purpose is to avoid negative impacts, not only to their clients’ enterprises, but also to their clients’ and users’ lives.

15 February 2022
The Evolution of Audit in the Wake of the Pandemic
ISACA Journal Article

The Evolution of Audit in the Wake of the Pandemic

The practice of audit is age-old, though the many models and methods have evolved over time. The audit community has faced significant challenges, ranging from misalignment with auditees to ignorance about changing risk areas with technology advances.

Author: Gopikrishna Butaka
Podcast
Podcast

Unpacking Pakistan's Cybersecurity Policy 2021

ISACA’s Director of Professional Practices & Innovation, Jon Brandt, is joined by Muneeb Imran Shaikh, author of "Pakistan’s Cybersecurity Policy in 2021: A Review".

15 February 2022
Governance
Blog Post

Individual Behavior, Corporate Action and Sarbanes-Oxley

In recapping the history of the Sarbanes-Oxley Act (SOX) of 2002, discussions often include lists of the corporations whose actions led to enactment of this United States legislation. The terms “corporate scandal” and “corporate fraud” are used.

14 February 2022
Information Security
Blog Post

A Workplace Sea Change: Sizing Up The Next Normal

The workplace in February 2022 looks drastically different than it did even a year ago and is likely to be reshaped even further in the year to come.

11 February 2022
Alex Bermudez
Blog Post

Many Shades of a Common Problem: Privacy Rights Requests

DSARs, IRRs, Consumer Rights’ Requests, Derechos ARCO – if you broke out into a cold sweat reading any one of those, then this blog post is for you. Privacy requests are complex and burdensome in daily operations today, and only getting more prolific.

10 February 2022
Redefining Risk Toward Its Management
ISACA Journal Article

Redefining Risk Toward Its Management

One analysis of the word “risk” and its impact on risk management processes uses RISK as an acronym for reasoning, intelligence, strategy and knowledge.

Author: Tapas Bhattacharya
Podcast
Podcast

Using XDR and Zero Trust to Combat Ransomware

Listen in as ISACA's Research Advisor, Brian Fletcher and Trend Micro's Bill Malik look into the realities behind ZDR and Zero Trust, how ransomware works, and how the both XDR and Zero Trust can help organizations minimize their vulnerabilities.

10 February 2022
Governance Roundup - What Are You Doing About Environmental, Social and Governance Factors in Your Enterprise?
@ISACA Article

Environmental, Social and Governance Gains Traction

A new ISACA publication discusses the importance of establishing an environmental, social and governance (ESG) framework and applying it to an enterprise’s daily operations.

9 February 2022
ISACA Conference Session to Spotlight Lessons from SolarWinds Breach
@ISACA Article

ISACA Conference Session to Spotlight Lessons from SolarWinds Breach

An upcoming ISACA Conference session will shed new light on one of the most consequential cybersecurity events of all time.

9 February 2022
Sunil Bakshi
@ISACA Article

Tips for Effective Control Design

While someone may be familiar with a concept because they have been putting it into practice for some time, when they try to articulate it to others, they might find it difficult to explain.

9 February 2022
Leeza Garber and Scott Olson
Security Article

Using a Team Approach in the New Year to Face the Future

Anticipating how the world of technology will evolve and change is not only a goal for economists, investors and power players in the stock market, but for cyberentrepreneurs, risk managers, IT professionals, chief information security officers (CISOs) and chief security officers (CSOs).

9 February 2022
Chetan Anand
Blog Post

Insights into Environmental, Social and Governance (ESG)

Are we prepared for the Environmental, Social and Governance (ESG) challenge? Organizations are facing heightened expectations from interested parties such as regulators, customers, consumers, investors, community activists and others when it comes to ESG.

8 February 2022
Paul Thompson
Blog Post

Leveraging Cybermaturity to Right-Size Cybersecurity

We hear the word “cybermaturity” tossed around quite often these days, but what does it mean? Cybermaturity is a state describing the sophistication, or rigor, of one’s cybersecurity capabilities and processes.

8 February 2022
A Three-Way Approach for Breaking Down the Great Wall of IT
ISACA Journal Article

A Three-Way Approach for Breaking Down the Great Wall of IT

Sometimes known as the Stone Dragon, the Great Wall of China is one of the world’s greatest engineering wonders. This masterpiece can be seen from space and was built as a series of fortifications over several hundred years and across the historical northern borders of Imperial China.

Author: Abdelelah Alzaghloul
Justin Henkel
Blog Post

Aggravating Circumstances for an RCE Vulnerability: A Log4j Retrospective and Risk Landscape Evaluation

Information security teams were forced to respond over the holiday as an Apache Log4j zero-day vulnerability was discovered and socialized across the infosec community.

7 February 2022
Luigi Sbriz
Blog Post

Understanding the Importance of Effective Board Communication

For any cybersecurity framework to be successful, it is essential that the chief information security officer (CISO) or equivalent figure be able to simply communicate with top management the state of security in the organization, present an improvement plan, justify it with the risk assessed and request the necessary resources.

4 February 2022
Podcast
Podcast

What is Environment, Social, and Governance (ESG)?

Mark Thomas (Founder, Escoute) and Caren Shiozaki (EVP & CIO, TMST, Inc.) join ISACA's Lisa Villanueva for a conversation about Environment, Social, Governance or ESG.

4 February 2022
The Importance of a National Digital Identity System
ISACA Journal Article

The Importance of a National Digital Identity System

The leaders and policymakers of nations around the world are working on building national digital identity systems and frameworks.

Author: Biji Scaria
A man staring at a network
@ISACA Article

Report Provides Insights on Evolving Privacy Landscape

New research from ISACA explores the latest trends in enterprise privacy—from privacy workforce and privacy by design to privacy challenges and the future of privacy—in its new Privacy in Practice 2022 survey report, sponsored by OneTrust.

2 Feburary 2022
Caitlin McGraw
@ISACA Article

The Job Search Timing Conundrum

Hiring for IT audit, IT GRC and information security roles appears to be in full-tilt boogie mode. Posts from hiring leaders promoting their openings are appearing frequently on LinkedIn.

2 February 2022
Matt Stamper
Blog Post

Simplify and Contextualize Your Data Classification Efforts

In the CISO Desk Reference Guide, I noted how critical the concept of “context” is to security programs. The same holds true for our organizations and their respective privacy programs.

2 February 2022
Christopher Henry
Blog Post

Achieving Workforce Diversity in Cybersecurity

In the current global landscape of near daily announcements of cyberattacks, organizations can no longer just sit back and wait for employees to find them; they must be proactive.

1 February 2022
Opeyemi Onifade
Governance Article

Using COBIT for Value-Based Direction Setting

Every organization goes through a phase in its life cycle that leaves it with 2 options: transform or decline.

1 February 2022
The Evolution of Information Systems Audit
ISACA Journal Article

The Evolution of Information Systems Audit

From the early days of electronic data processing (EDP) to modern cybersecurity, IS audits have come a long way. The landscape around information systems has been changing, but as in any journey, an eye on the rearview mirror enables better decision-making and safer travel forward.

Author: Anantha Sayana
Podcast
Podcast

The Impact of SOX on the Industry 20 Years Ago and Today

The Sarbanes-Oxley (SOX) Act was passed by the United States Congress in 2002. 20 years later, ISACA's Robin Lyons asks Cindy Baxter, Director at What’s the Risk, LLC all about SOX.

1 February 2022
Gopikrishna Butaka
Blog Post

The Weakest Link in the Cybersecurity Chain: Are You Aware of It?

Recently, there was a debate on our audit team regarding the increased amount of cybercrime during the pandemic and the best ways to handle it.

31 January 2022
CA Ratan Singh Tanwar
Blog Post

My Guide to Passing the CISA Exam

Becoming CISA-certified in the first attempt is not an easy task, but it can be passed simply by following a dedicated and structured study plan.

28 January 2022
Podcast
Podcast

Privacy in the Dark (Data)

Listen in as Safia Kazi, ISACA's Privacy Professional Practice Advisor, as she speaks with Steve Ross, Executive Principal of Risk Masters International, about his article "Privacy in the Dark (Data)".

27 January 2022
Tips of the Trade - Jack Freund
@ISACA Article

Proximate Cyberrisk Management Starts With Culture

Everybody wants to get to the root cause of a problem, but few actively try to manage the risk around its edges.

26 January 2022
Seeking Sustainable Results in Addressing Cyber Talent Gap
@ISACA Article

Seeking Sustainable Results in Addressing Cyber Talent Gap

One the most discussed topics of the past decade has been the growing talent gap in cybersecurity.

26 January 2022
Taking the Lead to Build the Cyber Workforce of the Future
@ISACA Article

Taking the Lead to Build the Cyber Workforce of the Future

2021 was a thrilling roller coaster of peaks, dips, twists and turns for cyber professionals across the United States in both the public sector and private industries.

26 January 2022
Yunique Demann
Blog Post

Plenty of Progress Still Needed on the Privacy Landscape

2021 was an eventful year for privacy with the emergence of new legislation such as the California Consumer Privacy Act, Brazilian General Data Protection Law and China Personal Information Protection Law.

26 January 2022
Dave Schmoeller
Blog Post

What Is a Risk Heat Map & How Can It Help Your Risk Management Strategy

In the early 2000s, pharmaceutical company GlaxoSmithKline (GSK) was facing a serious risk: One of its manufacturing plants did not meet the requirements of current good manufacturing practices (CGMP).

25 January 2022
Ali Pabrai
Security Article

US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework

Cybersecurity is only as good as an organization’s weakest link. Increasingly, the weakest link is the cyber supply chain.

25 January 2022
Working Toward a White Box Approach
ISACA Journal Article

Working Toward a White Box Approach

It has long been the assumption that, once built, all computer systems are Turing machines—that is, devices that perform one small, deterministic step at a time—and are, therefore, deterministic in nature

Authors: Sandipan Gangopadhyay, Stuart Mcguigan, Vijay Chakravarthy, Dheeraj Misra and Sumit Tyagi
Podcast
Podcast

Industry News Wrap

ISACA's CyberPro Jon Brant breaks down industry news stories so far in the new year: Log4j, Cyber Insurance, Augmented Reality/Virtual Reality, Metaverse, Deep Fakes, and even the legal discussion around vehicle car data.

26 January 2022
David Samuelson
Blog Post

Charting a Course for Digital Trust

As we begin this new year, we’re also in the early stages of executing on a new strategic plan that will shape ISACA’s focus in 2022 and the coming years.

24 January 2022
Adham Etoom and Veronica N. Rose
Blog Post

Enablers That Propelled Our Careers to a Higher Level

Undoubtedly, ISACA is cultivating the next generation of digital trust professionals as it is a one-stop-shop for top-notch industry-recognized credentials, pieces of training that bridge the gaps between what people learn in university and the practical skills required to perform tasks at work.

21 January 2022
SWIFT’s Customer Security Program
ISACA Journal Article

SWIFT’s Customer Security Program: Lessons for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the communication system of the Society for Worldwide Interbank Financial Telecommunication (SWIFT), were compromised through spear phishing emails.

Author: Ninad Dhavase
Boosting Cyberresilience for Critical Enterprise IT Systems
@ISACA Article

Boosting Cyberresilience for Critical Enterprise IT Systems With COBIT and NIST Cybersecurity Frameworks

The term cyberresilience is defined as “[T]he ability of a system to continue to operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities and recover to an effective operational posture in a time frame consistent with mission needs.”

19 January 2022
David Samuelson
@ISACA Article

Foundation in Place for a Promising Year Ahead

Happy New Year, ISACA community! The year ahead holds great promise, but before we turn our attention to all there is to look forward to in 2022, let's briefly reflect on how we've reached this point.

19 January 2022
Reaching DevSecOps Maturity
@ISACA Article

Reaching DevSecOps Maturity

Development teams may be using the latest and greatest technology to build amazing products, but security does not always keep the same pace.

19 January 2022
Stay on Top of Privacy Challenges with These Must Dos
@ISACA Article

Stay on Top of Privacy Challenges with These ‘Must-Dos’

Organizations seeking to build and strengthen their privacy programs in 2022 face a range of challenges – the proliferation of data, an evolving regulatory landscape, ongoing challenges related to the COVID-19 pandemic, and many more.

19 January 2022
Michael Powers
Blog Post

Technology Control Automation: Improving Efficiency, Reducing Risk and Strengthening Effectiveness

A principal component of a sound risk management framework, particularly in highly regulated institutions, is an effective control testing program.

19 January 2022
ShanShan Pa
Blog Post

Code of Conduct: An Effective Tool for GDPR Compliance

We are three+ years out from the EU General Data Protection Regulation (GDPR) taking effect. While many organizations are still new to or struggle with GDPR, a more recent milestone could shed light on this development for privacy practitioners and implementors.

18 January 2022
David Brown
Security Article

Cybersecurity Lies and the Lying Liars Who Tell Them

I freely admit I borrowed my title from former US Senator Al Franken’s 2003 book Lies and the Lying Liars Who Tell Them. But I think it is time we as security professionals take a good hard look at ourselves and admit all the ways that we are lying…to OURSELVES!

18 January 2022
Cybersecurity Incident Response Exercise Guidance
ISACA Journal Article

Cybersecurity Incident Response Exercise Guidance

Organizations must review cybersecurity threats and attack vectors, understand the importance of the incident response plan (IRP), review response activities, conduct tabletop exercises, analyze the exercises to determine areas for improvement, manage reporting and conduct IRP maintenance.

Author: Larry G. Wlosinski
Audit and Assurance
Blog Post

Is Agile Auditing a Sure Thing for Internal Audit?

Operational innovation. Business resilience. Operational disruption, possibly resulting from third-party management issues like suppliers’ solvency, compliance, service/product quality and even suppliers’ behavior (if your enterprise happens to be subject to the UK Bribery Act or similar legislation).

14 January 2022
Strengthening Cybersecurity With Red Team Engagements
ISACA Journal Article

Strengthening Cybersecurity With Red Team Engagements

These days, cyberadversaries are coming up with different kinds of capabilities and objectives behind each of their new cyberattacks, which has forced organizations to do a deeper, more introspective evaluation of their existing cyberdefense mechanisms.

Author: Vimal Mani
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Look Ahead at New Data Privacy Regulations

“Data are the new oil” is no longer a new sentiment. This has become the reality for individuals, organizations and entire countries since the adoption of digital transformation throughout the last 15 years.

12 January 2022
Luigi Sbriz
@ISACA Article

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

The idea of a risk register used in a practical and effective way is an expectation of the ISACA’s Certified in Risk and Information Systems Control® (CRISC®) certification.

12 January 2022
Jon Brandt
@ISACA Article

Finding Calm Amid Chaos: Improving Work-Life Balance

Many write about the need for work-life balance, but nothing affirms its criticality more than a negative health report. Recently, a friend required significant medical treatment, which provided some additional inspiration for this column.

12 January 2022
Patrick Sullivan
Blog Post

Maintaining Your Compliance Strategy During (and After) CISO Turnover

Amidst the “Great Resignation,” employees across industries — and experience levels — are reconsidering their relationship with work.

12 January 2022
David Samuelson
Blog Post

Foundation in Place for a Promising Year Ahead

In large part, 2021 for ISACA was about putting in place a sturdy technological foundation on which our community can grow. It was a year of big challenges and bigger successes.

11 January 2022
A Brief History of the Cybersecurity Profession
Security Article

A Brief History of the Cybersecurity Profession

Cybersecurity careers are in high demand, but a closer look at the timeline of network technology and the Internet reveals that this has virtually always been the case.

11 January 2022
A Security Awareness Program for PCI DSS Compliance
ISACA Journal Article

A Security Awareness Program for PCI DSS Compliance

Fintech organizations that provide payment solutions to merchants, banks and financial institutions have a strict requirement to maintain security and regulatory compliance.

Authors: Yasmin Razack and Timothy Sorbin
Podcast
Podcast

How Do Organizations Control Their Use of Social Media

What are the main risks that most enterprises need to consider when it comes to social media? If you don’t know, you and your organization are in danger of serious reputational risk!

11 January 2022
Vimal Mani
Blog Post

A Bird’s Eye View of Cyberinsurance Plans

Most cyberattacks launched by hackers result in financial repercussions for the organization and cause disruption of its critical assets and services.

10 January 2021
Glorin Sebastian
Blog Post

Online Education From a Security Risk and Controls Perspective

The internet and the subsequent online revolution have led to the digitization of almost every aspect of human life; education is no different.

6 January 2022
Going Agile in Audit
ISACA Journal Article

Going Agile in Audit: What to Do and What Not to Do

Agile is on trend these days. Even the people who opposed agile in the past have now jumped on the bandwagon and actively campaign for going Agile while not always understanding what that means—and often inserting the same nonagile obstacles they have been practicing into their version of Agile audit.

Author: Spiros Alexiou
Podcast
Podcast

From the Board Level to the Code Level

Blake Curtis is a global business risk and security engineer for Deloitte Global and a research scientist with a Ph.D. in cybersecurity and risk management. Today he breaks down frameworks, governance and governmental controls from the board level to the code level.

6 January 2022
Three Key Priorities for Privacy Practitioners in 2022
@ISACA Article

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away.

5 January 2022
Caitlin McGraw
@ISACA Article

Develop This Essential Career Skill in 2022: Getting to the Next Question

The head of IT audit at a major global organization once told me that an absolutely critical thing to success on the job was “getting to the next question.”

5 January 2022
More Governance than Ever
@ISACA Article

More Governance Than Ever

Few would doubt the need for proper enterprise governance, which, ultimately, ensures that direction is set, benefits are realized, risk is managed and resources are reasonably used. These four conditions summarize what governance is all about.

5 January 2022
New Resources Address Evolving Challenges on the Audit Landscape
@ISACA Article

New Resources Address Evolving Challenges on the Audit Landscape

In 2022, many audit professionals will shift their focus to developing dynamic new strategies such as agile auditing, revisiting established technologies from a remote or hybrid working environment perspective, and closing any gaps between compliance expectations and current practices—and how they can enhance their skills to meet the needs of the evolving audit landscape.

5 January 2022
Prasad Chaudhari
Blog Post

Recognizing the Customer’s Responsibility in a Shared Responsibility Model

Every industry, regardless of size, is eager to realize the benefits of the cloud. The cloud providers’ ability to move from a Capital Expenditures (CAPEX) model to Operating Expenses (OPEX) is not all about upfront cost savings, which the cloud platforms offer.

5 January 2022
Podcast
Podcast

ISACA Cyber Pro Chats with Naomi Buckwalter

ISACA’s Cyber Pro, Jon Brandt, invites information security guru, Naomi Buckwalter, Director of Information Security and IT to the podcast to discuss hot and heavy topics within Cybersecurity and the IT industry.

5 January 2022
Luigi Sbriz
Blog Post

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

In a practical way means that it could be managed directly by the owner of the risk. However, seeing a senior manager interact directly with the risk register instead of using an executive summary does not happen often.

4 January 2022
Cybersecurity and Technology Risk in Virtual Banking
ISACA Journal Article

Cybersecurity and Technology Risk in Virtual Banking

Managing cybersecurity and technology risk is a major challenge for virtual banks. Although cyberattacks and a lack of system resilience can be detrimental for both traditional and virtual banks, they arguably have a greater impact on the latter.

Author: Donald Tse
Podcast
Podcast

What Will it Take to Reach DevSecOps Maturity?

While our development teams have been busy running full speed ahead using the latest and greatest technology to build amazing products, security teams haven’t always been known to keep the same pace – and we have reached a point of “developer revolt.”

4 January 2022
Journal 50 Years
ISACA Journal Article

Letter from the CEO

The ISACA Journal you hold in your hand—or read on your screen—marks an important milestone. The year 2022 is the 50th year of this publication.

Author: David Samuelson
Privacy in the Dark Data
ISACA Journal Article

Information Security Matters: Privacy in the Dark (Data)

According to informed sources, 55 percent of all enterprise data are dark, so there is a lot of information just sitting there waiting to be (mis)used.

Author: Steven Ross
Innovation Against Cyberattacks
ISACA Journal Article

Innovation Governance: Innovation Against Cyberattacks

With the challenges of securing cyberspace, there has been a great deal of innovation throughout the past decade, especially in the last couple of years. However, the multitude of attacks and their increasing sophistication is going to require even more innovation...

Author: K. Brian Kelley
Migrating to the Cloud
ISACA Journal Article

Migrating to the Cloud: How the COVID-19 Pandemic Has Affected the IT Landscape

The question of whether to move on-premises software to the cloud has been relevant for several years. In the past, every year a few more enterprises migrated to the cloud, but that changed significantly in 2020 when organizations faced the effects of the COVID-19 pandemic.

Authors: Lukas Werner and Gerald Burch, PH.D.
On the Need for Combined Assurance
ISACA Journal Article

On the Need for Combined Assurance

Over the last 50 years there have been vast changes in IT. Opinions vary, but one of the most disruptive was the invention of the Internet, which, in turn, led to the creation of cloud computing.

Author: Ian Cooke
IT Audit
ISACA Journal Article

IT Audit: A Look Ahead

Traditionally, the term “IT audit” suggests certain familiar procedures such as ensuring the functionality and integrity of an entity’s tools, systems and networks; testing and monitoring the security of IT systems against intrusion or misappropriation...

Author: Kevin M. Alvero
The GRC Journey Never Ends
ISACA Journal Article

The GRC Journey Never Ends

Information security has existed since humans started sharing information. For example, Julius Caesar developed a cipher to protect information from unauthorized disclosure.

Author: Muhammad Asif Qureshi
Minority Students Drive Into the Tech Talent Pool
ISACA Journal Article

Case Study: Minority Students Dive Into the Tech Talent Pool

From the most senior level to the rank-and-file, the workforce running the US technology industry has long failed to mirror the ethnic diversity of the tech user base or society at large.

Author: Mick Brady
Overcoming a False Sense of Security
ISACA Journal Article

Overcoming a False Sense of Security: How to Deeducate Current Security and Control Practices

The current international dynamic characterized by tension between nations in the midst of gray zone conflicts highlights the challenges in cyberspace and how cyberoperations affect the relationships of enterprises and countries.

Author: Jeimy Cano
Embedded Finance Brings Banks to New Frontiers of Risk
ISACA Journal Article

Embedded Finance Brings Banks to New Frontiers of Risk

Embedded finance has been hailed as a paradigm shift in financial services, moving from being product-centric to customer-centric.

Author: Terrence Cai
Thorsten Stremlau
Blog Post

How to Enable DICE and TPM for Optimal Security

By 2030, more than 24 billion Internet of Things (IoT) devices will have entered our cities, workplaces and homes, according to Transforma Insights. For years, I have been working to make sure that these devices have a healthy immune system so that they can defend against malicious attacks.

30 December 2021
HelpSource Q&A
ISACA Journal Article

Help Source Q&A

How can organizations define risk appetite? Is there any standard method or technique?

Author: Sunil Bakshi
K-Harisaiprasad
Blog Post

Cybersecurity in Arbitration

Arbitration is a process of resolving a dispute between two or more parties through one or more arbitrators to obtain a legally binding decision outside of court. The proceedings and awards remain confidential.

29 December 2021
Assessing and Improving Information Governance Maturity Across Emerging Data and Cloud Systems
Blog Post

Assessing and Improving Information Governance Maturity Across Emerging Data and Cloud Systems

Organizations are concerned about the impact of rapid digital transformation on their data privacy, security, compliance and legal risk.

28 December 2021
Building a Maturity Model for COBIT 2019 Based on CMMI
ISACA Journal Article

Building a Maturity Model for COBIT 2019 Based on CMMI

Years ago, the COBIT 5 Process Assessment Model (PAM) was commonly used to assess the maturity level of a COBIT implementation.

Author: Luis Gorgona
ISACA live tile
Podcast

Emerging Tech Session #5 - Ultra-Emerging Tech

Join Kevin Keh, IT Professional Practices Lead - Research Development for ISACA, and guest, Ramses Gallego, International Chief Technology Officer for CyberRes in the latest session of our LinkedIn Live series on Emerging Technology.

27 December 2021
Security
Blog Post

Log4Shell Update and Resources

In the past week, you’ve likely seen multiple headlines about a new major security vulnerability. Log4j is an open-source logging framework built on Java coding language that is used by approximately one-third of all webservers. On 9 December, a flaw in the code was discovered and rated a 10 out of 10 on the Common Vulnerability Scoring System (CVSS) due to its possible impact. 

23 December 2021
Glib Pakharenko
Blog Post

The Importance of VPN Technology Assurance

Virtual Private Networks (VPNs) for many years have already been in place in almost every organization. Their use has been mostly limited to functioning as site-to-site tunnels between offices and third-party organizations, providing remote access of IT specialists for incident/change...

23 December 2021
Communicating Information Security Risk Simply and Effectively, Part 2
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 2

The ability to answer top management's questions is the first step to being successful in presenting information security risk effectively. In enterprise risk management, the difficulty is to combine different data...

Author: Luigi Sbriz
Drawing Connections Between Security and Employee Personalities
@ISACA Article

Drawing Connections Between Security and Employee Personalities

An enterprise’s employees are often regarded as its biggest weakness in terms of cybersecurity. Though some threats are posed inadvertently by employees with certain personality traits, an organization can also be targeted intentionally by an employee acting as an insider threat.

22 December 20212
Sushila Nair
@ISACA Article

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

22 December 20212
Wole Davis
Blog Post

Central Bank Digital Currency and Governments’ Quests for Control

According to National Geographic, “An adaptation is any heritable trait that helps an organism, such as a plant or animal, survive and reproduce in its environment.” Eucalyptus trees survive the wildfires of the Australian forest because of their thick, multilayered barks that act as insulation against heat.

22 December 2021
Veronica Rose
Blog Post

Qualities of a Trusted Information Systems Auditor

The information systems auditor’s journey is one of exploration because each time we encounter new risks, processes and controls, they become a part of our work.

21 December 2021
Communicating Information Security Risk Simply and Effectively, Part 1
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 1

In organizations, the topic of enterprise risk management presents a twofold problem: the calculation of the level of risk and effective communication to top management. An accurate risk assessment loses all its effectiveness if it is not properly understood by managerial executives with decision-making power.

Author: Luigi Sbriz
R.V. Raghu
Blog Post

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase data is the new oil. But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

20 December 2021
Joel Schwarz
Security Article

We Can Neither Regulate Nor Sanction Away Cryptocurrency’s Facilitation of Ransomware

While 2020 will be remembered for the beginning of the COVID-19 pandemic, 2021 may be remembered as the year when ransomware entered the collective public consciousness, courtesy of the Colonial Pipeline and JBS ransomware attacks.

20 December 2021
Kerie Kerstetter
Blog Post

Compliance Versus Risk: Why Choosing the Right Approach is So Important

Most organizations have now realized the critical importance of cybersecurity risk management.

17 December 2021
Mark Thomas
Blog Post

A Holistic Training Approach That Helps Enterprise Governance Thrive

If you have been on your professional or social networking sites in the past several months, you might have noticed that many of your colleagues are posting about their newly acquired certifications.

15 December 2021
Adopting International Standards
ISACA Journal Article

Adopting International Standards in Africa to Protect Critical Infrastructure

The digitally interconnected world has immense potential. Internet-based technologies are becoming an integral part of every critical infrastructure.

Author: Patrick Katuruza
IT Audit in Practice Survival When You Are Small Business Continuity and Resilience
@ISACA Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan.

15 December 2021
Nominations Open for ISACA Board of Directors
@ISACA Article

Nominations Open for ISACA Board of Directors

Nominations for the 2022-2023 ISACA Board of Directors are open now through 31 January 2022.

15 December 2021
Veronica Rose
@ISACA Article

Shining a Stronger Spotlight on the Information Systems Audit Profession

Way back while I was in university, despite the fact that I was pursuing a bachelor’s degree in computer science, I never heard any faculty mention a profession in IS/IT audit. To date, when I mention my profession to some, they ask what in the world it is that I do.

15 December 2021
Robert Findlay
Blog Post

The Challenging Task of Auditing Social Media

A request to audit social media is rarely confused with a pleasant sunny day at a picnic. It is fundamentally an audit of the organization’s marketing department, which comes with challenges as marketers are not always following best practices of internal controls.

15 December 2021
Diversity in the Cybersecurity Workforce
Security Article

Diversity in the Cybersecurity Workforce

The cybersecurity professional labor shortage is no secret and has only been exacerbated by the COVID-19 pandemic. For many enterprises, hiring processes slowed or stopped altogether; even those which were able to resume normal recruitment efforts were met with a cyberskills gap.

15 December 2021
Chris Dimitriadis
Blog Post

Log4shell Vulnerability Highlights Critical Need for Improved Detection and Response Policies and Procedures

A zero-day vulnerability of Log4j (CVE-2021-44228), an open-source, Java-based logging utility widely used by enterprise applications and cloud services, recently came to light.

14 December 2021
Trusted AI Platforms for the Connected Car Ecosystem
ISACA Journal Article

Trusted AI Platforms for the Connected Car Ecosystem

It is common knowledge that sensitive or personal data from connected cars are at risk of being hacked or breached. More important though, is that it is critical to realize that connected cars pose serious threats to human lives, including fatalities.

Authors: Khyati Mehta, Chinmoy Rajpal and Gaurav Verma
Ramses Gallego
Blog Post

Three Key Priorities for Emerging Tech Practitioners in 2022

Regardless of where somebody specializes in the IT field – whether an audit, risk, privacy, governance or security practitioner – the impact of emerging technology is becoming increasingly relevant.

13 December 2021
Rob Clyde
Blog Post

Wanted: Experienced, Passionate Leaders for ISACA Board of Directors

There’s a saying when it comes to what makes an effective board of directors: Noses in, fingers out. That’s the approach the ISACA Board of Directors takes, meaning the Board is responsible for governance and oversight for the organization, but we steer clear of the operational execution.

13 December 2021
Nivedita Malhotra
Privacy Article

Preparing for Upcoming Data Privacy Regulations

The global privacy landscape has changed drastically since the EU General Data Protection Regulation (GDPR) became law in 2018.

13 December 2021
Ravikumar Ramachandran
Blog Post

Three Key Priorities for Governance Practitioners in 2022

The accelerating technological advancements and digital transformation did not reduce its pace in 2021 and it does not figure to in 2022, nor for the foreseeable future.

10 December 2021
Jack Freund
Blog Post

Three Key Priorities for Cyberrisk Practitioners in 2022

It’s that time of the year again where people are making prognostications about what will happen in the new year.

9 December 2021
Evidence-Based Prioritization
ISACA Journal Article

Evidence-Based Prioritization of Cybersecurity Threats

The landscape of cybersecurity threats is evolving at a tremendous pace. New adversaries with increasingly sophisticated tactics and tradecraft seem to emerge on a continuous basis

Authors: Richard Kerkdijk, Sebastiaan Tesink, Frank Fransen and Federico Falconieri
Podcast

Security Operations Challenges in 2021

ISACA’s Director, Channel Business Development, Chris DeMale is joined by ServiceNow’s Director of Product Marketing, Karl Klaessig in this follow up interview that takes a deeper look into his presentation during ISACA’s Virtual Summit session, Security Operations Challenges in 2021.

10 December 2021
AI Uses in Blue Team Security
@ISACA Article

Artificial Intelligence Uses in Blue Team Security: What’s Working and What Isn’t?

Artificial intelligence (AI), machine learning (ML), and deep learning (DL) are often applied in cybersecurity, but their applications may not always work as intended.

8 December 2021
R.V. Raghu
@ISACA Article

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase, “Data is the new oil.” But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

8 December 2021
Tips of the Trade - Jack Freund
@ISACA Article

More Bad News About Cyber

If you clicked on this column because its title conveyed a negative tone, you are not alone. It is well known that negativity drives user interaction in online environments.

8 December 2021
Rebecca Herold
Blog Post

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away. They simply lurk beneath the new issues that claim the attention of privacy pros until the time is prime to exploit those old vulnerabilities.

8 December 2021
Sushila Nair
Blog Post

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

7 December 2021
Reduced Appetite
ISACA Journal Article

Reduced Appetite: How COVID-19 Will Impact Future Business Continuity Planning

No one could have predicted the far-reaching effects of the COVID-19 outbreak. However, many organizations had invested in business continuity and disaster recovery (BC/DR) to prepare for such unexpected disruptions.

Authors: Pascal A. Bizarro and Aaron Wheeler
Podcast
Podcast

Information Security Programs Need to be Ubiquitous, Proactive, and Vigilant

This ISACA TV interview is a discussing about information security concerns (and challenges), evolution, and the future. Topics covered include mobile computing devices, the Internet of Things (IoT), artificial intelligence (AI), cyber threat intelligence (CTI), software tools...

7 December 2021
Ookeditse Kamau
Blog Post

Three Key Priorities for Audit Practitioners in 2022

These past two years have been a stretch for everyone. Most are still learning how to work differently and re-evaluating their strategies to get the best out of the worst season.

6 December 2021
Linda Kostic
Governance Article

COBIT Focus Area: Information and Technology Risk—A Model for Internal Audit Analysis

Risk management is an important function in any organization. Financial services organizations often employ the three lines of defense approach to manage risk within the organization.

6 December 2021
Alain Marcuse
Privacy Article

Finding Common Ground: Security, Privacy and Marketing

It is a common perception that marketing is generally at odds with security and privacy. Although these are broad generalizations with plenty of excluded nuances and exceptions, marketing is seen as thriving on data—the more, the better.

6 December 2021
Adham Etoom
Blog Post

Cyber Defense Strategies 4.0 Incorporating AI Technology

In the age of Industrial Revolution 4.0, cybersecurity has become a more pressing and disturbing concern for both boards and senior management globally.

3 December 2021
Terry Cai
Blog Post

Data-Driven vs. Data-Informed: How Auditors Find the Right Balance

Data is a powerful thing. Consequently, the role that data analytics play in today’s audit profession cannot be emphasized enough, especially in light of digital transformation across different industries.

2 December 2021
Artificial_intelligence_adoption_250
@ISACA Article

Artificial Intelligence Adoption in Internal Audit Processes

As artificial intelligence and automation technologies advance, they are being used in a variety of fields to automate operations that were previously done manually.

1 December 2021
Caitlin McGraw
@ISACA Article

How to Ace Your Performance Review

So, do you prepare for your performance review? Like, really prepare – meaning that you have a list of your accomplishments.

1 December 2021
Sunil Bakshi
@ISACA Article

Tech Debt, Explained

I recently heard the term tech debt for the first time and wondered what it meant. A brief search engine query provided the shocking information that this term was first coined in 1992 by Ward Cunningham, a developer who developed Wiki software.

1 December 2021
Cyber maturity graphic
Blog Post

Cybermaturity: A Path to Right-Sizing Cyber Practices

The concept of cybermaturity has gained increased attention in recent years, while still not being well-understood in many circles across the industry.

1 December 2021
Podcast
Podcast

How Innovative Enterprises Win With Secure Machine Learning

Enterprises use machine learning to validate who they are doing business with and to find new opportunities. ISACA's IT Professional Practices Lead Kevin Keh discusses secure machine learning with Protegrity's Chief Security Strategist Ulf Mattsson.

1 December 2021
Aselsan MGEO Case Study
Blog Post

Case Study: How ASELSAN MGEO Improved Design and Management Processes with CMMI V2.0

Defense contractors and general manufacturers across the globe that are looking to improve overall design and management processes or upgrade their cybersecurity maturity level can do so with ease and efficiency – even during a pandemic.

30 November 2021
The Impact of Schrems II
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 1

The transfer of personal data out of the European Union (EU) to nations around the world takes place tens of thousands of times every day, and it has been occurring for so long that it has largely become routine business.

Author: Scott M. Giordano
Molly-Mullinger_Elliott-Bostelman
Blog Post

Six Steps to a Mature Policy Management Program

When the reality of the pandemic sank in, and people shifted to remote working nearly overnight, companies had to rethink the data and technology policies written for a typical office working space. Some organizations were scrambling to make updates, while others already had a policy management program to guide them through this event.

29 November 2021
Cybersecurity A Shared Responsibility
@ISACA Article

Cybersecurity: A Shared Responsibility

Let me begin by asking everyone a question – what does “shared responsibility” mean? What are the responses that come to your mind when you ask the question?

24 November 2021
Four Levers to Drive a Cyber savvy Culture
@ISACA Article

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

24 November 2021
Pakistan Cybersecurity Policy in 2021 A Review
@ISACA Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception. With its increasing number of start-ups, young professionals and digital transformation programs that have been implemented by established organizations, it was incumbent upon Pakistan to enact a cybersecurity policy supported by an overarching framework that also addressed data protection and privacy.

24 November 2021
Algorithms and the Auditor
ISACA Journal Article

Algorithms and the Auditor

Recent advances in machine learning (ML) and artificial intelligence (AI) have raised new awareness and concerns of algorithms, including their uses and misuses and their potential and limitations.

Author: Spiros Alexiou
Shini Menon
Blog Post

Imagining Audit Tech With AI

As an experienced professional who has worked with pharmaceutical, medical device, financial service, government, retail and hedge fund organizations, it did not take me many years to realize that audits and assessments were largely manual, tedious and intensive activities.

22 November 2021
Bill Malik
Security Article

Using Zero Trust and XDR to Stop Ransomware

The rise of ransomware has inspired the creation of myriad techniques attackers can use to achieve their goals. At its core, ransomware encrypts an enterprise’s data and then sells the key needed to decrypt them.

22 November 2021
Podcast
Podcast

HCL State of Cybersecurity 2021

Jon Brandt (Information Security Professional Practices Lead at ISACA) and Renju Varghese (Fellow and Chief Architect at HCL Technologies) break down the State Of Cybersecurity 2021 —Part II report.

22 November 2021
Melissa Swartz
Blog Post

Changing the World on ISACA CommunITy Day

The first Saturday in October has become my favorite day of the year at ISACA. Every year, thousands of ISACA members and their families join together to perform local community service, and we track those efforts to measure the collective impact we have when we work together – even while apart.

19 November 2021
Podcast
Podcast

ISACA’s New CyberPro – Jon Brandt

Listen in as ISACA’s Information Security Professional Practices Lead, Jon Brandt grabs the podcast microphone and takes over November’s Cyber Pros to discuss CISA’s Directive Breakdown.

19 November 2021
Julia Kanouse
Blog Post

Acronyms Only Scratch the Surface of What ISACA Stands For

ISACA itself is an acronym, formerly standing for the Information Systems Audit and Control Association. And of course, we’re well known for our global portfolio of IT certifications – CISA, CISM, CRISC, CGEIT, CDPSE, CET, ITCA – not to mention the COBIT framework.

18 November 2021
Benefits Management for Digital Transformation Programs
ISACA Journal Article

Benefits Management for Digital Transformation Programs

The global economy is becoming more challenging due to greater international competition, the pace of digital transformation and increased customer experience expectations.

Authors: Sam Opdenakker, Kim Maes, Ph.D. and Steven De Haes, Ph.D.
Human error
Security Article

Human Error in Cyberspace

Human error is inevitable, even in fields as thorough and technically efficient as cybersecurity. While there are mechanisms in place to prevent and detect such occurrences, on occasion, even an enterprise that is usually a well-oiled machine can fall victim to vulnerabilities that may arise due to the human factor.

17 November 2021
Member Spotlight
@ISACA Article

Member Spotlight: Janelle Vasquez

Janelle Vasquez, recently visited with @ISACA to discuss her journey with ISACA, why entrepreneurship appeals to her and how she became enamored with Latin dancing, among other topics.

17 November 2021
Cobit
@ISACA Article

Tailored Governance for Small and Medium Enterprises

When it comes to small and medium sized enterprises (SMEs), there is no one-size-fits-all approach to governance for enterprise information and technology.

17 November 2021
Anna Vladimirova-Kryukova
@ISACA Article

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

17 November 2021
Greet Volders
Blog Post

COBIT’s Value for Small and Medium Enterprises

If one or more of the statements below reflects your thoughts on COBIT®, you should investigate the latest ISACA publication, COBIT for Small and Medium Enterprises (SMEs).

17 November 2021
Wickey Wang
Blog Post

Why the Cloud Market is Booming

Cloud computing and the extended cloud service industry have become mainstream in today’s IT industry

16 November 2021
A Text-Mining Approach to Cyberrisk Management
ISACA Journal Article

A Text-Mining Approach to Cyberrisk Management

Cyberrisk is one of the most pervasive threats facing the global community. The World Economic Forum (WEF) has listed cybersecurity failure as one of the top-five global risk factors since 2018.

Authors: Arunabha Mukhopadhyay and Kalpit Sharma
ISACA live tile
Podcast

ISACA Live: Emerging Tech - Cloud

Why is the cloud still considered an emerging technology in 2021? Why is the cloud both an enabler and catalyst for all other technologies? How has the cloud changed our organizational eco-systems?

16 November 2021
Tom Conkle
Blog Post

Cybermaturity and Protecting Against Ransomware

Ransomware continues to dominate the headlines in both cybersecurity journals and mainstream media.

15 November 2021
ISACA live tile
Podcast

LinkedIn Live: State of Cybersecurity, Part 2

In honor of Cybersecurity month, ISACA’s Director of Communications, Kristen Kessinger, and Information Security Practices Lead, Jon Brandt, discuss the findings of this year’s ISACA State of Cybersecurity...

15 November 2021
Grad Students
Blog Post

The Latest Trends for Master’s Students In IT and How To Leverage Them

There are many reasons people in the IT industry choose to pursue further education. It could be because of the pursuit of knowledge wanting to get ahead of the trends. Or it could be because of the financial aspect – the promise of a promotion or a higher pay that comes with the master’s degree. 

12 November 2021
Ted Harrington
Blog Post

Challenge Underlying Security Assumptions

Ted Harrington runs Independent Security Evaluators (ISE), the elite security researchers who pioneered car hacking, were first to exploit the iPhone, first to exploit Android OS, pioneered medical device hacking, and run hacking event IoT Village.

11 November 2021
Does Trust Still Matter in the Era of Zero Trust?
ISACA Journal Article

Does Trust Still Matter in the Era of Zero Trust?

The most common theme of recurring security incidents in recent memory has been associated with the breaches of seemingly trustworthy service providers or technologies.

Author: Ar Kar Oo
ISACA live tile
Podcast

ISACA's Global Strategy

Join ISACA’s CEO David Samuelson as he discusses ISACA’s Global Strategy with ISACA’s Chief Global Strategy officer Chris Dimitriadis. Chris shares his career path to ISACA, industry trends, advice to the next generation and how ISACA will continue to innovate in the future!

11 November 2021
Diagnosing the Epic Fails in Cybersecurity
@ISACA Article

Diagnosing the Epic Fails in Cybersecurity

The cybersecurity industry has long been failing, and to reverse course, a better understanding of the root causes of that failure is needed.

10 November 2021
Anyone Can Be an Ally: Grow your Learning and Make Positive Change
@ISACA Article

Anyone Can Be an Ally: Grow your Learning and Make Positive Change

“Allies are people who bring change to life in a given setting,” said Sarah Benczik, principal at Deloitte, during her presentation at One In Tech’s seminar during last month’s ISACA Conference Europe.

10 November 2021
State of the Threat Landscape
@ISACA Article

State of the Threat Landscape Expert Panel

ISACA Conference Oceania welcomed a panel of security experts from the region and beyond to dive into the current threats facing enterprises: cyberrisk, emerging tech adoption, educating stakeholders about risk, and more.

10 November 2021
The Magic Trick to Gaining Influence
@ISACA Article

The Magic Trick to Gaining Influence

Vinh Giang, keynote speaker at last month’s ISACA Conference Europe, was able to convince his parents that not only should he quit university, but that they should invest in his dream: teaching magic online.

10 November 2021
Anna Vladimirova-Kryukova
Blog Post

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

10 November 2021
ISACA live tile
Podcast

Cyber Risk and Communicating to a Board of Directors

Digital transformation has heightened due to the pandemic. We went from, “we can’t work from home” to “we can only work from home moving forward”.

10 November 2021
Podcast
Podcast

Digital Body Language

What is digital body language and why does it matter? Join ISACA's Director of Global Volunteer Engagement Megan Moritz as she speaks with Erica Dhawan, author of Digital Body Language: How to Build Trust and Connection, No Matter the Distance. Mega and Erica discuss...

10 November 2021
Podcast
Podcast

Getting Started with Risk Quantification

One of the cornerstones of managing the unknown is defining it and measuring it. Anything that could cause harm to an organization needs to be tracked and managed. As more and more transactions occur entirely on digital platforms or are at least facilitated digitally, the ability of cybersecurity issues to trigger a breakdown in the delivery of products and services is a top concern of executives and boards.

10 November 2021
Podcast
Podcast

IT Audit in Practice: Survival When You are Small-business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan. Was your small-business or corporation prepared for the shift to remote work in early 2020? If not, you probably realized that business continuity is more than having the right systems and applications in place.

10 November 2021
Podcast
Podcast

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external cloud environments, and information sharing.

10 November 2021
Podcast
Podcast

Security as a Service

What is security as a service and when is it needed? Tune in as ISACA’s Cyber Pros explain how the increase in hacks and attacks are forcing companies to take cyber security more seriously.

10 November 2021
ISACA live tile
Podcast

The Cybersecurity Workforce

Join ISACA’s Director of Communications, Kristen Kessinger as she interviews ISACA’s Information Security Professional Practices Lead, Jon Brandt about what is currently happening in the cybersecurity workforce.

10 November 2021
Podcast
Podcast

US DoD’s CMMC Guidelines — What You Need to Know

Cybersecurity Maturity Model Certification or CMMC is a new security program being released by the US DoD. If you are a DoD contractor, your livelihood could be at stake as contract requirements and contractors will need to be certified or a contract won’t be awarded.

10 November 2021
How to Construct a Governance System From the Board Level to the Code Level
ISACA Journal Article

How to Construct a Governance System From the Board Level to the Code Level

The concepts involved in promoting a mature structure for software platforms and applications can be quite intricate.

Author: Blake Curtis
Julia Kanouse
Blog Post

New Opportunities Await ISACA Members in 2022

With Membership and Certification renewals right around the corner, I wanted to take a moment and preview some of what you have to look forward to in 2022!

8 November 2021
Nikolas Badminton
Blog Post

Planning for Multiple Futures at Once

Nikolas Badminton, a keynote speaker at ISACA’s EVOLVE emerging tech virtual conference, taking place 16-17 November, recently visited with ISACA Now to share his perspective on the business technology landscape.

8 November 2021
Muneeb Imran Shaikh
Security Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception.

8 November 2021
Guy Pearce, CGEIT, CDPSE, and Maureen Kotopski
Blog Post

Talking to Alan Turing About Artificial Intelligence

Is it enough that a computer can be called intelligent if it can deceive a human into believing that the computer is human? Maybe not.

5 November 2021
Larry Wlosinski
Blog Post

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a new and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

4 November 2021
Caitlin McGraw
@ISACA Article

Counteroffers on the Rise: Job Seekers, Be Prepared for a Wild Ride

The counteroffer strategy typically lies dormant until talent shortages mount. Then, they start popping up like mushrooms after a rain. Like mushrooms, some are tasty, while many are detrimental to your career; some are deadly damaging.

3 November 2021
Exploring Blockchain
@ISACA Article

Exploring Blockchain Forensics

Blockchain forensics enable organizations and experts to manage financial crime and reputational risks associated with cryptocurrencies and other blockchain applications from the onboarding of new customers and ongoing maintenance for existing customers.

3 November 2021
John P. Pironti
@ISACA Article

Five Key Considerations When Applying a Trust, but Verify Approach to Information Security and Risk Management

Doveryai, no proveryai or ”trust, but verify,” the Russian proverb made famous by former US President Ronald Reagan, means that a responsible person always verifies everything before committing themselves to a common business with anyone, even if the other party seems completely trustworthy.

3 November 2021
Tuan Phan
Blog Post

Exploring Blockchain Forensics

In technical terms, blockchain forensics is the use of science and technology to investigate and establish facts in criminal or civil courts of law.

3 November 2021
Sumedha Adavade
Blog Post

Building a Strong Risk Culture in the New Normal

The current times are challenging for many organizations in terms of adjusting their frame of mind to working in a hybrid manner (i.e., from home and in the office), keeping abreast of new guidelines from local regulatory and government authorities and managing operational risk.

2 November 2021
The Impact of Schrems II, Part 2
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 2

As discussed in “What the Schrems II Ruling Means for Modern Multinational Information Security Practice, Part I,” on 16 July 2020, the Court of Justice of the European Union (CJEU) rendered what is likely to be its most disruptive decision to international commerce to date, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (“Schrems II”).

Author: Scott M. Giordano
Cyberthreat Intelligence as a Proactive Extension to Incident Response
ISACA Journal Article

Cyberthreat Intelligence as a Proactive Extension to Incident Response

Cyberthreat intelligence (CTI) is one of the latest buzzwords in the information security industry.

Author: Larry G. Wlosinski
Jon Brandt
Security Article

Operational Security: A Business Imperative

The US military developed the operational security (OPSEC) methodology during the Vietnam War. Military service afforded me unique opportunities and insights obtained throughout assignments that spanned across the intelligence community and multiple areas of warfare.

1 November 2021
j21v6-Afraid-of-the-Dark
ISACA Journal Article

Information Security Matters: Afraid of the Dark (Data)

I have a cabinet at home that is stuffed full of…well, I am not quite sure what. I am pretty sure there are chargers, although I am not as certain that the devices they once charged still exist. There are cables, connectors and whatnot—a lot of whatnot. If I were a betting man, I would wager that most readers have a cabinet, closet, box or drawer just like mine.

Author: Steven J. Ross
j21v6-How-the-Lack-of-Business
ISACA Journal Article

IT Audit in Practice: Interconnections and Vendors

Business success is inextricably defined by relationships. No matter what technology is used or what brilliant application has been launched, the connections between business owners, suppliers and clients reflect the strategy and how the business owner defines...

Author: Cindy Baxter
j21v6-A-Fairy-Tale-of-Innovation
ISACA Journal Article

The Bleeding Edge: A Fairy Tale of Innovation

Greetings traveler! Since you have been navigating the wonderful and informative world of the ISACA® Journal for some time, you have likely been inspired to explore and question the world around you. I invite you to take a break from staring at screens for I have a tale to tell.

Author: Dustin Brewer
j21v6-Interconnectivity-Innovation
ISACA Journal Article

Innovation Governance: Interconnectivity Innovation

In today’s business world, few organizations larger than a small enterprise can survive without interconnectivity limited to just email or a website. Even smaller not-for-profit organizations are using tools that provide greater interconnectivity.

Author: K. Brian Kelley
j21v6-How-Innovative-Enterprises
ISACA Journal Article

How Innovative Enterprises Win With Secure Machine Learning

New solutions help innovative enterprises succeed in an ever-changing, increasingly competitive digital economy. These solutions can empower enterprises to activate and extract value from sensitive data and engender trust by preserving the privacy of customers and employees.

Author: Ulf Mattsson
j21v6-Differentiating-Internal-Audit
ISACA Journal Article

Differentiating Internal Audit in Supply Chain Risk Management

Bracing consumers for looming supply chain disruptions has become a repetitive task for the news media in the wake of the COVID-19 pandemic. In early 2021 alone, consumers were told to prepare for shortages of everything from gasoline to chlorine and chicken to computer chips.

Author: Kevin M. Alvero
j21v6-The-Anatomy-of-ICT
ISACA Journal Article

The Anatomy of ICT and Services Supply Chain Risk Management

Innovative cyberattacks are emerging across the world in the wake of the COVID-19 pandemic. Attackers are using more sophisticated tools, techniques and processes (TTPs), including information and communications technology (ICT) and services supply chains...

Author: Vimal Mani
j21v6-How-the-Lack-of-Business
ISACA Journal Article

The Pandemic Exposed a Lack of Business Continuity. How Business Must Change

Business continuity planning (BCP) has received considerable attention recently due to the COVID-19 pandemic. Many organizations found that they either did not have a plan to address the many changes that occurred due to the pandemic or that their plan...

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid and Tyler Fezzey
j21v6-Building-an-Enterprise-SOC
ISACA Journal Article

Case Study: Building an Enterprise SOC and Risk Management Function

Starting in the early 2000s and until the mid-2010s, compliance was a primary driver for many cybersecurity programs; as instilled by business executives, the fear of failing an audit was more worrisome than the threat of a breach.

Author: Katie Teitler
Cyberruse at the Cybergates
ISACA Journal Article

Cyberruse at the Cybergates: Technology, People and Processes

In 1587, Spain was at war with England. Under King Philip of Spain, the Spanish Empire built an armada of 130 large battleships, all waiting in the bay of Cadiz, Spain, ready to invade England.

Author: Pratim Datta
Helpsource
ISACA Journal Article

Help Source Q&A

We are hearing the term “disinformation” more often. Is it the same as misinformation? If not, what is the difference?

Author: Sunil Bakshi
Phil Zongo
Blog Post

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

29 October 2021
Security Adjustments to Strengthen the Bond Between Risk Registers and Information
ISACA Journal Article

Security Adjustments to Strengthen the Bond Between Risk Registers and Information

A valuable component of corporate governance is the risk register. Although it is not mandatory, using a risk register to build a sound risk governance process for an organization is strongly recommended.

Author: Luigi Sbriz
Top Ransomware attacks
@ISACA Article

Surge in Ransomware Attack and 10 Biggest Attacks in 2021

Ransomware attacks have increased alarmingly in 2021. No industry is safe from this malicious act, and every computer file is at risk of being encrypted.

27 October 2021
Security Terminology
@ISACA Article

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, law or information technology.

27 October 2021
Cybersecurity Workforce Diversity
@ISACA Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

With the growing challenges of finding suitable cyberworkforce recruits, organizations must analyze and understand the current workforce composition. Minorities comprise 26 percent of the cybersecurity workforce and only 21 percent of the overall workforce.

27 October 2021
Sunil Bakshi
Blog Post

A Strategy for Tackling ISACA Certification Examinations

ISACA offers several certifications in technology areas related to IT governance, information security, information system audits, privacy, risk management and emerging technologies.

27 October 2021
Serena Zhao
Blog Post

Delivering Company-wide Security through Cross-collaboration

You’ve just been directed by your CISO to create a set of operational security standards. Where do you even begin?

26 October 2021
The Evolution of Security Operations and Strategies for Building an Effective SOC
ISACA Journal Article

The Evolution of Security Operations and Strategies for Building an Effective SOC

Cybersecurity threats are becoming increasingly complex, sophisticated, malicious, well organized and well funded. The widespread adoption of artificial intelligence (AI)-powered tools and technologies will lead to customized, high-impact cyberattacks.

Author: Lakshmi Narayanan Kaliyaperumal
Avani Desai
Blog Post

Taking Fakeness to New Depths with AI Alterations: The Dangers of Deepfake Videos

Even if you haven’t heard the term before, chances are you’ve come across dozens of deepfake videos online and maybe didn’t know it.

25 October 2021
Larry Alton
Blog Post

Head In The Clouds: Seeing Cloud Security Risks Clearly

Businesses have transitioned huge swaths of their operations to the cloud in recent years, and the messaging around the shift has included at least one key pitch: the cloud is more reliable and more secure than legacy technology.

22 October 2021
Ioannis Routsis
Blog Post

Fascinating Numbers: How COBIT 2019 Helps Set Targets and Measure IT Performance

Since I was a child, I have been good at mathematics and my sister, who is one year older than me, has often taken advantage of this by explaining theories to me in order to do her homework. I did not mind because numbers always fascinated me.

21 October 2021
The Invisible Enemy Within
ISACA Journal Article

The Invisible Enemy Within: Insider Threats

When most organizations think of an insider threat, their focus is on a technically skilled, disgruntled and unethical employee or contractor with privileged access.

Author: Allen Ari Dziwa
Digital Governance
@ISACA Article

Can IT Governance Be Dispensed With?

In the present context of digital transformation no longer being optional for any enterprise in the current digitization-driven economy, whether wholly or partially in the case of retention of some legacy systems, a commitment to strong IT governance is absolutely mandatory for survival.

20 October 2021
Tips of the Trade- Todd Weinman
@ISACA Article

‘How Much Does It Pay?’

As a recruiter who specializes in recruiting audit and GRC professionals, I spend significant amounts of time each week reaching out to prospective candidates, via email, InMail, or phone, about the opportunities for which we are recruiting.

20 October 2021
Angela Hall
Blog Post

Addressing New Operational Resilience Requirements of the EU-DORA Proposal

In 2020, the European Union (EU) published a proposal on digital operational resilience known as EU-DORA. EU-DORA, albeit a proposal only, marks a turning point in EU banking regulation as it introduces wide-ranging new requirements in several areas and combines earlier singular regulatory provisions.

20 October 2021
Volkran Evrin
Blog Post

Qualitative vs. Quantitative Risk Assessment

With the ongoing impact of the COVID-19 pandemic in today’s business ecosystem, the value of decision making by using risk-oriented thinking has emerged more clearly and precisely.

19 October 2021
David Cross
Security Article

Novel Ideas From NIST for Fighting APTs

2021 brought many surprises, not the least of which was an uptick in the scale and severity of cyberattacks. One might be tempted to call 2021 the year of ransomware, yet ransomware is not merely automated worms anymore.

19 October 2021
Rise of Ransomware Attacks
ISACA Journal Article

Rise of Ransomware Attacks on the Education Sector During the COVID-19 Pandemic

Malware has existed for decades. Ransomware has become one of the most financially devastating types of malware attacks and poses a serious threat to agencies, school districts and other organizations

Author: James G. Koomson
Bojan Bajic
Blog Post

Key Pointers For a ‘People-First’ Transformation

So much has changed in the past decade of technology. Remember early iPhones, or the first generation of social media platforms just hitting the mainstream?

18 October 2021
Podcast
Podcast

ISACA Conference Europe – Keynote speaker: Vinh Giang

Listen in as ISACA Conference Europe Keynote speaker, Vinh Giang's discusses how he became the successful entrepreneur, magician and keynote speaker that he is today.

18 October 2021
Eszter Diana Oroszi
Blog Post

Patching Security Awareness: Human Traits as Vulnerabilities

October is Cybersecurity Awareness Month, a time of year when security awareness improvement actions become especially prominent.

15 October 2021
Augustus Ndamage
Blog Post

How to Prepare for and Pass the CISA Exam on Your First Try

In life, it is very easy to spot a certain model and brand of car if that is what you are yearning to have.

14 October 2021
Establishing a Foundation and Building an Insider Threat Program
ISACA Journal Article

Establishing a Foundation and Building an Insider Threat Program

Establishing a brand new process, function or program can be daunting. Some of the challenges include determining where to start, researching whether it has been done successfully in the past and, if it has, discovering the best practices and frameworks that can be used as a starting point.

Author: Kara Nagel
Ajay Barot
@ISACA Article

Latest Collaboration Brings Emerging Technology Focus to Puerto Rico

One of the best parts about my role at ISACA is the chance to build new relationships that can truly lead to transformative progress in people’s learning paths and, ultimately, their careers.

13 October 2021
Shuaib Shakoor
@ISACA Article

Navigating Changes in Internal Audit

Shuaib Shakoor, CISA, executive director for internal audit at professional services firm JLL, visited with @ISACA to discuss how internal audit is changing, how audit teams should approach cyberrisk and the challenges that accompany implementing emerging technology.

13 October 2021
Bruce R. Wilkins
@ISACA Article

Unraveling the Dark Web

When discussing the dark web, some might say that one will never find a more wretched hive of scum and villainy. But if that is true, why does it continue to exist?

13 October 2021
Kevin Alvero
Blog Post

Business Continuity Planning: Finding a Better Way

Although the details change on a case-by-case basis, a large number of organizations in some parts of the world have begun to reinstate pre-pandemic business operations in some form or another.

13 October 2021
Veronica Rose
Blog Post

Pass the IT Risk Fundamentals Certificate Exam on the First Attempt

To any exam-taker, it is always magnificent after completion of your test to view the screen displaying “You Passed.”

12 October 2021
Tom Conkle and Kelly Hood
Security Article

Lessons Learned From a Year of Remote Work

Over the last year, organizations have had to address many new challenges. When the COVID-19 pandemic first hit, many enterprises had to send staff home with workstations, printers and other resources they needed to continue working.

12 October 2021
Cybersecurity Workforce Diversity
ISACA Journal Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

There is undoubtedly a substantial gap in available cybersecurity personnel to fill the existing open positions, and most researchers believe this gap is only going to grow without a significant change in how personnel are recruited into and retained within the field.

Author: Christopher Henry
Vinh Giang
Blog Post

The Power of Goal-Setting and Re-Imagined Communication

Vinh Giang, a keynote speaker at ISACA Conference Europe 2021, recently discussed themes of perspective, empowerment, goal-setting, and positive mindset to encourage others to believe in the possibility of positive change with ISACA Now.

8 October 2021
Paul Frenken
Blog Post

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, lawor information technology.

8 October 2021
Wickey Wang
Blog Post

The Ethics of Artificial Intelligence

Artificial intelligence (AI) is intelligence demonstrated by machines as opposed to the natural intelligence displayed by humans or animals.

7 October 2021
The Influence of Employee Personality on Information Security
ISACA Journal Article

The Influence of Employee Personality on Information Security

Employees are often considered the weakest link in the information security chain, creating both unintentional and intentional security threats for their employers and their employers’ partners and customers.

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid, Tyler Fezzey and Christine Kelley
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Challenges of AI and Data Privacy—And How to Solve Them

Artificial intelligence (AI) has developed rapidly in recent years. Today, AI and its applications are a part of everyday life, from social media newsfeeds to mediating traffic flow in cities to autonomous cars to connected consumer devices such as smart assistants, spam filters, voice recognition systems and search engines.

6 October 2021
Caitlin McGraw
@ISACA Article

The Profile: The Most Underrated Section in the Modern CV

The Profile or Summary section at the very beginning of many résumés is the most underrated and abused section of all. Underrated because most professionals don’t fully understand how powerful this opening section of the CV can be, which is to say, extremely powerful.

6 October 2021
Why you will be hacked
@ISACA Article

Time to Push Back Against Emboldened Cybercriminals

There are no questions about the growing profitability of cybercrime, which will reach an estimated US$10.5 trillion by 2025.

6 October 2021
Richard Bailey
Blog Post

Seven Tips for Protecting Your HIPAA Database

Protecting confidential data is a top priority for every industry, but when it comes to the healthcare industry, the regulations and compliance requirements that are in place require stringent data protection measures.

6 October 2021
US Policy on the Use of Force in Cyberspace
ISACA Journal Article

US Policy on the Use of Force in Cyberspace

The United States’ ability to defend and protect itself in cyberspace has evolved at an incredible pace. This evolution has been accomplished largely due to various frameworks such as the US National Cybersecurity Strategy (NCS), Joint Publication 3-12 and Presidential Policy Directive 21.

Authors: Roncs Etame-Ese, Daniel Odei, Sean Manning, Eric Mavakala and Andrew Hall, Ph.D
Luigi Sbriz
Blog Post

How Can the Relationship Between Risk, Control and Maturity Create Value?

Sometimes the world of internal control is associated with the color gray—an environment of repetitive, boring and ineffective activities.

4 October 2021
Jesse Fernandez
Security Article

Protecting Your Organization From Ransomware

It seems as though ransomware is constantly being discussed on the news. It also seems there have been more news stories about ransomware in the past few months than in the past few years.

4 October 2021
Brian K. Ngac
Blog Post

When Are Virtual Chief Information Security Officers the Right Choice?

Cybersecurity executive management and leadership are a key component to securing an organization’s infrastructure and assets properly.

1 October 2021
Leadership David Samuelson
@ISACA Article

Cultivating the Next Generation of Digital Trust Professionals

Attracting the next generation of professionals is not just critical for ISACA’s future – it is critical for the future of our professions.

29 September 2021
Tips of the Trade-Mostafa
Blog Post

Five Easy Technical Tips for an Optimized SAP GRC ARA Report

An effective and mature governance, risk and compliance (GRC) program has proper business requirements and the right blend of automation and technology support.

29 September 2021
Write Strong Risk Scenarios
Blog Post

How to Write Strong Risk Scenarios and Statements

Risk management is both art and science. There is no better example of risk as an art form than risk scenario building and statement writing.

29 September 2021
Decentralized Cloud Computing
ISACA Journal Article

Decentralized Cloud Computing

Computing has penetrated all aspects of everyday life from smartphones, cars, televisions and cameras to home appliances.

Author: Daniel D. Wu, Ph.D., CISA, CISM
Shivvy Jervis
Blog Post

Building the Sustainable Innovations of the Future

Shivvy Jervis, Futurist & Founder of the FutureScape 248 laba, recently visited with the ISACA Now blog to discuss the job landscape of the future, what makes innovations sustainable, her past work with the United Nations and more.

27 September 2021
Assessing CyberSecurity
@ISACA Article

Assessing the State of Cybersecurity in 2021 and Preparing for 2022

Nearly three-quarters of the way through 2021, it is a good time to take stock on the state of cybersecurity and lessons learned this year.

22 September 2021
Information Security
@ISACA Article

Collective Curriculum Development in Information Security

We have all heard about or experienced the cybersecurity workforce and skills shortage. In an attempt to address the skills shortage from an educational institution point of view, I used crowdsourcing to develop a new graduate level cybersecurity course.

22 September 2021
Information System Contingency
@ISACA Article

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a trending and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

22 September 2021
Is Cyberspace Secure From Humans
ISACA Journal Article

Is Cyberspace Secure From Humans?

A stable mechanism is one that operates consistently and sensibly. Cybersecurity is fundamentally a dynamic sociotechnical mechanism and, due to the human factor, it is vulnerable because human behavior and decisionmaking are complex and often unreliable.

Author: Gopikrishna Butaka
Aneta Waberska
Blog Post

Five Considerations for Leveraging the Unified Compliance Framework

The compliance landscape is constantly shifting, and companies are often challenged to meet the requirements of multiple regulations and frameworks.

20 September 2021
Community Day
@ISACA Article

2021 ISACA CommunITy Day Fast-Approaching

Come give back with ISACA® for our third annual CommunITy Day as fellow ISACA members, staff and their families take action in their local communities to help make a difference across the globe.

15 September 2021
Five Reasons to Add Privacy Knowledge to Your Professional Repertoire
@ISACA Article

Five Reasons to Add Privacy Knowledge to Your Professional Repertoire

When we think of privacy professionals, we usually think of someone with the Data Protection Officer (DPO) designation, but that is a narrow view. A privacy professional does not need to have a DPO title in order to perform privacy responsibilities.

15 September 2021
Sunil Bakshi
@ISACA Article

Insurance as a Risk Response

A July 2021 post on ISACA’s Engage platform considered how insurance coverage can be proposed as a risk response when presenting the risk to senior management and the board of directors (BOD). Although there were quite a few replies to the post, I would like to answer from an operations perspective.

15 September 2021
Angela Hall
Blog Post

CRISC and My Career Path Dedicated to Risk and Controls

Throughout my years working in risk and controls, the two constants that helped propel my career have been demonstrating professional knowledge and enabling opportunities.

15 September 2021
A Technology Control Testing Automation Case Study
ISACA Journal Article

A Technology Control Testing Automation Case Study

Many organizations, particularly those highly regulated by government entities, such as banking and insurance, employ a Three Lines of Defense model for risk management.

Author: Michael Powers
Stephanie Urban
Blog Post

Cloud Auditing 101: How Do I Get Started?

We’re entering what feels like a new era in re-inventing how we once worked. Pre-2020 seems like a lifetime ago, and not only are organizations accelerating their cloud adoption, we as practitioners are re-examining our own careers and skills.

3 September 2021
Caitlin McGraw
@ISACA Article

Are Video CVs Back? Hiring Leaders Weigh In

This past July, TikTok launched a trial video résumé program to connect job-seekers with more than 30 major companies, including Target, Chipotle and Shopify. The job listings were a mix--for example, a “restaurant team member” for Chipotle and a senior data engineer for Shopify.

1 September 2021
Simona Rollinson
@ISACA Article

Future-Proofing Our Tech Stack

ISACA operates with a digital-first mindset. Soon, we will have the technological infrastructure in place to fully execute on that mentality.

1 September 2021
ISACA Conference Oceania Keynoters
@ISACA Article

ISACA Conference Oceania Keynoters to Share Solutions, Optimism for Future of Tech

Energize yourself, your career and your life with powerful messages from outstanding keynote addresses at ISACA Conference Oceania 2021, an event taking place virtually 28-30 September.

1 September 2021
How Do Organizations Control Their Use of Social Media? Part 2
ISACA Journal Article

Accessing Data and Maintaining Privacy Before, During and After Catastrophic Events

The basic precepts of privacy do not change in the face of catastrophes, but the type and amount of personally identifiable information (PII) used and generated and the need for legitimate access to those data increase substantially.

Author: C. Warren Axelrod
Sandeep Godbole
Security Article

Cyberrisk Quantification for Improved Cybersecurity

Cyberthreats and cyberattacks are inevitable. Cyberrisk, which formerly was considered relevant only to cybersecurity professionals, is now recognized as having the potential to threaten an entire organization.

31 August 2021
Wickey Wang
Blog Post

An IT General Controls-Based Audit Approach for Blockchain

From an audit standpoint, there are many different focal points for blockchain. Fortunately, looking at blockchain from the perspective of IT general controls (ITGCs) makes auditing blockchain more manageable and simpler.

30 August 2021
Valerie Lyons
Privacy Article

Doing Privacy Right, Not Privacy Rights

The current privacy discourse is shaped around the question: “Is your organization compliant with privacy regulations such as the EU General Data Protection Regulation (GDPR), the US State of California Consumer Privacy Act (CCPA) or the US Health Insurance Portability...

30 August 2021
j21v5-Privacy-Data-Management
ISACA Journal Article

Information Security Matters: Privacy Data Management

Several issues ago, I wrote an article in this space titled, “Why Do We Need Data Privacy Laws?”1 In that piece, I expressed my skepticism about many new privacy laws while the old ones were still not being observed.

Author: Steven J. Ross
j21v5-The-Human-Side-of-Cybersecurity
ISACA Journal Article

IT Audit in Practice: The Human Side of Cybersecurity—Careers

Cyber cops? In the 1990s, who would have thought that technology would offer an endless number of job opportunities fighting the bad guys? The technical nature of cybercrime offers information systems specialists unique career options in a world where cybercrime...

Author: Cindy Baxter
j21v5-Is-Anybody-Home
ISACA Journal Article

The Bleeding Edge: Is Anybody Home? The Return

While the world waited for the scientific breakthrough of a vaccine for COVID-19, we created second lives for ourselves in an effort to battle boredom, continue to work and learn, and stave off the mental side effects of living in quarantine for as long as possible.

Author: Dustin Brewer
j21v5-Innovating-the-Human-Factor
ISACA Journal Article

Innovation Governance: Innovating the Human Factor

In information security, one of the standard axioms is that people are the weakest link. Trust forms the foundation of society. Though in the last few years, we have seen the consequences of specific breakdowns in that trust. However, trust still drives things. Humans still trust.

Author: K. Brian Kelley
j21v5-Exploitable-Traits-as-Vulnerabilities
ISACA Journal Article

Exploitable Traits as Vulnerabilities: The Human Element in Security

As the saying goes, every chain is only as strong as its weakest link and, in the case of information security, that weakest link is the human factor. Employees are high-level risk factors at all enterprises.

Author: Eszter Diána Oroszi
j21v5-What-Role-do-Humans-Play
ISACA Journal Article

What Role do Humans Play in Ensuring Cybersecurity?

Human behavior is a significant variable in any organization’s cybersecurity program. People have the potential to create serious issues through negligence or harmful intent, but they can also play a vital role in keeping an organization’s information assets secure.

Author: Kevin M. Alvero
j21v5-Virtual-CISOs
ISACA Journal Article

Virtual CISOs: Security Leader or Security Risk?

Every organization needs a leader dedicated to establishing, executing and preserving its information security mission. For many mature organizations, this leader is the chief information security officer (CISO).

Author: Brian K. Ngac
j21v5-Rethinking-the-Weakest-Link
ISACA Journal Article

Rethinking the Weakest Link in the Cybersecurity Chain

The cybersecurity chain consists of IT systems, software, networks and the people who interact with this technology. Most cyber researchers consider humans to be the weakest link in the cybersecurity chain. Nine out of 10 (88 percent) data breach incidents are caused...

Author: Glorin Sebastian
j21v5-Technology-Modernization
ISACA Journal Article

Case Study: Technology Modernization, Digital Transformation Readiness and IT Cost Savings

“Digital Distinction” is a major trend for growing, medium-sized organizations, with growth requiring a well-executed digital platform enabled by foresight, leadership and accountability that helps ensure that societal needs are addressed with limited input resources.

Author: Guy Pearce and Richard Fullerton
j21v5-Best-Practices
ISACA Journal Article

Best Practices for Setting Up a Cybersecurity Operations Center

The cybersecurity operations center (CSOC) is a vital entity within any enterprise structure. Its responsibilities are dictated by the size of the enterprise, whether the enterprise is multinational, the enterprise’s preference for centralized or decentralized cybersecurity...

Author: Robert Putrus
Jack Freund
@ISACA Article

It Is Time to Focus on Cyberresilience

The events of 2020 have brought to the forefront of everyone’s mind the need for organizational resilience.

25 August 2021
A Holistic Approach to Mitigating Harm From Insider Threats
@ISACA Article

New Resource Sizes Up Insider Threats

Insider threats can be especially unpredictable for security teams to deal with, as perpetrators might already have access to organizational resources that are not available to the general public.

25 August 2021
Cybermetrics
@ISACA Article

Understanding Cyber Risk Metrics and Reporting

Cyber risk is top of mind for organizations around the world, but effectively addressing that risk and reporting on it to enterprise leaders require a nuanced approach based on organizations’ risk appetite and strategic aims.

25 August 2021
Abdelelah Alzaghloul
Blog Post

Modernizing IT Operations for the Digital Age

The IT discipline has evolved in an unanticipated pace during the last decade, and it is still evolving, forcing both development and operations teams to adapt to this new digital age that is centered around delivering value faster, cheaper and better.

25 August 2021
How Do Organizations Control Their Use of Social Media? Part 2
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 2

Imagine this scenario: A client asks an auditor to review their enterprise’s usage of social media, likely because their chief operating officer (COO) has asked them to do so.

Author: Robert Findlay
Chris Dimitriadis
Blog Post

Embracing the Next Step in My ISACA Journey

My introduction to ISACA was simple enough – a friend of mine recommended I pursue the Certified Information Systems Auditor (CISA) certification back in 2003.

23 August 2021
Ali Pabrai
Security Article

Achieving the CMMC’s Highest Levels

The achievement of higher levels of the US Department of Defense (DoD)’s Cybersecurity Maturity Model Certification (CMMC), specifically Maturity Levels 4 and 5, enhances an organization’s ability to protect Controlled Unclassified Information (CUI) and reduces the risk of advanced persistent threats (APTs).

23 August 2021
ISACA Acts
@ISACA Article

ISACA Acts as Expert Adviser to UK Cyber Policymakers

Concerns related to cyberattacks are wide-ranging, with impact on organizations’ reputations, the possibility of physical/financial harm and supply chain disruptions causing the most unease, according to ISACA’s recently released State of Cybersecurity 2021 report.

18 August 2021
FinTech
@ISACA Article

The FinTech Effect: Redefining the Financial Ecosystem

As the saying goes, “Nothing lasts forever.” This is the case with traditional banks and financial houses with their big and massive structures, from Wall Street in the United States to Bangalore in India. Banking as we have come to know it is changing.

18 August 2021
Caitlin McGraw
@ISACA Article

‘The Great Resignation’: The First Thing You MUST Do If Considering a Job Change

Of late, I have had both hiring managers and IT audit, GRC and security practitioners calling to ask about the “Great Resignation.” Team leaders are worried about retention and back-filling roles.

18 August 2021
Charisa Orwig
Blog Post

The Non-Human Path to an Effective Insider Threat Program

An insider threat program may seem like something from the Philip K. Dick story “The Minority Report,” where three precognitive individuals (precogs) identify criminals before they commit the crime and the precrime police force arrests the identified criminals to prevent the crime from occurring.

18 August 2021
What Government Contractors Should Know About the US DoD’s CMMC Guidelines
ISACA Journal

What Government Contractors Should Know About the US DoD’s CMMC Guidelines

By now, defense contractors of all sizes and service types should know about the Cybersecurity Maturity Model Certification (CMMC). If they do not, it is important to learn about it sooner rather than later: Their livelihoods will depend on it.

Author: Johann Dettweiler
Sandhya Narayan
Blog Post

Making the Security Conversation More ‘Feature-Driven’

A constantly changing security landscape driven by increasingly persistent threats, growing attack sophistication and tighter compliance requirements keeps both the security and product teams at Adobe busy.

16 August 2021
Kirsten Lloyd
Governance Article

Establishing Artificial Intelligence Governance

Artificial intelligence (AI) is seemingly everywhere, with events such as the COVID-19 pandemic spurring increased investment in AI as organizations accelerate plans to power an increasingly digitally connected workforce.

16 August 2021
Bruce R. Wilkins
@ISACA Article

How and Why Publicly Available Information Is Used

There are thousands of servers on the Internet ready to satisfy any data request that one might have. Although the Internet is commonly divided between the open web, the deep web and the dark web, only the open and deep webs coexist on the same infrastructure. The dark web, which will be explored in a forthcoming article, exists on an entirely separate network.

11 August 2021
At ISACA web CommunityDay
@ISACA Article

ISACA CommunITy Day Set for 2 October

Join ISACA for the third annual CommunITy Day as ISACA members, staff and their families take action in their local communities and make a difference worldwide. This year’s CommunITy Day event is scheduled to take place on 2 October 2021.

11 August 2021
Fonteva transition
@ISACA Article

ISACA Website Outage Planned for Mid-September as New Association Management System Is Implemented

ISACA is preparing to transition to a new association management system that will deliver more valuable, relevant and personalized information to ISACA members.

11 August 2021
Blockchain Audit Program
@ISACA Article

New Resource Evaluates Blockchain Controls

Blockchain technology has become one of the most promising technological advancements of the past decade with the potential to transform a variety of key industries.

11 August 2021
Ved Prakrash
Blog Post

The Complexity Conundrum: Simplifying Data Security

As technology continues to evolve at an accelerating pace, unprecedented situations like the COVID-19 pandemic have further cemented our digital way of living and doing business. With digitization, there has been massive data proliferation and growth of data repositories.

11 August 2021
Decoding the Secrets of Cyberinsurance Contracts
ISACA Journal

Decoding the Secrets of Cyberinsurance Contracts

Cyberattacks are emerging faster than ever in the wake of the COVID-19 pandemic. As new dimensions are incorporated into these disruptive cyberattacks, enterprises around the world must be more vigilant about protecting their critical information assets.

Author: Vimal Mani
Ookeditse Kamau
Blog Post

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

9 August 2021
ISACA live tile
Podcast

ISACA’s Digital Transformation Part III — The Digital Member Experience

David Samuelson and ISACA’s Chief Membership Officer, Julia Kanouse discuss the positive impact of technology on our members and the ways in which our global community has grown even closer despite the pandemic.

6 August 2021
Three Things COBIT® Is – And Three Things It Isn’t
@ISACA Article

Enhancing Digital Transformation Through New COBIT Focus Area for DevOps

Advancing digital transformation is a top priority for today’s enterprises. Providing business and technology leaders with new tools to support this effort, ISACA’s new publication, COBIT Focus Area: DevOps, offers guidance based on COBIT 2019 to optimize governance and management practices for enterprises implementing DevOps.

4 August 2021
IT Auditors Corporate Jungle
@ISACA Article

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

4 August 2021
Caitlin McGraw
@ISACA Article

Influencing and Engaging Gen Z: Let’s Fill the Workforce Gap!

Back in March, I wrote a blog post for ISACA Now titled “IT Audit is ‘Boring’? Time to Fix the Perception Problem.” The post seemed to strike a chord; it stirred up a lot of conversation globally and generated more than 9,000 views on LinkedIn.

4 August 2021
Jon Brandt
Security Article

Final Thoughts on the State of Cybersecurity in 2021

ISACA® recently published State of Cybersecurity 2021, Part 2: Threat Landscape, Security and Cybersecurity Maturity, the second part of its annual cybersecurity report. Now in its seventh year, the report enables ISACA to poll its target audience and report the survey findings.

4 August 2021
Direct From the Practitioner
ISACA Journal

Direct From the Practitioner: Crowdsourcing for Cybersecurity Curriculum

Cybersecurity threats and the technology to deal with them are constantly evolving. Because of this, both aspiring and current cybersecurity practitioners must be educated about relevant issues and should keep up to date on new developments so they can adapt and excel in defending their enterprises’ assets.

Author: Brian K. Ngac
Podcast
Podcast

Why should I listen to you?

Dustin Brewer and Frank Downs will take you through their journey, from their start in cybersecurity to how they expanded their knowledge and skills to become the recognized cyber professionals that they are today.

3 August 2021
Avani Desai
Blog Post

Leading a Business and Raising a Family: 5 Ways to Maintain the Balance as a Boss Mom

If you’re a woman—especially if you’re both a working boss and a mom—I bet you can relate to Beyoncé’s hit “Run the World (Girls),” a proud shout-out to female strength and empowerment.

2 August 2021
James Paul Kakembo
Blog Post

Key Considerations in an Era of Remote and Hybrid Workforces

COVID-19 has changed the way we live, think, work and operate in a way that was never envisioned. Many organizations have now embraced the hybrid model, with employees splitting time between in-office and remote work.

30 July 2021
Ekaterina Volkovich
Privacy Article

The Automation of a Data Protection Officer’s Tasks

Data protection officers (DPOs) are facing increasing difficulties when performing tasks manually to comply with data privacy regulations. Gathering information about personal data processing activities in a large enterprise can take several months.

30 July 2021
Veronica Rose
Blog Post

Does Your Organization Have a Risk-Aware or Risk-Blame Culture?

In this blog post, I would like to share with you some of the scenarios to recognize if we are instead in blame culture organizations when it comes to risk management.

29 July 2021
Hybrid Security COnsiderations
@ISACA Article

Caught In Between: Evolving Security Challenges for the Hybrid Workplace

After a year and a half of pandemic, most audit, security and governance professionals have grown comfortable with the “remote work” risk landscape.

28 July 2021
State of Cybersecurity
@ISACA Article

State of Cybersecurity: Reputational Damage from Attacks Tops List of Concerns

With high-profile cyberattacks such as the SolarWinds incident and the Colonial Pipeline ransomware attack on the rise, global government and business leaders are challenged to keep pace with the barrage of threats.

28 July 2021
Daisy Madeleine Jardine-Viner
@ISACA Article

The Final Decision: Which Cybersecurity Job Offer Should I Accept?

As a recruiter, it isn’t uncommon for my cybersecurity candidates to end up with three or four job offers. I recently worked with a candidate who was trying to decide between seven! In this in-demand field, how do you work out which job offer to accept?

28 July 2021
Shawn Rhodes
Blog Post

Seeing the Impact of Change in Real Time

Shawn Rhodes, TEDx Speaker and a nationally syndicated columnist, recently visited with ISACA Now to discuss the evolving risk landscape, managing change and more.

28 July 2021
Partly Cloudy or Clear Skies Ahead?
ISACA Journal Article

Partly Cloudy or Clear Skies Ahead?

In a recent survey of general counsel at large enterprises, titled The General Counsel Report 2021: Rising to Today’s Challenges and Building Resilience for the Future, the majority of respondents indicated that the risk they feel their organizations are most notably ill prepared to navigate is the impact of “emerging” data sources on ediscovery—the process of collecting, analyzing and reviewing electronic evidence—for legal matters, investigations and regulatory compliance.

Authors: Tim Anderson, Ted Barassi and Ted Barassi
ISACA live tile
Podcast

The Lowdown on IoT

Join ISACA's Dustin Brewer as he tells you what you need to know about IoT now – why is it still considered an emerging tech? What are the biggest cybersecurity threats, and what opportunities will the Internet of Things bring in the next five years?

28 July 2021
Sandra Ajimotokin
Blog Post

AI Looms as Major Variable on Cyberthreat Landscape

Artificial intelligence is one of those big, scary topics that can incite fear, excitement, or a bit of both. Security professionals such as myself wonder how increased usage of AI and machine learning will help to shape the future state of our work.

27 July 2021
Guy Pearce
Blog Post

Privacy By Design: How Far Have We Come?

One can hardly consider any part of the data value chain today – from data acquisition to data archiving or disposal – without considering privacy.

26 July 2021
Neeraj Benjamin
Blog Post

Is Blockchain the Ultimate Cybersecurity Solution for My Applications?

Blockchain technology can offer important cybersecurity benefits, such as reducing cyberattacks, and it has recently created a lot of hype as a panacea for all the current challenges related to information security.

23 July 2021
Julia Kanouse
Blog Post

New Points of Connection for ISACA's Global Community

Whether it is our chapters collaborating in new ways, the rise of virtual and hybrid conferences, or growing traction on the Engage platform, ISACA’s global community has come even closer together despite the challenges brought on by the pandemic.

22 July 2021
Podcast
Podcast

Breaking Down the ESET Threat Report

ESET has released its T1 2021 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research.

22 July 2021
ShanShan Pa
@ISACA Article

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up.

21 July 2021
Optimizing Risk Response
@ISACA Article

New Paper Explores Combination of Risk Responses for Enterprises to Weigh

Risk response is a part of daily life – every time drivers get in a car, they actively implement strategies to respond to driving-related risks through wearing a seatbelt, being a defensive driver, and having a car with enhanced safety features. However, everyone is willing to take on a different level of risk, which makes matters complicated.

21 July 2021
Gary Carrera
@ISACA Article

Preventing the Next Cybersecurity Attack with Effective Cloud Security Audits

The use of cloud services to support business needs has exponentially increased over the past years. Most companies have now moved from traditional IT environments to private or public cloud deployments to support IT, security and business needs.

21 July 2021
Caitlin McGraw
@ISACA Article

What Do You Want Your Career to Be? Now’s the Time to Ideate

The second half of 2021 is the ideal time to dream, plan, revise and set new goals. This second half of the year is like none other before. Many are reclaiming a sense of normalcy after a health crisis that shut down the world. It is tempting to dive into that with trips...

21 July 2021
Sunil Bakshi
Blog Post

A Nuanced View of Risk Response

Managing risk is not easy despite it often being considered “common sense” since we do risk assessments all the time in our day-to-day life.

21 July 2021
Prevention of Vulnerabilities in Software Development Using Design Thinking
ISACA Journal Article

Prevention of Vulnerabilities in Software Development Using Design Thinking

In today’s software delivery, the Agile methodology is one of the most widely adopted approaches. Agile has several variants such as Scrum, XP, Kanban and Scrum Bann.

Authors Thejasvi Nagaraju and Shubhamangala Aithal
How IoT Has Changed, and Why It’s Still Considered ‘Emerging Tech’
Blog Post

How IoT Has Changed, and Why It’s Still Considered ‘Emerging Tech’

Even though the IoT originated 15 years ago, organizations in 2021 continue to define IoT as an emerging piece of technology.

20 July 2021
Sushila Nair
Blog Post

Wanted: A Cybersecurity Upton Sinclair

The drumroll of ransomware attacks featured on the evening news, such as the recent Kaseya incident or the Colonial Pipeline incident in the US, has brought the issue further into the public’s awareness.

19 July 2021
Isaac Kohen
Privacy Article

How to Promote Privacy Best Practices at Work

Data privacy is increasingly top-of-mind for today’s executives. The 24th Annual Global CEO Survey—US Findings found that chief information security officers (CEOs) ranked cybersecurity and data privacy second among 11 areas of impact and value, which is why many organizations are putting financial resources behind privacy initiatives.

19 July 2021
Tony Martin-Vegue
Governance Article

The Elephant in the Risk Governance Room

Effective risk governance means organizations are making data-driven decisions with the best information available at the moment.

19 July 2021
Larry Marks

Rethinking Cyberresilience

The National Institute of Standards and Technology (NIST) Special Publication 800-160 has caused organizations to do some rethinking when it comes to cyberresilience and disaster recovery, and what this standard means to existing plans.

15 July 2021
Podcast
Podcast

Cybersecurity Isn’t Real, Right? Wrong!

Every day, the risk of cyber and ransomware attacks regularly increases in frequency and danger. But despite the proof in numbers, many organizations still don’t recognize the need to fortify their fortress and improve the strength of their Cybersecurity practices.

15 July 2021
Advanced Security
@ISACA Article

Encryption and Extended Monitoring to Protect Secret Information

All companies —no matter how small— need some form of a security program to protect their secret information. However, the security that is currently in place to protect those secrets are oftentimes insufficient.

14 July 2021
Ravikumar Ramachandran
@ISACA Article

Five Ways Frameworks Can Drive Your Organization’s Digital Transformation

The top executives and CEOs of organizations across the globe are overwhelmed trying to cope with changing technological developments and customer expectations.

14 July 2021
Julia Kanouse
@ISACA Article

ISACA Community Finds New Connection Points

The power of community is ISACA’s secret sauce. It’s what binds our global community together, and never has that been more evident than during the pandemic.

14 July 2021
Yotam Ben Ezra
Blog Post

Bridging the Gap Between Security and the Business: A New Approach to Business Risk Quantification

In the security arena, today’s teams have to navigate significant layers of complexity, contending with too many different standards and too many disparate technologies. When we talk about security, we have a lot of buzzwords, catchphrases, and, of course, acronyms, which too often serve to compound the confusion.

14 July 2021
The Changing Face of Education
ISACA Journal Article

The Changing Face of Education: Risk, Security and Process Around Distance Learning

The digital revolution has changed many industries, including education. Although digitized learning platforms have made education and information more easily accessible, they have also brought on a rise in cybersecurity and other process risk that must be addressed.

Author: Glorin Sebastian
Josh Hamit
Blog Post

What Do CIOs Want from IT Newcomers? Adaptability

How can recent graduates and other newcomers to IT fields make an impression on CIOs and other enterprise technology leaders who are looking to hire? Josh Hamit, vice president and CIO with Altra Federal Credit Union, recently visited with ISACA Now to describe what characteristics he finds most promising in early-career candidates.

13 July 2021
Antonio Ramos
Security Article

How to Determine the Cybersecurity Level of Your Value Chain

Assuring that third parties with access to systems and/or information do not pose a risk to business is a major pain for most organizations, but there are ways to assess the level of cybersecurity that a vendor provides.

13 July 2021
ShanShan Pa
Blog Post

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up. Plus, the person I was speaking with is also a privacy fanatic like me...

12 July 2021
Anna Johannson
Blog Post

How AI Can Make Your Office More Safe and Secure

It’s hardly news that artificial intelligence has amazing potential to boost organizations’ productivity and workflows

9 July 2021
David Cross
Security Article

Security Inventors Need Not Apply

Part of what makes a cyberjob appealing is that you get to invent, build the “killer application (app)” or make a new breakthrough. That is the appeal for many brilliant creative types, but the reality is that the cybersecurity realm does not allow much leeway for creativity.

9 July 2021
A (Kind of) Quantitative Approach to Organizational Risk Tolerance
Blog Post

A (Kind of) Quantitative Approach to Organizational Risk Tolerance

At times it seems risk tolerance relates to the famous quote on congressional accomplishments, “When all is said and done, there is a lot more said than done.” This is likely because the term is often used qualitatively. That is, we describe one organization as more or less risk tolerant than another without addressing how much more or less.

8 July 2021
Podcast
Podcast

Building a Zero-Trust Network Platform

Finding a balance between a pleasant user experience and stringent security requirements can be a challenge.

8 July 2021
John P. Pironti
@ISACA Article

Five Key Considerations When Adopting a Seed Vault Approach for Ransomware Protection

A “seed vault” approach to ransomware protection can be a last-resort method for organizations to access their data in the event of a catastrophic availability event such as a ransomware attack.

7 July 2021
ISACA awards
@ISACA Article

Have a Question for ISACA Leaders? Join Our ‘Ask Me Anything’

ISACA members can join ISACA Director Veronica Rose, ISACA Board Chair Gregory J. Touhill and ISACA CEO David Samuelson as part of a new “Ask Me Anything” Leadership Series.

7 July 2021
R.V. Raghu
@ISACA Article

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

7 July 2021
Caitlin McGraw
@ISACA Article

The Best Interview Hack? Start With Rethinking Your Résumé

Most people face job interviews with a degree of trepidation about the unknown-ness of it all. There is the sense of the interview being sort of a black box. The biggest bogey is trying to suss out what the hiring team is really looking for.

7 July 2021
Ravikumar Ramachandran
Blog Post

Architecting COBIT for Governance Success

While I was in the process of implementing the ISO 27001 standard for a mission-critical healthcare system for one of the major health care organizations in India, I became COBIT-certified, and I took the opportunity to use COBIT to ensure compliance not only in an ISO 27001 audit but also in the privacy assessment that the organization was undergoing at the same time, which was conducted by a government agency.

7 July 2021
A Trusted Secure Ecosystem Begins With Self-Protection
ISACA Journal Article

A Trusted Secure Ecosystem Begins With Self-Protection

As the connected digital ecosystem expands, cyberthreats and vulnerabilities are gaining momentum at an unprecedented scale. Creating a healthy immune system on every device is critical to build cyberresilience and protect organizations, end users and networks from malicious attacks.

Author: Thorsten Stremlau
Andrea Tang
Privacy Article

Cross-Border Data Transfer and Data Localization Requirements in China

In 2020, China launched a global data security initiative focused on strengthening international coordination for cross-border data flow and outlining the principle of personal information protection.

6 July 2021
Larry Alton
Blog Post

Three Ways the IT Department Can Boost Customer Retention

When a business’s decision-makers develop a customer retention strategy, they typically involve certain critical team members such as the marketing director, in these discussions.

2 July 2021
Tuan Phan
Blog Post

Did the FBI Hack Bitcoin? Deconstructing the Colonial Pipeline Ransom

On 7 May, 2021, Colonial Pipeline, a US oil pipeline system, that mainly carries gasoline and jet fuel to the southeastern United States suffered a ransomware cyberattack that impacted the computerized equipment that managed the pipeline.

1 July 2021
ISACA awards
@ISACA Article

2022 ISACA Awards Call for Nominations

Each year, ISACA recognizes outstanding contributions that advance our professional community and exemplify our leadership and purpose.

30 June 2021
Three Things COBIT® Is – And Three Things It Isn’t
@ISACA Article

3 Things COBIT Is & 3 Things It Isn’t

For over 25 years, COBIT 2019 has built on and integrated best practice frameworks that are used to develop and promote the process of understanding, designing and implementing enterprise governance of IT (EGIT).

30 June 2021
Cobit Application Rationalization
@ISACA Article

Achieving Application Rationalization Using COBIT 2019

How many applications does the average organization use? Research shows that, typically, an organization with 200 to 501 employees uses 123 applications.

30 June 2021
Ginger Spitzeri
@ISACA Article

Connecting Community to Build the Future of Cybersecurity

ISACA’s annual State of Cybersecurity report provides an environmental scan of the cyber workforce and real-world implications of enterprise budgets, the length of time required to fill positions, and what skills cyber professionals need to ensure success in their roles.

30 June 2021
Evolving Cybersecurity
@ISACA Article

Evolving Your Cybersecurity Through Cyber Maturity

In a recent ISACA survey that asked participants what their top cybersecurity program goals were, more than 73 percent cited that achieving continuous improvement of cyber security was their number-one need.

30 June 2021
Sean Ways
Blog Post

Transformation Goes Beyond Hardware, Software

Technology drives everything that we do at ISACA – whether that is powering members’ pursuit of a career-changing certification, providing an array of flexible virtual learning opportunities, offering support and resources for our global chapters – the list goes on.

30 June 2021
j21v4-RBAC
ISACA Journal Article

Information Security Matters: RBAC, BCM & SoD

What a perfect information technology headline! Three acronyms and not a single word. But they are three important concepts in information security, and I would like to take a few pages to explore their intersection.

Author: Steven J. Ross
j21v4-driving-digital
ISACA Journal Article

The Network: Driving Digital Transformation

Information technology is changing the world. It is transforming how we interact, learn and communicate. Around the world, IT fuels national prosperity and security, and ISACA members are at the forefront of optimizing and securing the digital ecosystem.

Author: Gregory Touhill
j21v4-algorithmsand-audit
ISACA Journal Article

IT Audit in Practice: Algorithms and Audit Basics

I must admit, when I saw the theme of this volume of the ISACA Journal, algorithms, or as we call them at work “algos,” I thought, “There’s a topic I don’t understand.” Of course, that is not really the case because every industry I have worked in uses algorithms...

Author: Cindy Baxter
j21v4-the-student
ISACA Journal Article

The Bleeding Edge: The Student Becomes the Teacher

If you have been following this column, you have probably recognized some recurring themes, one of those themes being that for everyone, especially IT personnel, continuing education is never finished.

Author: Dustin Brewer
j21v4-algorithms-and-the-enterprise
ISACA Journal Article

Algorithms and the Enterprise Governance of AI

Alan Turing (1912-1954), a founding father of artificial intelligence (AI) and the inventor of the Turing Test that determines whether a computer can think, defined algorithms as sets of precise instructions for solving problems.

Author: Guy Pearce and Maureen Kotopski
j21v4-to-bot-or-not
ISACA Journal Article

To Bot or Not to Bot? That Is the Question for Digital Banking

There is a legendary proverb that emphasizes that a journey of a thousand miles begins with a single step. In this case, the first step is highlighting the concept of digital banking by introducing the idea of chatbots or bots.

Author: Luis Emilio Alvarez-Dionisi
j21v4-how-can-AI
ISACA Journal Article

How Can AI Drive Audits?

Auditing is viewed as a manual, subject-matterdriven, tedious and sometimes highly subjective practice. With the digital disruption that surrounds IT professionals, it is time to explore how the next generation of artificial intelligence (AI), natural language processing...

Author: Shini Menon
j21v4-how-effective
ISACA Journal Article

How Effective Is Blockchain in Cybersecurity?

Recently, blockchain technology has created a lot of hype as a panacea for all issues related to information security. Blockchain technology provides stronger transactional security than traditional, centralized computing services for secured networked transaction ledger.

Author: Neeraj Benjamin
j21v4-retooling
ISACA Journal Article

Case Study: Retooling Carbon Accounting—Better Business, Healthier Planet

Salesforce, a San Francisco, California, USA-based enterprise with a global workforce exceeding 54,000, offers a broad range of cloud software and services, including customer relationship, customer service, marketing automation, analytics and application development.

Author: Mick Brady
j21v4-Information-System
ISACA Journal Article

Modern IT Operations: Ninja, Samurai or Ronin?

For decades, the IT discipline has suffered from a division between its two main entities: the development team and the operations team. This segregation of duties (SoD) has resulted in different mindsets, models and tools, and competing and conflicting objectives.

Author: Abdelelah Alzaghloul
j21v4-how-do-organizations
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 1

A few years back, there was an Irish enterprise that based its whole business model on its social media presence. This was a vital part of the enterprise’s business strategy, and it prided itself on its use of social media channels. So, it was no surprise when the chair...

Author: Robert Findlay
j21v4-HELP-source
ISACA Journal Article

HelpSource Q&A

How much cybersecurity budget or investment does an organization need to effectively plan to reduce the number of security incidents and data breaches? How can security practitioners convince the board of directors (BoD) to approve this budget?

Author: Sunil Bakshi
Cyberresilience in an Evolving Threat Landscape
ISACA Journal Article

Cyberresilience in an Evolving Threat Landscape

It is important to know if one’s organization is robust enough to survive in the event of a security event, let alone expand and improve. Many reputable cybersecurity organizations are publishing guidance on how to respond in the event of a theft or data breach.

Author: Larry Marks
Benjamin Hentschel
Blog Post

Mountain Climbing and the CGEIT Exam: Relishing the Journey

Studying for a certification is not so different from any other endeavor, whether it be professional or personal. One of my hobbies for over a decade has been hiking mountains of all shapes and sizes.

29 June 2021
Ookeditse Kamau
Blog Post

Accounting for Cyber Fraud Risks During Audit Planning

With a changing global economic outlook, there has been a correlated shift in the fraud landscape, and how audit leaders should manage it. An assessment of fraud possibility is a requirement when carrying out an audit engagement, after all.

28 June 2021
Babur Kohy, CDPSE, CASO, and Michael M. Dowd CASO, XRY
Privacy Article

Advertising Technology: The Invisible Tracker Cheating Privacy

There are many privacy concerns impacting humanity across the globe—one of which is advertising technology (ad tech).

28 June 2021
Podcast
Podcast

Advance Security for Secret Information

Listen in as ISACA Journal columnist, Steven Ross, CISA, CDPSE, AFBCI, CISSP, MBCP, delves deeper into his latest article, “Advanced Security for Secret Information.” As a follow up to his two previously published journals, “Keeping Secrets,” and “Secrets and Privacy,” Ross continues to make the case that the protection of secret information is becoming a significant issue in cybersecurity.

28 June 2021
Farhan Imitaz
Blog Post

Is Traditional Detection and Response Reliable?

I have been in the security industry and helped customers with their cybersecurity business challenges for the last 15 years; therefore, I have had the opportunity to witness and experience the evolution and modernization of attack vectors, the evolution of advanced tactics and techniques and the expansion of the attack surface.

25 June 2021
Avani Desai
Blog Post

How IOT Opportunities and Risks Will Evolve in a Post-Pandemic Environment

According to the World Economic Forum, the number of connected devices exceeded 50 billion last year.

24 June 2021
Cybersecurity-merryGoRound_0621_tile_500
@ISACA Article

Cybersecurity Merry-Go-Round

There are many US citizens outside the cyber industry who only pay attention to cybersecurity incidents when they are affected by them. It can be argued that every data breach directly affects those whose personally identifiable information (PII) was accessed by...

23 June 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

QR Code Security Challenges

Quick Response (QR) codes are rising in popularity. According to a survey conducted by MobileIron, more than 66% of respondents stated that a QR code makes life easier in a touchless world–despite a majority of people lacking security on their mobile devices.

23 June 2021
Daisy Jardine-Viner
@ISACA Article

Three Ways to Limit Burnout and Improve Work-Life Balance in Cybersecurity

As a recruiter, it’s my job to speak with professionals who are actively or passively considering looking for a new job. One of the most common discussions I have now (even more so since the pandemic) is around work-life balance and burnout.

23 June 2021
Amy Witkowski
Blog Post

Redefining Effective Project Management

As we undergo a digital transformation at ISACA, one key element has been strategic project management.

23 June 2021
A Novel Approach for Government Acquisition and Procurement
ISACA Journal Article

A Novel Approach for Government Acquisition and Procurement

In 2015, the commissioner of US Customs and Border Protection (CBP) engaged the Defense Acquisition University (DAU) (Fort Belvoir, Virginia, USA) to review CBP’s acquisition and procurement performance.

Authors: Steven Moyer, Gunter Brunhart, Richard Dubs, Thomas Erickson, Robert Skalamera, Rob Kepner
ISACA live tile
Podcast

ISACA’s Digital Transformation Part II — People, Process, and Technology

David Samuelson is back and continuing his discussion of ISACA’s Digital transformation. This time David interviews members of ISACA’s IT team — CTO, Simona Rollinson; Sr. Director, Application Development, Sean Ways; and Sr. Director of Enterprise Project Management, Amy Witkowski.

23 June 2021
ISACA live tile
Podcast

ISACA’s Digital Transformation Part I — Positive Potential of Technology

Join ISACA’s CEO David Samuelson as he discusses the positive potential of technology with ISACA’s Chief Product Officer, Nader Qaimari.

23 June 2021
Silvana Carpineanu
Blog Post

How Mid-Sized Businesses Can Overcome Cybersecurity Challenges

Growing cybersecurity concerns, combined with regulation and compliance challenges, are a problem for enterprises of all sizes including mid-sized companies.

22 June 2021
Digital-transformation_250
Blog Post

ISACA Talks Digital Transformation

ISACA hosted a LinkedIn Live discussion last week regarding new strategies that are being developed and implemented as part of ISACA’s ongoing digital transformation, and how those efforts will benefit members.

22 June 2021
Gary Carrera
Blog Post

How Cloud-Based Mobile Device Management Supports Remote Working

Years ago, companies managed their devices manually and often using solutions allowing capabilities for device management activities.

21 June 2021
RV Raghu
Blog Post

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

18 June 2021
Tom Faraday
Blog Post

Metrics that Matter: Measuring Organizational Performance in a Post-Pandemic World

There’s no question that environmental, social and corporate governance (ESG) is on the minds of almost every board member and C-suite leader, but it has expanded beyond the boardroom and is now also top of mind for investors and consumers. This all happened—or at least was accelerated—as a result of the COVID-19 pandemic.

17 June 2021
At-ISACA_web_Tips-Rising-Professionals_061621_500
@ISACA Article

Five Ways for New IT Pros to Accelerate Career Growth

Gaining a foothold in IT careers can be intimidating for industry newcomers, given the rising complexity of the technology landscape and the evolving privacy and security threats professionals must learn to mitigate.

16 June 2021
Caitlin McGraw
@ISACA Article

What the Heck is ‘Auditor Instinct’? IT Audit and Security Leaders Provide the Low-down

For years, I have had IT audit directors ask me, as a recruiter, to look for experienced IT audit professionals with “auditor instinct” – that ability to “just know” when something isn’t quite right and when more questions and more digging are is needed to surface the big issues, the root causes, the major findings.

16 June 2021
GRC Conference
@ISACA Article

Virtual and In-person Options Available for 2021 GRC Conference

A high degree of flexibility for learners will mark the hybrid 2021 GRC Conference, taking place 9–11 August. The conference, put on jointly by The IIA and ISACA, will take place in Denver, Colorado, USA, as well as virtually.

16 June 2021
New Resource Illustrates Synergies Between ITIL 4 and COBIT 2019
@ISACA Article

New Resource Illustrates Synergies Between ITIL 4 and COBIT 2019

Organizations looking to create value for their stakeholders can implement frameworks as effective tools for building structures, organizing thoughts, planning events and architecting businesses. A new free white paper from Axelos and ISACA discusses...

16 June 2021
Organizational Culture for Information Security
ISACA Journal Article

Organizational Culture for Information Security: A Systemic Perspective on the Articulation of Human, Cultural and Social Systems

Many international reports and research centers repeatedly insist that the individual is the most important element concerning information security and one of the most relevant when determining an information protection practice for organizations.

Author: Jeimy Cano
Podcast
Podcast

Just the Fax on Cybersecurity

Is your home printer or fax machine an IOT device? You bet it is! Dubbed ‘Faxploit’, research has shown how cyber criminals can infiltrate any home or corporate network by exploiting wireless printers and fax machines. A fax numbers is all it takes to launch this type of attack.

16 June 2021
Mark Thomas
Blog Post

Leverage COBIT and ITIL for Customer-Centric, Connected and Collaborative Organizations

The information and technology (I&T) industry has operated in a changing environment for decades, but it wasn’t until the recent convergence of many disruptive events that forced us to rethink our governance models.

15 June 2021
Veronica Rose
Blog Post

Practice Healthy Career Hygiene

Just like the way hygiene is comprised of conditions or practices conducive to maintaining health and preventing disease, especially through cleanliness, the practice of career hygiene is no different when it comes to preventing career risk, building career capital and maintaining a healthy career.

14 June 2021
Ron Quaranta
Blog Post

Understanding Blockchain Risks and the Coming Wave of Enterprise Adoption

In collaboration with AICPA & CIMA, ISACA published a joint white paper in April entitled “Blockchain Risk: Considerations for Professionals,” an important work that describes and provides background about specific risks related to blockchain implementation and operation.

11 June 2021
Nader Qaimari
Blog Post

The Case for Stackables in Addressing the Skills Gap

I have written before about how there are fractures in our current education system, globally, and how the skills gap continues to widen as there is misalignment between what students are taught in universities and what companies need and expect.

10 June 2021
Board of Directors
@ISACA Article

ISACA Installs 2021-2022 Board of Directors

ISACA welcomed its 2021-2022 Board of Directors last week during its virtual Annual General Meeting. The new board includes members with diverse backgrounds and a range of expertise from across the globe, including new Board Chair Gregory J. Touhill.

9 June 2021
Cloud Governance
@ISACA Article

Key Questions to Address for Effective Cloud Governance

The migration to the cloud is occurring faster than ever in an era of widespread remote work and increased need for speed and agility in conducting business. As enterprises move away from on-premise servers and embrace cloud computing and SaaS applications...

9 June 2021
Sunil Bakshi
@ISACA Article

The Peltzman Effect and Cybersecurity

The COVID-19 vaccination program designed to contain the pandemic is progressing rapidly across the globe. As the number of people who are vaccinated increases, experts have raised concerns about the Peltzman effect, wondering if people will feel more secure...

9 June 2021
Ulf Mattsson
Blog Post

Preserving Privacy With New Technologies

New technologies for data protection can arm innovative enterprises to win in an ever-changing, increasingly competitive digital economy.

9 June 2021
Graciela Braga
Governance Article

The Better the Board Management, the Better the I&T Governance

Today, information and technology (I&T) can have tremendous influence on whether an organization succeeds or fails.

9 June 2021
Sea Change in Risk Culture
ISACA Journal Article

Sea Change in Risk Culture

Until a few months ago, no one would have believed that large swaths of the workforce would be doing nearly everything from within the four walls of their homes, including, for example, the most complex banking transactions and other financial activities that normally involve walking into a bank branch office.

Author: Sumedha Adavade
Election Security 2020
Blog Post

Serving ISACA is Baked into My Professional DNA

Many in IT fields fixate on the new technology and tools that are regularly trumpeted to help us keep pace with new challenges. While the allure of technological innovation draws our attention, we often forget that technology must complement the people and processes...

8 June 2021
Nandita Rao
Blog Post

Building a Successful Strategy for the CDPSE Exam

Evolving privacy regulations and technology require companies to implement privacy by design and by default into products.

7 June 2021
Milica Vojnic
Security Article

What Role Does Data Destruction Play in Cybersecurity?

There are many concerns associated with the modern cybersecurity community. Robust firewalls, reliable cloud storage solutions, in-house IT support and antivirus bundles are all examples. Still, the role of data destruction should never be taken for granted.

7 June 2021
Vimal Mani
Blog Post

Cyberresilience: A Critical Cybersecurity Capability

The rapid evolution of cyberthreats leaves the gamut of risk assessment efforts undertaken by organizations inadequate in addressing cybersecurity concerns.

4 June 2021
Sourya Biswas
Blog Post

The Importance of Risk Assessments and Risk-Informed Decision Making

Recently, I wrote about the concept of “just enough security” and mentioned how “striking the balance between too much, not enough, and just enough security is no cakewalk.”

3 June 2021
The Privacy-Research Connection
@ISACA Article

The Privacy-Research Connection

Medical research and clinical trials have long been relied on as means of obtaining useful, accurate data to learn more about diseases and their potential treatments.

2 June 2021
Caitlin McGraw
@ISACA Article

The Risk of Remote Work

When it comes to how people work, 2020 was a fantastic experiment, demonstrating that millions of professionals in myriad roles, across a plethora of company sectors and sizes, around the world, can successfully work remotely.

2 June 2021
Colonial Pipeline Attack Infographic
@ISACA Article

ISACA Pulse Poll: Ransomware Insights in the Aftermath of Colonial Pipeline

The Colonial Pipeline attack caused massive disruptions to gasoline distribution in parts of the United States in May, resurfacing preparedness for ransomware attacks as a front-burner topic for enterprises around the world.

2 June 2021
Sneha Dasgupta
Blog Post

Four Things I’ve Learned as an Early-Career Professional To Help Create Trust

As an early-career professional, I have learned – through experience and an amazing set of mentors – that two of the most crucial qualities that can impact your career opportunities are: Integrity and Credibility.

2 June 2021
Guy Pearce
Blog Post

Beware the Privacy Violations in Artificial Intelligence Applications

It has been proposed that, “Privacy matters to the electorate, and smart business looks at how to use data to find out information while remaining in compliance with regulatory rules.” Since “smart business” also consists of “the electorate” as employees, at least one...

27 May 2021
Daisy Jardine-Viner
@ISACA Article

Developing Your Career in Cybersecurity

In my previous article “Becoming a CISO,” one of the core pieces of advice was to stay curious and always learn. In the cybersecurity space, learning and development is crucial to progression.

26 May 2021
CMMI V2.2
@ISACA Article

Announcing CMMI V2.2 Release – Security and Safety

ISACA’s new CMMI Model content describes best practices for holistically defining security and safety strategies, approaches, activities, and functions necessary to protect an organization’s entire ecosystem, including personnel, resources and information.

26 May 2021
The Role of the Supply Chain in Security
@ISACA Article

The Role of the Supply Chain in Security

One of the many unexpected consequences of the COVID-19 pandemic has been the global computer chip shortage—or reallocation, as described by security expert Frank Downs in the “Supply Chain Security Considerations” episode of the ISACA Podcast.

26 May 2021
Cyberrisk Quantification
@ISACA Article

Explore Cyberrisk Quantification With Free ISACA Resource

Cyberrisk quantification (CRQ) expresses cybersecurity risk in terms of monetary value to the enterprise. A new white paper from ISACA, Cyberrisk Quantification, addresses the importance of acquiring useful data and amplifying it as part of a CRQ analysis.

26 May 2021
Jack Freund
@ISACA Article

Cyberrisk Quantification Purity Tests

Measurement can be a tricky thing. Many practitioners want more ways to measure the effectiveness of cybersecurity programs to determine whether they are doing the right things to protect their organizations.

26 May 2021
Paul Phillips
Blog Post

Converting Technology Language to Business Language with Cyberrisk Quantification

Cyber risk is continuously evolving. Companies are dealing with different threat actors and events every day, which is why cyber is the fastest-growing risk for many enterprises, and why cybersecurity ranks among the top priorities for global organizations.

26 May 2021
A hand touching a computer server
Governance Article

A Systematic Approach to Implementing a Governance System Using COBIT 2019

Effectively addressing the challenges posed by the COVID-19 crisis requires not just a management system but a governance system that is designed with a primary focus on stakeholder needs and continually serving customers.

26 May 2021
Lost in the Woods
ISACA Journal Article

Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard

George is an inexperienced hiker. He is lost in the woods and it is dark. He wants to go back to civilization. He has a global positioning system (GPS) navigator, but he does not know how to use it correctly.

Author Ioannis Routsis
Tracey Dedrick
Blog Post

Proud to Be Part of ISACA’s Growth and Resilience

First and foremost, it has been my great honor and privilege to serve as Chair of the ISACA Board of Directors. It has been my true pleasure to be surrounded by the sincere dedication of the staff, the board and ISACA members around the world.

25 May 2021
Chris Cooper
Blog Post

Ransomware Defense Calls for Solid Fundamentals, Rigorous Enforcement

Every 11 seconds, an employee will click on a link or open an attachment in a seemingly innocent email and his or her organization will be rapidly infected with ransomware.

24 May 2021
Ali Pabrai
Security Article

APTs Require Enhanced Cyberdefense

Advanced persistent threats (APTs) are introduced by adversaries that possess sophisticated levels of expertise and significant resources, which allow them to achieve their objectives by using multiple attack vectors (e.g., cyberattacks, physical attacks, deception).

24 May 2021
Sizing up the New US Executive Order on Cybersecurity
Blog Post

Sizing up the New US Executive Order on Cybersecurity

For years we have seen standards, regulations and legislation arise in the aftermath of a cyber incident or shifts on the technology landscape.

21 May 2021
A Modern Perspective on IT Risk
@ISACA Article

A Modern Perspective on IT Risk

With cybercrime and related threats on the rise, and increased global spending on cybersecurity with not much impact on risk reduction, there is a need for change. “Let’s switch our mindset from the old management style that uses outdated thinking and slows remediation, and instead look to a forward, modern perspective,”...

19 May 2021
ISACA Conference Keynoters
@ISACA Article

ISACA Conference Keynoters Deliver Calls to Action

ISACA Conference North America 2021 united business IT professionals in many roles and disciplines. One commonality in attendees’ careers is the desire to bring more passion, leadership and bravery to both their work and personal lives. The conference’s three keynote presenters...

19 May 2021
Remote Engagements, Audit Fatigue Among Challenges for Auditors
@ISACA Article

Remote Engagements, Audit Fatigue Among Challenges for Auditors

“As auditors, we abide by clear rules that are repeatable,” Doug Landoll said this month in his ISACA Conference North America presentation, “Remote Assessments: Retooling Security Risk Assessments in a Pandemic Environment.” He shared some of the work-around solutions...

19 May 2021
Mary Breslin
@ISACA Article

Revisiting Third-Party Risk in the Pandemic Era

Pandemic-driven disruption has drastically changed the way most organizations conduct business, and that includes third-party vendors upon which many companies heavily rely.

19 May 2021
Cybersecurity War
@ISACA Article

Why We’re Losing the Cybersecurity War

It’s time to admit we’re losing the cybersecurity war and become more accountable about the real reasons why.

19 May 2021
Demystifying the Implementation of Cyberresilience Programs
ISACA Journal Article

Demystifying the Implementation of Cyberresilience Programs

Cyberattacks are emerging faster than ever across the world in the wake of the COVID-19 pandemic. With newer dimensions incorporated into emerging disruptive cyberattacks, organizations globally are more vigilant about protecting their critical information assets.

Author: Vimal Mani
Gary Carrera
Blog Post

Best Practices to Implement Secured Cloud Collaboration Tools

According to a recent study published by Gartner Inc., end-user spending on public cloud services could grow 23.1% in 2021, reaching US$332.3 billion compared to $270 billion in 2020.

18 May 2021
Tuan Phan
Blog Post

Hidden Insights from The Pulse: Emerging Technology 2021

In The Pulse: Emerging Technology 2021 report, ISACA sought feedback on specific emerging technology trends, training, and implementations, to identify and establish a baseline of what constitutes an emerging technology, as these definitions can vary from person-to-person or between organizations.

18 May 2021
Podcast
Podcast

The Relationship Between Privacy and Research

Volunteering to participate in medical research is a commendable act of service, but to do so can understandably raise questions about subject privacy. In this episode of the ISACA Podcast, ISACA Journal columnist Cindy Baxter discusses...

18 May 2021
Tony Luciani
Blog Post

Achieving Continuous Compliance and IT Control Automation

Every organization has to comply with regulations and control frameworks. As assurance professionals, we are often tasked with understanding the compliance requirements, validating the compliance controls’ design, and then testing the control effectiveness.

17 May 2021
Kelly Hood
Privacy Article

Building a Solid Foundation for Privacy: What Data Exist?

As more privacy regulations are released, organizations must evaluate their privacy capabilities. However, it is difficult to know where to start. The first thing organizations need to do to make sure they are being responsible is to determine what data they possess.

17 May 2021
Jason Yakencheck
Blog Post

Understand the Cyber Skills Shortage to Get Ahead

Cybersecurity remains a seller’s market. Threats and exploits continue to be more sophisticated and increase in frequency

14 May 2021
Nader Qaimari & David Samuelson
Blog Post

Building the Foundation for ISACA’s New Learning Pathways

Nader Qaimari, Chief Product Officer at ISACA, was interviewed by ISACA CEO David Samuelson on 7 May in a LinkedIn Live discussion on ISACA’s digital transformation and how it is supporting the evolving learning resources for ISACA’s professional community. The following is an excerpt from the conversation.

13 May 2021
Congratulations to the 2021 ISACA Hall of Fame Inductees
@ISACA Article

Congratulations to the 2021 ISACA Hall of Fame Inductees

ISACA is pleased to honor the 2021 Hall of Fame inductees for their thought leadership, volunteer service and/or engagement activities. Earlier this year ISACA announced the legacy inductees to initiate this new honor, and to complete the first class of this member-to-member recognition...

12 May 2021
Risk
@ISACA Article

Fighting Risk to Find Resilience

Digital transformation can add value to an organization and position it to become—and stay—resilient. But to accomplish this, “you have to have some way of measuring both your maturity today and where you are in the digital transformation journey,” ServiceNow’s ...

12 May 2021
IoT
@ISACA Article

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword. GRC systems target a fusion of three elements that should harmoniously exist in business...

12 May 2021
Sunil Bakshi
@ISACA Article

Is Outsourcing Truly Considered Risk Sharing?

Risk management practices specify that every risk be identified and assessed. Based on the risk assessment, one or more of the following four risk management options can be chosen as the preferred method of addressing the risk...

12 May 2021
Thomas Kyei-Boateng
@ISACA Article

Welcoming Thomas Kyei-Boateng: ISACA’s new CFO

Thomas Kyei-Boateng joined ISACA in May as Chief Financial Officer (CFO). Thomas is a strategic finance professional with 15 years of progressive experience in financial leadership roles at some of the world's biggest organizations, including Capital One Financial Corporation...

12 May 2021
Ron Lear
Blog Post

Performance and Compliance – Stop the Level Chase!

Take a maturity level-based compliance framework as a compliance example. The intention and design of these frameworks is that compliance can be boiled down to a single number, e.g. maturity level 3, which theoretically then equates to certain demonstrable performance expectations.

12 May 2021
Neil Harper
Blog Post

Bridging the Digital Divide

Niel Harper is an ISACA Global Achievement Award-winner for “contributions to capacity building across the world towards the development of affordable, open and user-centric Internet infrastructure.” Find out more about Niel’s background and achievements in the Q&A below.

11 May 2021
Alejandro Mijares
Security Article

The US FFIEC’s Cybersecurity Assessment Tool in Numbers

In an era of hyperconnectivity, cybercriminals are constantly innovating their tactics to exploit human error and technological vulnerabilities. Adapting to the changing threat landscape is essential for any organization to remain secure in the digital age.

11 May 2021
Podcast
Podcast

Supply Chain Security Considerations

The computer chip shortage resulting from the COVID-19 pandemic may sound like a mere supply chain issue, but the ramifications of it have also been felt in the cybersecurity sector.

11 May 2021
Guy Pearce
Blog Post

Data Resilience: A Hero’s Journey for Data Professionals

In the archetypal hero journey, once ordinary characters, such as Luke Skywalker, Frodo Baggins, Arya Stark, Katniss Everdeen or even the android, Data, leave what they know to pursue a quest, facing many extraordinary, fantastic and sometimes supernatural predicaments or dilemmas in an unknown world.

10 May 2021
Binita Patel
Blog Post

Fill in Gaps from University Studies for Early Career Success in InfoSec

The world of InfoSec is full of opportunities and challenges, but not everyone is ready to tackle them right out of school.

7 May 2021
Larry Alton
Blog Post

Practical Tips to Get the Right Cybersecurity Insurance for Your Company

Falling victim to a cyberattack isn’t an experience anyone wants to deal with. However, cyberattacks are always a potential threat and cause devastating consequences. Just in the first half of 2020, 36 billion records were exposed in data breaches. The effects of those breaches will be felt for quite some time.

6 May 2021
Blockchain Risk Considerations for Professionals
@ISACA Article

Complimentary Guide Explores Blockchain Risk

Blockchain can bring transformational benefits to businesses, but also comes with risks that need to be identified and mitigated, as detailed in a new joint white paper from ISACA and AICPA, Blockchain Risk: Considerations for Practitioners.

5 May 2021
How to Stay on Top of Data Privacy Changes and Ensure Ongoing Compliance
@ISACA Article

How to Stay on Top of Data Privacy Changes and Ensure Ongoing Compliance

After a flurry of activity and changes to privacy settings and disclosure, many felt they could move on once they had checked that compliance box. But things have not remained static from a regulatory standpoint

5 May 2021
Caitlin McGraw
@ISACA Article

Improving the Odds of Your Résumé Reaching the Hands of a Human

Talent acquisition and HR teams like ATSs because they reduce the hours spent by humans (often too few in HR functions) reading résumés. Presumably, the AI in the ATS system can parse for key words and match those to a job description and any other custom parameters that a company builds into their résumé screening.

5 May 2021
State of Cybersecurity 2021
@ISACA Article

State of Cybersecurity 2021: Cyber Field Thriving Despite Pandemic

Despite the widespread economic damage resulting from the COVID-19 pandemic, the cybersecurity industry has remained relatively unscathed, according to ISACA’s State of Cybersecurity 2021 study.

5 May 2021
Annual Report
@ISACA Article

The Power of Technology in a Pandemic

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available...

5 May 2021
Avani Desai
Blog Post

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword.

May 5 2021
Cyberresilience in a Societal Context
ISACA Journal Article

Cyberresilience in a Societal Context

In this century, especially in the previous few years, several factors have placed enormous stress on the resilience of businesses—and by extension, of their suppliers, customers and employees—around the world. The first among these was the global financial crisis...

Author: Steven J. Ross
Jon Brandt
Blog Post

The More Things Change in Cybersecurity, the More They Stay the Same

Amidst a global pandemic that prompted a wide range of governmental response actions and mandates, the cybersecurity industry was largely untouched, as shown by respondent data to ISACA’s State of Cybersecurity 2021: Global Update on Workforce Efforts, Resources and Budgets.

4 May 2021
The Pace of Technology Change Doesn’t Have to Be Overwhelming
Blog Post

The Pace of Technology Change Doesn’t Have to Be Overwhelming

When I started my career in technology, I began by working on SNA networks. Mainframes, Virtual Telecommunications Access Method (VTAM), Synchronous Data Link Control (SDLC), and Token Rings were all things I learned about right away, and just when I got good at them, I was thrown into a land of Transmissions Control Protocol / Internet Protocol (TCP/IP) and multiprotocol networks.

3 May 2021
MD-annual-report-2020
Blog Post

Pandemic Calls for Flexibility, New Approaches

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available for certification exams and transitioning in-person conferences to virtual events, among many major safety-minded “pivots” brought on by the pandemic.

30 April 2021
j21v3-Advanced-Security
ISACA Journal Article

Information Security Matters: Advanced Security for Secret Information

No matter how small, every enterprise beyond a lemonade stand has some form of a security program. Even someone with a one-person business probably has a personal computer with Internet connectivity, and that PC undoubtedly has a firewall, antivirus software...

Author: Steven J. Ross
j21v3-Survival
ISACA Journal Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

We have all been through a lot. The pandemic has built a new working model, changing leadership perceptions on how and where work can be performed. The intricate plans that many enterprises tested on an annual basis in line with business continuity turned into...

Author: Cindy Baxter
j21v3-Cryptocurrency
ISACA Journal Article

The Bleeding Edge: Cryptocurrency—A Microcosm of Emerging Technology

Emerging technologies can be a tough subject for discussion. Experts, practitioners and just about anyone in the IT field can be very opinionated and passionate when it comes to a particular technology, especially if they are currently working on an implementation...

Author: Dustin Brewer
j21v3-Innovating-Resilience
ISACA Journal Article

Innovation Governance: Innovating Resilience

Innovation is not just about new products, new ways to compete and developing new features. Innovation is also examining what is in place today, seeing where the gaps are and building solutions to address those gaps. When it comes to resilience, innovation has a strong role to play.

Author: K. Brian Kelley
j21v3-The-Global-Pandemics
ISACA Journal Article

The Global Pandemic’s Affect on Business Continuity

Though the events of 2020 are sometimes characterized as unimaginable, many organizations have been preparing for a global pandemic for years. However, many others have found themselves scrambling to maintain operations in the wake of mass shutdowns...

Author: Kevin M. Alvero
j21v3-Data-Resilience
ISACA Journal Article

Data Resilience Is Data Risk Management

Data resilience has several vendor definitions, for example: maintenance of the availability of hosted production data, the ability of data infrastructure to avoid unexpected disruptions, and a combination of the governance, operational and technical considerations...

Author: Guy Pearce
j21v3-Working
ISACA Journal Article

Working Toward a Managed, Mature Business Continuity Plan

Business continuity is defined as having the right tools in place to make sure that an organization can continue to function during an interruption of one or more of its critical mission functions.

Author: Sven De Preter
j21v3-Succession
ISACA Journal Article

Succession Planning for Business Continuity

In this digital age, when discussing business continuity, the first things that come to mind are technology and related processes. However, it is important to note that the critical elements of human resources (HR) and processes have equal weight. The challenge of ...

Author: Muhammad Asif Qureshi
j21v3-Journey
ISACA Journal Article

Case Study: A Journey Toward CMMC Compliance

Peerless Tech Solutions is a managed service provider that specializes in support for government contractor clients. As a federal contractor in its own right, Peerless, in late 2019, began an internal project to prepare itself for compliance with Cybersecurity Maturity Model Certification...

Author: Mick Brady
j21v3-Information-System
ISACA Journal Article

Information System Contingency Planning Guidance

When planning information security for a system, it is essential to remember to include contingency planning because it provides the resilience needed to respond to technical disruptions and ensure the system is available. The critical planning component is an information...

Author: Larry G. Wlosinski
j21v3-HELP-SOURCE
ISACA Journal Article

Help Source Q&A

Recently I heard the term “purple team.” What are the objectives and roles of this team?

Author: Sunil Bakshi
A Futurist’s Take on Cryptocurrency
@ISACA Article

A Futurist’s Take on Cryptocurrency

Cryptocurrency is a useful tool for solving process issues and conducting transactions within enterprises. Its record-keeping and self-auditing capabilities make it highly valuable to many industries—and individuals. Some authorities believe cryptocurrency is used primarily...

28 April 2021
Daisy Jardine-Viner
@ISACA Article

Becoming a CISO

Almost every candidate recruiters speak to in cybersecurity wants to know one thing: How do I reach the top and get to that CISO level? Speaking with individuals who specialize in the space is one of the best places to start.

28 April 2021
Breaking Through Into Cybersecurity
@ISACA Article

Breaking Through Into Cybersecurity

Our specialty at Tiro Security is cybersecurity and GRC, and here is one of the reasons I highly recommend it: the great thing about cybersecurity is that there is an element of it in every single role inside IT (and even outside of IT).

28 April 2021
Can There Ever Be Normalcy in Cyberspace?
@ISACA Article

Can There Ever Be Normalcy in Cyberspace?

Challenges face the US government amid an increasingly turbulent threat landscape foreshadowed by the December 2020 SolarWinds supply chain attack. But to categorize SolarWinds as merely a hack is a disservice, as it is now understood to be a major cybercampaign involving an estimated 1,000 nation-state actors.

28 April 2021
LG-benjamin-Witt_Sarah_Wonlanske
Blog Post

Governance and Ethics of Emerging Technology

As organizations explore and adopt emerging technologies, governance is rarely if ever at the forefront of their agendas.

28 April 2021
Risk Assessment
ISACA Journal Article

Risk Assessment and Analysis Methods: Qualitative and Quantitative

A risk assessment determines the likelihood, consequences and tolerances of possible incidents. “Risk assessment is an inherent part of a broader risk management strategy to introduce control measures to eliminate or reduce any potential risk-related consequences.”

Author:Volkan Evrin
Sourya Biswas
Blog Post

In the Technology Age, You Can’t Always Trust What You Hear and See

It seems like any mention of technological advancement also can unearth a case of misuse.

27 April 2021
Kyla Guru
Blog Post

Cybersecurity’s Allure for Rising Professionals

Kyla Guru, a Stanford University student and CEO of Bits ’N Bytes Cybersecurity Education, visited with ISACA Now to discuss her passion for cybersecurity and why she considers the field to be a great fit for young professionals.

26 April 2021
Key Considerations for Business Continuity and Disaster Recovery
Blog Post

Key Considerations for Business Continuity and Disaster Recovery

Business success is often couched in terms of growing and maintaining the customer base and launching innovative products.

23 April 2021
Ookeditse Kamau
Blog Post

Reasonable Professional Care for The Next Generation of Women Leaders

As we celebrated International Women’s Day last month under the tagline “Choose to Challenge,” I took time to reflect on my own journey.

22 April 2021
Caitlin McGraw
@ISACA Article

Composing Thank You Notes That Support Your Job Search and Your Life

Want to stand out from the competition when interviewing for jobs? Send a thank you note. But don’t just send any old thank note copied from a template because a boring thank you note will do more harm than good.

21 April 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Developing an Enterprise Innovation Practice

Today, the survival of enterprises depends on the ability to innovate. Since the world is becoming more global and the development of new technologies is rapidly increasing, the ability to effectively innovate is likely to become even more important in the future.

21 April 2021
The Hidden Benefits of Nontraditional Backgrounds in Security Roles
@ISACA Article

The Hidden Benefits of Nontraditional Backgrounds in Security Roles

It is widely known that a skills gap has plagued the cybersecurity workforce for years, leaving security professionals in high demand. But according to Adobe’s Director of Application Security, David Lenoe, now is a good time for organizations to source from a generally untapped...

21 April 2021
Dustin Brewer
Blog Post

Secure Implementation of Emerging Technology Critical in Evolving Business Landscape

The COVID-19 pandemic changed how we utilize technology on both a personal and business level. Although some of these changes will fade away as we approach the end of the pandemic, there will be permanent effects that will linger indefinitely.

21 April 2021
Innovating in Times of Change
ISACA Journal Article

Innovating in Times of Change: The Place for Artificial Intelligence in Auditing

With the growth of computing power and big data over the last two decades, the direction of artificial intelligence (AI) adoption has been forward, and it is moving fast. AI is technology that aims to boost the capability of machines to mimic human cognitive skills...

Author: Ivy Munoko
Melissa Swartz
Blog Post

Creating Community and Connections with ISACA Volunteers

It is my honor to write this blog each April as we celebrate the contributions and connections we have made through the ISACA Volunteer Program.

20 April 2021
George McPherson
Blog Post

How to Prepare for the CISM Exam

Governments around the world are in the midst of the challenging task of pushing out COVID-19 vaccines in a safe, but urgent and calculated manner. Unprecedented leadership is needed to overcome logistical hurdles.

19 April 2021
Ali Pabrai
Security Article

Advanced Cyberdefense US DoD’s CMMC Maturity Level 5

Advanced persistent threats (APTs) require that organizations respond with active and credible cyberdefenses. This is the focus of Maturity Level 5 of the US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC). Maturity Level 5 focuses on the protection of Controlled Unclassified Information (CUI) and is the highest level of cybersecurity defined in the CMMC standard.

19 April 2021
William Emmanuel Yu
Blog Post

Varying Standards of Censorship and Privacy in the Age of Parler

On 6 January 2021, the US Capitol was stormed. It was subsequently determined that some of the perpetrators of this act, which resulted in loss of life, used the social media platform Parler to coordinate the attack.

16 April 2021
Podcast
Podcast

Pursuing Risk Resilience

To survive—and thrive—after a digital transformation, organizations must establish a robust resilience program. In this episode of the ISACA Podcast, sponsored by ServiceNow, Risk Solutions Specialist Brandon Reese...

16 April 2021
Yoshimasa Masuda
Blog Post

A New Framework to Drive Digital Transformation

Yoshimasa Masuda recently visited with ISACA Now to discuss his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation and innovation and its connections in areas including pandemic response, healthcare and academia.

15 April 2021
Julia Kanouse
@ISACA Article

Your Attention, Please: Introducing the New @ISACA

No matter where we live, or what our professional roles may be, there are many shared experiences to which we all can attest. One of those universal truths in today’s world: there is so much content out there, it can be overwhelming.

14 April 2021
Caitlin McGraw
@ISACA Article

Tune Up Your Career Now for High Performance All Year

Maintenance, hygiene, good habits, best practices. Whatever we call looking after our careers, the ongoing work of building our career success is our business as professionals.

14 April 2021
Mostafa Elghazaly
@ISACA Article

How to Embrace Agile Principles in Risk Management

Risk management professionals must embrace a new way of working by applying the principles of Agile. Applying Agile principles in assurance generates high-quality, focused value faster, using short sprints over the course of the year to alleviate the burden of a stringent audit plan.

14 April 2021
Mohit Kalra
Blog Post

Fingerprinting a Security Team

The central security team in a product development organization plays a vital role in implementing a secure product lifecycle process.

14 April 2021
Third-Party Assurance
ISACA Journal Article

Third-Party Assurance: Why and How?

Outsourcing IT services to the cloud offers many benefits for organizations. The concerns regarding maintaining and securing IT services become the responsibility of the supplier. The organization is supported and risk is transferred with a contract.

Author: Jouke Albeda
Ronke Oyemade
Blog Post

5G Implementation: Healthcare Costs and Benefits

Normal, day-to-day life has been reshaped by the COVID-19 pandemic for more than a year, greatly impacting the lives of virtually everyone. People were and still are being advised to stay home, isolating themselves from the rest of world to reduce the spread of the virus.

13 April 2021
Sudhakar Sathiyamurthy
Privacy Article

A Primer to Defensible Data Disposition

Transforming business frontiers have created an expanding digital universe and explosive data growth, requiring organizations to act as reservoirs and graveyards of data. With the amount of data that exists doubling every 2 years...

12 April 2021
Tony Martin-Vegue
Governance Article

Using Risk Assessment to Support Decision Making

An effective and mature risk governance program drives better decision making in all directions of an organization: up to leadership and the board, down to individual contributors and laterally to all lines of business.

12 April 2021
Genuine Parts Company Case Study
Blog Post

Genuine Parts Builds Improved Cyber Maturity with ISACA’s CMMI® Cybermaturity Platform

Genuine Parts Company determined that its initial cyber maturity assessment needed to create a baseline against a common framework that aligns with NIST CSF and the ISO 27001 controls.

9 April 2021
David Samuelson
Blog Post

Incoming ISACA Board Features Experienced Leaders, Diverse Backgrounds

Diversity is one of ISACA’s great strengths, and it comes in so many forms. Because of our global scope – ISACA has a presence in 188 countries and more than 220 chapters worldwide – our geographic diversity may be most obvious, enabling ISACA members to network and learn from colleagues from many cultures and backgrounds.

7 April 2021
Thomas Tyler
Blog Post

Managing a Remote Team Securely and Effectively

More than a year after the start of the COVID-19 pandemic, organizations across the world are still adjusting to this unprecedented event.

7 April 2021
Aina Rao
Blog Post

Shorting Third-Party Security

Last night, I watched a movie named “The Big Short.” While it was a complete dramatization of events that led to the financial market collapse of 2008, it seemed too good to be fiction.

7 April 2021
Ethics and Morality in the Fourth Industrial Revolution
ISACA Journal Article

Ethics and Morality in the Fourth Industrial Revolution: Rethinking Ethics, Values and Innovation in the Digital Age

The Fourth Industrial Revolution (4IR) is fundamentally changing the world, and technological advances such as artificial intelligence (AI), machine learning (ML) and digitization are increasingly affecting how people live, work, communicate, learn and play.

Author: Oupa Mokgoantle
Podcast
Podcast

The State of Cryptocurrency

Cryptocurrency has helped make blockchain technology mainstream, lauded by the general public for its decentralizing capabilities and in the cybersecurity space due to its integrity and self auditing.

6 April 2021
MDDAP
Blog Post

Driving Sustainable Improvement for Medical Device Quality

Medical device manufacturers seeking to better understand, measure and improve their capabilities have a new avenue to do so.

5 April 2021
Alex Holden
Security Article

A Tiny Link in an Endless Chain

We are all part of a giant and interwoven supply chain. Cybersecurity failure within the supply chain is a collective problem that has always existed, but its severity has been brought to light once more due to recent events.

5 April 2021
Tony Martin-Vegue
Governance Article

The Sweet Spot of Risk Governance

In baseball, the “sweet spot” refers to the precise location on a bat where the maximum amount of energy from a batter’s swing is shifted into the ball.

5 April 2021
Sam Meenasianv
Blog Post

So, You Read Cybersecurity Predictions For 2021: What’s Next?

By now, it’s not the cybersecurity predictions for 2021 that matter – it’s what you do with them.

2 April 2021
Minaz Khan
Blog Post

A Four-Step Approach to Adopting a Privacy Framework

Organizations with mature privacy programs are reaping more benefits than average and are finding it easier to comply with new privacy regulations, according to Cisco’s 2021 Privacy Benchmark Study.

1 April 2021
Giving IT Governance Its Real Value
ISACA Journal Article

Giving IT Governance Its Real Value

One of the most misused words in IT is “governance.” Unfortunately, the constant misuse of the terms “IT governance” and “governance” often leads to either a lack of context or a blurred meaning that is subject to personal interpretation.

Author: Ramón Serres
John P. Pironti
@ISACA Article

Navigating Change: The 5 Stages of Security Control Acceptance

Change, even when embraced, requires adjustments within organizations and their workforces. The changing and evolving threat landscape and frequency of attacks has highlighted the need for organizations to continue implementing new security controls—and mature existing ones.

29 March 2021
Privacy professionals
@ISACA Article

Privacy Professionals Can Now Test Their Expertise With ISACA’s CDPSE Exam

The demand for technical privacy professionals is high, but these roles are harder and more time-consuming to fill than legal/compliance positions, according to ISACA’s Privacy in Practice 2021 survey report.

29 March 2021
Encourage Cyber Accountability by Embracing Security Culture
@ISACA Article

Encourage Cyber Accountability by Embracing Security Culture

An organization’s first line of defense against cyberthreats is its employees and the culture in which they work, but without a proper security posture, they can quickly become an enterprise’s weakest link.

29 March 2021
The Hidden Vulnerabilities of Remote Access Tools
@ISACA Article

The Hidden Vulnerabilities of Remote Access Tools

The sudden shift to remote work caused by the COVID-19 pandemic left organizations and IT departments scrambling to provide in-home office solutions that would allow employees to continue working safely.

29 March 2021
Career Goals with CRISC
@ISACA Article

Accomplish Your Career Goals With CRISC

Jose Vazquez has spent most of his career working in compliance, audit and business controls roles and has familiarized himself with many industry- and company-specific IT risk management frameworks.

29 March 2021
Fabiola Amedo
Blog Post

How to Overcome Obstacles on Your Path to Certification

“It ain’t about how hard you can hit, it’s about how hard you can get hit and keep moving forward; how much you can take and keep moving forward. That’s how winning is done.”

29 March 2021
Jose Ramon Coz Fernandez
Governance Article

Auditing IT Governance in the Navigation Sector

Auditing IT governance in the navigation sector is a challenge. The number of interdependencies and stakeholders in new navigation systems makes the process truly complex, and the increasing trend in subcontracting large parts of a system hides some of those interdependencies and other details in a huge number of contracts and other legal documentation.

29 March 2021
Mohammed Khan
Privacy Article

Data Minimization—A Practical Approach

The amount of data collected across enterprises has exponentially increased over the years—and it continues to grow.

29 March 2021
Podcast
Podcast

Diversifying the Security Hiring Pool

It is no secret that there has long been a gap in the cybersecurity workforce. But enterprises can take a step toward filling it by looking to nontraditional candidates, according to Adobe’s Director of Application Security, David Lenoe.

29 March 2021
Ron Lear
Blog Post

Capability is King and Performance is Paramount

Being a musician myself (jazz and classical bass trombonist), I was thinking about how playing music well during a concert is VERY similar to developing new software or system or service.

26 March 2021
Michael Argast
Blog Post

Selecting, Building, Landing and Growing Your Cybersecurity Career

I’ve been fortunate to work in a wide diversity of cybersecurity roles over my two decades in the field – from operations, services, consulting, vendors, managed service providers (MSPs) and more. I’ve hired hundreds of professionals from senior, experienced leaders to green new recruits.

24 March 2021
5G
ISACA Journal Article

Healthcare Revolution in the 5G Age: Health Risk and Opportunity

In 2017, more than 180 scientists and doctors across the European Union (EU) co-signed an appeal calling on the EU to halt the rollout of fifth generation (5G) technology for telecommunications until potential hazards for human health and the environment...

Author: Ronke Oyemade
Sebastian Terry
Blog Post

Creating a Values-Driven, Balanced Life and Career

Sebastian Terry, an author, TV host and founder of the 100 Things philanthropic movement, recently visited with ISACA Now to discuss his approach to goal-setting and life balance.

23 March 2021
A cloud with a blue computer background
Blog Post

Overcoming Cloud Hurdles Through Effective Audits

Remote access, increased collaboration capabilities, automatic software updates, potential for cost savings – organizations increasingly are drawn to these and other major benefits of leveraging cloud services

22 March 2021
Jon Brandt
Security Article

Entrepreneurship Gone Bad

Just when you thought 2020 was bad enough, 2021 ushered in its own chaos. The events that transpired in the United States during the first weeks of the new year were highly emotional, wrought with anxiety and, in many ways, an embarrassment to every US citizen who wakes up each day just trying to do and be better than the day before.

22 March 2021
Rebecca Herold
Blog Post

Best Practices for Data Hygiene

Data hygiene consists of actions that organizations can, and should, take as a matter of following not only compliance requirements, but also as part of basic risk management program practices. Consistent, risk-specific data hygiene practices supports not only...

19 March 2021
Sourya Biswas
Blog Post

Why Executive-Focused Security Awareness Training is Important

Willie Sutton was a bank robber in the early 1900s, and a quite successful one at that. Over a long and less-than-illustrious-but-more-than-successful career, he amassed over US$2 million. Even without considering inflation, that’s a serious chunk of change.

18 March 2021
Tony Luciani
Blog Post

Four Steps to Achieve SOC 2 Compliance

SOC 2 compliance is stressful for many organizations, but achieving continuous compliance while lowering the annual frustration is within your reach.

17 March 2021
Privacy-Preserving Analytics and Secure Multiparty Computation
ISACA Journal Article

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external environments, such as the cloud...

Author: Ulf Mattsson
Ed Moyle
Blog Post

What Next? Near- and Long-Term Actions Following Microsoft Exchange Hack

By now, you’ve almost certainly heard about the serious and ongoing attacks being conducted against on-premise Microsoft Exchange Server implementations.

16 March 2021
Privacy
@ISACA Article

Discover the Future of Privacy and Risk at ISACA’s Virtual Summit

As emerging technologies including artificial intelligence (AI), the Internet of Things (IoT) and robotic process automation (RPA) continue to dominate innovation in IT, enterprises have been granted more access to personal data than ever. This has made the need for...

15 March 2021
How Workforce Risk Was Impacted by COVID-19
@ISACA Article

How Workforce Risk Was Impacted by COVID-19

The workforce as we know it has undergone significant changes since the onset of the COVID-19 pandemic, some of which are likely to become permanent. Shifting to remote work has allowed employees around the world to keep their jobs...

15 March 2021
Jack Freund
@ISACA Article

Not All Risk Treatment Options Are the Same

Risk management frameworks can teach risk professionals valuable lessons about what a risk management program should look like. We are encouraged to begin by making a list of the threats to, and vulnerabilities of, our organizational assets...

15 March 2021
Writing for ISACA
@ISACA Article

Showcase Your IT Thought Leadership by Writing for ISACA

ISACA is committed to expanding the IT knowledge base by publishing original thought leadership that explores trending topics in the fields of governance, privacy and cybersecurity. To source this valuable content, ISACA invites industry experts to serve as volunteer...

15 March 2021
Muneeb Imran Shaikh
Blog Post

How the CISO Can Build Support from Senior Management

Trust is the cornerstone of any relationship, and it is built and nurtured progressively based on many factors.

12 March 2021
Brennan Baybeck
Blog Post

How to Thrive as a CISO: Award-Winner Brennan P. Baybeck Shares His Perspective

Brennan P. Baybeck, CISA, CISM, CRISC, CISSP, recently was named 2021 CISO of the Year in the APEX Awards, hosted by the Colorado Technology Association. Baybeck, VP & CISO for Customer Services at Oracle Corporation, was ISACA’s 2019-2020 board chair and remains an ISACA board director.

11 March 2021
Patrick Offor
Blog Post

Understanding the Link Between the Need Signal and Information Privacy Equipoise

One thing that became clear when writing an article on need signal is that we are just scratching the surface in our understanding of information privacy, both practically and from a scholarly standpoint.

11 March 2021
Babur Kohy
Blog Post

Contemplating the Dark Web and Secure Human Behaviors

Technological advances have made the job of information system auditors, risk managers and governance and security professionals difficult.

10 March 2021
I&T Governance Framework for Artificial Intelligence in Marketing
ISACA Journal Article

I&T Governance Framework for Artificial Intelligence in Marketing

Information and technology (I&T) governance is a critical component of corporate governance, and it becomes even more crucial when organizations implement emerging technologies. Of the various emerging technologies that are currently transforming...

Authors: Benjamin A. Witt, Sarah J. Wolanske and Jeffrey W. Merhout
Mirna Boheiri
Blog Post

CISA-Certified Professionals Are More Needed Than Ever: How I Prepared to Join the Club

The COVID-19 pandemic is revealing just how important it is for all businesses to have a robust and efficient information technology infrastructure.

9 March 2021
Podcast
Podcast

Remote Access Tools From a Hacker Perspective

Remote access tools can be an IT blessing, allowing tech support to quickly and remotely troubleshoot computer problems while reducing the need for lengthy conversations with confused employees.

9 March 2021
Celebrating the Women
Blog Post

Celebrating the Women in our Global Network of Engaged Members

In honor of International Women’s Day, the ISACA Now Blog asked women who are helping elevate the profession about their volunteer roles with ISACA and their advice about getting involved.

8 March 2021
Caitlin McGaw
Blog Post

IT Audit is ‘Boring’? Time to Fix the Perception Problem

I was recently on a social media site where professionals join a career topic discussion group and ask questions. Someone asked: What job is boring? The very first answer: “IT audit.”

4 March 2021
Avoiding the Post-Quantum Cyber Apocalypse
Blog Post

Avoiding the Post-Quantum Cyber Apocalypse

Today, the comfort of our modern living is driven by advances in information technology: think of the mobile banking apps on your phones, the proliferation of blockchain technologies, and the various electronic sensors and components that are powering your home appliances, cars and the electricity grid, hospitals, and the list goes on.

3 March 2021
Benefits of Using a SOAR Solution
ISACA Journal Article

Benefits of Using a SOAR Solution

Security orchestration, automation and response (SOAR) is a widespread discussion among academicians, technologists, and executives linked to the cyber and digital spaces.

Author: Farhan Imitaz
Sonja Jovanovic
Blog Post

HR and Cybersecurity: Supporting Each Other in Challenging Times

Cybersecurity was not on the top of the agenda for many Human Resources professionals in early 2020.

2 March 2021
Auditing for Success
@ISACA Article

Auditing for Success

Thorough compliance audits are critical to the success of every IT organization—and every auditor. But to achieve the desired results, sufficient time and resources must be allotted to prepare for the audit.

1 March 2021
Bruce R. Wilkins
@ISACA Article

Be Wary of Security Product Marketing

I recently read an article about cybersecurity and concluded that vendor influence on the discipline has reached a point of concern. Vendors and their marketing campaigns strive to introduce different terms into cyberprofessionals’ occupational jargon...

1 March 2021
CDPSE Certified Data Privacy Solutions Engineer logo
@ISACA Article

Certify Your Privacy Experience With CDPSE Early Adoption

As data collection and management regulations increase in number and complexity, enterprises must enlist IT privacy professionals to successfully implement data privacy programs from a technical perspective.

1 March 2021
SheLeadsTech: From Inspiration and Awareness to Action
@ISACA Article

SheLeadsTech: From Inspiration and Awareness to Action

ISACA is committed to improving gender diversity in the technology field. To support this initiative, ISACA has continued to evolve its SheLeadsTech program since its inception in 2017.

1 March 2021
The Power and Potential of 5G
@ISACA Article

The Power and Potential of 5G

Cellular network technology has evolved at an exceptional, nearly unpredictable pace, growing from the voice-only system it once was to the impressive voice, text and data 5G technology of today.

1 March 2021
Michelle Poler
Blog Post

Become Inspired, Not Intimidated, by Technology

Michelle Poler, a creative and passionate social entrepreneur, fear-facer, and branding strategist, will be the closing keynote speaker at the ISACA Conference North America 2021, a virtual event to take place 4-6 May.

1 March 2021
Diana L. Burley
Security Article

The Assault on Truth

Truth. Fact—a statement in accordance with reality. For years, there has been an assault on truth, whether through the promotion of “alternative facts,” the normalization of seemingly insignificant lies, the sharing of half-truths that mischaracterize reality or the confounding of fact and opinion.

1 March 2021
Ssalar Atrizadeh
Privacy Article

Understanding the Importance of US Privacy and Identity Theft Laws

It is essential for IT experts and practitioners to be aware of and understand privacy laws as there are increasing global cybersecurity incidents.

1 March 2021
Reviewing Digital Transformation Practices
Blog Post

Reviewing Digital Transformation Practices

Competitive pressures, new markets and new digital technologies are the main drivers of digital transformation.

26 February 2021
Ali Pabrai
Security Article

Resilience in the Cybersecurity Supply Chain

The US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC), establishes 5 maturity levels.

26 February 2021
Benefits of Using a SOAR Solution
ISACA Journal Article

IS Audit in Practice: Relinquishing Privacy to Research

I have always loved medicine. The science is intriguing and you can get involved if you want, which I did as a teenager, volunteering at the local hospital and giving blood every time a blood drive came through my community.

Author: Cindy Baxter
Keeping Secrets
ISACA Journal Article

Information Security Matters: Keeping Secrets

In my last column, I made the case that the protection of secret information—as opposed to personally identifiable information (PII)—is becoming a significant issue in cybersecurity. This article picks up where that one left off.

Author: Steven J. Ross
j21v2-The-Boxes-of-Pandora
ISACA Journal Article

The Bleeding Edge: The Boxes of Pandora and Schrodinger

If you have not heard it already, the Schrodinger’s Cat thought experiment1 is meant to help people understand just how strange things are on the quantum level of existence. From superposition to entanglement, when it comes to quantum mechanics...

Author: Dustin Brewer
j21v2-Privacy-Innovations
ISACA Journal Article

Innovation Governance: Privacy Innovations

At the time of the writing of this article, the SolarWinds supply chain hack is the big news within information security. Due to the sophistication of the attack and the follow-up, information security researchers believe a nation-state actor...

Author: K. Brian Kelley
j21v2-A-Guide-to-Selecting
ISACA Journal Article

A Guide to Selecting and Adopting a Privacy Framework

COVID-19 imposed change on every aspect of life and business in 2020, but 2020 was also a significant year in the world of privacy protection for reasons beyond the pandemic.

Author: Minaz Khan
j21v2-What-Is-Your-Privacy
ISACA Journal Article

What Is Your Privacy and Data Protection Strategy?

The global data privacy and protection landscape has been radically transformed within the last five years, notably with the enactment of the EU General Data Protection Regulation (GDPR) in 2018.

Author: Corlane Barclay
j21v2-Varying-Standards
ISACA Journal Article

Varying Standards of Censorship and Privacy in an Interconnected World

On 5 August 2020, the US State Department announced the expansion of the Clean Network,1 which includes a number of programs intended to safeguard US assets and protect US IT from interference by malicious actors.

Author: William Emmanuel Yu
j21v2-Need-Signal
ISACA Journal Article

Need Signal: Information Privacy Equipoise

It has become apparent that need signal, more than information privacy concern or information privacy calculus, is the primary driver for individuals’ online participation or online transactions, whether it is participating or transacting in egovernment...

Author: Patrick Offor
j21v2-Building-a-Zero-Trust
ISACA Journal Article

Case Study: Building a Zero Trust Architecture to Support an Enterprise

Cimpress is a US$2 billion global company specializing in “mass customization,” meaning customizable business-to-business (B2B) and business-to-consumer (B2C) hard copy and digital print products. Cimpress was founded in 1994 with a focus on helping...

Author: Katie Teitler
j21v2-The-Gentle-Art-of-Password
ISACA Journal Article

The Gentle Art of Password Management

System and security administrators and information system auditors are often faced with the task of providing an adequate level of IT assurance for their own enterprises or those of their clients. This daunting challenge has become a high-profile endeavor...

Authors: David Trepp and Joshua Schmidt
j21v2-The-Dark-Web
ISACA Journal Article

The Dark Web and the Role of Secure Human Behaviors

Dark web concepts are helpful for preserving the privacy and security of its users. These hidden corners of the Internet provide anonymity for people who are oppressed by their governments, free speech to journalists, and secure communication channels...

Authors: Babur Kohy, Warren D. Holston and Ibrahim Waziri Jr.
David Foote
Blog Post

How the Pandemic Has Boosted Some Tech Skills and Certifications

With the annus horribilus of 2020 now behind us, have tech certifications been affected by all the sturm und drang brought on by the double whammy of a pandemic and economic recession? The answer may surprise you.

24 February 2021
Deepfake: The Lay of the Land
ISACA Journal Article

Deepfake: The Lay of the Land

Deepfake is the modern equivalent of Photoshop. It uses an artificial intelligence (AI) method called deep learning to create fake images and videos.

Authors: Pavankumar Mulgund and Samina Lohawala
Ookeditse Kamau
Blog Post

Being a Reasonable IT Auditor During the Pandemic

Recently I have had a number of people asking me, “How are you conducting your audits with the onset of the COVID pandemic?”

23 February 2021
Maria Gregorio
Blog Post

Best Practices to Manage Risks in the Cloud

The growth in cloud computing has been exponential. Forrester predicted that the global public cloud infrastructure will grow 35% to US$120 billion in 2021. COVID-19 has served to accelerate this trend further

22 February 2021
Andrea Tang
Privacy Article

China’s Personal Financial Information Protection

On 8 December 2020, the chairman of the China Banking and Insurance Regulatory Commission (CBIRC) laid out areas that the authorities will be looking at closely in the fintech industry.

22 February 2021
Alen Beganovic
Security Article

Cybersecurity in the Digital Onboarding Process

Acquiring new clients using a digital channel such as a mobile application rather than requiring a physical presence is a process referred to as digital onboarding.

22 February 2021
Podcast
Podcast

Risk After COVID-19: A New Workforce

The COVID-19 pandemic has prompted massive changes within the modern workforce, providing risk assurance and audit professionals a unique opportunity to assess how they approach the risk framework.

22 February 2021
Prithvi Bisht
Blog Post

Creatively Scaling Application Security Coverage and Depth

One of the biggest challenges and opportunities for an Application Security (AppSec) team is to scale effectively.

18 February 2021
Neil Lappage
Blog Post

Baselining Cybersecurity Skills for All IT Professionals

In the era of modern IT, it is becoming increasingly important for IT professionals to have a base-line contemporary cybersecurity skillset.

17 February 2021
Sudeep Subramanian
Blog Post

Rethinking Information Security Awareness Strategies

In 2000, it was predicted that semantic attacks that target humans and use the vulnerability in information processing capabilities of humans would be the primary attack vector of cybercriminals.

17 February 2021
Melissa Swartz
Blog Post

Congratulations to the Exceptional 2021 ISACA Award Recipients

ISACA values the contributions of our members and professionals across our industry and recognizes outstanding achievements annually through the ISACA Awards Program. Join us in celebrating the 2021 ISACA Award Recipients!

16 February 2021
Abdul Rafeq
Governance Article

Using COBIT 2019 to Proactively Mitigate the Impact of COVID-19

Enterprises are established with set objectives of meeting stakeholders’ needs and serving customers with desired products or services that add value. To be able to continually meet these objectives, an appropriate risk management strategy with a...

16 February 2021
Corporate Governance
ISACA Journal Article

Book Review: Corporate Governance—A Pragmatic Guide for Auditors, Directors, Investors, and Accountants

Vasant Raval’s Corporate Governance: A Pragmatic Guide for Auditors, Directors, Investors, and Accountants clearly sets the tone for the reader in the preface by stating that the “primary purpose of this book is to provide as complete a picture of the current state of corporate governance in the USA.”

Author: Ken Doughty
How to Improve Your Cybersecurity Audit
@ISACA Article

How to Improve Your Cybersecurity Audit

Cybersecurity audits ensure that organizations are well prepared to defend themselves against internal and external cyberthreats.

15 February 2021
Sunil Bakshi
@ISACA Article

Why Auditors Should Adopt Social Engineering

Social engineering is considered a type of security attack that targets the weakest link; that is, humans. However, rather than discuss how to audit social engineering preparedness or eliminate social engineering attacks, I pose—and answer—the question, do auditors need to acquire social engineering skills?

15 February 2021
Risk in 2021, as Identified by IT Auditors
@ISACA Article

Risk in 2021, as Identified by IT Auditors

The onset of the COVID-19 pandemic at the end of 2019 led to a tumultuous year that followed for organizations worldwide. Usual business operations came to a halt, with a resulting shift to remote work for many that presented new challenges—and increased risk.

15 February 2021
Creating a Culture of Cybersecurity at Princeton University
@ISACA Article

Creating a Culture of Cybersecurity at Princeton University

Building a culture of cybersecurity through user awareness training reduces risk to the enterprise and can enhance employee productivity.

15 February 2021
Security
@ISACA Article

The Dangers of Neglecting Physical Security

In the age of cloud-hosted services, the Internet of Things (IoT) and remote work, cybersecurity conversations typically revolve around securing your network and devices, rather than your office building.

15 February 2021
Leroy Chiao
Blog Post

Freedom to Fail – and Innovate

Leroy Chiao recently visited with ISACA Now to discuss lessons he took from his time as an astronaut, his observations on the latest technology trends and more.

12 February 2021
Ronke Oyemade
Blog Post

The COVID-19 Pandemic, Digital Security and 5G Security Architecture

Normal day-to-day life was brought to a halt by the COVID-19 pandemic, which greatly impacted the lives of virtually all people worldwide in unprecedented fashion.

10 February 2021
Nudging Our Way to Successful Information Security Awareness
ISACA Journal Article

Nudging Our Way to Successful Information Security Awareness

Ensuring the security of information flowing in an organization requires the attention of all stakeholders including top management, employees and customers. Compliance with information security policies should be taken seriously with small or large...

Authors: Sudeep Subramanian and Udita Agrawal
Muhammad Mushfiqur Rahman
Blog Post

Essential Cybersecurity Components: Continuous Monitoring, Human Intelligence and Commitment

Continuous monitoring is essential in the cybersecurity ecosystem of an organization. Proper design, implementation and continuous monitoring provide just-in-time reflection of users, devices, networks, data, workloads activities and status in the organization’s infrastructure.

9 February 2021
Anna Murray
Privacy Article

CCPA in a Multilayered B2B Environment

Organizations that collect business-to-business (B2B) data from residents of the US State of California got a reprieve in 2019. The California Consumer Privacy Act (CCPA) went into effect in January 2020, applying to the collection of business-to-consumer (B2C) data.

5 February 2021
Ryan Kelch
Blog Post

When the Mundane Becomes the Target

Cloud security in 2020 was upended from previous years – to say the least. The COVID-19 pandemic fundamentally altered human behavior, and those changes directly impacted the tech industry.

4 February 2021
Podcast
Podcast

The Perils of Overlooking Physical Security

With today’s advanced cloud capabilities, cybersecurity is an obvious priority at many organizations. But that can leave physical security diminished or outright neglected.

4 February 2021
Sundaresan Ramaseshan
Blog Post

Disciplined IT Hygiene During Organizational Change

Everyone knows that IT and its evolution is an undisputable partner in any organization. IT teams no longer play a supporting role.

3 February 2021
Identifying the Practices of Digital Transformation
ISACA Journal Article

Identifying the Practices of Digital Transformation: Based on a Systematic Literature Review

Initiatives using digital technologies as an enabler have been studied and implemented by many enterprises in recent years, mainly due to the increasing demand from customers for value-added products and services delivered faster and more conveniently.

Authors: Tomás Aguiar, Silvia Bogea Gomes, Paulo Rupino da Cunha and Miguel Mira da Silva
Joanna Grama
Blog Post

When to Assess Security and Privacy During the Procurement Process

Many organizations are concerned about security, privacy and vendor management for information technology (IT) services and applications, and rightly so.

2 February 2021
Improve Your Active Directory Security
@ISACA Article

Improve Your Active Directory Security

Malicious cyberactors can leverage an organization’s Active Directory settings to gain network privileges by moving laterally. However, by taking proactive security measures, it is possible to reduce the attack surface of the enterprise’s network.

1 February 2021
The State of Privacy in the New Year
@ISACA Article

The State of Privacy in the New Year

Though some organizations consider privacy to be a static, one-size-fits-all objective to be accomplished merely to comply with regulations, it should instead be viewed as an essential part of gaining customer trust and, therefore, critical to business success.

1 February 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Building Cloud Governance From the Basics

Cloud computing and cloud services have become a reality, and they are here to stay. Organizations of all sizes are adopting cloud computing and cloud services. According to Cisco, cloud data centers will process 94% of workloads in 2021.

1 February 2021
Information Technology
@ISACA Article

Information Technology From an Ethical Perspective

The power of an organization’s ethics, culture and individual behaviors to contribute to successful governance and management practices is often underestimated. Effective IT auditors must understand the ethical implications of the information systems...

1 February 2021
audit and assurance
@ISACA Article

Top ISACA Resources of 2020

In today’s rapidly changing technology landscape, continuing education and skills development are essential tools for professionals who wish to keep up. To contribute to the IT knowledge base, ISACA is dedicated to creating relevant educational content...

1 February 2021
Vote For an Inspirational Volunteer
@ISACA Article

Congratulations, 2021 ISACA Award Recipients and Hall of Fame Inductees

ISACA is pleased to recognize the 2021 ISACA Award recipients and honor the first-ever Hall of Fame inductees for their thought leadership and volunteer service. It is only through peer nominations that ISACA can recognize these achievements.

1 February 2021
Mea Clift
Security Article

Supply Chain Threats and the Cybersecurity Solution

On 6 December 2020, the Craft Industry Alliance reported that the McCall printing facility in Manhattan, Kansas, USA, had been shut down since October 2020 due to what appeared to be a malware attack.

1 February 2021
Sourya Biswas
Blog Post

Security in the Cloud: Not Somebody Else’s Problem

Unless you’ve been living under the proverbial rock, you likely are aware of the Capital One breach in 2019 that leaked confidential information from more than 100 million credit applications stored in the Amazon Web Services (AWS) cloud.

29 January 2021
Victor Gamra
Blog Post

How to Identify Vulnerable Third-Party Software

The year 2020 will be reflected in history as a year of many surprises. In hindsight, one trend that, though not a surprise, rattled unexpecting companies, was the explosive occurrence of cybersecurity breaches via third-party software.

28 January 2021
Scott C. Algeier
Security Article

Cost-Effective Steps to Managing Cyberrisk

Today’s complex cyberthreat landscape is a risk to all enterprises. Combating these threats requires an enhanced, coordinated and sustained national effort across industry and government. A determined, well-resourced adversary can penetrate any network.

27 January 2021
Cyberattacks
ISACA Journal Article

What Type of Management Is Required to Stop Serious Cyberattacks?

The actual level of cyberrisk that many organizations face is now far out of alignment with what top management would consider an acceptable level of cyberrisk. In 2017, Warren Buffett, the chairman and chief executive officer (CEO) of Berkshire Hathaway...

Authors: Charles Cresson Wood and Jody R. Westby
Nadia Bizzarri
Blog Post

Cyber Insurance for a Changing Landscape

In 2020, we adjusted to a global pandemic. Many businesses were not prepared to face this new reality but were forced to respond quickly to ensure their operations continued.

26 January 2021
Hafiz Sheikh Adnan Ahmed
Blog Post

Privacy in Practice 2021: Data Privacy Trends, Forecasts and Challenges

Data privacy, privacy management, digital privacy, data protection – the list goes on when it comes to data privacy and protection imperatives. The phrase “Data is the new oil” was coined considering the growing importance of personal and organizational data.

26 January 2021
Solving Your Most Frequently Asked Questions
Blog Post

Solving your Most Frequently Asked Questions

In late 2020 and early 2021, ISACA received more inquiries from members and customers than ever before, with unprecedented demand for certifications, including the CDPSE early adoption program.

25 January 2021
Sandy Silk
Blog Post

When IT is Your Profession, Life-long Learning Beyond Academia is Your Devotion

When you begin a new role or join a new employer, specific existing skills and experience secured the opportunity for you.

25 January 2021
Anna Johannson
Blog Post

Setting the Record Straight on 5 Cloud Security Myths

When it comes to cybersecurity in today’s digital landscape, the cloud is one of the most misunderstood elements.

22 January 2021
Guy Ngambeket
Privacy Article

Smart Objects and Their Privacy Implications

In the cybersecurity realm, it has long been discussed and understood that people are considered the weakest link in cybersecurity. And, like security, everyone has a crucial role to play to ensure a reasonable degree of privacy, to keep personal data safe.

22 January 2021
Jacob Young
Blog Post

Azure DevOps: Access, Roles and Permissions

As IT auditors, we are well aware that the change management process is a critical component of IT controls testing in risk-based and compliance audits.

21 January 2021
Robert Putrus
Blog Post

Cybersecurity and the Board of Directors

A key initiative that enterprises should not overlook is the need for IT teams to bridge the gap between the chief information security officers (CISOs) and their organization’s board of directors (BoD).

20 January 2021
Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls
ISACA Journal Article

Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls

Cyberrisk is not just an IT issue; it is much broader. The magnitude or impact of a cyberattack can determine the survival of an enterprise. Business risk continues to exist.

Author: Robert Putrus
Surveying the State of Privacy in 2021
@ISACA Article

Surveying the State of Privacy in 2021

Consumers are becoming increasingly aware of how, when and by whom their data are being used. Organizations that fail to protect the privacy of their customers are at risk of financial and reputational damage. Results from ISACA’s 2020 State of Privacy survey...

18 January 2021
Jack Freund
@ISACA Article

Zero Trust Should Not Equal Zero Business

The IT community made some incorrect assumptions about risk in 2020. That is to be expected, as all risk assessments rely upon assumptions. However, it is important to ensure that such assumptions are communicated to others and clearly articulated...

18 January 2021
Communicating Cyberrisk to Organizational Leadership
@ISACA Article

Communicating Cyberrisk to Organizational Leadership

Cybersecurity professionals are often tasked with presenting technical risk assessments and the subsequent implications to their organization’s board of directors (BoD). To do so effectively, one must adopt the language that the board members use...

18 January 2021
Reinvigorate Your Professional Development at Latin CACS 2021
@ISACA Article

Reinvigorate Your Professional Development at Latin CACS 2021

Professional conferences are an exciting and enriching way to explore valuable learning experiences and form connections with industry professionals. While in-person gatherings were brought to a halt in 2020 due to the global risk of the COVID-19 pandemic...

18 January 2021
Aleš Zupan
Security Article

Cyberrisk Governance: A Practical Guide for Implementation

Despite cybercrime cost amounting to more than US$1 trillion globally in 2020—more than 1% of the global domestic product (GDP)—the topic still does not receive sufficient attention at the board and C-suite levels in organizations, according to a report conducted by the Center for Strategic and International Studies (CSIS) and McAfee.

14 January 2021
Larry Alton
Blog Post

Eight Benefits of Seeking a Career in IT

Information technology (IT) is a field that can open up many different career paths. In IT, you could be responsible for installing and configuring hardware, managing third-party software, providing training and support to employees, auditing security systems, or possibly writing custom software.

15 January 2020
privacy
Privacy Article

Impacts of Canadian Government Oversight of PIPEDA

The Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) is a comprehensive act that governs collecting, using and disclosing personal information. Initially, the act was a mechanism proposed to ensure trust in e-commerce...

15 January 2021
Princess Ngozi Uche Ucheoption
Blog Post

Princess Ngozi Uche: A CSX-P Pioneer

Princess Ngozi Uche, the first CSX Cybersecurity Practitioner Certification (CSX-P) credential-holder in Nigeria, has a pioneering spirit, as further evidenced by her work to help initiate an ISACA chapter in Port Harcourt.

14 January 2021
Podcast
Podcast

Assessing the Ethical Implications of Information Technology

IT enterprises with strong ethical frameworks are successful not only in making a greater, more positive impact on society, but in terms of financial and reputational status as well. To achieve this, however, organizations must be able to involve everyone...

14 January 2021
Josh Hamit
Blog Post

Accelerating to the Cloud, Responsibly

Coming out of 2020, most organizations are probably pivoting from digital transformation to digital acceleration. In only a matter of weeks, the world witnessed unprecedented adoption of digital technology that will shape consumer behaviors and business operations for years to come.

13 January 2021
Technology-Based Trust With Blockchain
ISACA Journal Article

Technology-Based Trust With Blockchain

Emerging technologies such as 5G, microservices, the Internet of Things (IoT), cloud computing, containers, blockchain and many others are shaping the meaning of “technology-based trust.” Consequently, technology-based trust deals with the acceptance...

Author: Luis Emilio Alvarez-Dionisi
David Samuelson
Blog Post

Building on the Lessons from 2020

As we begin a new year, I think it’s safe to say that many of us are ready to leave 2020 in the rearview mirror.

11 January 2021
Philip Casesa
Blog Post

Four Ways to Change the Cybersecurity Hiring Process

A few years ago, I was an IT director on the hunt for new IT talent. I went the traditional route, posting jobs, reviewing resumes and holding interviews

8 January 2021
Ali Pabrai
Privacy Article

America’s Newest Privacy Rights Act—California’s CPRA

2023 compliance readiness starts now. The US State of California’s Proposition 24, known as the California Privacy Rights Act of 2020 (CPRA), was passed by voters in the November 2020 election. The CPRA provides additional rights to consumers and places...

8 January 2021
Robert Brzezinski
Security Article

Cloud Strategy Challenges

I have had the privilege of working with organizations that adopted cloud strategies and were able to improve productivity for end users and optimize IT operations and cybersecurity. I have also worked with organizations that stepped into the cloud world...

8 January 2021
Muhammad Mushfiqur Rahman
Blog Post

Threat Hunting and Cyberrisk Assessment Using Cyber Kill Chain

Virtually every organization needs to provide digital services to its clients. However, digitization creates enormous threats for an organization, its customers and its employees.

7 January 20201
Abdelelah Alzaghloul
Blog Post

Leveraging Marketing to Overcome the Cybersecurity Workforce Shortage

Organizations around the globe are struggling to overcome the challenge of the cybersecurity workforce shortage, and filling this gap has become a top priority as cyberthreats continue to grow.

6 January 2021
Security and Risk Assessment of IT Defense Strategies Considering the Cyber Kill Chain
ISACA Journal Article

Security and Risk Assessment of IT Defense Strategies Considering the Cyber Kill Chain

Defensive IT architecture helps to deploy defense-in-depth concepts in an organization’s IT architecture, which helps to prevent, identify, detect, contain, respond to and recover from cyberincidents in a timely manner. Defensive architecture in information...

Author: Muhammad Mushfiqur Rahman
Emerging Tech
Blog Post

Five Security and Emerging Tech Insights for 2021

As we begin 2021, ISACA experts are weighing in with anticipated major trends in the worlds of cybersecurity and emerging technology that they expect to gain traction in the new year.

5 January 2021
Julian Marquez
Governance Article

Indicator Management: A Question That Should Start With “Why?”

Enterprises’ operational functions often need their data on a real-time basis to know about business performance and have an overall assessment of their strategic and tactical goals. Simultaneously, the risk management function wants to define analytical models ...

5 January 2021
Mostafa Elghazaly
@ISACA Article

Building an Effective Data Privacy Communication Plan Using 3 Design Principles

An effective data privacy communication plan will increase awareness of data privacy requirements and help establish a clear set of steps to execute when a breach occurs. There are 3 reasons why an effective privacy communication plan is critical to the success...

4 January 2021
privacy
@ISACA Article

Demonstrate Your Privacy Expertise With the CDPSE Beta Exam

Certification exams are developed by ISACA through consultations with industry experts in the IT community. Beta exams allow for the gathering of valuable feedback from candidates around the world, resulting in final exams—and grades—that accurately...

4 January 2021
Zero Trust
@ISACA Article

The Rise of Zero Trust, Explained

As pressure to meet compliance requirements continues to mount, more enterprises are turning to a zero trust approach. To effectively implement the zero trust framework, enterprises should achieve a thorough understanding of its nuances.

4 January 2021
UK Cyber Security Council Established to Strengthen Skill Sets, Collaboration
@ISACA Article

UK Cyber Security Council Established to Strengthen Skill Sets, Collaboration

Over 100,000 cyber roles come up in the UK each year, yet half of companies state they have a basic skills gap and a third struggle to fill those roles. ISACA® is proud to help champion the cybersecurity profession as a founding member of the Cyber Security Alliance...

4 January 2021
Leader
@ISACA Article

Nominate an Outstanding Individual to Serve on the ISACA Board of Directors

ISACA strives to provide continuous value to members by serving as a beacon of knowledge for the IT community. Electing a strong Board of Directors to govern is an important part of that effort. Nominations for the 2021-2022 ISACA Board of Directors...

4 January 2021
ISACA Foundation Strives to Achieve Global Impact in 2021
@ISACA Article

ISACA Foundation Strives to Achieve Global Impact in 2021

As key leaders in the cyber field know, organizations across all industries rely on cybersecurity professionals to serve as the frontline of defense against threats and risk. But the shortage of qualified cybersecurity workers is increasing, exposing organizations...

4 January 2021
Neil Lappage
Privacy Article

Will Low-Earth Orbit Satellites Fly Under the Privacy Radar?

As the world considers what 5G will mean for privacy, low-earth orbit (LEO) satellite Internet continues to gain momentum and quietly fly under the radar from a privacy perspective.

4 January 2021
j21v1-A-Window
ISACA Journal Article

A Window of Opportunity: Ending the Cyberworkforce Shortage Once and For All

Two years ago, the cyberworkforce shortage was the number-one concern for chief information security officers (CISOs), security operations center (SOC) managers and other security leaders. Researchers estimated that there would be 1.8 million unfilled...

Author: Philip Casesa
Language: 日本語
j21v1-Adaptation
ISACA Journal Article

Adaptation of Information Security in the Agile World

One of the core values of Agile is to maintain built-in quality, which implies that security controls should be embedded in the Agile mindset. However, it may be argued that information security and an Agile mindset do not always go hand in hand with...

Author: Gerald Pang
j21v1-Secrecy-and-Privacy
ISACA Journal Article

Information Security Matters: Secrecy and Privacy

The COVID-19 pandemic has accelerated many trends in information technology that were already evident before the global outbreak, including teleworking, cloud-based hosting and distance learning. Not all the accelerated trends were positive, however.

Author: Steven J. Ross
j21v1-Watching-Out
ISACA Journal Article

IS Audit in Practice: Watching Out for Workforce Risk in the New Normal

What a year 2020 was: climate change marked by wildfires across the globe and record counts of tropical storms; health welfare at center stage from a pandemic that changed people’s lives and attitudes; elections that called cybersecurity effectiveness...

Author: Cindy Baxter
j21v1-Intelligence
ISACA Journal Article

The Bleeding Edge: Intelligence—A Not-So-Mediocre Commodity

“Brains are the only things worth having in this world, no matter whether one is a crow or a man.” Not that long ago, humankind used candles to produce light and horses to travel or to do mechanical work.

Author: Dustin Brewer
j21v1-Transforming
ISACA Journal Article

Case Study: Transforming Princeton’s Security Culture Through Awareness

Security awareness and training programs (also known as user awareness programs) educate users about computer security and organizational policies and procedures for working with IT resources. User awareness programs can reduce information risk...

Authors: Dan Blum, David Sherry, and Tara Schaufler
j21v1-Tips-for-Strengthening
ISACA Journal Article

Tips for Strengthening Organizations From Within, the Tom Hanks Way

At a time when cyberthreats continue to grow, organizations around the globe are struggling to overcome the challenge of a cybersecurity workforce shortage. According to the 2019 Strategies for Building and Growing Strong Cybersecurity Teams...

Author: Abdelelah Alzaghloul
j21v1-Security
ISACA Journal Article

Security Discipline and Hygiene Mean Healthy, Naturally

In this time of the COVID-19 pandemic, personal cleanliness and hygiene are discussed more frequently than ever before. It is essential to maintain hygiene to stay safe and prevent the spread of COVID-19. Even from a cost perspective, the cost of being cautious...

Author: Sundaresan Ramaseshan
Privacy
ISACA Journal Article

Help Source Q&A

What is “zero trust” in information security? Is it a new concept or just old wine in a new bottle?

Author: Sunil Bakshi
The Rise of Fintech: Managing and Controlling your Money
Blog Post

The Rise of Fintech: Managing and Controlling your Money

Every now and then, I travel across the world of emergent technologies. My passport has been stamped so many times for my visits to the wonderland of IoT, cloud computing, virtual networking, containers, microservices, cybersecurity, virtual machines...

30 December 2020
Key Performance Indicators for Security Governance, Part 2
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 2: Security Reporting for Senior Management

The value of information security may be understood differently within an enterprise. For security specialists, the need for protective measures against known threats is sufficient to justify investments. However, management wants higher level reports presenting results based on figures...

Author: Andrej Volchkov
Niral Sutaria

Artificial Intelligence Regulations Gaining Traction

Not long ago, complex artificial intelligence (AI) systems involving deep learning were mainly just theories. There were very few practical use cases. Today, many organizations are using AI to make their processes more efficient. AI has gained traction much faster than other emerging technologies.

29 December 2020
Looking to the Accelerated Digital World of 2021
Blog Post

Looking to the Accelerated Digital World of 2021

“There are decades where nothing happens; and there are weeks where decades happen.” True to this quote by Lenin and as articulated by Fareed Zakaria in his book, Ten Lessons for a Post-Pandemic World...

23 December 2020
Artificial Intelligence’s Impact on Auditing Emerging Technologies
ISACA Journal

Artificial Intelligence’s Impact on Auditing Emerging Technologies

Artificial intelligence (AI) is the demonstration and simulation of human intelligence by machines, especially computer systems. AI, robotic process automation (RPA), the Internet of Things (IoT) and blockchain are among the next-generation technologies that are considered disruptive in nature.

Author: Niral Sutaria
Podcast
Podcast

What Makes a Threat an APT?

APTS are typically driven by experienced cyberactors, significant funding and a target that possesses extremely sensitive data. The depth of these threats means that virtually no enterprise is immune, even those which have implemented highly sophisticated cybersecurity measures.

22 December 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Auditing Guidelines for Artificial Intelligence

Over the past few years, there has been a tremendous shift toward emerging technologies such as blockchain, robotics and artificial intelligence (AI). Global organizations and governments have come to terms with the impact—and opportunity—of advanced technology.

21 December 2020
Compliance Assurance During the Time of COVID-19 and Beyond
@ISACA Article

Compliance Assurance During the Time of COVID-19 and Beyond

Has there ever been a more challenging climate for the second and third lines of defense? The COVID-19 pandemic has quite clearly changed the entire 2020 landscape for financial services. A flurry of economic challenges and hurdles has put tremendous pressure...

21 December 2020
Ten Ways Hospitals Can Prepare for Ransomware Attacks
@ISACA Article

Ten Ways Hospitals Can Prepare for Ransomware Attacks

The COVID-19 pandemic has resulted in a surge of ransomware attacks focused on 1 target in particular: hospitals. To help combat this trend, ISACA has provided a tip sheet with 10 key actions hospital cybersecurity teams can take...

21 December 2020
#IamISACA
@ISACA Article

#IamISACA: My New and Unexpected Adventure

I spent nearly 4 months of this year shopping for complete strangers, thousands of miles from my home and navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic—and I loved it.

21 December 2020
Information security
Blog Post

IT Audit Technology Risk: Knowns and Unknowns

Knowns and unknowns. In a game of word association, some may think of the US National Aeronautics and Space Administration (NASA). It was an associate administrator from NASA’s Office of Safety and Mission Assurance who heightened awareness of known/unknown risks in a 2003 presentation on safety and mission success.

21 December 2020
Let’s Apply APT Lessons From SolarWinds Hack
Blog Post

Let’s Apply APT Lessons From SolarWinds Hack

Well, my cyber and information security friends, it’s that time again. We’re starting to get asked questions about what we do by more than just our immediate supervisors. We get comments such as “I bet you’re busy this week” and “Should I change my password on my account?”

21 December 2020
Anna Johannson
Blog Post

5 GDPR Compliance Tips for Businesses That Are Still Lagging Behind

We’re more than two years removed from the introduction of the General Data Protection Regulation (GDPR) into EU law.

18 December 2020
Muhammad Asif Qureshi
Privacy Article

Privacy During a Pandemic

It will soon be one year since the first case of COVID-19 was reported. Ever since that first case, governments, healthcare providers and pharmaceutical companies have been under constant pressure to find a vaccine for this virus.

18 December 2020
Gabriel Cusu
Governance Article

The Role of IT Governance During the COVID-2019 Pandemic

It is likely that 2020 will remain in history as the year of COVID-19. The virus has changed everything, affecting personal and professional lives across the globe. Organizations have had to change their ways of working, and as a result, many more people are now working remotely to adhere to social distancing protocols.

16 December 2020
ISACA Community Shows Off Its Diverse Talents in 2020 #IamISACA Stories
Blog Post

ISACA Community Shows Off Its Diverse Talents in 2020 #IamISACA Stories

Beginning in April, our #IamISACA series has told the stories of the accomplished, volunteer-minded and multitalented people who make up the ISACA community. We hope you have enjoyed reading and viewing these stories as much as we have enjoyed sharing them...

17 December 2020
Eight Future Privacy Governance Imperatives That Boards Have a Duty to Perform
Blog Post

Eight Future Privacy Governance Imperatives That Boards Have a Duty to Perform

Surveys show that most people still feel they should have more control over their data and are uncomfortable with the sale of their data to third parties, implying that some privacy regulations are failing to effectively protect the privacy of their citizens.

16 December 2020
The Role of IT Governance During COVID-19 and Beyond
ISACA Journal Article

The Role of IT Governance During COVID-19 and Beyond: Keeping the Momentum

This is an extremely critical and dangerous period in everyone’s lives. A single message is heard from every corner of the world: “Stay home.” This is a vastly different situation from how the world has functioned for the last five decades.

Author: Lionel Jayasinghe
Podcast
Podcast

Exploring the Push for Zero Trust

Increasing pressure on many organizations to meet compliance requirements has resulted in a push to adopt a zero trust approach. But for implementation to be successful, enterprises must obtain a thorough understanding of the nuances of the framework.

16 December 2020
Organizational Culture: Friend or Foe in 2020?
Blog Post

Organizational Culture: Friend or Foe in 2020?

2020 has either been a year of reviews or a year of forward reflections depending on what dominated your outlook.

15 December 2020
Tuan Phan
Blog Post

A Foundational Path for Blockchain Implementation

Twelve years after its birth, blockchain technology has now become mainstream. Its market adoption can be attributed to the industry and blockchain enthusiasts who pushed for new regulations.

14 December 2020
Isaac Kohen
Privacy Article

Why Employee Privacy Matters More Than Ever

For organizations and their employees, 2020 is a uniquely transformative and challenging year. Although this reality is expressed in many ways—including a global pandemic, a deep economic recession, perpetual social unrest and a litany of natural disasters...

14 December 2020
Jon Brandt
Security Article

When Worlds Collide

This year will likely be remembered unfavorably by most people due to the multitude of hardships, losses and inconveniences associated with the COVID-19 pandemic.

11 December 2020
How to Involve Senior Management in the Information Security Governance Process
Blog Post

How to Involve Senior Management in the Information Security Governance Process

Chief information security officers (CISOs) and security specialists often complain about the disinterest of senior management in information security.

10 December 2020
Paul Phillips
Blog Post

Assessing Risk in a Pandemic

To effectively assess risk in a pandemic, leaders need to focus on the risk at hand, the associated right metrics, and evaluate all elements of risk: impact, likelihood and velocity.

9 December 2020
Digital Banking Poses Challenges for Third-Party Risk Management
ISACA Journal Article

Digital Banking Poses Challenges for Third-Party Risk Management

Digital banking is a disruptive trend growing in the banking industry across the world. Simply put, it includes banking services provided primarily or wholly through digital or electronic means.

Authors: Maosen Cai and Han Yan
Navigating the New Hiring Landscape
Blog Post

Navigating the New Hiring Landscape

Daisy Jardine-Viner, a cybersecurity recruitment specialist for NDK Infosec, recently shared her expertise on pandemic-impacted industry hiring trends at ISACA’s EuroCACS conference, hitting on topics including Zoom interview best practices, how the pandemic has altered hiring and what skills and credentials can best position candidates for success in this new climate.

8 December 2020
Mitigating the Dangers of Malware
@ISACA Article

Mitigating the Dangers of Malware

Malware, sometimes conflated with electronic “spam,” has long been a commonly used tactic by ill-intentioned cyberactors, geared toward targets that range from hyper-protected government bodies to student email accounts.

7 December 2020
Sunil Bakshi
@ISACA Article

Securing Work-From-Home Devices

The outbreak of the COVID-19 pandemic resulted in lockdown measures that were imposed to contain the spread of the virus, which included a freeze on commuting to the office to work in person for almost everyone but essential workers.

7 December 2020
Cybereducation
@ISACA Article

ISACA Foundation Commits to Children’s Cybereducation

As developments in technology continue to saturate all aspects of everyday life, it has become more important than ever to ensure that children are properly educated about cyber best practices.

7 December 2020
Vote For an Inspirational Volunteer
@ISACA Article

Vote For an Inspirational Volunteer for the ISACA Founders Award

ISACA® is proud to honor members who have shown outstanding dedication to activities that advance ISACA's purpose, including volunteer service and member engagement activities.

7 December 2020
#IamISACA
@ISACA Article

#IamISACA: Respecting Technology’s Power–and Its Limits

I currently work as the head of internal audit at SAVE, an organization that manages the airport of one of the most beautiful cities in the world, a city with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships: Venice, Italy. SAVE is also the parent company of several organizations that manage other airports in the Italian northeast airport system, including Treviso, Verona and Brescia.

7 December 2020
Anna Johannson
Blog Post

How Smart Technology Helps Fintech Companies Succeed

Smart technology has evolved at a rapid pace. In the beginning, smart tech reached consumers in the form of smart household appliances like thermostats, security systems and refrigerators.

7 December 2020
Surendra Nidar
Governance Article

The Role of IT Governance in Addressing Pandemic-Related Cyberrisk

The entire world is now grappling with the COVID-19 pandemic, which is turning out to be not only a massive health challenge, but also one of the most enormous economic challenges in recent history. With every passing day, thousands of positive cases are added to the already huge number of active cases.

7 December 2020
Sizing Up the Impact of COVID-19 and Remote Work on IT Auditors
Blog Post

Sizing Up the Impact of COVID-19 and Remote Work on IT Auditors

The year 2020 will go down in the history books as one of the most trying years in modern world history. The COVID-19 pandemic has tested nearly every nation, government, business and individual in many unforeseen ways that heavily impact daily life, with additional consequences and impacts likely into the future.

3 December 2020
Podcast
Podcast

The Microcomputing Revolution

Since its conception, microcomputing has made waves in the open source community, providing an accessible and relatively user-friendly way for technology owners to create their own amateur smart devices before mass-manufactured ones hit the market.

3 December 2020
#IamISACA: Weekend Studies for Weekday Successes
Blog Post

#IamISACA: Weekend Studies for Weekday Successes

As a security professional, I am used to new vulnerabilities and threats materializing every day, creating unforeseen challenges and a huge learning scope. It can be difficult, but that is what drew me to the profession in the first place.

2 December 2020
Security and Compliance: What to Expect in 2021
Blog Post

Security and Compliance: What to Expect in 2021

There is little doubt that 2020 has been one of the most challenging years many security professionals have encountered.

2 December 2020
Scott C. Algeier
Security Article

Why You Need to Take Cybersecurity Seriously in the New Year

Today’s cyberthreats are more complex and severe than ever. The risk to organizations of all sizes has never been greater. As we begin 2021, it is important to reflect on the state of cyberthreats so that organizations can better secure themselves.

2 December 2020
Robotic Process Automation
ISACA Journal Article

Robotic Process Automation to Aid Accounting and Finance Departments

Enterprises are currently experiencing one of the most groundbreaking periods of technology evolution since the Internet first came on the scene decades ago, and the rise of robotic process automation (RPA) is a perfect example.

Authors: Angel R. Otero, and Ryan Paul Fink
Security Awareness as a Corporate Asset
Blog Post

Security Awareness as a Corporate Asset

A recent blog post about culture as a corporate asset discussed the importance of a healthy culture in an organization.

1 December 2020
Why Cybersecurity Is a MUST not a SHOULD
Blog Post

Why Cybersecurity Is a MUST not a SHOULD

There is no doubt that security is now a recognized need within and across organizations. This reflects the acceptance of how an organization’s behavior is dependent on shared beliefs, values, and actions of its employees, which includes their attitudes towards cybersecurity.

30 November 2020
Andrea Tang
Privacy Article

Privacy Governance and Privacy Engineering in the Cloud

In the light of digital transformation, cloud computing has become widely adopted. The separation of ownership, management and usage rights of resources increases the possibility and severity of privacy risk in the cloud.

30 November 2020
#IamISACA: My New and Unexpected Adventure
Blog Post

#IamISACA: My New and Unexpected Adventure

I spent nearly four months this year shopping for complete strangers, thousands of miles from my home, navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic.

25 November 2020
Fintech Governance Challenges, Levels and Theories
ISACA Journal Article

Fintech Governance Challenges, Levels and Theories

The fintech industry is growing at such a fast pace that investors, boards of directors, senior management and government regulators need to reexamine current practices and models of fintech governance. One well-known example of this growth is the US$16 billion ...

Author: Luis Emilio Alvarez-Dionisi
Simplifying the Transition to Quantum-Safe Security with Crypto Agility
Blog Post

Simplifying the Transition to Quantum-Safe Security with Crypto Agility

The quantum computing threat to public-key encryption is enormous. Large-scale quantum computers are on the not-too-distant horizon.

24 November 2020
John P. Pironti
@ISACA Article

Five Key Considerations for Developing a Cybersecurity Emergency Action Plan

Recently, the ever-expanding cybersecurity threat landscape, along with an increasing frequency of attacks, has highlighted the need for organizations to develop and implement emergency action plans as part of their business resilience programs.

23 November 2020
Data Security and IT Audit
@ISACA Article

The Connection Between Data Security and IT Audit

The world’s economy is powered by data. Yet organizations still experience significant difficulties when it comes to protecting and securing information. As ransomware evolves and cloud services attacks increase, enterprises face heightened pressure to secure data.

23 November 2020
Cybersecurity Attacks
@ISACA Article

Transform From Trust to Zero Trust at Asia CACS 2020

This year, the COVID-19 pandemic and its resulting physical distancing requirements have made the idea of congregating with other professionals to explore industry topics and insights seem like a thing of the past. Yet the ISACA community can still gather...

23 November 2020
Audit
@ISACA Article

Using ITAF to Empower IT Audit

In the United States in the early 2000s, several very public cases of financial fraud occurred within large organizations such as WorldCom, Adelphia Communications and Enron. The construction and facilities management corporation Carillion in the United Kingdom raised similar fraud concerns...

23 November 2020
Technology
@ISACA Article

ISACA CTO Shares Tech Upgrades to Improve Online Learning Experience

To better serve members, ISACA has rolled out 2 significant technology updates. The first is a new learning platform called ISACA PERFORM. PERFORM, as the name suggests, offers an experiential approach to learning that improves engagement and performance.

23 November 2020
Security by Design: Are We at a Tipping Point?
Blog Post

Security by Design: Are We at a Tipping Point?

The much-publicized Target breach of 2013—where 70 million customers lost their personal data, 40 million credit and debit card details were stolen, more than US$250 million was spent to manage the breach and the chief executive officer (CEO) and chief information officer (CIO) were replaced—does not even place among the top 15 breaches of this century.

20 November 2020
Podcast
Podcast

Strategies for Securing Remote Technology

The dust of the COVID-19 pandemic has begun to settle and professionals around the globe are now more comfortable with the realities of remote work. Yet even increased familiarity with working from home still leaves room for security threats to arise.

11 November 2020
Ivana Bartolett
Blog Post

How the Concept of Privacy is Shifting

Ivana Bartoletti, a privacy and digital ethics expert recently visited with ISACA Now to share her perspective on major trends in privacy, digital ethics, AI and more.

19 November 2020
Enterprise Security Morphing and Evolving Into Security Intelligence
Blog Post

Enterprise Security Morphing and Evolving Into Security Intelligence

The ongoing global crisis brought about by the COVID-19 pandemic has caused a huge shift in society and how we conduct our daily lives.

18 November 2020
#IamISACA: CISM Connects the Dots in My Professional Development
Blog Post

#IamISACA: CISM Connects the Dots in My Professional Development

At the beginning of my career, I was partly lucky, but later on also quite selective in deciding to work for organizations and bosses that embraced empowerment and supported individual development of their people, as I myself was always a strong advocate of servant leadership and continuous education.

18 November 2020
CISO Burnout
Security Article

Understanding and Addressing CISO Burnout

The job of a chief information security officer (CISO) is notoriously grueling. CISOs often only remain in their roles for a year or two, with high stress levels and unrealistic organizational expectations among the leading factors that drive CISOs from the job.

18 November 2020
Harnessing Zero Trust Security
ISACA Journal Article

Harnessing Zero Trust Security

Cybersecurity is awash with acronyms, jargon and marketing slogans. There is no dearth of so-called “silver bullets.” Yet, history and headlines demonstrate the ongoing success of adversaries and tell us a different story.

Author: Rajiv Raghunarayan
Deepa Seshadri
Blog Post

Approaching Risk Management in the New Normal

As we approach the end of 2020, it has become clear that the COVID-19 pandemic is not a passing storm or something that we can wait out before returning to a familiar business routine; it is the new normal.

16 November 2020
Daimon Geopfert
The Nexus Article

The Cybersecurity Implications of an Evolving Work Environment

It is an understatement to say that COVID-19 has forced significant changes in how most organizations operate today.

16 November 2020
Securing the IoT Landscape of Tomorrow
Blog Post

Securing the IoT Landscape of Tomorrow

Security consultants and practitioners have insight into how organizations of various sizes, across both the public and private sectors, are preparing for Internet of Things (IoT) deployments during this unusual pandemic year.

13 November 2020
Guy Pearce
Privacy Article

Three Ways Your Approach to Privacy Is at Risk

At the federal (or national) level, the risk associated with outdated privacy laws has received good coverage. What has received less coverage is how outdated—and, therefore, risky...

13 November 2020
Raising the Bar Beyond Privacy Compliance
Blog Post

Raising the Bar Beyond Privacy Compliance

In the context of privacy by default, privacy compliance is not nearly enough.

12 November 2020
#IamISACA: I Love What I Do
Blog Post

#IamISACA: I Love What I Do

Doing your job well with knowledge and commitment requires you to love what you do. I started my career almost 19 years ago, but information security as a profession came into my life 10 years ago.

11 November 2020
Robotic Process Automation for Internal Audit
ISACA Journal Article

Robotic Process Automation for Internal Audit

Advances in data science, processing capabilities and technology have sparked the fourth industrial revolution. Organizations are rapidly digitalizing parts of their businesses using robotic process automation (RPA) to achieve efficiency and increase quality.

Author: Hassan Toor
Change Is Good
Blog Post

Change Is Good

Shortly after its launch in 2014, I bought a Microsoft Surface Pro 3. If you studied for the Certified Information Systems Auditor (CISA) exam using the review manual or online review course, studied for the Certified in Risk and Information Systems Control (CRISC) exam using the online review course, took the Certified in the Governance of Enterprise IT (CGEIT) exam or read an “IS Audit Basics” column anytime since 2016, you likely read words penned on that computer.

10 November 2020
Risk
@ISACA Article

Identify KRIs to Keep Your Business Afloat During the Pandemic

New and sometimes unpredictable IT vulnerabilities have cropped up as a result of work-from-home policies implemented in the wake of the COVID-19 pandemic. One way organizations can combat these situations for effective governance is by identifying...

9 November 2020
Securing the Cloud
@ISACA Article

Securing the Cloud for Competitive Edge

External forces in business today have driven organizations to transform their IT and security practices. The rise of cloud adoption has left many security teams half-invested in their current security measures, while the other half looks toward the future.

9 November 2020
Sunil Bakshi
@ISACA Article

The Auditor’s Dilemma

Recently, the COVID-19 pandemic and its effects on the IT industry triggered a memory in my mind as an auditor. It took place some years ago when I had just passed my Certified Information Systems Auditor (CISA) exam and was eager to conduct system...

9 November 2020
Leading-Diversity-in-Risk
@ISACA Article

ISACA Foundation Creates Diversity Pipelines

The lack of diversity in the tech space continues to be a critical, prevailing issue, yet organizations are realizing this challenge extends beyond corporate responsibility, social justice or even regulatory compliance. A lack of diversity undermines good business practices.

9 November 2020
ISACA Community
@ISACA Article

ISACA Community Makes a Difference on Second Annual Day of Service

Even a global pandemic could not stop passionate ISACA members and their families from serving their communities. On 3 October 2020, 100 teams of ISACA members from around the world came together to give back for the second annual ISACA CommunITy Day...

9 November 2020
Working from Home with Remote Video Technology Audit and assurance
Blog Post

Working from Home with Remote Video Technology

Working from home has gone from being a luxury to a necessity because of the COVID-19 pandemic. Usually, we talk about disrupting technology, but this time, we have an external non-controllable factor that is causing the disruption.

9 November 2020
Victor Antonio Jimenez
Governance Article

COBIT Resource Optimization Mapped to TOGAF’s Architecture Review Board

Several years ago, the IT department of the largest bakery factory in the world conducted a COBIT® 5 assessment and implementation of enterprise governance as presented in the article, “A Partial Transition to COBIT 5 Demonstrates Value to IT.”

9 November 2020
One Year In: Tech Update From ISACA’s CTO
Blog Post

One Year In: Tech Update From ISACA’s CTO

Just over one year ago, I came on board as ISACA’s first chief technology officer. I knew I had an exciting challenge in front of me. ISACA members are extremely sophisticated technology professionals, and I needed to make your experience with us elegant, quick and on your terms.

6 November 2020
CCP
Security Article

Top Cyberattacks of 2020 and How to Build Cyberresiliency

Cyberattacks rank as the fastest growing crime in the US, causing catastrophic business disruption. Globally, cybercrime damages are expected to reach US $6 trillion by 2021.

6 November 2020
Alex Holden
Blog Post

Battling Ransomware: US Hospitals Under Fire

In 2010, I moved away from the financial industry into the world of cybersecurity consulting. My first consulting project was within the healthcare industry, and so was my next big project, and hundreds of projects in which I have participated since.

5 November 2020
Zero Trust Architecture—Myth or Reality?
ISACA Journal Article

Zero Trust Architecture—Myth or Reality?

Trust is an emotion that cannot be applied to machines; however, it is, regularly. In today’s hostile cyberspace, the “trust, but verify” approach typically results in crisis management. The IT landscape has been changing ever since the first computer was invented. More and more organizations are adopting big data...

Author: Muhammad Asif Qureshi
Podcast
Podcast

Managing Malware Threats

Phishing emails and dangerous links are among the most pervasive threats to cybersecurity, capable of targeting everyone from seemingly impenetrable government organizations to college students’ university email accounts.

4 November 2020
Don’t Just Fight Privacy Fires: Plan Ahead to Prevent Them
Blog Post

Don’t Just Fight Privacy Fires: Plan Ahead to Prevent Them

As privacy concerns continue to increase, most of us spend our days fighting fires. With more privacy regulations continuing to be released, it’s difficult to understand the key differences and know what is most important.

3 November 2020
#IamISACA: Diagnosing the Need for a Career Change
Blog Post

#IamISACA: Diagnosing the Need for a Career Change

Just a few short years ago, having completed my bachelor’s degree in physiotherapy, I was on track to become a doctor in the lake city of Udaipur, India, where I am from. But by the time I completed my doctorate, I realized that something was missing in my career and my life.

3 November 2020
Successful Second Annual CommunITy Day Changes the World!
Blog Post

Successful Second Annual CommunITy Day Changes the World!

A global pandemic did not stop the dedicated and passionate ISACA members, staff and their families around the world from giving back to their local communities on ISACA’s second annual CommunITy Day

2 November 2020
Ali Pabrai
The Nexus Article

Getting Started With CMMC, a US DoD Mandate for Cybersecurity

On 31 January 2020, the US Department of Defense (DoD) introduced a new cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC).1 Every cybersecurity and compliance professional, including senior executives, must raise their awareness of this important and valuable cybersecurity standard developed by the DoD.

2 November 2020
Keeping Up with Change with Agile
Blog Post

Keeping Up with Change with Agile

The phrase “the only constant is change” rings true for every single one of the organizations I have been a part of.

30 October 2020
Journal Volume 6
ISACA Journal Article

Information Security Matters: The Context of Cybersecurity in the Post-Pandemic World

In my previous article, I stated that “serious cyberattacks seem no worse than before” the COVID-19 pandemic. Whenever anyone qualifies a categorical statement, the qualifier is always awfully important. In this case, it invites the question, “Just what is a trivial cyberattack?”

Author: Steven J. Ross
Journal Volume 6
ISACA Journal Article

How to Start Your Quantum Migration Journey

If quantum migration were a train, it would be a cryptoagility train with the destination quantum readiness. All aboard!

Author: Paul Lucier
Journal Volume 6
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 1

Having reliable metrics or key performance indicators (KPIs) in the field of information security is a prerequisite to building a successful security program. Measuring operational efficiency, costs and benefits has always been a concern for managers, and information security is no exception.

Author: Andrej Volchkov
Journal Volume 6
ISACA Journal Article

IS Audit Basics: Ethics in Information Technology

I am sitting down to write this column in mid-August, which, believe it or not, is quite late for an ISACA Journal vol. 6 column (at least for me). The reason? After 3.5 years and 21 articles, I have decided that this will be my last column.

Author: Ian Cooke
2020 Journal Volume 6
ISACA Journal Article

Leaving the Cathedral: A Case Study of Open Source as a Business Strategy

Most practitioners know that support for open-source software can sometimes be a loaded question for an organization. From a usage point of view, there are a few concerns. Organizations worry about compliance with open-source licenses— fearing, for example...

Author: Ed Moyle
Journal Volume 6
ISACA Journal Article

The Bleeding Edge: The Dog Days of IoT

When humans first domesticated wolves, the implications of the symbiotic relationships could not have been foreseen. We (humans) were slowly able to somewhat let down our guards while sleeping with our trusty companions on guard and place some of our hunting burdens on our furry friends.

Author: Dustin Brewer
Journal Volume 6
ISACA Journal Article

Innovation Governance: Innovation on Trust

Once upon a time, in order to secure a computer, an organization only had to worry about physical security. After all, computers took up an entire room and were programmed using punch cards that were fed into them. However, as computer technology progressed...

Author: K. Brian Kelley
Journal Volume 6
ISACA Journal Article

The Practical Aspect: Privacy Compliance—A Path to Increase Trust in Technology

The need for privacy is increasing at an unprecedented rate. It cuts across technologies and work models, especially the new ones, that create opportunities for and facilitate the management of personally identifiable information (PII).

Authors: Vasant Raval and Samir Shah
Journal Volume 6
ISACA Journal Article

Security and Privacy in the New Normal

Since the beginning of 2020, communities throughout the world—personal and professional—have been impacted in a way that was always only talked about in hypothetical scenarios, such as running an organization completely virtually.

Author: Deepa Seshadri
Journal Volume 6
ISACA Journal Article

The Unintended Consequences of Zero Trust on Enterprise Culture

It has been 10 years since John Kindervag, then with Forrester Research, first laid out the information systems security concept called the zero trust model. In the decade since, few organizations could boldly claim that their information technology environments were safe from hazards and threats emanating from the inside and outside.

Author: Grace F. Johnson
2020 Journal Volume 6
ISACA Journal Article

Predicting Cybersecurity Risk Severity Using Bayesian-Based Machine Learning

Cybersecurity risk assessment is a nebulous process that requires a delicate balance between art and science. Typically, a risk assessor begins by collecting relevant information for all the identified risk factors. The assessor gathers information from logs, architecture diagrams, network topology...

Author: Srinidhi Mallur
audit and assurance
ISACA Journal Article

Standards, Guidelines, Tools and Techniques

An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques...

Author: ISACA
The 8 Most Common Cybersecurity Weaknesses to Watch for in Small Businesses
Blog Post

The 8 Most Common Cybersecurity Weaknesses to Watch for in Small Businesses

As a cybersecurity expert, you know that all it takes is a single weakness, or a single vulnerability to compromise the integrity of a business.

29 October 2020
#IamISACA: Curious About the Cloud and Addicted to Hockey
Blog Post

#IamISACA: Curious About the Cloud and Addicted to Hockey

It’s hard to believe I have been working in the financial services industry for 20 years. My primary focus over the last 12 years has been building enterprise, operational, and IT risk management programs from the ground up, including enablement of audit readiness.

28 October 2020
#IamISACA: Respecting Technology’s Power – and Its Limits
Blog Post

#IamISACA: Respecting Technology’s Power – and Its Limits

I’m currently working as the Head of Internal Audit at SAVE, the company managing the airport of the most beautiful city in the world, with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships...

28 October 2020
Implementing the Right to be Forgotten When the Internet Never Forgets
Blog Post

Implementing the Right to be Forgotten When the Internet Never Forgets

The internet never forgets, or so the adage goes. But what started off as a catchy saying or something that might be relevant to a technology subculture has evolved into a global reality, especially with dropping storage costs, access to cheap internet and, more importantly, the propensity of the human race to share data willy-nilly.

28 October 2020
Addressing the Human Fallibility That Leads to a Data Breach
ISACA Journal Article

Addressing the Human Fallibility That Leads to a Data Breach

Within the last decade or so, cyberincidents have made headlines and have become top strategic risk factors for enterprises.

Author: Farid Vayani
Anna Johannson
Blog Post

How Law Firms Can Avoid Cybersecurity Fiascos

With each passing month, we’re seeing steep increases in the number of cyberattacks waged against businesses, particularly small businesses.

27 October 2020
Engage
@ISACA Article

New Expert Directory Connects Speakers With Opportunities

Industry thought leaders can be an invaluable resource for accessing exclusive, expertise-rich content. Unfortunately, the COVID-19 pandemic has brought many industry events to a halt, making it more difficult for professionals to connect with experts and consume their compelling content.

26 October 2020
Defining IT Governance and Its Roles for Business Success
@ISACA Article

Defining IT Governance and Its Roles for Business Success

Refining IT governance systems can be invaluable to organizations throughout today’s ever-changing, highly disruptive business environments. Identifying the differences between governance and management and using principles found in COBIT and Certified in the Governance of Enterprise IT...

26 October 2020
Lisa Young
@ISACA Article

Making Sense of Privacy

People everywhere are impacted by privacy, or more accurately, the lack of a common, global set of standards, guidelines and laws to help people understand what privacy is, what it means to them and how to take steps to ensure the privacy of information related to individuals, communities, societies and the enterprise.

26 October 2020
Risk
@ISACA Article

Managing the Risk of Remote Work

The COVID-19 pandemic has resulted in remote work becoming the new normal for employees worldwide. While this measure has been successful in keeping employees safe, unfortunately, it has introduced new security vulnerabilities that can put an organization’s systems and data at risk.

26 October 2020
Pursuing a New Career in Times of Adversity
@ISACA Article

Staying Connected While Working From Home

Virtually every industry has been impacted by the public health risk posed by COVID-19, and as a result, the realities of the traditional work environment have changed, possibly permanently. Conversations about disrupting technology have been forced to address the coronavirus...

26 October 2020
Leveraging COBIT 2019 to Face the Challenge of Digital Transformation in Small Enterprises
Governance Article

Leveraging COBIT 2019 to Face the Challenge of Digital Transformation in Small Enterprises

Information is a key resource for all organizations, regardless of their size. It is created, used, retained, disclosed and destroyed. Technology plays a key role in these activities. Both information and technology (I&T) have become an integral part of all aspects of personal and enterprise life.

26 October 2020
Diana L. Burley
The Nexus Article

Treat the Whole Patient: Cybersecurity Amid COVID-19

Treat the whole patient. Public health practitioners have long known that the symptoms a patient presents in the doctor’s office tell only a portion of the story.

26 October 2020
Cloud Native Security: A Blue Ocean
Blog Post

Cloud Native Security: A Blue Ocean

Digital transformation is driving massive workloads across to the cloud as organizations move beyond a traditional brick and mortar model. Cloud provides the flexibility to execute at speed, time to market and embrace change in the digital landscape.

23 October 2020
Why Build a Cybersecurity Culture?
Blog Post

Why Build a Cybersecurity Culture?

One of the best ways for an organization to reduce cyber risk is to build a culture of cybersecurity. This entails creating a mindset in employees that the risk is real and their daily actions impact that risk.

22 October 2020
#IamISACA: Activating My Spirit of Ubuntu
Blog Post

#IamISACA: Activating My Spirit of Ubuntu

My friends often ask why I am so passionate about volunteering. Answering this question requires me to look back over my life’s experiences. In the quest to find my purpose, I found great wisdom in Mahatma Gandhi‘s words, with one of my favorite sayings being, “The best way to find yourself is to lose yourself in the service of others.”

21 October 2020
#IamISACA: My Endless Journey in IT
Blog Post

#IamISACA: My Endless Journey in IT

In the early 2000s, studying Computer Science and Engineering was a hotcake field; everyone wanted to study it in Bangladesh. Only those who are truly passionate about IT stayed on this journey, and the rest left. Fortunately, I am one of those who has continued.

21 October 2020
Components of Security Awareness and Their Measurement, Part 2
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 2

Security awareness encompasses attitude and knowledge. There is a third component as well, automation, that defines behavior in stressful situations. These concepts were examined in part 1 of this two-part series. However, attitude and knowledge prejudice this kind of automation.

Author: Zsolt Bederna
Key Considerations for Robotic Process Automation
Blog Post

Key Considerations for Robotic Process Automation

Robotic Process Automation (RPA) is a modern trend in which a typically simple (i.e., requiring no real intelligence) sequence, that up until now involved a human operator, is replaced with a virtual robot.

20 October 2020
Valerie Lyons
Blog Post

Mind the Gap: Bridging the Divide Between Digital Ethics and Privacy

When Gartner highlighted “digital ethics and privacy” as one of its top 10 strategic technology trends for 2019, it noted that “any discussion on privacy must be grounded in the broader topic of digital ethics and the trust of consumers, constituents and employees.”

19 October 2020
Adam Kohnke
Blog Post

Auditing with Microsoft Azure

Writing about Azure audit and its associated audit program is a logical follow-up to a previous ISACA Journal article I wrote on auditing Amazon web services (AWS).

16 October 2020
Chloe Haywood
Blog Post

Cybersecurity Hiring Trends Now and in a Post-Pandemic World

There’s no doubt the coronavirus will permanently change the world we live in. For most of us, the past seven months have been a bumpy ride. Demonstrating adaptability (combined with a big dose of resilience) will be key to keeping the wheels turning career-wise in 2021.

15 October 2020
Podcast
Podcast

The Evolution of Wi-Fi

Once a technological marvel, the idea of a wireless connection to the Internet has become so engrained in the digital world that it is hard to fathom a time when that was not the case.

15 October 2020
#IamISACA: Learning My Way to a New Career Path
Blog Post

#IamISACA: Learning My Way to a New Career Path

I was approached by my company a few years back with an opportunity to build a cybersecurity program. At the time, I was working in our internal audit department and cybersecurity risk was a rising and prominent concern for our company.

14 October 2020
Components of Security Awareness and Their Measurement, Part 1
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 1

People are an essential part of security. They operate processes; produce technology, in the cases of hardware and software; and apply technology; therefore, they are the basis of security. Furthermore, they behave according to their intrinsic and extrinsic sources of motivations.

Author: Zsolt Bederna
Podcast
Podcast

Why You Need a Proactive Approach to Risk

The wave of remote working arrangements implemented as a response to the COVID-19 pandemic has introduced new and often unpredictable IT vulnerabilities.

14 October 2020
Dustin Brewer
Blog Post

Adapting to Emerging Technology

A pentester, security operations center (SOC) analyst, IT auditor, risk analyst and system administrator walk into a bar.

13 October 2020
Syed Salman
Governance Article

Digital Transformation Realized Through COBIT 2019

There is an understanding that is spreading quickly throughout the world: The COVID-19 pandemic has shut down much of the physical world temporarily and the resulting void will be filled by the digital world permanently.

13 October 2020
Enhance Professional Development by Renewing ISACA Membership
@ISACA Article

Enhance Professional Development by Renewing ISACA Membership

The rapid pace of global technological innovation in recent years has led to ever-changing expectations for professional skills and competencies. What satisfied employers 1 year ago may no longer be enough, and for that reason, taking advantage of professional development opportunities...

12 October 2020
Exploring the Basics of Blockchain
@ISACA Article

Exploring the Basics of Blockchain

Blockchain can be defined as a type of digital ledger that records and distributes transactions while protecting data integrity and availability. “Of the confidentiality, integrity and availability (CIA) triad, blockchain is trying to solve the integrity issue,” says cyber expert Dustin Brewer in the “Breaking Down Blockchain” episode of the ISACA Podcast.

12 October 2020
Pursuing a New Career in Times of Adversity
@ISACA Article

Pursuing a New Career in Times of Adversity

The turbulent events of this year have resulted in an uncertain job market for many, whether or not they expected to find themselves searching for a new position. This means it is more important than ever for information security...

12 October 2020
Bruce R. Wilkins
@ISACA Article

Zero Trust

So, it has begun. Zero trust, an old cybersecurity term that is being reintroduced with new meaning. If you remember zero trust, it is probably in the context of trusted development. Zero trust meant that all software created, and hardware tools used to enforce a security safeguard...

12 October 2020
ISACA Student Groups Open Doors to Opportunities
@ISACA Article

ISACA Student Groups Open Doors to Opportunities

Edmund Ho studies accountancy and information management at the City University of Hong Kong College of Business (Hong Kong, People’s Republic of China). He serves as the internal secretary of City University’s ISACA Student Group (ISG), which is affiliated with ISACA’s China–Hong Kong chapter and ISACA Global.

12 October 2020
Jon Brandt
The Nexus Article

Cybersecurity Awareness: Progress or Passivity?

October is Cybersecurity Awareness Month (CSAM), created 17 years ago as a public-private partnership to ensure individuals have the proper resources for online safety. CSAM 2020’s overarching theme is “Do Your Part. #BeCyberSmart” aimed at empowering...

12 October 2020
How COVID-19 Is Changing Risk Management
Blog Post

How COVID-19 Is Changing Risk Management

One of the most visible results of the COVID-19 pandemic is the transition from traditional office-based work to remote work-from-home (WFH) arrangements for global enterprises.

9 October 2020
Cloud Security Breaches: Who is Ultimately Responsible?
Blog Post

Cloud Security Breaches: Who is Ultimately Responsible?

Cloud security breaches consistently make news headlines. Yet, the stories of these breaches are often framed with vague explanations — a “misconfigured database” or mismanagement by an unnamed “third party.”

8 October 2020
Podcast
Podcast

Engineering an Effective Privacy Game Plan

Putting effective privacy measures into practice can be a difficult task for organizations that lack a comprehensive, well-documented privacy strategy. Without one, enterprises may be exposing customer data to vulnerabilities, and could find themselves at risk of noncompliance with privacy regulations.

8 October 2020
#IamISACA: Calligraphy is My Meditation
Blog Post

#IamISACA: Calligraphy is My Meditation

Starting my career in information security and privacy compliance roles has made for a fascinating journey. I am currently working in the fintech sector, which is a relatively young sector in the digital economy. I am learning disruptive technologies first-hand and also learning about start-up culture.

7 October 2020
Next-Generation Security
ISACA Journal Article

Next-Generation Security

The world is interconnected. An event that occurs in one part of the world (e.g., an infected animal for sale at a market introducing COVID-19 to humans) can have dramatic, unexpected consequences everywhere else.

Authors: Louisa Saunier and Kemal A. Delic
Podcast
Podcast

Finding the Human Factor in Work from Home

Once considered a privilege, remote work has become a necessity resulting from the public health risk posed by COVID-19.

7 October 2020
Prioritizing People Perils During a Pandemic Prioritizing people
Blog Post

Prioritizing People Perils During a Pandemic

With the COVID-19 pandemic continuing to plague the world, it goes without saying that as technology and transformational program leaders, we should be managing our “people” risk a lot closer.

6 October 2020
Benjamin Scribner
The Nexus Article

Take Action for Cybersecurity Awareness Month

With so much of our lives taking place online these days, wouldn’t it be great if there was a time of year that was dedicated to cybersecurity? The good news: There is.

5 October 2020
Rajul Kambli
Blog Post

Governance for Effective Digital Transformation

Many successful organizations have been transforming their processes to adapt to the changing environment.

2 October 2020
Embedding Security in the Agile Product Development
Blog Post

Embedding Security in the Agile Product Development

Outline security requirements at the beginning of the project, review the design to check if the requirements have been incorporated and perform security testing before go-live. If this sounds familiar, it should.

1 October 2020
Empathy and Flexibility Can Help Us Navigate a Chaotic 2020
Blog Post

Empathy and Flexibility Can Help Us Navigate a Chaotic 2020

Oof. What a year. 2020 has certainly been a year of contradictions. In some ways, it is a year that has trudged along at a glacial pace.

30 September 2020
#IamISACA: Bringing ISACA Closer to Home
Blog Post

#IamISACA: Bringing ISACA Closer to Home

In 2009, I was certified as a CISA and became an ISACA member, joining the Lagos Chapter in the west region of Nigeria. Five years after, I relocated to Port Harcourt in the south of Nigeria. At the time, there was no nearby ISACA chapter.

30 September 2020
Auditing the Cloud
ISACA Journal Article

Auditing the Cloud: Microsoft Azure

When it comes to the cloud and the methods used to audit this expanding technology, Amazon Web Services (AWS) is not the only major player. There may not be as many advertisements for Azure, but as of 2019, Microsoft was one of the top-three providers of public cloud services.

Author: Adam Kohnke
IT Audits: Running to Stand Still
Blog Post

IT Audits: Running to Stand Still

The work life of an IT auditor can be a thankless one. As the IT department becomes busier, it is increasingly difficult to get IT audit reports over the line. When they are completed, what is the reward?

29 September 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Six Privacy Considerations for Auditors

As compliance requirements continue to evolve, it is critical for auditors to stay abreast of the most current regulations. Efforts to implement proper privacy measures should not necessarily lead to separate information security projects completed merely for compliance reasons...

28 September 2020
privacy
@ISACA Article

Implementing and Executing Privacy by Design

Legislation such as the EU General Data Protection Regulation (GDPR) has popularized the concept of privacy by design, or the notion that privacy be at the forefront during the creation of every process and product in an organization.

28 September 2020
Cloud Environments
@ISACA Article

Strategies for Securing Complex Cloud Environments

Cloud services are commonly used for data storage, meeting operational needs and running applications. Changing to cloud services enables organizations to create new environments when needed and retire them if business needs shift.

28 September 2020
Digital mail
@ISACA Article

Subscribe to ISACA SmartBrief Newsletters to Learn the Latest Trends in Cybersecurity, Privacy and Governance

ISACA has partnered with SmartBrief to offer a new collection of newsletters focusing on the areas of cybersecurity, privacy and governance. The ISACA SmartBriefs deliver multiple pieces of relevant and timely industry news to subscribers’ inboxes in a regular, comprehensive newsletter.

28 September 2020
David Samuelson
@ISACA Article

ISACA CEO David Samuelson’s Commitment to Lifelong Learning

ISACA Chief Executive Officer (CEO) David Samuelson is proud to be a lifelong learner. “Helping people be better so that they can get the most out of their lives has always been a passion of mine,” Samuelson says in a new video as part of the #IamISACA series.

28 September 2020
Pursuing a Multicloud Security Strategy
Blog Post

Pursuing a Multicloud Security Strategy

If your organization is like most, you know that cloud is here to stay. Even if your organization is new to cloud, as a security practitioner, you know that it’s not a matter of “if” but “when” key business processes will find themselves becoming increasingly more dependent on externally-hosted services and cloud technologies.

28 September 2020
Pritesh Parekh
The Nexus Article

Secure Cloud Migration Starts With Trust

Several years ago, discussions with IT organizations tended to revolve around convincing skeptics to move to the cloud. This is no longer the case. Over time, those discussions evolved because IT leaders grew to understand the clear value of adopting cloud.

28 September 2020
Mark T. Edmead
Governance Article

Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy

COBIT is an IT governance and management framework designed to help organizations create value from their IT initiatives, better manage their risk and optimize resources.

28 September 2020
Make Security Awareness an Experience
Blog Post

Make Security Awareness an Experience

In a lot of countries, October is ”Cybersecurity Month,” and organizations like to time their security awareness programs around this period. As we approach October, it is important to start thinking about security awareness training and how best to engage employees.

25 September 2020
Jason Kang
Blog Post

CGEIT Preparation Tips and the Timelessness of Good Governance

My preparation for the CGEIT certification exam took about five months of self-study, deep-dive research on the weekends and answering practice questions.

24 September 2020
Ookeditse Kamau
Blog Post

Building a Privacy Focus Area Using COBIT and the NIST Privacy Framework

As ICT professionals we are overwhelmed with quite a number of frameworks, but it is the nature of the specialization in the field that prompts the need for them.

23 September 2020
#IamISACA: Uplifting Others: The Measure of My Life
Blog Post

#IamISACA: Uplifting Others: The Measure of My Life

The life of a human being should be measured and valued by what it does for others. That is what my parents taught me.

23 September 2020
Common Sense Authentication
ISACA Journal Article

Common Sense Authentication

In the mid-1970s, 96 kilobytes of computer memory cost more than US$100,000. Today, 8 gigabytes of computer memory can be purchased for less than US$50. That difference demonstrates the huge advancements in information systems in the last 45 years.

Author: Paul C. Schauer, Ph.D.
The Blurred Lines of Information Privacy Attitudes in the COVID-19 Era
Blog Post

The Blurred Lines of Information Privacy Attitudes in the COVID-19 Era

The paradox and the naked reality is that people are simultaneously needing to protect their personal information by not participating in online transactions, while also needing to participate in online transactions to obtain goods or services...

22 September 2020
‘No Other Option’ Than Ethical Hacking
Blog Post

‘No Other Option’ Than Ethical Hacking

FC, a well-known ethical hacker and social engineer, has been working in the information security field for over 20 years and excels at circumventing access controls.

21 September 2020
IT Governance Value and the Pandemic
Blog Post

IT Governance Value and the Pandemic

Today, more than ever, people, business and information & technology are related: I&T are essential resources to facilitate the survival of people and business.

18 September 2020
What I Learned About Risk During the Pandemic: Meme Edition
Blog Post

What I Learned About Risk During the Pandemic: Meme Edition

The internet is rife with memes that speak to how nobody could have seen what was coming in 2020. From the futility of buying a 2020 calendar to the pretentiousness of answering the question of where you are going to be in five years, they are endlessly funny and help to ease us through these difficult times. v

17 September 2020
#IamISACA: This Time, I’m Here to Stay
Blog Post

#IamISACA: This Time, I’m Here to Stay

The first time I became an ISACA member, I did not stay long. I became a member in 2015 simply because there was a need for an IT auditor at my organization, but that reason was not enough to keep me in ISACA.

16 September 2020
j20v5-article-091610
ISACA Journal Article

Addressing Risk Using the New Enterprise Security Risk Management Cycle

Enterprise Security Risk Management (ESRM) is a holistic security program designed to identify and prioritize assets and risk to mitigate those risk areas. ESRM bridges security professionals and asset owners in making informed decisions through the ESRM cycle.

Author: Harisaiprasad Kumaragunta
Like Cold Weather, Handle Election Security with Layers
Blog Post

Like Cold Weather, Handle Election Security with Layers

What I’m going to tell you in this blog post is nothing new, and no secret to most cybersecurity professionals, but it nonetheless bears repeating leading up to the November US election, and really taking to heart.

15 September 2020
Taking Steps to Win the Battle Against Misinformation
Blog Post

Taking Steps to Win the Battle Against Misinformation

As a risk professional working in county government in the state of Kansas, I am on the frontlines of helping to secure the upcoming 2020 US election.

15 September 2020
Realizing the Benefits of Robotic Process Automation
@ISACA Article

Realizing the Benefits of Robotic Process Automation

Robotic process automation (RPA) reduces the amount of time it takes to perform logical, repetitive tasks, allowing more complex, value-added work to be completed. RPA is software designed specifically to perform manual, regularly occurring tasks, not to be confused with the use of robotic machines to construct a product on an assembly line, which the name may imply.

14 September 2020
Jack Freund
@ISACA Article

Problems With Using Record Count as a Proxy for Risk

Developing a cyberrisk appetite can be a daunting task. Many organizations struggle to determine how much risk they have, how much is acceptable and how to measure risk at all. When faced with these problems, many practitioners default to measuring things that are within arm’s reach or appear novel or significant based on someone’s experience.

14 September 2020
audit and assurance
@ISACA Article

Finding a Framework That Fits

Enterprises that effectively implement a cybersecurity framework are better able to create value through processes, people and technology. Guided by a framework, organizations can establish their own cybersecurity policies and procedures while adhering to industry best practices.

14 September 2020
information security
@ISACA Article

ISACA Partners With NYU for Member Discounts on Exclusive Cyber Fellows Program

ISACA and the New York University (NYU) Tandon School of Engineering have partnered to offer the CSX Cybersecurity Practitioner (CSX-P) certification at a discounted price along with a 75% scholarship toward a Master’s in Cybersecurity to all ISACA members accepted into the NYU Cyber Fellows Program

14 September 2020
ISACA Awards Program
@ISACA Article

Nominations Due 30 September for the 2021 ISACA Awards

ISACA’s professional community is advanced by outstanding contributions from members who strive to exemplify ISACA’s purpose and leadership. It is through the ISACA® Awards peer-recognition program that incredible achievements of volunteers across the industry are celebrated, inspiring future generations of business technology professionals.

14 September 2020
Security Study
@ISACA Article

ISACA’s New Election Security Study Shows Declining Confidence

In the lead-up to the 2020 US elections, ISACA surveyed more than 3,000 US members in January 2020 and again in July. Results show that confidence levels are low—and declining. Even though experts largely agree that technical controls and security procedures for elections are relatively strong...

14 September 2020
CommunITy Day
@ISACA Article

Local Outreach Makes a Global Impact on ISACA’s CommunITy Day

Recognized by the American Society of Association Executives (ASAE) with a 2020 Power of a Gold Award for its global impact, CommunITy Day encourages ISACA members and their families to take action in their local communities while ISACA measures the positive effect created globally.

14 September 2020
The Secret to Passing Cybersecurity Certification Exams
Blog Post

The Secret to Passing Cybersecurity Certification Exams

Getting ready to take a certification exam in the cybersecurity realm – whether it’s CISM, CRISC, CISSP, CSX-P or another blue-chip certification – can be quite stressful.

14 September 2020
Adam Cason
The Nexus Article

A Green Eggs and Ham Guide to Securing Your Critical Infrastructure

Whether your data are in a box, with a fox, in a house, with a mouse, on a train, in the rain, in a car or on a boat... Wherever the critical data that you manage are located—which brings to mind the Dr. Seuss book Green Eggs and Ham...

14 September 2020
Ali Pabrai
The Nexus Article

COVID-19 Cyberattacks Require Businesses to Prioritize Cyberresilience

Businesses and end users are being targeted to download COVID-19 ransomware malware disguised as legitimate applications. We are witnessing an increase in phishing attacks that then lead to ransomware events by using COVID-19 as bait to mislead employees and customers.

14 September 2020
Ron Lear
Blog Post

CCPA: Nine Months In

Protecting consumer data privacy has been a critical issue for years, but California was the first US state to actually enact a law.

11 September 2020
Privacy as a Differentiator: Going Beyond Regulations
Blog Post

Privacy as a Differentiator: Going Beyond Regulations

The array of proposed and adopted privacy laws across the globe, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), reflect growing concerns around privacy.

10 September 2020
Common Misconceptions About Agile Auditing
Blog Post

Common Misconceptions About Agile Auditing

Before the pandemic disrupted our lives, I attended a fascinating webinar in which the head of a very large internal audit shop shared lessons learned from the department’s Agile journey.

9 September 2020
j20v5-article-090910
ISACA Journal Article

US Data Privacy Law: A Disparate Landscape in Need of Consolidation

Even before the EU General Data Protection Regulation (GDPR) brought attention to the issue of data privacy, the United States already had one of the most complex regulatory approaches to privacy, having implemented different laws and regulations by industry...

Authors: Jacob Nix and Pascal A. Bizarro
Podcast
Podcast

Breaking Down Blockchain

At its core, blockchain functions to maintain the integrity of data and systems. But how does it compare to other databases and when should it be used?

9 September 2020
Dušan Žikić
Governance Article

COBIT and IT Audit—A Partnership for Eternity

The first time I heard about COBIT was almost 10 years ago, as I was starting out as an IT internal audit intern. Since then, I have been using COBIT for various aspects of IT audit, including developing IT audit plans, planning and performing IT audit engagements...

8 September 2020
Making Our Mark on ISACA CommunITy Day 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Making Our Mark on ISACA CommunITy Day 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Responding to and Protecting Against Ransomware
Blog Post

Responding to and Protecting Against Ransomware

There have been many recent successful ransomware attacks, and there is frustration that in today’s cybersociety, information security safeguards and best practices are not being followed by local governments, financial services, law enforcement, academia, government agencies, healthcare organizations and businesses and commercial enterprises.

3 September 2020
Choosing the Ideal API with Security in Mind
Blog Post

Choosing the Ideal API with Security in Mind

Application programming interfaces, or APIs for short, provide very secure and standardized ways for applications to work together and deliver greater information and functionality for end users

2 September 2020
#IamISACA: Reaching the Top, and Finding a New Challenge
Blog Post

#IamISACA: Reaching the Top, and Finding a New Challenge

After more than 10 years as an IT and IS auditor and consultant for one of the Big 4 audit and advisory companies worldwide, I gained world-class experience by working in a high-ranking professional environment on challenging local and international engagements.

2 September 2020
#IamISACA: Striving for Excellence
Blog Post

#IamISACA: Striving for Excellence

The 2008-2009 recession gave me the opportunity to look beyond the obstacles and to find out what opportunities lie after a crisis. With that in mind, today’s COVID-19 pandemic reminds me how a crisis turned into an opportunity to land in information security and to become involved with ISACA.

2 September 2020
Building a Privacy Culture
ISACA Journal Article

Building a Privacy Culture

Privacy is the right to be free from interference or intrusion. Information privacy is most often associated with digitization, but information privacy has been an issue ever since personal information started to be stored on and processed by mainframe and mini-computers.

Author: Muhammad Asif Qureshi
COVID-19: A Pilot for the Future of Work
Blog Post

COVID-19: A Pilot for the Future of Work

Daniel Susskind visited with ISACA Now to discuss how AI will impact the professional landscape, how COVID-19 factors in and more. The following is a transcript of the conversation, edited for length and clarity.

1 September 2020
Podcast
Podcast

The Road to Achieving Privacy by Design

Most organizations would agree that privacy by design is fundamental to growing a successful business and building customer trust. Yet putting this ideal into practice can often prove challenging. In this episode of the podcast...

1 September 2020
Mostafa Elghazaly
@ISACA Article

How to Build a Strategic and Effective GRC Operating Model

Many organizations are facing a set of challenges with regard to governance, risk and compliance (GRC)-related processes, technologies and overall programs embedded within their IT and business enterprise architecture.

31 August 2020
Audit Program From ISACA Reviews Microsoft Azure Cloud Platform
@ISACA Article

Audit Program From ISACA Reviews Microsoft Azure Cloud Platform

To be effective, auditors must familiarize themselves with the latest cloud trends and top cloud computing platforms such as Amazon Web Services (AWS) and Microsoft Azure (Azure) as well as market newcomers and the latest cloud trends.

31 August 2020
Navigating Governance
@ISACA Article

Navigating Governance in the Wake of COVID-19

An informed risk response is fundamental to the success of IT risk and assurance professionals, and the importance of this tactic has been amplified since the rise of the COVID-19 pandemic.

31 August 2020
Discover the Latest in Cybersecurity at ISACA’s Virtual Summit 2020
@ISACA Article

Discover the Latest in Cybersecurity at ISACA’s Virtual Summit 2020

In the age of the COVID-19 pandemic and physical distancing, gathering in a single room with hundreds of other professionals to explore ideas and the latest industry trends is unlikely to become a reality anytime soon.

31 August 2020
New Hall of Fame Recognizes Dedicated Volunteer Service
@ISACA Article

New Hall of Fame Recognizes Dedicated Volunteer Service

Volunteering not only benefits the recipient of the service provided, the act of giving creates a ripple effect and encourages participation across entire communities. Donating time to a cause can reinvigorate an individual both personally and professionally.

31 August 2020
Deploying a Data Security Defense
Blog Post

Deploying a Data Security Defense

Data security has always been a top priority, but the COVID-19 pandemic has made it even more prominent.

31 August 2020
CDPSE Spotlights Relationship Between Privacy and Security
Blog Post

CDPSE Spotlights Relationship Between Privacy and Security

Few organizations are driving more meaningful change than ISACA for our professions and our careers.

28 August 2020
journal volume 5
ISACA Journal Article

IS Audit Basics: Defining Targets for Continuous IT Auditing Using COBIT 2019

I have previously discussed sitting and passing my Certified Information Systems Auditor® (CISA®) exam back in 2005.1 I tend to remember that one of the hot topics at that time was continuous online auditing.

Author: Ian Cooke
journal volume 5
ISACA Journal Article

The Dark Side of Robotic Process Automation

Business processes involve performing a sequence of tasks, such as registering a sale, computing value-added tax, sending an invoice, packaging and sending the product, updating the inventory and accounts receivables, etc.

Author: Spiros Alexiou
journal volume 5
ISACA Journal Article

Pandemic-Driven Remote Working and Risk Management Strategies

One of the most visible results of the 2020 COVID-19 pandemic has been the mainstream transition from traditional office-based work to remote work-at-home arrangements. Government officials worldwide mandated that nonessential employees stay home.

Author: Brett Bonin
journal volume 5
ISACA Journal Article

The Bleeding Edge: Why the Bleeding Edge Is So Bloody

Those of us who have been in this industry for a while have seen amazing accomplishments and growth within the technology sector. We have also seen security breaches happen, usually paired with quick knee-jerk reactions and a “slap-a-Band-Aid-on-it” mentality as a response.

Author: Dustin Brewer
journal volume 5
ISACA Journal Article

The Practical Aspect: Working From Home—Reassessing Risk and Opportunities

The technology for remote communication through distributed networks existed in rudimentary form during the 1990s,1 but sophisticated applications for distance learning, video teleconferencing, online chat and telemedicine developed modest acceptance in the early 21st century.

Authors: Vasant Raval and Edward A. Morse
journal volume 5
ISACA Journal Article

Information Security Matters: Lessons for the IT Community From the Pandemic

As I write this piece in June 2020, the world has been facing the COVID-19 outbreak for nearly seven months. Millions have been infected; hundreds of thousands have died. Millions more people have lost their livelihoods, at least in the short term.

Author: Steven J. Ross
journal volume 5
ISACA Journal Article

Building a Culture of Security

A cybersecurity culture is more than physical barriers of entry into a building, multifactor authentication system access or least privilege authorization. It is a collective mindset of the people in the organization working every day to protect the enterprise.

Author: Paul Frenken
journal volume 5
ISACA Journal Article

Applying Agile to Digital Audit Transformation

The following statement sounds like it could have come from today’s news: “54% (of [chief executive officers] CEOs) are funneling money toward growth initiatives, including emerging technologies in mobile devices, social media, and data analytics.”

Author: Chris Sanders
journal volume 5
ISACA Journal Article

Emerging Technologies Do Not Call for Emerging Cybersecurity

The world is undergoing constant transformation, and IT is the powerhouse of this process. Data are produced in high volumes every day, and the pace is increasing in areas such as social media, for example, which has evolved from text to images and from images to videos and soon will move from videos to augmented reality (AR) and virtual reality (VR).

Author: Demetrio Carrión
journal volume 5
ISACA Journal Article

Case Study: How FAIR Risk Quantification Enables Information Security Decisions at Swisscom

Swisscom is Switzerland’s leading telecom provider. Due to strategic, operational and regulatory requirements, Swisscom Security Function (known internally as Group Security) has implemented quantitative risk analysis using Factor Analysis of Information Risk (FAIR).

Authors: Dan Blum and Laura Voicu
journal volume 5
ISACA Journal Article

The Role of Governance in Digital Reporting

In today’s environment, decision-making has become more challenging than ever, and the ability to adapt is vital. The availability of real-time digital reports allows management to form strategies and adjust them to meet changing conditions. The foundation of such decisions...

Author: Rajul Kambli
Journal volume 5
ISACA Journal Article

Helpsource Q&A

We are a service organization providing IT-based services to customers. Because of containment efforts and stay-at-home orders, most of our personnel are working from home, and only essential support staff who reside near the office are managing support from the office location.

Author: Sunil Bakshi
Larry Alton
Blog Post

Ad Threats: What Are They and Why Do They Matter?

Ad fraud has been around for many years, but it’s not the only risk businesses and advertising networks face.

27 August 2020
Veronica Rose
Blog Post

Become Engaged with the ISACA Community

In addition to ISACA being a top-flight professional global community with great resources for IT professions of all levels, it is a highly collaborative community.

26 August 2020
#IamISACA: Finding Joy in a Varied Career Path
Blog Post

#IamISACA: Finding Joy in a Varied Career Path

When I was a child, I dreamt of touring the world, seeing new places and meeting new people. Those were the days when my parents could barely afford to send me anywhere beyond our hometown in India, which was in the picturesque state of Goa, some 600 kilometers south of Mumba...

26 August 2020
MD-journal2020-article-082620
ISACA Journal Article

Ransomware Response, Safeguards and Countermeasures

It is time to reassess cybersecurity because current efforts to prevent ransomware events are porous and are not fulfilling their purpose. The facts are clear. Ransomware is distributed by a variety of methods, including infected websites, online advertisements and Universal Serial Buses (USBs); direct attacks...

Author: Larry G. Wlosinski
Governance and Innovation Are Not Competitors
Blog Post

Governance and Innovation Are Not Competitors

I have sometimes heard teams complain that governance is getting in the way of their progress. Usually this is because of out-of-date governance or a misunderstanding by the teams as to what governance is telling them.

25 August 2020
Oluwaseyi Ojo
Governance Article

Achieving Operational Excellence Using COBIT 2019

Imagine the last time you went on vacation or a business trip to another city or country. You had a reservation for a rental car, and when you arrived at your destination airport and went to the rental car desk, you saw a lot of people waiting to be assisted.

24 August 2020
In Budget Season, Don’t Forget to Account for Training
Blog Post

In Budget Season, Don’t Forget to Account for Training

With the budget season approaching for many organizations and everyone under a pandemic alert of some sort, it is time to look at what is essential to invest in within your operation’s audit, risk or security department for next year. We know there are always non-negotiable activities and criteria for each budget year.

24 August 2020
Integrating GDPR Into the Threat Intelligence Program
Blog Post

Integrating GDPR Into the Threat Intelligence Program

When the EU General Data Protection Regulation (GDPR) went into effect in May 2018, management attention to controls around data breaches—mitigation controls and incident management—became the most important issues that an organization can face based on financial penalties.

21 August 2020
Practical Tips for Managing Privacy Risk
Blog Post

Practical Tips for Managing Privacy Risk

Privacy risk is the likelihood that someone will experience problems resulting from data processing and the impact of these problems should they occur.

20 August 2020
#IamISACA: 400,000 Miles and Counting
Blog Post

#IamISACA: 400,000 Miles and Counting

I love off-roading. I have traveled all over my country of Brazil and various countries in Latin America in my 1996 Land Rover Defender, which has more than 400,000 miles on it. My trusty Land Rover might not be the fastest or most comfortable...

20 August 2020
#IamISACA: Transforming My Career, One Credential at a Time
Blog Post

#IamISACA: Transforming My Career, One Credential at a Time

My interest in cybersecurity was seeded with the “love letter” computer worm that infected millions of computers in 2000, spreading through emails. People received unsuspecting emails with attachments labeled “I Love You.”

20 August 2020
Using Gamification in Cybersecurity Incident Response Tabletop Exercises
Blog Post

Using Gamification in Cybersecurity Incident Response Tabletop Exercises

If you are looking for innovative, fun and proven methods of gamification-based learning to apply in organizations that can be used without any restrictions in the development and execution of cybersecurity incident response tabletop exercises (TTEs), Lego Serious Play (LSP) is a worthy choice.

19 August 2020
journal
ISACA Journal Article

Blind Spots for Executives Embarking on a Digital Transformation Program: Managing Risk

In response to declining revenue in one of their customer segments due to changes in market dynamics, a group of executives assembled on a Monday morning to come up with a strategic initiative to counter this problem.

Authors: Chris Ngiba and Mayank Naik
Muneeb Imran Shaikh
Blog Post

Applied Collection Framework: A Risk-Driven Approach to Cybersecurity Monitoring

Cybersecurity or network security monitoring is incumbent upon organizations through various regulations or laws prevalent in respective countries or regions. The purpose of network security monitoring is to establish and maintain a command and control center that monitors...

18 August 2020
Privacy
@ISACA Article

Data for Trade

Over the past 2 decades, the Internet has cemented its status as a digital marketplace, making it virtually inevitable that an increasing amount of consumer data will be swapped and even sold. But not all consumers are comfortable with exchanging their data for a service online.

17 August 2020
Lisa Young
@ISACA Article

Tips for Scoring or Rating Impact Criteria

Risk management is a forward-looking activity used to reduce uncertainty when making decisions that may impact an enterprise’s ability to meet its strategic objectives. An analysis technique that is useful in improving risk scoring or rating is the development of organization-specific impact criteria. Impact criteria...

17 August 2020
Privacy Compliance
@ISACA Article

ISACAs Audit Program Addresses CCPA Compliance

As expectations for data privacy continue to evolve, auditors are more likely to encounter difficulties when providing assurance for compliance initiatives. Fortunately, in parts of the United States, officials have put together privacy task forces and even enacted legislation...

17 August 2020
ISACA Awards Program
@ISACA Article

Recognize Local Service and Chapter Activities With ISACA Awards

ISACA® Chapter Awards recognize outstanding contributions by chapters and individual chapter leaders in fulfilling the needs of ISACA and its professional community. Many ISACA members engage with the organization in their local community through continuing education, certification...

17 August 2020
North America CACs
@ISACA Article

Expert Insights From North America CACS Promote Soft Skills, Career Advancement

The unexpected rise of the COVID-19 pandemic brought live events to a halt. As it became unsafe for event attendees to gather in person, the industry shifted to accommodate online conferences and seminars. To ensure that attendees were still able to learn and network...

17 August 2020
Framing Your Audit Reports in the Language of Business
Blog Post

Framing Your Audit Reports in the Language of Business

Of the many excellent resources released by ISACA over the last few years, without doubt one of the more seminal documents is the COBIT 2019 Design Guide. Why? Because it enables IT governance professionals to support the enterprise strategy, the detailed plan for ...

17 August 2020
Vikum Thebuwana
Blog Post

A Clear and Practical Approach to Risk Assessments

As information security professionals, we conduct risk assessments for companies, projects, new businesses and start-ups, etc. To complete this task, we follow guidelines from trustworthy sources, not limited to online searches, consultancies and security...

14 August 2020
The Quilted Landscape of US Consumer Data Privacy
Blog Post

The Quilted Landscape of US Consumer Data Privacy

Consumers are aware of data trade-offs. Creation of a customer account can make online shopping checkout faster; setting up a free social media account can make connecting with others easier. These conveniences are available often in exchange for data that entities use to better...

13 August 2020
IT Governance and the COVID-19 Pandemic
Blog Post

IT Governance and the COVID-19 Pandemic

COVID-19 has left a deep impact on society. It still affects the way we live and the way we work. Companies changed their delivery models, and many more people are now working remotely to adhere to new social distancing protocols. No organization was...

12 August 2020
journal
ISACA Journal Article

Incident Response Models

As global regulators start to tentatively embrace the concept of cyberresilience, it is clear that there has been a significant change in the way that cyberattacks are perceived.

Author: Cameron Young
#IamISACA: From Rock Star to Speak Star
Blog Post

#IamISACA: From Rock Star to Speak Star

Although I play guitar in a band, I’m far from being a “rock star” (well, my mom thinks I’m one), and I don’t think the term “speak star” exists (although it should!) But I decided to title my story this way because the title of an article is like the intro of a song or the name of a presentation: it should catch you from the start.

12 August 2020
#IamISACA: Making Time for What Matters to Me
Blog Post

#IamISACA: Making Time for What Matters to Me

I was 13 when I decided to become a computer programmer. Before then, I was sure that I would be an electrical engineer, like my father. However, that changed when I saw a TV spot about “Basic programming” on the local TV channel.

12 August 2020
Changing a Risk-Averse Mentality
Blog Post

Changing a Risk-Averse Mentality

Caspar Berry is the opening keynote speaker at the GRC Conference 2020, a virtual event to take place 17-19 August. After starting his working life as an actor in BBC drama Byker Grove alongside Ant and Dec, Berry studied economics at Cambridge before making the decision to move to Las Vegas and become a professional poker player.

11 August 2020
How to Prepare for the Digital Hiring Process of the Future
Blog Post

How to Prepare for the Digital Hiring Process of the Future

For years we have known when applying for a job that computer software was screening our resumes to determine whether it would make it to the hands of a recruiter. What if I told you that technology now has a more integrated role in the hiring process?

10 August 2020
Greet Volders
Governance Article

How to Downsize the Cost of Compliance

The technological developments of the last decades offer organizations many opportunities and possibilities to expand their product portfolio and offer their services in new ways. This requires them to determine how to evolve from paper and manual management to create...

10 August 2020
Paul Lucier
The Nexus Article

Six Steps to Start Readying for Quantum

On the not-too-distant horizon are quantum computers. They will be capable of so much, including the ability to break the cryptography underlying public key infrastructure (PKI). This creates an unprecedented problem for the encryption and authentication that enterprises put their trust in today.

10 August 2020
Jon Brandt
The Nexus Article

Stepping Out From the Shadows

As a remote employee and IT professional, the pandemic has only minimally affected my professional life. I wake up each day and go about my routine to provide for my family and, ideally, positively influence the cybersecurity career field, enabling those of you on the frontlines working hard to support your respective enterprises to survive another day in the midst of a dynamic threat environment.

10 August 2020
Local Outreach, Global Impact: ISACA CommunITy Day 2020
Blog Post

Local Outreach, Global Impact: ISACA CommunITy Day 2020

So often as a volunteer manager, I hear, “I would like to get more involved, but I am not sure how.” Or “I want to make a difference but do not have much free time.” Now I hear, “How can I participate during a global pandemic?”

7 August 2020
Transforming Your Team: The Value of Group Training
Blog Post

Transforming Your Team: The Value of Group Training

Training is an essential cornerstone of maintaining our ongoing professional relevance. While conferences and webinars should be a staple in any individual or company training repertoire, a perhaps ...

6 August 2020
The Fine Art of Stepping on the Same Rake
Blog Post

The Fine Art of Stepping on the Same Rake

For more than half a decade I presented a talk about learning from current events in a “stepping on a rake” series. While the title changed slightly from year to year, the material ...

5 August 2020
#IamISACA: Three Countries and Three Lessons Learned
Blog Post

#IamISACA: Three Countries and Three Lessons Learned

I originally am from the Philippines and started my career there, working with the biggest telecommunications company in the country. Then I was given a chance to be part of a team of seven Filipinos who were sent to the State of Qatar to build the first certified commercial Security Operations Center (SOC) there.

5 August 2020
journal
ISACA Journal Article

Are Organizations Actually Performing Risk-Based Audits?

Organizations place a strong emphasis on cybersecurity, privacy and compliance. However, many enterprises are uneducated when it comes to identifying, assessing, responding to and monitoring these domains. Auditors provide value in these areas and address these deficiencies via various techniques and approaches.

Author: Blake Curtis
Podcast
Podcast

Cybersecurity Degrees or Certificates?

When it comes to the ever-expanding field that is cybersecurity, passionate practitioners should adopt the attitude that there is always more to learn.

5 August 2020
Revamped ISACA Awards Program Enhances Prestige and Engagement
Blog Post

Revamped ISACA Awards Program Enhances Prestige and Engagement

As a volunteer on the 2020 ISACA Awards Working Group and past ISACA Michael Cangemi Award recipient, I am excited to help ISACA recognize the incredible contributions our colleagues and organizations make, and the positive impact we, as the global IT community, have on the world.

4 August 2020
Audio waves
@ISACA Article

ISACA Podcast Receives AM&P EXCEL Award for Excellence and Leadership

Launched in 2015, the ISACA Podcast features experts discussing relevant trends in technology. Podcast guests cover topics related to cybersecurity, privacy, audit and governance, applying their unique knowledge and experience to give listeners insights on industry-related topics...

3 August 2020
ISACA Awards Program
@ISACA Article

ISACA Awards Program Enhances Global Industry Recognition

In early 2020, the ISACA Awards Working Group, made up of 10 volunteers from around the world, was charged with reviewing the current ISACA Awards portfolio and identifying ways to enhance the program.

3 August 2020
Streamline Your Team’s Asset Management Process
@ISACA Article

Streamline Your Team’s Asset Management Process

As IT environments become increasingly complex, it is more important than ever for teams to practice effective cybersecurity asset management. Yet to many, this topic can be challenging and even frustrating.

3 August 2020
Bruce R. Wilkins
@ISACA Article

The Age of Collaboration and a Distributed Workforce

Like the auditors, evaluators, assessors and certifiers before us, we are now confronted with a new cultural reality brought on by medical concerns. People at risk and people at a lower risk of COVID-19 are changing what they work on, how they work and where they work.

3 August 2020
privacy
@ISACA Article

The Evolution of Privacy

The definition of privacy has had many different interpretations in recent years, aligning with the rapid growth of social media, Internet transactions and digital marketing. As a result, even trusted organizations can be susceptible to privacy violations in the form of security breaches...

3 August 2020
RiskEngaging ISACA’s Community Virtually
Blog Post

Enterprise Risk Summarized Effectively

A risk management process always starts in top-down mode. The enterprise risk management’s (ERM's) long journey begins between methodologies and fears of not achieving business objectives. Roughly speaking, we design a model, define metrics and establish how data are collected.

3 August 2020
James Azarowicz
Blog Post

Be Prepared and Don’t Panic to Steer Your Career Through Challenging Times

Imagine you’re driving down the highway and, all of a sudden, your hood flies open, blinding your view of the road. What is the first thing you should do?

31 July 2020
Culture as a Corporate Asset
Blog Post

Culture as a Corporate Asset

Culture is described as the sum of the shared assumptions, values and beliefs that create the unique character of an organization. Culture, if managed well, can deliver value to stakeholders through the behavior and actions of employees.

30 July 2020
#IamISACA: Overcoming Challenges By Always Learning New Things
Blog Post

#IamISACA: Overcoming Challenges By Always Learning New Things

I have faced many challenges in my career in project management when implementing technology projects, including the last couple of years working on implementations of cybersecurity frameworks, standards and regulatory requirements to achieve good IT governance.

30 July 2020
Internal Audit Evolution by Unnatural Selection
Blog Post

Internal Audit Evolution by Unnatural Selection

I get it. You feel like the world is moving at a faster pace. Blockchain teases with the potential of revolutionizing the financial world. Artificial intelligence technologies are expected to be as ubiquitous as electricity, helping us with many decisions and making predictions.

29 July 2020
journal
ISACA Journal Article

Using Gamification to Improve the Security Awareness of Users: The Security Awareness Escape Room

It is vital that organizations take action to improve security awareness. Threat reports increasingly acknowledge and predict attacks connected to the human factor (e.g., ransomware, fake news). Employees pose a high-level risk at all enterprises because it is generally known that they are the weakest link in the chain of information security.

Author: Eszter Diána Oroszi
Podcast
Podcast

Creating Value by Taking Risks and Overcoming Fear of Failure

The thought of taking a risk can dredge up feelings of discomfort or even outright fear for many. This reluctance has only been amplified by the uncertainty stemming from the COVID-19 pandemic.

29 July 2020
Digital Transformation and Human Error
Blog Post

Digital Transformation and Human Error

There was a time back in 2016/2017 when the whole world seemed abuzz with news that robots were about to take over the world, an outcome that would leave many of us humans...

28 July 2020
Controlling the Cloud
Blog Post

Controlling the Cloud

The cloud has been and continues to be an important enabling technology for many, both professionally and socially, during the COVID-19 pandemic. We have built a virtual world and now we are putting...

27 July 2020
Emeka Elue
Governance Article

Effective Capability and Maturity Assessment Using COBIT 2019

COBIT provides guidance to assist enterprises in making key governance system design decisions to successfully achieve enterprise goals and objectives. This is accomplished by focusing on objectives specific to both the governance and management components of a governance system. Organizations vary in how they approach, design and define the parameters for how governance and management operate within an enterprise.

27 July 2020
The Bedrock of a Post-COVID-19 Security Operations Center
Blog Post

The Bedrock of a Post-COVID-19 Security Operations Center

Given the profound impact of COVID-19, a constantly evolving threat landscape, constraints of operating a Security Operations Center (SOC) remotely, increased remote workforce, disparate managed and unmanaged endpoints, an avalanche of phishing, malicious campaigns masquerading in the name of COVID-19...

24 July 2020
Jo Stewart-Rattray
Blog Post

Carrying Forward John Lainhart’s COBIT Legacy

Back in late 2018, a small group of COBIT enthusiasts were set to meet at ISACA Global in Schaumburg, Illinois, USA, to commence work on what an information security offering for the latest version of COBIT would look like. We were to be led by my dear friend, mentor and one of the founding fathers of COBIT back in 1995, John Lainhart.

23 July 2020
#IamISACA: Feminism and Food Make Me Who I Am
Blog Post

#IamISACA: Feminism and Food Make Me Who I Am

Going back to my childhood, I have always been interested in feminism, and that has only grown stronger as an adult. I am always eager to talk about it and explain when someone does not understand issues related to inequality. To me, feminism is not just about women's rights...

23 July 2020
Welland Chu
Blog Post

Quick Questions for IoT Manufacturers

Despite good intentions from the manufacturing community to improve security, the decision of whether and how security is implemented always comes down to economics.

22 July 2020
journal
ISACA Journal Article

Impact of GDPR on Threat Intelligence Programs

The EU General Data Protection Regulation (GDPR) plays a part in enterprises’ overall strategies and, more specifically, in their collection and use of threat intelligence. In particular, it impacts enterprises’ security and privacy strategies for current and planned projects.

Author: Larry Marks
One In Tech: Leveling the Playing Field in the Digital World
Blog Post

ISACA Foundation: Leveling the Playing Field in the Digital World

Just to give a little history, it was about four or five years ago that ISACA brought together a number of women leaders to talk about the underrepresentation of women in the tech space, and as we started those conversations and we developed a program – it started off as something different, but it eventually became what we know today as SheLeadsTech.

21 July 2020
AtIsaca
@ISACA Article

ISACA’s Commitment to Bridging the Digital Divide

ISACA is excited to announce the launch of One In Tech, an ISACA Foundation and nonprofit dedicated to ensuring a healthy digital world for all. Over the past year, ISACA has worked to develop One In Tech as a philanthropic entity...

20 July 2020
Governing
@ISACA Article

Governing the New Perimeter: Cloud IAM

Without strong identity and access management (IAM) governance, organizations are more susceptible to dangerous security incidents such as data breaches. Leveraging cloud IAM reduces this risk, enabling organizations to assess improper permission combinations...

20 July 2020
At ISACA
@ISACA Article

Making the Most of ISACA Member Benefits

ISACA is always working to strengthen member benefit offerings. As part of the Member Advantage Savings program, ISACA recently partnered with Clements to offer insurance solutions to members in more than 170 countries.

20 July 2020
Sunil Bakshi
@ISACA Article

The AIC Myth

When I joined a banking and finance company as chief information security officer (CISO), I was focused on using the availability, integrity and confidentiality (AIC) triad to secure information.

20 July 2020
Security
@ISACA Article

Build Efficiency Into Your Information Security Governance and Management

Information security breaches can expose an organization to compliance risk, cause harm to customer relationships and result in financial or operational damages. This makes good information security governance and management practices critical to the success of every organization.

20 July 2020
IamISACA
@ISACA Article

#IamISACA: Why I Love to Learn

For me, the pursuit of lifelong learning is not just about gaining the knowledge I need, it is about enjoying the learning process itself. My experience with ISACA has made it even easier to love learning.

20 July 2020
The Twitter Hack: How Did They Do It?
Blog Post

The Twitter Hack: How Did They Do It?

On 15 July, Twitter was hacked in an epic way. One-by-one, a number of accounts were targeted and compromised, including verified accounts of famous users including Elon Musk, Bill Gates, Barack Obama, Kanye West and Joe Biden, and a number of Twitter accounts...

20 July 2020
What Is the Difference Between Requirements and Controls?
Blog Post

What Is the Difference Between Requirements and Controls?

Practically speaking, there tends to be a great deal of confusion around the topics of requirements vs. controls. We are all very familiar with the various marketing strategies for complying with the US National Institute of Standards and Technology (NIST), Payment Card Industry...

17 July 2020
#IamISACA: A Toast to Work-Life Balance
Blog Post

#IamISACA: A Toast to Work-Life Balance

Long before I became an IT management professional or a wine aficionado, I dreamed of being an engineer. Machines and computers were all I could think of as a kid, and understanding the logic behind them was my passion for a long time. I studied software engineering...

16 July 2020
#IamISACA: Adapting to Change
Blog Post

#IamISACA: Adapting to Change

I started my career in the finance department during a time when manual accounting systems were mostly used. My true passion since childhood, however, was in IT. I read IT books about programming and networking in my leisure time and started taking courses step by step...

16 July 2020
journal
ISACA Journal Article

Securing and Embracing Infrastructure as Code

Recent advances in computing technology have empowered IT professionals to increasingly rely on abstraction, freeing them from the burden of managing infrastructure and allowing them to focus their energies on delivering quality software as fast as possible.

Author: Taimur Ijlal
Tailoring Enterprise Information Security Training and Awareness for Remote Working
Blog Post

Tailoring Enterprise Information Security Training and Awareness for Remote Working

The ongoing COVID-19 outbreak has compelled most organizations to roll out work from home arrangements. In the changed times, work no longer means being inside the office facing your computer. The increase in at-home working also puts organizations at a greater risk of cyber-attacks because home networks are generally not as securely configured...

14 July 2020
Data Ownership Questions in Light of COVID-19
Blog Post

Data Ownership Questions in Light of COVID-19

What was clear when writing my recent Journal article, “Data Rights: Single vs. Multiple Ownership?,” is the knowledge that data ownership rights, data source and data quality are unquestionably critical to any data analytics and visualization, at least to a reasonable person...

13 July 2020
Graciela Braga
Governance Article

COBIT 2019 and the IIA 2019 Guiding Principles of Corporate Governance

2019 was a very productive year for corporate governance. ISACA completed the publication of COBIT 2019, a master framework internationally recognized for the governance and management of enterprise information and technology...

13 July 2020
Donald R. Owens
The Nexus Article

Ignoring Indiscernible Threats Is No Longer an Option

Why have many internal audit (IA) functions failed to drive the type of value stakeholders expect? The question provokes varying responses. Assertions that IA frequently raises in its defense are...

13 July 2020
How the CSX-P Certification Has Bolstered My Credibility in Audit
Blog Post

How the CSX-P Certification Has Bolstered My Credibility in Audit

As an IT or systems auditor, my job is all about assessing and testing controls designed and in place to protect the company’s treasure trove of information. In my case, health insurance claims data of our members is the Holy Grail to be protected. When I go into an audit, my credibility sets the tone for an open and honest dialogue throughout the engagement.

10 July 2020
#IamISACA: Building an IT Audit Community From the Bottom Up
Blog Post

#IamISACA: Building an IT Audit Community From the Bottom Up

I started work at the State Audit Office (SAO) of Georgia in late 2013 as an intern. At that time, SAO had no IT audit function, but one was needed to keep up with the government due to rapid development of government electronic systems. I was tasked to learn more about IT audit and build a qualified team.

8 July 2020
#IamISACA: Satisfaction Through Volunteering
Blog Post

#IamISACA: Satisfaction Through Volunteering

Life is all about tackling and winning over challenges that come your way. In that spirit, I want to share some of my experiences with ISACA (mostly with the Chennai, India Chapter) and from my personal life – and how these two became connected.

8 July 2020
journal
ISACA Journal Article

Essential Functions of a Cybersecurity Program

No matter the size of an organization, every organization that depends on information technology to conduct any part of its business should have a functioning cybersecurity program.

Author: Steve Akridge
Leveraging Cybersecurity to Increase Diversity, Equity and Inclusion
Blog Post

Leveraging Cybersecurity to Increase Diversity, Equity and Inclusion

As an industry, cybersecurity has always been challenged by a shortage of supply when it comes to talent. This is further complicated by a lack of diversity, an issue that when addressed well has always proven to deliver stronger teams and better results.

7 July 2020
Seven Ways AI is Improving the Job Market – Not Killing It
Blog Post

Seven Ways AI is Improving the Job Market – Not Killing It

Artificial intelligence is not a thing of the future anymore. We live in a world where AI is working diligently in the shadows of every major industry. The industrial revolution of the past built the world we are enjoying today, and it was done using the strength...

6 July 2020
ISACA Awards
@ISACA Article

Congratulations, 2020 ISACA Award Recipients

ISACA is thrilled to recognize the 2020 ISACA Award recipients for their thought leadership and volunteer service. Although COVID-19 challenges have altered the presentation schedule in 2020, the individuals and chapters who have committed to advancing ISACA and the business technology community deserve recognition.

6 July 2020
Risk
@ISACA Article

Balance Circumstances With Safety Using Risk IT Materials

Managing business, IT and cybersecurity risk is vital for the success of any organization, especially during the uncertain age of the COVID-19 pandemic. Executives and managers must consider circumstances, security, hazards and even opportunities, all through the lens of risk.

6 July 2020
John P. Pironti
@ISACA Article

Five Key Considerations When Securing a Work-from-Home Workforce

Recent events have forced many organizations to require their workforces to operate from their homes. For some employees, this is nothing new, but for those who regularly interact with high-risk and controlled data and systems...

6 July 2020
New ISACA Paper Enables Enterprises to Use Cyberrisk Quantification to Improve Approach to Cybersecurity Risk
@ISACA Article

Protecting the Integrity of ISACA Certifications

For more than 40 years, ISACA certifications have had a globally recognized reputation for being relevant, valuable and credible. This reputation has benefited certification holders around the globe, and ISACA makes every effort to protect the integrity of its certifications and those who have earned them.

6 July 2020
Omar Alarcon
@ISACA Article

Getting Ahead With CISM

When Omar J. Alarcon traveled overseas to Australia with more than 10 years of professional experience, the competitive job market he found left him motivated to enhance his certifications.

6 July 2020
Preserving Privacy in Video Analytics Solutions in Smarter Cities
Blog Post

Preserving Privacy in Video Analytics Solutions in Smarter Cities

Video analytics in smarter cities pose a challenge for security and privacy professionals that are focused on preserving the privacy of the public, while balancing their organization’s desire to utilize information. As with all analytics, these principles come with competing needs.

2 July 2020
#IamISACA: Calligraphy is My Meditation
Blog Post

#IamISACA: Carrying on My Father’s Volunteering Legacy

After voting precincts began relying upon computers, my father stopped volunteering as an election worker. That’s right about when he passed the torch to me and I signed up.

1 July 2020
#IamISACA: Embracing Cross-Cultural Connections
Blog Post

#IamISACA: Embracing Cross-Cultural Connections

I worked for a company a long time ago that sent us to a training about cultural differences between the US and UK. Most of our senior managers were in the UK or in the U.S. and we thought, we both speak English so why can’t we communicate?

1 July 2020
journal
ISACA Journal Article

Deploying a Data Security Defense

Maintaining data security has become more challenging in recent years. Many countries have passed and adopted comprehensive laws dealing with this issue, and others are debating the necessity of doing so.

Author: Jason Jiao
Emily Tsitrian
Blog Post

Becoming the Boss: Guidance for New Supervisors in an Era of Remote Work

Emily Tsitrian, senior manager of professional services at Castlight Health, presented last week at the Pride Summit in her session, “Boss Up! How to Become the Boss.” Tsitrian visited with ISACA Now following her session to share some of her guidance on transitioning to becoming a supervisor, especially in current times in which remote work has become increasingly commonplace.

30 June 2020
2020-volume-4
ISACA Journal Article

Information Security Matters: Privacy by Implementation and Execution

When I was in graduate school, I read a lot of scholarly journals. (None of them were as lively nor as useful as the journal you are now reading.) One of the features I loved best was a rousing argument between academics about matters of miniscule interest to the general public.

Author: Steven J. Ross
2020-volume-4
ISACA Journal Article

Connecting Good Governance With Key Risk

During the COVID-19 pandemic, many enterprises have stated that employee health and well-being are their primary concern. The events of 2020 have also led organizations to evaluate their preparedness for and responses to another major risk factor...

Author: Kevin M. Alvero
2020-volume-4
ISACA Journal Article

Privacy Risk Management

Concerns about privacy risk have triggered a number of new privacy protection regulations: The US State of California Consumer Privacy Act (CCPA) went into effect on 1 January 2020, the Brazilian General Data Protection Law (LGPD) becomes effective in August 2020...

Author: Andrea Tang
2020-volume-4
ISACA Journal Article

Digital Governance: Closing the Digital Strategy Execution Gap

Never before has there been such an intense focus on digital as during the COVID-19 pandemic. This has been especially true for the business continuity management (BCM) efforts needed to provide work-from-home functionality to support social distancing.

Author: Guy Pearce and Tony Gaffney
2020-volume-4
ISACA Journal Article

IS Audit Basics: Enhancing the IT Audit Report Using COBIT 2019

Earlier this year, I authored a column on the “Components of an IT Audit Report.” These components need to provide assurance, inform auditees and others of management and control issues, recommend corrective action, and represent the quality of the audit and the credibility of the audit organization.

Author: Ian Cooke
2020-volume-4
ISACA Journal Article

The Bleeding Edge: Nothing but Blue Skies—Virtualizing Humanity

I have been a remote worker for approximately five years. The transition was not an easy one. However, in the past two years I have come to a very “Zen” place in my work-from-home routine…or lack thereof.

Author: Dustin Brewer
Career and Leadership
ISACA Journal Article

The Network: Responding to a Changing Business Landscape

Tracey Dedrick is a C-suite executive experienced in risk, compliance, treasury and investor relations. She was executive vice president (EVP) and head of enterprise risk management for Santander Holdings US, where she was responsible for enterprise risk, operational risk and market risk for the Americas.

Author: Tracey Dedrick
2020-volume-4
ISACA Journal Article

Innovation Governance: Governance for Better Innovation

Leadership expert and former US Navy SEAL Jocko Willink wrote the following, “And most important, discipline will put you on the path to FREEDOM.” What does this have to do with innovation? Everything, as it turns out.

Author: K. Brian Kelley
2020-volume-4
ISACA Journal Article

Case Study: Building an Enterprise Security Program

Mercury NZ, a US$2 billion renewable energy generation and retail company, has the most NZ Stock Exchange shareholders of any New Zealand company, serving more than 373,000 residential, commercial, industrial and spot customers across New Zealand.

Author: Katie Teitler
2020-volume-4
ISACA Journal Article

Cybersecurity Incident Response: Tabletop Exercises Using the Lego Serious Play Method

It is foolish to wait until an enterprise is in the midst of a data breach to test its cybersecurity incident response plan (CSIRP). How likely is it that the enterprise will know that a cyberattack is underway and be able to react appropriately?

Author: Fabian Garzón
journal
ISACA Journal Article

Helpsource Q&A

With the proliferation of cloud computing services available, our organization is considering moving IT-related services to cloudbased services. What are the benefits and risk associated with using cloud services? What steps should we follow when selecting a cloud service provider (CSP)?

Author: Sunil Bakshi
Podcast
Podcast

Framework Overload

Cybersecurity frameworks can be a valuable tool for organizations, helping them implement best practices and establish documentation for complex processes.

30 June 2020
Blake Curtis
Governance Article

The Value of IT Governance

Ineffective governance has a substantial impact on business alignment and risk management. Misalignment can result in improper identification of sensitive data, critical services and substandard security controls.

29 June 2020
Open-Minded Approaches to Addressing the Cybersecurity Skills Gap
Blog Post

Open-Minded Approaches to Addressing the Cybersecurity Skills Gap

It is more important than ever that organizations become creative in their approaches to addressing under-resourced security staffs. If you look at ISACA’s State of Cybersecurity 2020 report, which predates COVID-19, 62% of companies are understaffed and 57% have unfilled security positions.

26 June 2020
Risk IT Revitalized
Blog Post

Risk IT Revitalized

I had the privilege of being on the task force that created the original version of ISACA’s Risk IT Framework several years ago. At the time, I felt Risk IT was an important contribution to the profession...

25 June 2020
#IamISACA: IT Leader By Day, Belly Dancer By Night
Blog Post

#IamISACA: IT Leader By Day, Belly Dancer By Night

I took up belly dancing at the same time I started preparing for my CISA exam 16 years ago. It is great exercise, and concentrating on the music and the movements takes my mind completely off the problems and stressful decisions that I face in my daily work as the leader of a big team of highly skilled IT auditors.

24 June 2020
#IamISACA: Never Too Late to Start a New Dream
Blog Post

#IamISACA: Never Too Late to Start a New Dream

In 1984, when I was 16 years old, I had the opportunity to take computer science as an additional school subject. The classes were presented after regular school hours, and this opportunity opened up the new world of computers to me.

24 June 2020
NIST and COBIT: Working in Harmony for More Reliable and Secure Technology
Blog Post

NIST and COBIT: Working in Harmony for More Reliable and Secure Technology

The events of 2020 have shown us, more than ever before, how profoundly circumstances can change, seemingly in a moment. Information and technology are constantly on the move, and we have seen technology revolutions on every front, from mobile devices to changing office environments – even in our spacecraft!

24 June 2020
Enterprise Risk Monitoring Methodology, Part 4
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 4: Risk Executive Summary

Everyone involved in the enterprise risk management process has probably had to summarize their work and condense a great deal of information into a short presentation. In doing so, it is often necessary to highlight some information at the expense of other information...

Author: Luigi Sbriz
COVID-19 Underscores Value of Resilient Supply Chains
Blog Post

COVID-19 Underscores Value of Resilient Supply Chains

My supply chain focus started when I was the vice president controller for a shoe retailer in the US, and we were hit with an unexpected new tariff on our Chinese products for a piece of metal that was used to keep the holes in place for shoelaces to go through.

23 June 2020
Risk Management
@ISACA Article

Understanding the Science of Risk Management

Every decision an enterprise makes requires thoughtful balancing of circumstances, security, hazards and opportunities, all of which are components of risk. ISACA has updated The Risk IT Framework and Risk IT Practitioner Guide...

22 June 2020
Managing Privacy Risk
@ISACA Article

Managing Privacy Risk and Expectations

As privacy regulations expand around the world and the emphasis on privacy increases, it is more important than ever for organizations to protect their customers’ privacy. But when a privacy violation occurs in 1 country and affects someone in a different country...

22 June 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

The Rising Security Risk and Mitigation Options for IoT Devices

In our world today, there are more smart devices than there are people. Many people could not make it through a modern workday without using a connected device. A growing number of people are connected to the Internet in one way or another, 24 hours a day.

22 June 2020
Business Continuity
@ISACA Article

Ensuring Business Continuity During a Pandemic

The COVID-19 pandemic has forced many businesses to pivot dramatically or risk devastating losses, possibly even closure. As a result, business continuity management has been evolving drastically.

22 June 2020
ISACA Buyers Guide
@ISACA Article

ISACA Buyers’ Guide Connects Members to Products They Need

To connect members to products and solutions that benefit their organizations, ISACA has launched the new ISACA Connect buyers’ guide. Users can access ISACA Connect to research products and services before making a purchase.

22 June 2020
The Importance of Privacy-Focused Monitoring In Light of COVID-19 Work Disruption
Blog Post

The Importance of Privacy-Focused Monitoring In Light of COVID-19 Work Disruption

The COVID-19 pandemic has increased the already-robust adoption rates for employee monitoring software. Prominent publications, including The Washington Post and The New York Times, have reported on this trend, and they have documented employees’ general unease about the practice.

22 June 2020
Harnessing the Power of Technology in the Fight Against COVID-19
Blog Post

Harnessing the Power of Technology in the Fight Against COVID-19

The turn of a new decade has brought an interesting twist to the old debate on the pros and cons of technology. The unprecedented coronavirus pandemic (hereafter referred to as COVID-19 or the pandemic) has not only exposed the fragility of humanity but also a spiral of challenges that may affect our interconnected world for years to come.

19 June 2020
Understanding the Human Side of Cybersecurity
Blog Post

Understanding the Human Side of Cybersecurity

Dr. Jessica Barker, the closing keynoter speaker at ISACA’s EuroCACS 2020 conference, to take place 28-30 October in Helsinski, Finland, is a leader in the human nature of cybersecurity. She has been named one of the top 20 most influential women in cybersecurity in the UK and in 2017 she was awarded as one of the UK’s Tech Women 50.

18 June 2020
#IamISACA: Becoming Richer Through Travel
Blog Post

#IamISACA: Becoming Richer Through Travel

When Norway decided to go into lockdown for COVID-19, I was actually sitting in Singapore, preparing to travel to the island countries of Palau and Micronesia, where I had lined up a couple of weeks of diving the reefs and chatting up the locals.

17 June 2020
#IamISACA: Hitting Reset in the Back Garden
Blog Post

#IamISACA: Hitting Reset in the Back Garden

Due to the blending of home and work life, and especially with the need to educate my three sons from home during the COVID-19 pandemic, it has been harder to ensure some sort of separation at the end of a work day.

17 June 2020
journal2020-article-061720
ISACA Journal Article

A Fintech Risk Assessment Model

The financial technology, or “fintech,” revolution is happening right now. Mobile payments are changing consumer spending habits, online brokerage services are creating opportunities to make investments from home, financial chatbots are advising individuals about new...

Author: Luis Emilio Alvarez-Dionisi
Privacy by Design—Opinions Matter
Blog Post

Privacy by Design—Opinions Matter

In response to the global health emergency and, after much national soul-searching, the Irish government reluctantly decided to cancel this year’s Leaving Certificate, the set of final exams that a student takes in secondary school here in Ireland.

16 June 2020
Nonsense Compliance
Blog Post

Nonsense Compliance

A project manager just completed a cybersecurity project on time and on budget. He schedules the last meeting with his sponsor, the chief information security officer (CISO). While plugging in the beamer for his final presentation, he thinks back at those frenzied few weeks he went through and sighs in relief.

15 June 2020
Sunil Sheen
Governance Article

Communicating the Value of IT Governance

A network patch management tool to be procured is often seen mainly as an expense by the finance department and, therefore, queried subjectively or even rejected.

15 June 2020
Leveraging AI to Provide Better IT Service Management Using COBIT
Blog Post

Leveraging AI to Provide Better IT Service Management Using COBIT

I started my own Watson Assistant project last year. This was after I was informed of how successful IBM’s help desk, which is based on Watson Assistant, was. As an assurance specialist, I naturally decided to work on something along the same lines.

12 June 2020
#IamISACA: Defying Assumptions and Embracing Opportunities
Blog Post

#IamISACA: Defying Assumptions and Embracing Opportunities

My introduction to ISACA came in 2013 when I hired Emil D’Angelo out of retirement to help me bring information security up to regulatory acceptable levels at the bank where we worked. A lot of you will know Emil as a past ISACA board chair and a very active and passionate member of the ISACA family.

11 June 2020
Podcast
Podcast

Protecting the Privacy of Our Digital Selves

As the role of technology has expanded, so has the amount of personal data that are being shared. While people want to protect their privacy, there is often a tradeoff between being able to use a service and not sharing data about yourself.

11 June 2020
Digital Businesses Need Tailored Security Solutions and Services
Blog Post

Digital Businesses Need Tailored Security Solutions and Services

Many enterprises prefer to outsource their IT security and believe their cybersecurity operations will be managed well. Typical security device management services that are offered by leading managed security service providers (MSSPs) are broadly categorized into the below clusters...

10 June 2020
Audit and Assurance
ISACA Journal Article

The Impact of Poor IT Audit Planning and Mitigating Audit Risk

IT auditors provide reasonable assurance that business processes and their supporting technology are secure and comply with enterprise policies, standards, and applicable statutory and regulatory mandates.

Author: Blake Curtis
Jack Freund
Blog Post

Achieving Proper Risk Communication

The goal of communication is multifaceted. It is typically expressed as one or more of the following: to inform, to persuade, to request and/or to build relationships.

9 June 2020
Why Patching Is Not Permanent
@ISACA Article

Why Patching Is Not Permanent

Misconfigurations lead to exposed data and can introduce as much risk as unpatched vulnerabilities, if not more. Patching helps reduce the attack surface, especially for the OS. But what about databases?

8 June 2020
Jack Freund
@ISACA Article

Good Risk or Bad Risk?

It is universally understood, at least in theory if not in practice, that life involves risk. Every action we take has some consequence that we, as adults, are conditioned to understand.

8 June 2020
CGETI Certified in the Governance of Enterprise IT
@ISACA Article

Updated CGEIT Job Practice Reflects New Trends and Technologies

As the IT landscape continues to evolve as a result of innovation and new technologies, it is more important than ever for practitioners to stay abreast of up-to-date information.

8 June 2020
Research Report
@ISACA Article

ISACA Research Report Evaluates Threat Landscape and Security Practices

As new security practices are implemented due to the spike in remote work caused by COVID-19, data and information are more critical than ever, especially related to cybersecurity performance.

8 June 2020
Keep Third Party Relationships Effective
@ISACA Article

Keep Third-Party Relationships Effective and Efficient

Organizations rely on third parties to be effective. Yet third parties have access to your networks, host your data, manage transactions on your behalf and possess sensitive information.

8 June 2020
CISA Holders Keep Up With the Industry
@ISACA Article

CISA Holders Keep Up With the Industry

Dusan Zikic started his career as an IT auditor 8 years ago, after graduating from college. He was influenced by 3 mentors who had a positive impact on his professional and personal development and introduced him to ISACA certification...

8 June 2020
What Background Makes a Good DPO?
Blog Post

What Background Makes a Good DPO?

The enactment of the EU General Data Protection Regulation (GDPR) formalized the role of the Data Protection Officer (DPO) role to ensure there was senior leader in the organization who was responsible and accountable for driving the privacy program and upholding the rights of data subjects and their data.

8 June 2020
Jon Brandt
The Nexus Article

Hacking the Experience Requirement

In April 2020, I penned a column titled “Qualifying the Skills Gap” which arose from ISACA’s findings in the State of Cybersecurity 2020, Part 1: Global Update on Workforce Efforts and Resources report and discussed the need to dissect the skills gap.

8 June 2020
Adam Cason
The Nexus Article

Is Your Security Scalable?

The ability to scale infrastructure and systems to match growth rates, increased workloads, market demands and spikes is critical. This has been tested in recent months with the hyper growth of video conferencing platforms such as Zoom and online shopping...

8 June 2020
COVID-19 Response Still Needs Data-driven Decisions
Blog Post

COVID-19 Response Still Needs Data-driven Decisions

Effectively gathering, using, storing and archiving data have become major concerns in all industries. Timely and trustworthy data are critical for effective decision-making since the new coronavirus continues to spread.

5 June 2020
Disruptive Technology and the Role of the Auditor
Blog Post

Disruptive Technology and the Role of the Auditor

Heraclitus said, “The only thing that is constant is change.” This reflects on today’s ever-changing world with disruptive technologies overturning the way organizations were traditionally run.

4 June 2020
#IamISACA: From ISACA to Fly Fishing, I’m All In
Blog Post

#IamISACA: From ISACA to Fly Fishing, I’m All In

I’m not the type to do something half-way. When I take an interest in something, I dive in deep, try to learn all I can and be the best I can be.

3 June 2020
#IamISACA: Playing the Long Game and Making a Difference
Blog Post

#IamISACA: Playing the Long Game and Making a Difference

Many people have a galvanizing moment when they are certain about their career goals. That definitely isn’t what my path in cybersecurity looks like. In fact, I originally majored in vocal performance, but decided after two years of study that my career outlook as an opera theater performer didn’t meet my goals for a stable career and family.

3 June 2020
journal
ISACA Journal Article

Security for Internet of Things Device Manufacturers

The Internet of Things (IoT) has introduced new security risk factors that are unprecedented in scope and scale. Although the recommendations presented here are intended for IoT manufacturers...

Author: Welland Chu
Larry Marks
Blog Post

CCPA’s Impact on Encryption

The California Consumer Privacy Act (CCPA) is having an impact on the security professionals, auditors, managers and boards responsible for ensuring its effective implementation.

2 June 2020
Driving True Empowerment for Security Teams
Blog Post

Driving True Empowerment for Security Teams

Traditional wisdom tells us that organizational commitment is important to the practice of security. Meaning, for an organization to establish and maintain a robust security posture, the organization needs to have what COBIT refers to as the right “tone at the top” – in this case, one that engenders and facilitates security.

1 June 2020
Avinash Kadam
Governance Article

Evaluating Business Service Continuity and Availability Using COBIT 2019

COBIT 2019’s enterprise goal EG06 Business service continuity and availability must be foremost in everyone’s mind today due the ongoing pandemic situation. It is important to identify the critical components that need to be evaluated to assess the preparedness of an organization toward business service continuity and availability.

1 June 2020
Sizing Up COVID-19's Impact on Security Professionals and Their Organizations
Blog Post

Sizing Up COVID-19's Impact on Security Professionals and Their Organizations

Sizing Up COVID-19's Impact on Security Professionals and Their Organizations

29 May 2020
On Respect for the Individual and the Individual’s Data
Blog Post

On Respect for the Individual and the Individual’s Data

Google’s holding company, Alphabet, has been investing in its Verily Life Sciences initiative over the last seven years with the aim of revolutionizing healthcare.

28 May 2020
Phil Zongo
Blog Post

Building a High-Value Cyber Resilience Strategy: Five Essential Tips

The idea of cyber resilience remains a distant dream for many enterprises. Faced with a barrage of high-profile data breaches, most impacting highly respected organizations, some business leaders now harbor deep-seated beliefs that cyber threat actors are undeterrable and cyber resilience...

27 May 2020
#IamISACA: A Gateway to Amazing People and Lasting Relationships
Blog Post

#IamISACA: A Gateway to Amazing People and Lasting Relationships

The thing that always amazes me the most about working so closely with our global community is how alike we all are. When you get the amazing opportunity to see people from every country imaginable working alongside one another...

27 May 2020
journal
ISACA Journal Article

Risk Management Strength and Financial Disclosure Quality

Enterprises are increasingly incorporating risk management functions into their operations. This is usually accomplished by establishing a board-level risk committee, hiring a chief risk officer (CRO) or both.

Authors: Cristina Bailey and Joshua J. Filzen
Mostafa Elghazaly
@ISACA Article

An Introduction to Assessing the Compliance Risk of RPA-Enabled Processes

Robotic process automation (RPA)-enabled environments are quite different from traditional environments supported by the core application’s manual processes and their normal automated application controls.

26 May 2020
Cloud
@ISACA Article

Connecting Cybersecurity and Remote Work

The COVID-19 pandemic has resulted in many organizations shifting to an entirely remote workforce. Remote work better enables people to stay safe while doing their jobs, but being out of the office does present some cybersecurity concerns.

26 May 2020
Cybersecurity Attacks
@ISACA Article

Put an End to Security Attacks by Thinking Like a Hacker

The MITRE ATT&CK Framework is a comprehensive, up-to-date knowledge base of cyberattacker tactics and techniques gathered from actual observation of attacker behavior.

26 May 2020
Audit and Assurance
@ISACA Article

Adapting to Challenging Times With Security Automation

Security attacks are becoming increasingly sophisticated and are growing more aggressive as the pandemic crisis has caused employees to adapt to new methods of working.

26 May 2020
Employing Privacy Frameworks in Uncertain Times
Blog Post

Employing Privacy Frameworks in Uncertain Times

The current global crisis is disrupting and disabling many core business functions. For many, in-office work has transitioned to remote work, requiring virtual conferencing tools and the sharing of sensitive information with a dispersed workforce.

21 May 2020
RA(CI) Light
Blog Post

RA(CI) Light

For decades, IT practitioners have made use of RACI charts. You’ve seen them, those grids that assign roles to tasks or practices. COBIT has had RACI charts in several versions and continues to make use of them in COBIT 2019.

21 May 2020
Brian Gill
Blog Post

A Global Pandemic: Cyber Threats and Remote Employees

COVID-19 changed the lives of nearly everyone in the world in a matter of weeks. From work life to home life, essentially every aspect has been altered in some way.

20 May 2020
#IamISACA: Pursuing Clarity of Thought in a Cluttered World
Blog Post

#IamISACA: Pursuing Clarity of Thought in a Cluttered World

In the frenetic pace of life, it is important that at times we just stop and take a deep breath, clear the mind and refocus our energies on what is important. Being a spouse, parent, volunteer and professional are all important aspects of my life that demand attention and devotion.

20 May 2020
#IamISACA: Why Mentoring Women in Cybersecurity Matters to Me
Blog Post

#IamISACA: Why Mentoring Women in Cybersecurity Matters to Me

My experience as a mentor in a career comeback program for Malaysian women who want to return to the cybersecurity workforce has been very meaningful to me.

20 May 2020
journal
ISACA Journal Article

A Decision Tree to Objectively Determine Policy Compliance

Assuring compliance with policies and regulations is a major stake for organizations that invest significant time and money to avoid the consequences and penalties of noncompliance. Yet answering the simple question of compliance with a policy is more complex than it looks.

Author: David Doret
How I Passed the CISM Exam on the First Attempt
Blog Post

How I Passed the CISM Exam on the First Attempt

In March 2019, I passed ISACA’s CRISC exam and became certified the next month. This achievement motivated me to pursue another ISACA certification – the Certified Information Security Manager (CISM).

19 May 2020
Don’t Get Caught Without Good Governance When the Tide Goes Out
Blog Post

Don’t Get Caught Without Good Governance When the Tide Goes Out

In my many weeks of working from home recently due to the COVID-19 pandemic, I’ve been on regular peer group calls listening to the challenges that my colleagues have dealt with in getting their companies situated to effectively work remotely.

18 May 2020
John E. Jasinski
Governance Article

Brainstorms and Commentary for Using COBIT

This is an exercise in providing creative brainstorm references for using COBIT content to support digital business governance and management activities. It is important to keep in mind that COBIT is a reference model to be used as you see fit. It is the user’s choice as to how to use it—a little or a lot, for comparison or as reference.

18 May 2020
Industry 4.0: Future-Proofing Your Career
Blog Post

Industry 4.0: Future-Proofing Your Career

A panel of cybersecurity, audit, emerging technologies and governance experts shared their perspectives and advice Wednesday at ISACA’s first virtual conference as part of North America CACS 2020.

15 May 2020
Using Network Segmentation to Combat Ransomware
Blog Post

Using Network Segmentation to Combat Ransomware

In the latest ISACA Journal issue, we published a two-part article titled “Avoid Having to Run Somewhere from Ransomware.” The article included a deep dive on what ransomware is, how it infiltrates most systems, our suggestions for the top 10 ways to...

14 May 2020
Podcast
Podcast

Privacy Expectations and Regulatory Complexities

With the growing number of privacy regulations around the world and the growing emphasis on privacy, organizations must protect their customers’ privacy. But what happens when a privacy violation occurs in one country but affects someone in a different country...

14 May 2020
#IamISACA: Defining Our Success Metrics
Blog Post

#IamISACA: Defining Our Success Metrics

Do you believe that where we come from helps us shape our own success? Personally, I do. Actually, I think this has a great deal of impact on what we are able to achieve in life.

13 May 2020
Privacy
ISACA Journal Article

Practical Data Security and Privacy for GDPR and CCPA

With sensitive data residing everywhere and the breach epidemic growing, the need for advanced data security solutions has become even more critical. Compliance with regulations such as the EU General Data Protection Regulation...

Author: Ulf Mattsson
Managing Risk in a Pandemic: Novel Today, Standard Practices Tomorrow
Blog Post

Managing Risk in a Pandemic: Novel Today, Standard Practices Tomorrow

COVID-19, a novel coronavirus, has come as a shock to many across the globe, changing practically every aspect of our functioning daily lives.

12 May 2020
Information Systems
@ISACA Article

Information Systems in the Time of Pandemic

Protecting sensitive data is critical to everyday operations, but rare events such as the recent outbreak of the novel coronavirus can cause organizations to face unique technological challenges.

11 May 2020
Audit and Assurance
@ISACA Article

A Rise in Collaboration Between Internal Audit and IT Is a Welcome Trend

In October 2019, Protiviti and ISACA released the 2019 Global IT Audit Benchmarking Study, for which more than 2,200 internal audit (IA) executives and professionals around the world were surveyed.

11 May 2020
CISA Certified Information Systems
@ISACA Article

CISA Offers Success Across Disciplines

Anamika Roy loves that every day at her job is so different and, though it can be challenging, she gets to see and learn from so many different clients. Ever-changing technology and processes can sometimes present challenges, but that is exactly why Roy finds it so rewarding.

11 May 2020
Sunil Bakshi
@ISACA Article

Cyberhygiene: Going Beyond Dos and Don’ts

The recent barrage of coronavirus advisories by various authorities all have one recommendation in common: maintain personal hygiene until a treatment becomes available. This maxim is true for information security as well.

11 May 2020
Risk Management
@ISACA Article

ISACA Journal Excerpt: How One Organization Is Managing and Evaluating Risk

Rock Holdings, Inc., is a US-based holding company which owns several subsidiary companies including Quicken Loans, the US’s largest mortgage lender.

11 May 2020
CGETI Certified in the Governance of Enterprise IT
@ISACA Article

ISACA Updates CGEIT Certification Exam Content

As the technology environment continues to evolve, it is more important than ever that professionals have the knowledge and skills to strengthen governance at their organizations.

11 May 2020
Cybersecurity
The Nexus Article

Identifying APTs Through Healthy Network Testing

Cybersecurity threats are often perceived as obviously and immediately disruptive to an organization’s operations. But more subtle threats can be equally debilitating.

11 May 2020
Snedaker Susan
Blog Post

As Telehealth Becomes Common, Security Considerations Increasingly Important

The COVID-19 pandemic has changed almost every aspect of our daily lives. What we’re seeing in healthcare today is unprecedented.

8 May 2020
#IamISACA: Finding Mentors Who Value You
Blog Post

#IamISACA: Finding Mentors Who Value You

Throughout my career, I have had a couple managers whom I consider my mentors. One mentor I had is the one who brought me into security. I was a programmer when she approached me one day and asked if I wanted to join her security test team, doing pen testing.

7 May 2020
#IamISACA: Making Lifelong Friends Through Volunteering
Blog Post

#IamISACA: Making Lifelong Friends Through Volunteering

I first became interested in volunteering at ISACA in 1999 when then-London Chapter President Gerry Penfold asked me to update and run the chapter website.

7 May 2020
From “Meh” to an EPIC Career in Cybersecurity
Blog Post

From “Meh” to an EPIC Career in Cybersecurity

If you’ve selected IT as a profession, then you’ve chosen life-long learning as a discipline. Like so many STEM fields, the rate of change and advancement in technology is awe-inspiring. And if you hold or aspire to a leadership position in the cybersecurity profession, then the phenomenon of impostor syndrome comes with the territory.

6 May 2020
Data Rights
ISACA Journal Article

Data Rights: Single vs. Multiple Ownership?

Organizations that are interested in accurate and dependable decision support systems; accurate metrics; descriptive, predictive and prescriptive analytics; cause-and-effect analysis; and/or if the enterprise or business process is data driven...

Author: Patrick I. Offor
Telework Successfully During (And After) the COVID-19 Pandemic
Blog Post

Telework Successfully During (And After) the COVID-19 Pandemic

For state/province/national leaders, coronavirus is forcing a trade-off between public health and privacy as well as balancing the saving of human lives at the cost of temporarily limiting individual liberties.

5 May 2020
Shannon Donahue
Blog Post

CDPSE Credential Calls Attention to Need for Technical Privacy Professionals

ISACA recently opened its early-adoption opportunity for its new Certified Data Privacy Solutions Engineer (CDPSE) certification. CDPSE is the latest in ISACA’s well-respected line of credentials and offers a unique certification opportunity to professionals who participate in the design...

4 May 2020
Peter C. Tessin
Governance Article

COBIT Tool Kit Enhancements

The COBIT Tool Kit has a number of resources to aid practitioners, including an overview, an executive summary, frequently asked questions (FAQs), a listing of the governance and management objectives in spreadsheet format, and more.

4 May 2020
#IamISACA: Innovating and Being a Change Agent in an Amazing Technological World
Blog Post

#IamISACA: Innovating and Being a Change Agent in an Amazing Technological World

The start-up has changed my life. The day before my wedding, one of our clients at the company I had worked for at the time experienced an important security incident.

1 May 2020
#IamISACA: Looking on the Bright Side of Life
Blog Post

#IamISACA: Looking on the Bright Side of Life

There are a lot of causes of stress for those of us working in the security industry. For me, the biggest concern is that a lot of decision-makers are unaware of the consequences that can be caused by inadequate budgeting or investment in security, especially in industries where the consequences can be the loss of human lives.

1 May 2020
Utilize IT Governance for Stronger Enterprise Alignment
Blog Post

Utilize IT Governance for Stronger Enterprise Alignment

Ineffective governance has a substantial impact on business alignment and risk management. Malformed alignment can result in improper identification of sensitive data, critical services and substandard security controls.

1 May 2020
Baybeck David
Blog Post

Celebrating a Milestone While Transforming ISACA for the Next 50 Years

ISACA Board Chair Brennan P. Baybeck and ISACA CEO David Samuelson recently had a conversation about ISACA reaching its 50-year anniversary in 2019 and how that milestone inspired the organization to reach even greater heights in the future.

30 April 2020
Managing Your Career in Strange Times: Five Steps to Take Now
Blog Post

Managing Your Career in Strange Times: Five Steps to Take Now

There is no crystal ball right now. For business, work, our lives, the world – these are unprecedented times. How should we be thinking about career management right now?

30 April 2020
ISACA Journal volume 3
ISACA Journal Article

Human Error: A Vastly Underestimated Risk in Digital Transformation Technology

There should be no doubt that digital transformation is an organizational necessity performed in the interest of maintaining, sustaining and enhancing an enterprise’s relevance to its constituents.

Author: Guy Pearce
ISACA Journal volume 3
ISACA Journal Article

Communicating Technology Risk to Nontechnical People: Helping Enterprises Understand Bad Outcomes

Too often, well-meaning technology professionals attempt to explain risk to their enterprises and fail to achieve their objective. These professionals fully understand the state of the computing environment and the importance of securing it.

Author: Jack Freund
Building a Rock-Solid ERM Culture on FAIR
ISACA Journal Article

Case Study: Building a Rock-Solid ERM Culture on FAIR

Rock Holdings, Inc., is a US-based holding company which owns several subsidiary companies including Quicken Loans, the US’s largest mortgage lender.

Authors: Dan Blum and Keith Weinbaum
ISACA Journal volume 3
ISACA Journal Article

Information Security Matters: CISOs in the Cloud

Here is an unoriginal observation: The Cloud changes everything. Oh, wait, that was the Internet. Whatever. It seems that if it is novel, it changes everything. So the Cloud makes most of us information security professionals unnecessary.

Author: Steven J. Ross
ISACA Journal volume 3
ISACA Journal Article

IS Audit Basics: In Defense of Privacy by Design

In a couple of recent editions of the ISACA Journal (referred to as columns one and two herein), my fellow columnist, Steven J. Ross, made a case whereby he believes that, contrary to the EU General Data Protection Regulation...

Author: Ian Cooke
ISACA Journal volume 3
ISACA Journal Article

The Bleeding Edge: The Patter of Emerging Technologies

The idea that we are all connected via some ethereal or other unknown plane is a belief held by metaphysical enthusiasts and religions all around the world. There is something to be said about the interconnectivity of the human spirit and experience.

Author: Dustin Brewer
ISACA Journal volume 3
ISACA Journal Article

Innovation Governance: Massive Automation to Reduce Human Risk

Even in large organizations, it is not unusual to find controls that still involve a great deal of manual effort. In fact, evidence for an attestation may be entirely generated by someone taking screenshots.

Author: K. Brian Kelley
ISACA Journal volume 3
ISACA Journal Article

The Practical Aspect: The Human Elements of Risk

In classical Greek mythology, Daedalus was helplessly watching Icarus, his son, fall to his death. Daedalus, having designed the Minotaur’s Labyrinth, was imprisoned.

Authors: Vasant Raval and Rajesh Sharma
ISACA Journal volume 3
ISACA Journal Article

How to Balance Insider Threats and Employee Privacy

Recent headlines are replete with extremely costly and disruptive examples of insider threats playing a prominent role in high-profile data breaches.

Author: Isaac Kohen
ISACA Journal volume 3
ISACA Journal Article

Addressing Key Pain Points to Develop a Mature Third-Party Risk Management

Third-party risk management is high on the boardroom’s agenda. The business ecosystem is heavily dependent on third-party relationships, and with this dependence comes a responsibility to manage risk.

Authors: Visveshwar Ramasubramaniam and Anil Kumar Singh
ISACA Journal volume 3
ISACA Journal Article

Managing Technology Risk to Protect Privacy and Confidentiality

Enterprises must deal with a large and constantly growing volume of data, and they require the capacity to manipulate and process this information while protecting data sources.

Author: Thiago de Oliveira Teodoro
Podcast
Podcast

Information Systems in the Time of Pandemic

Many organizations found themselves unprepared for the workplace and business disruptions caused by COVID-19. But it is possible for organizations to act now to protect their information systems.

30 April 2020
audit and assurance
@ISACA Article

CISA, CRISC and CISM Named Top Paying IT Certifications

Information security is imperative to every enterprise, with high visibility at the board level. Security practitioners who invest in valuable certifications are important assets and rewarded accordingly.

29 April 2020
Elevate Your Career
@ISACA Article

Earn CPE for Free and Elevate Your Career as an ISACA Member

ISACA members have access to many valuable discounts and perks through ISACA’s benefit program. Educational, professional and cost-saving resources provide members with competitive industry advantages.

29 April 2020
Insider Risk
@ISACA Article

Insider Risk: Managing the Delicate Balance

As more and more organizations make the shift to digital, often remote, workplaces, malpractice such as IP theft and codes of conduct violations poses a heightened threat.

29 April 2020
Bruce R. Wilkins
@ISACA Article

Just Browsing

One of the most misunderstood applications we use in the connected environment is the web browser, or simply, the browser. I often hear browsers called by many different names such as Google, the web or “how I get on the line.”

29 April 2020
Digital Security
@ISACA Article

The Role of the CISO and the Digital Security Landscape

Every organization has a different perception of what digital security is—and what it is not. This can create confusion about which position is responsible and accountable for digital security.

29 April 2020
Privacy professionals
@ISACA Article

Using Security Practices and Compliance Requirements to Protect Data

Because of recent technological innovations and the relatively low cost of data storage, the volume of data organizations accumulate has skyrocketed. As a result, there is now more information that needs to be protected.

29 April 2020
I am ISACA
@ISACA Article

Passion of the ISACA Community Brought to Life in #IamISACA Series

ISACA members safeguard their organizations’ most precious assets, get involved with enterprise risk management, and provide governance and assurance over how organizations leverage their technology.

29 April 2020
Managing Our Ever-Growing Data Requires Empowering Users
Blog Post

Managing Our Ever-Growing Data Requires Empowering Users

As data costs have decreased, data retention and complexity have grown. Organizations have identified the need to capture data and retain it in response to legislation, regulation and opportunity. Has the value of our data increased relative to the growth in data volume?

29 April 2020
ISACA Journal
ISACA Journal Article

Why Was There No Warning? Risk Management

Risk management is an old discipline. As such, some tend to underestimate its importance until something bad happens or a crisis is triggered. And COVID-19 brings up risk management again as a trending topic.

Author: Ramón Serres
Security in the Smart Home
Blog Post

Security in the Smart Home

Tech companies have pushed smart home devices and technologies for years. And while we’ve finally reached a point where smart solutions are considered mainstream, we haven’t quite reached total adoption.

28 April 2020
The New Normal: GDPR and Audit
Blog Post

The New Normal: GDPR and Audit

I am writing this blog under COVID-19 lockdown on the eve of my 25th wedding anniversary. Besides feeling somewhat guilty that I am at home while others are out in the frontline, working from home has left me more time to contemplate this milestone as, well, there is no commute and no colleagues to gossip with at the water cooler or when grabbing a coffee.

27 April 2020
K. Harisaiprasad
Governance Article

COBIT 2019 and COBIT 5 Comparison

COBIT is a broad and comprehensive framework that has been developed to support understanding, designing and implementing the management and governance of enterprise IT (EGIT).

27 April 2020
IT Professionals Make Important Privacy Partners
Blog Post

IT Professionals Make Important Privacy Partners

When asked to describe my responsibilities as a chief privacy officer, I often say my primary function is to be an advocate for the individuals whose personal data my organization collects, maintains and processes.

24 April 2020
Podcast
Podcast

Cybersecurity Considerations for Remote Work

As a result of the COVID-19 pandemic, many organizations are now trying to manage having an entirely remote workforce. While remote work can allow people to stay safe while doing their jobs, there are some cybersecurity concerns associated with remote work.

24 April 2020
Headshot of Josh Hamit
Blog Post

CISM ‘A Natural Fit’ for My Career in Information Security Management

Josh Hamit, vice president, chief information officer at Altra Federal Credit Union, was among a recent set of professionals achieving Certified Information Security Manager (CISM) who helped CISM surpass the milestone of 50,000 certification-holders since its inception.

23 April 2020
Communicating the Value of IT Governance
Blog Post

Communicating the Value of IT Governance

A network patch management tool to be procured is often seen mainly as an expense by the finance department, and therefore queried subjectively or even rejected.

22 April 2020
Five Organizational Cybersecurity Dangers Amplified by COVID-19
Blog Post

Five Organizational Cybersecurity Dangers Amplified by COVID-19

The global pandemic has impacted businesses on an unprecedented level. Only in a handful of instances in the past 100 years have companies and organizations been forced to such extremes to maintain business operations.

21 April 2020
Thank you, ISACA Volunteers!
Blog Post

Thank you, ISACA Volunteers!

ISACA Volunteer Appreciation Week is once again upon us (19-25 April 2020), and we take a moment to reflect on the advancements ISACA has made in the last year thanks to the expertise and dedication of thousands of dedicated volunteers.

20 April 2020
Nader Qaimari
Blog Post

A Needed Wakeup Call for Online School Safety

Right now, as millions of kids all over the world are in the midst of crisis learning done digitally, we are creating the perfect cybersecurity storm. Think about it. While many parents are also working at home, they hardly have the time to conduct their own work, let alone watch over their kids as they do everything online.

16 April 2020
Dave Bowden
Blog Post

Adding Value to the Organization By Bridging the Privacy Gap

Dave Bowden, CISM, CIPT, CIPM, PMP, CSM, VP - Information Security, Data Privacy, Compliance & Information Technology, Zwift, Inc., and a member of ISACA’s privacy advisory group, recently visited with ISACA Now to discuss the state of the privacy field and how different stakeholders in an organization can come together to create comprehensive privacy solutions.

16 April 2020
ISACA Board Directors
@ISACA Article

ISACA Welcomes Incoming 2020-21 Board Directors

As part of a multiyear effort to improve our board governance and impact, ISACA has recruited expertise to serve on the board and help ISACA reach new heights. The mix of ISACA global and chapter leadership expertise plus the leadership and industry expertise of the new board directors will bring valuable and diverse perspectives that will make ISACA even better.

15 April 2020
Careers
@ISACA Article

Stand Out as a Job Seeker by Improving Your Resume

Though qualified IT talent is in high demand, job seekers must make a strong first impression. Part of that impression is a strong resume that captures the attention of hiring managers.

15 April 2020
Ransomware
@ISACA Article

Addressing Ransomware and Malware Threats

Ransomware and malware can be incredibly detrimental to organizations, and malware seems to be on the rise. Organizations must understand how to combat ransomware and advanced malware.

15 April 2020
Managing Remote Work Environments With COBIT 2019
@ISACA Article

Connect With Others and Learn in a Virtual Community

With so many people working from home and maintaining a physical distance during this global health crisis, it is easy to feel disconnected or isolated.

15 April 2020
Lisa Young
@ISACA Article

Tips for Setting or Evaluating Risk Appetite

At an enterprise level, risk management is about achieving strategic objectives and creating value, all while ensuring that the activities undertaken are neither too risky nor too conservative to achieve the stated outcomes.

15 April 2020
Muhammad Mushfiqur Rahman
@ISACA Article

Proving Your Skills and Advancing Your Career With a CISA

Muhammad Mushfiqur Rahman likes that his job gives him the freedom to execute an audit plan and that management listens to his comments and suggestions and empowers him to establish a plan accordingly.

15 April 2020
CommunITy Day
@ISACA Article

Celebrating ISACA Volunteer Appreciation Week

During ISACA Volunteer Appreciation Week (19-25 April), the ISACA staff and leadership will extend their appreciation for the many volunteers who selflessly contribute their time and efforts to advancing information technology for ISACA members and the global community

15 April 2020
#IamISACA: An Introvert Networks Her Way to a New Career
Blog Post

#IamISACA: An Introvert Networks Her Way to a New Career

As a self-proclaimed introvert, Lisa DiNezza often has shied away from professional networking and seeking mentors.

13 April 2020
#IamISACA: Connecting Across the Globe
Blog Post

#IamISACA: Connecting Across the Globe

Ramona Ratiu says it is “absolutely amazing” how the challenges faced by security professionals are so similar no matter where in the world people are located.

13 April 2020
#IamISACA: Early Involvement Paying Dividends in My Career
Blog Post

#IamISACA: Early Involvement Paying Dividends in My Career

If it had not been for Scott Moody, I would have never gotten this far in my career.

13 April 2020
#IamISACA: Embracing My Underdog Journey
Blog Post

#IamISACA: Embracing My Underdog Journey

In 2017, I was invited to Chicago to receive the Michael Cangemi Best Article/Book Award, one of ISACA’s highest global honors that recognizes major contributions to the field of IS audit, security and governance publications.

13 April 2020
#IamISACA: Finding Balance in the Wild
Blog Post

#IamISACA: Finding Balance in the Wild

Photography is an art form – it takes creativity, imagination and an eye for detail. I really enjoy it, and I especially love wildlife photography.

13 April 2020
#IamISACA: No Quenching My Adventurous Spirit
Blog Post

#IamISACA: No Quenching My Adventurous Spirit

Before I became an IT auditor, I spent seven years traveling and during that time I got shot twice, once in El Salvador and once in Chicago. I laugh about it now, but I wasn’t laughing about the experience at the time, and it did change my outlook on life.

13 April 2020
#IamISACA: On the Frontlines of Change
Blog Post

#IamISACA: On the Frontlines of Change

Establishing my career in IT risk and assurance as a Jordanian woman has been a fascinating journey.

13 April 2020
#IamISACA: Pivoting to My Passion
Blog Post

#IamISACA: Pivoting to My Passion

The cybersecurity training program through SheLeadsTech, AnitaB.org and City Tech is the reason why I’m in the position that I’m in right now. It really solidified this is the industry that I want to work in.

13 April 2020
#IamISACA: Security a Multigenerational Family Passion
Blog Post

#IamISACA: Security a Multigenerational Family Passion

Naganat Guru’s fascination with security has made an impression on his children, who are now following their owns paths in the field.

13 April 2020
#IamISACA: Upskilling and Getting Uncomfortable to Get to the Next Level
Blog Post

#IamISACA: Upskilling and Getting Uncomfortable to Get to the Next Level

I’ve been in security for about 14 years. I started my career in help desk, moved up to desktop support, then server support, built a help desk team and security team, and here I am now.

13 April 2020
Governance
Governance Article

How COBIT 2019 Supports the Brazilian GDPR

The General Personal Data Protection Act (LGPD) is the Brazilian law that regulates the processing of personal data. It was sanctioned on 14 August 2018 and entered into force 18 months after its publication.

13 April 2020
Jon Brandt
The Nexus Article

Qualifying the Skills Gap

In February 2020, ISACA released its State of Cybersecurity 2020, Part 1: Global Update on Workforce Efforts and Resources report. This paper reports on data collected in Q4 2019, and it is similar to the series of reports on the state of cybersecurity issued by ISACA on an annual basis.

13 April 2020
Adam Cason
The Nexus Article

Why Cryptographic Infrastructures Require High Availability

In today’s 24/7, hyperconnected world, system failures are simply not an option. Modern society depends on unbroken connectivity, and one of the most critical services requiring high availability is cryptographic infrastructure.

13 April 2020
Incoming Board of Directors Highlights ISACA’s Transformation
Blog Post

Incoming Board of Directors Highlights ISACA’s Transformation

In our 50th anniversary year last year, we took stock of ISACA as an organization—what was going well and what we could do better as we strive to be a modern association dedicated to providing world-class learning, membership and enterprise services to our growing community.

10 April 2020
Powerful WordPress Security Tips to Protect Your Site
Blog Post

Powerful WordPress Security Tips to Protect Your Site

WordPress is, without a doubt, the most popular content management system on the web. But this also means it’s one of the most frequently targeted content management systems around. This means cybersecurity is of the utmost importance for people and businesses with WordPress websites.

9 April 2020
Data
ISACA Journal Article

The California Consumer Privacy Act and Encryption: Theory, Practice, Risk Assessment and Risk Mitigation

The US State of California Consumer Privacy Act of 2018 (CCPA) will have an impact on security professionals, auditors, managers and boards responsible for ensuring its effective implementation.

Author: Larry Marks
Organizational Cybermaturity Comes to the Forefront During COVID-19
Blog Post

Organizational Cybermaturity Comes to the Forefront During COVID-19

The worldwide pandemic has touched everyone at different levels. Across the globe, people are taking additional steps and implementing new routines into their daily lives in order to help slow the spread of the coronavirus. 

7 April 2020
How COBIT® 2019 Can Help Businesses Thrive in Uncertain Times
Blog Post

How COBIT® 2019 Can Help Businesses Thrive in Uncertain Times

With the current world health crisis, more organizations are making the shift to remote working environments for their employees. At ISACA, we are living this today as ISACA’s office is closed and all staff are working remotely.

6 April 2020
Privacy and Respect Under COVID-19
Blog Post

Privacy and Respect Under COVID-19

Many actions have been taken to address the COVID-19 pandemic. Some involve penalties for the spread of misinformation in Bosnia and Herzegovina, the derogation of some human rights in an emergency in Romania, Armenia and Latvia and companies like Palantir and Clearview AI negotiating partnerships with US state agencies for infection monitoring by surveillance, geolocation and facial recognition.

3 April 2020
Engaging ISACA’s Community Virtually
Blog Post

Engaging ISACA’s Community Virtually

Being part of ISACA’s professional community offers not only networking, career advancement and continuing education but also personal relationships, inspirational leaders and mentors. As social distancing has become a global reality for us all at least temporarily, it is more important than ever to focus on the people in our community...

2 April 2020
CDPSE Certified Data Privacy Solutions Engineer logo
@ISACA Article

New Certification Coming Soon: Certified Data Privacy Solutions Engineer

According to Indeed.com, the number of job postings on its website with the terms “data privacy” or “data protection” in their titles has increased by 75% in the last 4 years.

1 April 2020
John P. Pironti
@ISACA Article

Five Key Considerations When Adopting a Zero-Trust Security Architecture

A zero-trust security architecture approach is based on the premise that organizations should not inherently trust any systems that connect to or interact with their technical infrastructure and/or networks without verification and validation of their need to connect and an inspection of their security posture and capabilities.

1 April 2020
Cloud Access
@ISACA Article

Managing Privileged Cloud Access

Organizations often store petabytes of user and consumer data on cloud services, and compliance requirements have made it essential that organizations effectively manage privileged access on these systems.

1 April 2020
Fargo Chapter
@ISACA Article

ISACA’s Newest Chapter: Fargo

New ISACA chapters are established to build and expand communities of IT individuals who want to share best practices, provide local continuing professional education (CPE) opportunities, and to promote the value of ISACA certifications. ISACA is excited to announce the formation of the Fargo (North Dakota, USA) Chapter.

1 April 2020
Person in front of laptop
@ISACA Article

Register Now to Take an ISACA Certification Exam From Your Own Home

Because the unprecedented COVID-19 pandemic has shut down test centers in areas across the world, ISACA and PSI, its exam partner, will be offering live remote proctoring of the CISA, CRISC, CISM, and CGEIT certification exams by the end of April 2020.

1 April 2020
ISACA
ISACA Journal Article

Data Ownership: Considerations for Risk Management

There is no easy answer to the question of who owns data. Indeed, debates about the subject tend to be theoretical. Depending on the situation, the possessor, the user, the creator and the subject of the data could all claim ownership, and sorting it out can pose logistical, technological and even ethical challenges.

Author: Kevin M. Alvero
Location, Organizational Culture Make an Impact When Addressing Privacy Regulations
Blog Post

Location, Organizational Culture Make an Impact When Addressing Privacy Regulations

25 May 2018 came and went. So did 1 January 2020. And businesses around the world didn’t stop (although the current COVID-19 pandemic has certainly presented new challenges). What GDPR did was push organizations across the world to think more, think large and hold themselves accountable. That might seem like old news.

31 March 2020
Podcast
Podcast

Understanding and Addressing CISO Burnout

A recent survey found that 90 percent of CISOs would take a pay cut if it meant better work/life balance. There are many reasons for CISO burnout, and a broader cultural shift is needed to combat the excessive pressure put on CISOs. In this podcast episode, Dustin Brewer and Frank Downs discuss the reasons for CISO burnout, why it is a problem and how it can be addressed.

31 March 2020
MD-with-Cobit2019-authors
Governance Article

Managing Remote Work Environments With COBIT 2019

More organizations are making the shift to remote working environments for their employees due to the current world health crisis. Those organizations and the personnel responsible for security, infrastructure, risk and governance may need guidance.

30 March 2020
What Do You Think About When You Hear the Words “Cybersecurity” and “Breaches”?
Blog Post

What Do You Think About When You Hear the Words “Cybersecurity” and “Breaches”?

Cybersecurity refers to the technologies and processes implemented to help protect computers and networks from unauthorized access or attacks. A breach is an incident in which confidential information is viewed, stolen or utilized by an unauthorized individual.

27 March 2020
Learning is Evolving, Whether We Like it or Not. So Is ISACA.
Blog Post

Learning is Evolving, Whether We Like it or Not. So Is ISACA.

No doubt, these are challenging times. Aside from dealing with all the stress at home, where those of us with kids are seeing them face anxiety adjusting to a normal they were never prepared for, we also, as adults, are learning to work differently.

26 March 2020
Journal 2020 volume 2
ISACA Journal Article

Information Security Matters: Information Systems in the Time of Flu

I am not in the public health field either, so if you are concerned about the ability of doctors and hospitals to withstand the surge of demand that a pandemic will bring, speak with your local medical authorities.

Author: Steven J. Ross
Securing Citizens’ Data in an Era of Connected Societies
Blog Post

Securing Citizens’ Data in an Era of Connected Societies

Southeast Asia has some of the biggest cities in the world, such as Manila, Jakarta and Bangkok, with close to 47% of the local population living in cities. As governments strive to build future cities, where infrastructure and public delivery are connected and seamlessly enabled by digital advancement...

25 March 2020
Five Steps to Realize Your Data-Driven Digital Transformation Strategy
Blog Post

Five Steps to Realize Your Data-Driven Digital Transformation Strategy

In today’s “data is the new oil” era, no one can say an organization is able to achieve digital transformation without data. Executives and even the board level are talking about data-driven business strategy when they develop business objectives and goals.

24 March 2020
The Importance of Preparing for a Ransomware Attack Hits Close to Home
Blog Post

The Importance of Preparing for a Ransomware Attack Hits Close to Home

As a cybersecurity professional, I work with organizations every day to enhance the various aspects of their cybersecurity programs, from foundational capabilities such as data classification to more tactical functions like incident response. I’ve seen the real-world impacts that various types of attacks have on an organization and the efforts that go into recovery.

19 March 2020
State of Cybersecurity
@ISACA Article

Cybersecurity Survey Results Reveal Hiring Struggles Persist, More Diversity Progress Needed

ISACA recently released part 1 of its State of Cybersecurity 2020 survey report, which found that cybersecurity teams are still struggling with hiring and retention, with very little improvement from last year.

18 March 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Best Practices for Privacy Audits

When the EU General Data Protection Regulation (GDPR) rolled out in May 2018, the first questions many asked were, “What is the difference between privacy and security? Is there a different way of assessing privacy and security?”

18 March 2020
Extreme Adventuring
@ISACA Article

Applying Extreme Adventuring Principles to a Business Context

Climbing Mount Everest and the workplace challenges IT professionals experience daily may not initially seem similar, but there are valuable lessons from extreme adventuring that can apply in a career context.

18 March 2020
Jan Anisimowicz
@ISACA Article

Certification as a Path to Pursuing New Interests and Finding a Like-Minded Community

When Jan Anisimowicz, director of audit, risk and compliance at C&F Sp. z o. o., initially pursued the Certified Information Security Manager (CISM) certification, he did not know it would give him the opportunities to extensively travel around the world and discover new hobbies.

18 March 2020
Ookeditse Kamau
Blog Post

Building A Governance System: A Review of Information Flow and Items Component

The COBIT 2019 framework defines seven components of a governance system that individually and collectively contribute to the good operations of the enterprise system over information and technology. Among those components is information flow.

17 March 2020
Organizational Security Spending Trending Toward Services
Blog Post

Organizational Security Spending Trending Toward Services

Since the emergence of information security online, organizations have poured millions of dollars into products promising to increase speed of incident recognition, response times and overall operational efficiencies. To a certain extent, the idea that automation and enablement work hand-in-hand has proved out over the past several decades.

12 March 2020
Learning From Technology’s Past
Blog Post

Learning From Technology’s Past

When I think of technological progress, in a lot of cases we are seeing new views and takes on existing ideas. Ideas keep coming back around, just like “The Song That Doesn’t End.”

11 March 2020
Ssalar Atrizadeh
The Nexus Article

The CCPA Impact Privacy and Cybersecurity Guideline

The US State of California state legislature enacted the California Consumer Privacy Act (CCPA) on 1 January 2020 through Assembly Bill 375 (AB 375), with additional amendments that were passed through Senate Bill 1121 (SB 1121). The CCPA refers to consumers in its language, which by definition includes employees.

9 March 2020
Robert Brzezinski
The Nexus Article

Vision or Visibility?

When speaking about IT or cybersecurity, I often come across the strategy/vision or visibility challenge—what comes first? It is almost a chicken or egg question and, while I believe we can develop the vision for IT/cybersecurity without the visibility into current environment, the question becomes: Can we “sell” that vision to decision-makers?

9 March 2020
We Need More Women Working in AI
Blog Post

We Need More Women Working in AI

A study by the World Economic Forum and LinkedIn found that only 22 percent of AI professionals are women. Research by the AI Now Institute found that women make up only 15 percent of the AI research staff at Facebook and only 10 percent at Google

6 March 2020
A Look Back at RSA 2020 Conference leadership and careers
Blog Post

A Look Back at RSA 2020 Conference: ISACA Attendees Share Their Takeaways and Tips

Several ISACA experts attended the RSA 2020 Conference last week in San Francisco, California, and took advantage of the wealth of onsite sessions and opportunities to meet with others in the tech community. A few shared some reflections from the conference with ISACA Now—both around industry trends and takeaways, and about the first-timer’s overall conference experience.

5 March 2020
In It Together: Expert Advice on Creating Strong Teams at RSA Leadership and Careers
Blog Post

In It Together: Expert Advice on Creating Strong Teams at RSA

ISACA’s recently released 2020 State of Cybersecurity survey report revealed some sobering findings around hiring and retention for cybersecurity teams.

5 March 2020
Blockchain
@ISACA Article

Learn Blockchain Basics and Apply Your Skills

Blockchain is a powerful resource to increase the integrity of data, but it is important that security teams fully understand it before using it. To help cybersecurity practitioners better understand blockchain, ISACA’s Cybersecurity Nexus™ (CSX) is offering the CSX Blockchain Basics Course.

4 March 2020
Type Mismatch Error
@ISACA Article

Type-Mismatch Error

In programming, one common error encountered is a type-mismatch error (different compilers may call it different things). Space must be allocated to store data in variables, and the way this is done is by defining the type of variable it is.

4 March 2020
Data Governance
@ISACA Article

Improving Data Governance and Management Processes

Data are one of an organization’s most valuable assets. Because of the value of data, it is imperative that organizations have a strong data governance program that aligns with the organization’s business objectives.

4 March 2020
Information Security
@ISACA Article

New ISACA Journal Column Focuses on Emerging Technology

Keeping pace with cutting-edge technology is a challenge for most governance, audit, risk and information security professionals. The technology landscape and, therefore, the risk landscape are constantly evolving.

4 March 2020
risk
@ISACA Article

Leveraging Audits to Address Third-Party Risk

With the growing number of services consumers expect, many organizations are turning to outsourcing. Leveraging third parties can help enterprises lower their costs and benefit from specialized knowledge and skills that may not exist within the organization.

4 March 2020
ISACA
@ISACA Article

ISACA’s Newest Chapter: Rwanda

To help IS audit, governance, risk and security professionals in Rwanda better acquire and share knowledge, a new ISACA® chapter has been formed in Rwanda. Prior to the formation of this chapter, those looking to participate in chapter activities had to travel out of the country.

4 March 2020
Evaluating Security Incident Management Programs
Blog Post

Evaluating Security Incident Management Programs

The dynamic operational landscape that is created as businesses drive competitive advantage through technology renders a static risk management program ineffective. As enterprises innovate, information technology groups are challenged with revisiting the suitability of architecture, security platforms and/or software deployment to meet business-driven changes.

4 March 2020
aligning Coso and privacy
ISACA Journal Article

Aligning COSO and Privacy Frameworks to Manage Privacy in a Post-GDPR World

There is one constant in the data privacy landscape: change. The EU General Data Protection Regulation (GDPR) was adopted in 2016 to protect the personal data of EU citizens and harmonize data privacy laws across EU member states. Since then, data privacy has become a growing concern for boards of directors (BoDs).

Authors: Donel Martinez and Joshua Marks
Susan Snedaker
Blog Post

Business Continuity – Pandemic Preparation

The recent outbreak of a new virus, COVID-19, or the coronavirus, has many businesses scrambling to develop or review their business continuity plans. While there is much unknown about COVID-19 and whether it will turn into a pandemic, there are many things business can do today to ensure their businesses continue to operate if it does occur.

3 March 2020
A Compliance-First Mentality Increases Enterprise Risk
Blog Post

A Compliance-First Mentality Increases Enterprise Risk

Risk, in the context of cybersecurity, constantly looms in the minds of all information security professionals. From the introductory IT help desk professional to the seasoned chief information and security officers, threats, and their potential impact, can cause serious concern and stress if they remain unknown variables.

17 February 2020
Innovating IT Audit To Keep Up With New Technologies
Blog Post

Innovating IT Audit To Keep Up With New Technologies

IT is continuing to progress. Personal and business computing solutions are increasingly elaborate and far-reaching. And concepts such as the Internet of Things (IoT), machine learning (ML) and artificial intelligence (AI) have begun to be applied in a practical way.

28 February 2020
Journal 2020 volume 2
ISACA Journal Article

How Internal Audit Can Help Capture Value in Robotic Process Automation Projects

A fundamental value proposition of robotic process automation (RPA) is its ability to reduce time spent on repetitive, rule-based tasks, thereby freeing up precious time that can be allotted to more value-added work. However, a survey of 1,000 US information...

Authors: Kevin M. Alvero and Kevin McCarthy
Audit and Assurance
ISACA Journal Article

Auditing Emerging Technologies: Facing New-Age Challenges

With unprecedented advances in information technology, audit professionals need to gear up to face the challenge of auditing emerging technologies. Auditors need to learn and understand new skills and acquire knowledge related to predictive analytics...

Author: Muhammad Asif Qureshi
Journal 2020 volume 2
ISACA Journal Article

Whose Data Is It Anyway?

Beyond the privacy concerns expressed about organizations such as Facebook and Google, the next wave of data privacy issues is fueling the white-hot inferno that resulted in the globally significant and influential regulation of the EU General Data Protection...

Authors: Guy Pearce and Sandra Ketchen
Journal 2020 volume 2
ISACA Journal Article

Information Security Matters: Amber Heard’s Privacy

Evidently, Amber Heard is an actress in Hollywood. I say “evidently” because I have never seen any of her films or television shows. I first became aware of Ms. Heard when she published an article in The New York Times concerning nonconsensual...

Author: Steven J. Ross
Journal 2020 volume 2
ISACA Journal Article

IS Audit Basics: Incorporating the GDPR Into IT Audits

It is now almost two years since the EU General Data Protection Regulation (GDPR) was enacted. Since then, a lot has been written about the regulation. Indeed, a quick Google search produces about 486,000,000 results. Given the elapsed time since it came...

Author: Ian Cooke
Journal 2020 volume 2
ISACA Journal Article

The Bleeding Edge: Blockchain: Love It or Hate It, It’s Here

I have noticed that the mere mention of the word “blockchain” elicits a myriad of responses among groups of IT security professionals. I find that some individuals roll their eyes, murmuring disapproving phrases such as, “It’s just a glorified database.”

Author: Dustin Brewer
Journal 2020 volume 2
ISACA Journal Article

The Practical Aspect: Organizational RPA Adoption and Internal Auditing

Robotic process automation (RPA) adoption is a gateway for the internal audit function to contribute more to the organization. RPA adoption extends the insights of internal auditors in business processes to help innovate new or modified processes to...

Authors: Vasant Raval and Erica Smith
Journal 2020 volume 2
ISACA Journal Article

Healthcare Organizations’ Compliance With the CCPA

The California Consumer Privacy Act (CCPA) is the first piece of legislation in the US to emulate the EU General Data Protection Regulation (GDPR) and be enacted into law. The CCPA is a milestone in what is likely to become a new era of data privacy...

Authors: Louise Rains Gomez and Thomas Hiney
Journal 2020 volume 2
ISACA Journal Article

Assessing the Risk of Cyberattacks in the Online Gaming Industry: A Data Mining Approach

Malicious hackers employ distributed denial of service (DDoS) attacks to disrupt business by preventing legitimate users from accessing organizations’ websites. In 2018, the direct and indirect losses caused by a single DDoS attack ranged from US$120,000 to US$2 million.

Authors: Kalpit Sharma and Arunabha Mukhopadhyay
Journal 2020 volume 2
ISACA Journal Article

Plan for Successful System Implementations

Organizations need to constantly assess their systems landscape and identify projects that meet business needs and add value to the enterprise. Information technology departments play a crucial role when implementing systems...

Author: Hashim Seedat
HelpSource
ISACA Journal Article

HelpSource Q&A

Question: Is there any standard or framework for managing IT vendors? What best practices should we adopt to effectively manage vendors?

Author: Sunil Bakshi
Three Essentials To Thrive in a High Pressure CISO Role
Blog Post

Three Essentials To Thrive in a High Pressure CISO Role

A recent Ponemon Institute report predicted that the role of the chief information security officer (CISO) will continue to rise in significance. This is underpinned by the growing realization by executives that just one serious security incident or data breach could derail the growth and profitability of their companies because of impact to brand and the cost to remediate, the incurring of fines and legal fees, and/or customer lo

27 February 2020
Differentiating Key Terms in the Information Security Hierarchy
Blog Post

Differentiating Key Terms in the Information Security Hierarchy

The following terms may be familiar, but they can be used incorrectly. Many of these will be referred to as “policies,” even if that’s not what they truly represent. Having a better understanding of these terms enables your organization to create better governance documentation.

26 February 2020
The Growing Role of Cybersecurity Disclosures
ISACA Journal Article

The Growing Role of Cybersecurity Disclosures

Yahoo Inc. was fined a US$35 million penalty for failing to disclose one of the largest data breaches in the world, in which hackers captured the personal data of millions of user accounts. The failure to disclose the breach misled investors.

Authors: Jacob Peng and Gregory Krivacek
Podcast
Podcast

Fear IS OK, But Complacency Will Kill You

Complacency, refusal to deviate from a plan and freezing in stressful situations are harmful in a corporate environment but and can be deadly in an extreme adventuring context. Alison Levine, the first American women's Everest expedition team captain, shares how lessons she learned on Everest can apply in a business context.

26 February 2020
Solving the Cybersecurity Skills Gap Requires a Mindset Change
Blog Post

Solving the Cybersecurity Skills Gap Requires a Mindset Change

ISACA’s State of Cybersecurity 2020 research on hiring and retention requires us to confront a challenging reality: We simply aren’t making enough progress.

24 February 2020
Blog Post

Who and What Are Worthy of Trust?

It has become extraordinarily difficult to distinguish between whom or what you can trust, and who or what is out to get you. Indeed, the 29 December 2019 issue of The New York Times included a section highlighting “A Decade of Distrust,” which featured the following quote from Michiko Kakutani...

20 February 2020
risk
@ISACA Article

Improve Your Third-Party Risk Management Program

Most organizations’ risk management programs have room for improvement, especially when it comes to third-party risk. Understanding third-party risk management best practices can help organizations improve their risk program and reduce their overall risk.

19 February 2020
ISACA Awards
@ISACA Article

ISACA Congratulates 2020 ISACA Award Recipients

ISACA is proud to recognize the outstanding achievements of its individual contributors, chapters and certification exam takers who offer thought leadership, volunteer service and professional contributions that advance ISACA’s purpose and promise.

19 February 2020
ISACA
@ISACA Article

New Logo and Web Experience Mark a New Era for ISACA

As the new decade begins, ISACA is embarking on a new era with a new look: an entirely new website experience and a new logo. The new website provides smoother navigation, improved searching capabilities and greater security.

19 February 2020
Audit and Assurance
@ISACA Article

Share Your Real-World Experience in a Case Study

One of the best ways to advance the governance, audit, risk and information security fields is to share your real-world experience with other professionals in these areas.

19 February 2020
Governance
@ISACA Article

Why Do IT-Related Projects Go Overboard?

IT-related projects are projects with deliverables that use information and related technology. These projects can be new solution implementations, new application software development, business function automation or relate to IT in any other way.

19 February 2020
ISACA Journal volume 3
ISACA Journal Article

Innovation in the IT Audit Process: The IT Semantic Audit Models Audit Segments Using Semantic Graphs

The need for innovation in the IT assurance field is based on evolving requirements for which traditional responses have lagged behind. The ability to have an in-depth understanding of the organization and its changing environment and track its complex technology represents a challenge for IT auditors and IT assurance analysts.

Author: Huáscar Méndez
Digital Transformation: Proper Preparation Prevents Poor Performance
Blog Post

Digital Transformation: Proper Preparation Prevents Poor Performance

Without proper planning, backcountry winter camping in Canada can be deadly. With temperatures that can easily drop below -25 degrees Celsius (-13 degrees Fahrenheit) during polar vortex conditions while you are out there with little more than snowshoes (or backcountry skis), a tent, backpack and a sleeping bag (and enough nutrition to handle minor emergency situations), any mistakes or omissions from your kit...

18 February 2020
Key Touchpoints on the Job Candidate Journey

Key Touchpoints on the Job Candidate Journey

When I work with companies as an executive recruiter, I advise them on how they can improve their recruiting and hiring process by mapping different parts of the candidate journey, and how to make an impact through critical candidate touchpoints.

14 February 2020
Your Audit Reports Have Consequences
Blog Post

Your Audit Reports Have Consequences

A report is defined as a spoken or written description of an event or situation. As such, reports can have positive or sometimes negative impacts upon people or subsequent events. Can you remember the first time your brought back a bad school report to your parents or guardian?

12 February 2020
The NIST Cybersecurity Framework Third Parties Need Not Comply
ISACA Journal Article

The NIST Cybersecurity Framework—Third Parties Need Not Comply

How can an organization make third parties comply with NIST?” This question haunts risk management professionals (and their lawyers) who are familiar with all five functions, 23 categories and 108 subcategories of the Cybersecurity Framework (CSF), published by the US National Institute of Standards and Technology (NIST).

Author: Thea Janeway
Expanding Opportunity in Cybersecurity Through Deeper Collaborations Between Schools, Providers and Employers
Blog Post

Expanding Opportunity in Cybersecurity Through Deeper Collaborations Between Schools, Providers and Employers

Ever since I started working in education, from K-12 to higher ed, and now to the professional sector, I envisioned this transformative trifecta that could lead to the ultimate educational outcome – employability.

10 February 2020
David Smith
The Nexus Article

Cybersecurity Regulations That Impact the Banking Industry

The emergence of cybersecurity many years ago meant that financial services had to adhere to the laws and regulations that came with it. While some industries experienced little disruption from these regulations, the same cannot be said for the global banking industry.

10 February 2020
Jon Brandt
The Nexus Article

Misinformation—A Rapidly Growing Threat to Enterprises

As if the constant defensive posture of protecting digital assets were not enough, we now must question the authenticity of information. Deepfake reporting is on the rise and, just this past month, a popular US television series included deepfake in its storyline.1 Deepfakes are fake multimedia recordings but are usually manifested as video.

10 February 2020
Information Security
The Nexus Article

Share Your Real-World Cybersecurity Experience in a Case Study

One of the best ways to advance the cybersecurity field is to share your real-world experience with other professionals in the industry. Consider sharing your successes, key learnings and business solutions by contributing a case study for publication in the ISACA Journal.

10 February 2020
Making Risk Assessments Relevant
Blog Post

Making Risk Assessments Relevant

Organizations track risk for good reason. Risk is a way of measuring the effects of uncertainty, and the resulting opportunities and potential pitfalls. When risk is measured, it can be managed, and organizations that actively manage risk are better positioned for success, today and in the future.

5 February 2020
Podcast
Podcast

Lessons Learned From the First-Ever Hack

Inventor Guglielmo Marconi, a key contributor to wireless telegraphy, did not want to engage with anyone who criticized his wireless telegraph technology, and he believed it to be completely secure. But in 1903, magician Nevil Maskelyn hacked a wireless telegraph communication.

5 February 2020
New Look Marks a New Era for ISACA
Blog Post

New Look Marks a New Era for ISACA

If you’re a return visitor to the ISACA website, the site probably looks very different than your last visit, but it’s still packed with the valuable resources that keep you coming back.

31 January 2020
Five Common Privacy Problems in an Era of Smart Devices
Blog Post

Five Common Privacy Problems in an Era of Smart Devices

I gave an Internet of Things (IoT) security and privacy keynote half a dozen times throughout the world last year, along with as many executive presentations. These presentations described the lack of security and privacy engineering within the devices themselves and related contributing factors.

28 January 2020
Address the Challenges of SD-WAN
@ISACA Article

Address the Challenges of SD-WAN

Software-defined wide area networking (SD-WAN) is a useful tool to view an organization’s network architecture. But while it can be useful, its lack of security

22 January 2020
Harnessing the Power of Emerging Technology
@ISACA Article

Harnessing the Power of Emerging Technology

Emerging technologies such as quantum computing, artificial intelligence (AI) and augmented reality (AR) have tremendous potential and pose significant risk

22 January 2020
Learn to Conduct an IT Security Risk Assessment
@ISACA Article

Learn to Conduct an IT Security Risk Assessment

Organizations must conduct regular risk assessments not only to ensure business continuity, but also to verify that their expenditures are providing a high return on investment.

22 January 2020
How to Keep Yourself Safe From Hackers
@ISACA Article

Romanticizing Fraud: How to Keep Yourself Safe From Hackers

Concepts and terminology differ between the physical and cyberworld. In an attempt to define new terms, IT professionals often come up with terms that confuse and romanticize instead of inform.

22 January 2020
Cybersecurity
@ISACA Article

Share Your Cybersecurity Knowledge and Experience in The Nexus

One of the best ways to advance the cybersecurity field is to share your expertise and knowledge with other professionals in the industry worldwide. Consider sharing your knowledge by contributing an original article

22 January 2020
CCPA’s Do Not Sell: It’s Here, But What Does It Mean?
Blog Post

CCPA’s Do Not Sell: It’s Here, But What Does It Mean?

So, the California Consumer Privacy Act (CCPA) went into effect – and, the world didn’t burn. Companies have many issues to contend with, but one in particular has presented challenges to businesses that sell personal information.

22 January 2020
Complacency Presents a Glaring Career Risk
Blog Post

Complacency Presents a Glaring Career Risk

Alison Levine, First American Women's Everest Expedition Team Captain and a New York Times bestselling author of “On the Edge,” will be the opening keynote speaker at ISACA’s 2020 North America CACS conference

16 January 2020
Another Buzzword Demystified: Zero-Trust Architecture
Blog Post

Another Buzzword Demystified: Zero-Trust Architecture

I recently attended a security conference with multiple speakers covering a wide variety of topics – one of the topics, “Zero-Trust Architecture” (ZTA), was being addressed by one of the vendors, and I decided to sit-in to listen.

14 January 2020
Using AI as a Defensive Tool
Blog Post

Using AI as a Defensive Tool

In a previous Journal article, I wrote about artificial intelligence (AI) and talked about the massive amount of digital data that are being accumulated, how new digitally oriented technology is affecting us, the sources of online data (e.g., personal, private), how data are used and how a career in AI can be useful to those interested in developing the skills to use AI.

13 January 2020
Information Security
The Nexus Article

Cybervictims, Defenders and Cybercriminals: How to Tell Them Apart

In this Orwellian era, when opponents are enemies and enemies are co-conspirators, where news is falsified and trust is endangered, it has become well-nigh impossible to apply clear definitions to attackers, victims and defenders in the context of cyberspace.

13 January 2020
Cybersecurity
The Nexus Article

Fluid Security: Managing Risk in Hybrid Networks

For years, security teams have been tasked with supporting the shift to the cloud, all while maintaining the responsibility of securing on-premise infrastructure and assets. Many are no doubt dreaming of the day they reach cloud-only status and they can shake off the fragmentation that creates so much complexity and inefficiency.

13 January 2020
Storing for the Future: How Data Centers Will Advance in 2020
Blog Post

Storing for the Future: How Data Centers Will Advance in 2020

The idea that data is an incredibly valuable resource in the modern business landscape isn’t new—but best practices for managing that data seem to change almost by the year.

10 January 2020
Information Security
@ISACA Article

Improving Your Security Through Red Teaming

In the past, nonmalicious hackers who found and exploited an organization’s weaknesses and notified it of those weaknesses often faced severe penalties, including jail time. But now, this testing activity is a vital element of cybersecurity. Red team testing can help organizations find their biggest vulnerabilities and fortify the security around them. Despite becoming a crucial component of cybersecurity, the skills gap has resulted in a shortage of qualified red team personnel.

8 January 2020
Risk Management
@ISACA Article

Manage Enterprise Cyberrisk by Applying the NIST CSF With COBIT 2019

Modern threat actors target enterprises across all industries regardless of their type, size or geographic location. Comprehensive protection against cyberthreats requires enterprises to assess their information and technology (I&T) and digital assets through a broad lens and to develop their cyberposture as part of a comprehensive governance and management framework. With the proper enterprise governance program in place, the audit and assurance function can help inform risk-reward decisions and maximize enterprise value while addressing stakeholder needs.

8 January 2020
Tips for Building a Risk Optimized Enterprise
@ISACA Article

Tips for Building a Risk-Optimized Enterprise

The goal of effective risk management is to align the amount of risk taken with the enterprise’s risk appetite to meet the strategic goals and objectives of the organization. When risk is strategically and thoughtfully taken, there are opportunities for competitive advantage, entering additional geographic markets, or developing new products and services.

8 January 2020
New ISACA Paper Enables Enterprises to Use Cyberrisk Quantification to Improve Approach to Cybersecurity Risk
@ISACA Article

Volunteer and Earn CPE With ISACA

Making time to volunteer has both personal and professional benefits and can be a component of professional development and growth. ISACA members have access to a plethora of educational content, networking and professional recognition opportunities. This means you can get more involved in engagement programs in 2020 at no additional cost, and these programs can help you build your professional network, solve challenging problems you encounter at work and even earn free CPE hours.

8 January 2020
Healthy Network Testing to Identify APTs
ISACA Journal Article

Healthy Network Testing to Identify APTs

Advanced persistent threats (APTs) were utilized to breach financial information, costing millions of US dollars during the recent Facebook, Capital One, Google Plus and Uber breaches...

Author: Timothy Neuman
In the New Year, Don’t Fall Back Into the Same Bad Cybersecurity Habits
Blog Post

In the New Year, Don’t Fall Back Into the Same Bad Cybersecurity Habits

Around this time each year, many people aim to follow through on their New Year’s resolutions with the hope of finally being able to break that bad habit, which can prove trickier than we would like.

7 January 2020
Who Will Harness AI More Effectively in the New Decade: Cybercriminals or Cybersecurity Professionals? Risk
Blog Post

Who Will Harness AI More Effectively in the New Decade: Cybercriminals or Cybersecurity Professionals?

We know artificial intelligence will loom large in the new decade, and we know cybersecurity will be critically important as well. How those two forces intersect sets up as one of the most fascinating – and consequential – dynamics that will shape society’s well-being in the 2020s.

3 January 2020
Information Security
ISACA Journal Article

The (Hidden) Cost of Handling Events and Incidents

Because incidents cause trouble and potential losses, there are processes such as business continuity management and disaster recovery planning...

Author: Sven De Preter
Key Steps to Ensuring CISO Effectiveness
Blog Post

Key Steps to Ensuring CISO Effectiveness

n the classic movie “The Wizard of Oz,” protagonist Dorothy Gale leaves Kansas and enters a new world, the land of Oz.

Information Security
ISACA Journal Article

Applying Privileged Access Management to Cloud Environments

Privilege in IT is like oil: The machine cannot run without it, but too much and there will be a mess. The industry has struggled with privilege over the years and...

Author: Dan Blum
Governance
ISACA Journal Article

Innovation Governance: In Everything New, There Is Plenty of Old

I have been an IT professional for more than four decades, starting in the 1980s. So much has changed, yet so much has stayed the same or, more appropriately, returned to the same...

Author: K. Brian Kelley
Cloud Computing
ISACA Journal Article

Information Security Matters: The Residual Data Center

It is no great secret that organizations are moving more and more applications into the cloud. In fact, a recent research study states that by 2021, 53 percent “of all IT and data processing requirements will be in the cloud...

Author: Steven J. Ross
Audit and Assurance
ISACA Journal Article

IS Audit Basics: The Components of the IT Audit Report

While authoring this column and, indeed, participating in the Audit and Assurance community on ISACA’s Engage Online forum, my opinion is often sought on a wide range of audit-related topics from ISACA members...

Author: Ian Cooke
The Risk and Rewards of Enterprise Use of Augmented Reality and Virtual Reality
ISACA Journal Article

The Risk and Rewards of Enterprise Use of Augmented Reality and Virtual Reality

More than 20 years ago, virtual reality (VR) was a simple headset that communicated with video-game consoles and allowed humans to play video games viewed on a four-inch screen housed inside the headset...

Author: Adam Kohnke
Cloud Computing
ISACA Journal Article

Sponsored Feature: Fluid Security—Managing Risk in Hybrid Networks

For years, security teams have been tasked with supporting the shift to the cloud, all while maintaining the responsibility of securing on-premise infrastructure and assets...

Author: Amrit Williams
Cloud Computing
ISACA Journal Article

Anticipating the Disruptive and Incremental Innovations Brought by Quantum Computing

Quantum computing has become one of the most interesting areas of research, training and investment, particularly in the IT-related business sector...

Author: Ahmet Efe
Attaining Digital Transformation Readiness
ISACA Journal Article

Attaining Digital Transformation Readiness

It does not matter whether it is Industry 4.0, a digital twin, the Internet of Machines, distributed system optimization in edge computing or just plain process digitization, digital transformation initiatives are about positively...

Author: Guy Pearce
Artificial Intelligence
ISACA Journal Article

Understanding and Managing the Artificial Intelligence Threat

Artificial intelligence (AI) has come to the forefront of software technology and is presented as both a positive and negative influence on humanity....

Author: Larry G. Wlosinski
Information Security
ISACA Journal Article

When Victims and Defenders Behave Like Cybercriminals

In this Orwellian era, when opponents are enemies and enemies are co-conspirators, where news is falsified and trust is endangered, it has become well-nigh impossible to apply clear definitions to attackers...

Author: C. Warren Axelrod
Information Security
ISACA Journal Article

HelpSource Q&A

“Deep fake” is a term derived from deep learning, and it refers to modifying or creating fake videos using human image synthesis and artificial intelligence (AI)...

Author: Sunil Bakshi
IT/IS Auditing Standards, Guidelines, Tools & Techniques
ISACA Journal Article

Standards, Guidelines, Tools and Techniques

An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques...

ISACA Member and Certification Holder Compliance
Innovating Yourself as an IS Auditor
Blog Post

Innovating Yourself as an IS Auditor

As new technologies are developed, we have to stay up to date with them. More so than almost any other practitioner interfacing with information technology, auditors have to work hard at continual education.
Enterprise Risk Monitoring
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 3

Internal audit often selects the entities to audit using an aging policy or in response to an incident.

Author: Luigi Sbriz
Analyzing Cybersecurity Spending in Depth
@ISACA Article

Analyzing Cybersecurity Spending in Depth

The US fiscal year 2020 presidential budget for cybersecurity-related activities is set at US$17.4 billion. This represents a 5% increase over the fiscal year 2019 budget and amounts to approximately US$53 for every person in the United States.

23 December 2019
CISM: The Key to Entering Executive Leadership
@ISACA Article

CISM: The Key to Entering Executive Leadership

In 2018, Michael Kearns, CISM, chief information security officer (CISO) for Nebraska Methodist Health System, evaluated options to make himself more employable in the next decade. After researching the most desirable certifications security professionals...

23 December 2019
How to Manage I&T-Related Risk Using NIST and COBIT 2019
@ISACA Article

How to Manage I&T-Related Risk Using NIST and COBIT 2019

IT and operational technology (OT) create value and promising opportunities for enterprises today—they are no longer just support mechanisms for key resources.

23 December 2019
Women Influencing Tech as a New Decade Brings More Change
@ISACA Article

Women Influencing Tech as a New Decade Brings More Change

The end of a year—and the end of a decade—offer the opportunity to pause and reflect, but also to focus on the future and imagine how work lives and enterprises might change and evolve.

23 December 2019
Connecting COBIT 2019 to the NIST Cybersecurity Framework
Blog Post

Connecting COBIT 2019 to the NIST Cybersecurity Framework

Among the most exciting projects I’ve worked on has been the integration of NIST’s Cybersecurity Framework with COBIT.

Leveraging Emerging Technology for Better Audits
Blog Post

Leveraging Emerging Technology for Better Audits

My first role post-graduation was working as a financial statement auditor. We used tick mark pencils on printed workpapers, and we manually footed (recalculated) balances.
Podcast
Podcast

Understanding the Marriott Starwood Hack

More than 500 million Starwood accounts were compromised in the recently discovered Marriott Starwood hack. How can those compromised protect themselves, and what are some of the lessons learned? In this podcast, we discuss why the hack happened, how the impact could have been minimized and some key takeaways from Marriott Starwood's response.

20 December 2018
Government Officials Must Become Better Attuned to Data Privacy Regulations
Blog Post

Government Officials Must Become Better Attuned to Data Privacy Regulations

Data privacy and security is more important than ever before. Despite existing policies, the number of data breaches is on the rise and unencrypted personal information is getting into the wrong hands.
Cloud Security
ISACA Journal Article

SOC Reports for Cloud Security and Privacy

Cloud adoption has increased by leaps and bounds, adding to the already increasing types of cyberrisk.

Author: Ashwin Chaudhary
Podcast
Podcast

Using Red Teaming to Improve Your Security

Red team exercises can help enterprises find and address their weaknesses. Unfortunately, the cybersecurity skills gap extends to red teams and blue teams. In this podcast, Frank Downs and Dustin Brewer discuss why red teaming, in conjunction with blue teaming, is a valuable tool for cybersecurity, and they also discuss some of the causes of and solutions to the skills gap.

18 December 2019
Addressing the Challenges of New Privacy Laws
Blog Post

Addressing the Challenges of New Privacy Laws

US State of California Senate Bill 327 Information Privacy: Connected Devices (SB 327) goes into effect January 2020.
Artificial Intelligence: A Damocles Sword?
Blog Post

Artificial Intelligence: A Damocles Sword?

In Greek mythology, the courtier Damocles was forced to sit beneath a sword suspended by a single hair to emphasize the instability of kings’ fortunes. Thus, the expression “the sword of Damocles” to mean an ever-present danger.
CRISC: The Perfect Partner to CISA for a Holistic View of Audit and Risk Management
@ISACA Article

CRISC: The Perfect Partner to CISA for a Holistic View of Audit and Risk Management

In 2018, Mercy Omollo-Mbai, CISA, CRISC, ISACA Kenya (Africa) Chapter communications committee secretary (2019-20) and IT internal audit manager at Liberty Group East Africa...

11 December 2019
ISACA Concludes 50th Anniversary Year With a Look at the Next Decade of Tech
@ISACA Article

ISACA Concludes 50th Anniversary Year With a Look at the Next Decade of Tech

As ISACA’s 50th anniversary year draws to a close, the association looks to the future and explores how to help members navigate tech innovations in the 2020s.

11 December 2019
Keep Your Certifications Current: Earn CPE Hours Before Year-End
@ISACA Article

As an ISACA certification holder, you need to earn continuing professional education (CPE) hours by 31 December 2019 to maintain your certification through 2020.

As an ISACA certification holder, you need to earn continuing professional education (CPE) hours by 31 December 2019 to maintain your certification through 2020. As an ISACA member, you can earn CPE hours in many ways...

11 December 2019
Learn to Detect Encrypted Traffic
@ISACA Article

Learn to Detect Encrypted Traffic

Over the last decade, encrypted network traffic has increased tremendously, making incident responders’ jobs more challenging. Decrypting traffic can be difficult, and while encryption can protect user privacy...

11 December 2019
Three More Vs of Big Data
@ISACA Article

Three More Vs of Big Data

In my 12 June 2019 @ISACA column, I identified the 4 Vs of big data as areas of focus and understanding to properly review, assess and audit big data systems and organizational efforts. There are at least 3 other Vs to consider when reviewing big data systems.

11 December 2019
Why Passwords Still Persist
@ISACA Article

Back in 2001, someone wrote, “In the near future, I am certain we are going to replace passwords.

Back in 2001, someone wrote, “In the near future, I am certain we are going to replace passwords. Maybe a better way to put it is that we are going to replace all those passwords with just one.” Who said that?

11 December 2019
Security Governance
ISACA Journal Article

Security Governance or an Elephant Fight?

There is an African proverb that says, “When elephants fight, it is the grass that suffers.”

Author: Enric Llaudet
Who Am I? CRISC Equips Professionals and Organizations with a Valuable Identity
Blog Post

Who Am I? CRISC Equips Professionals and Organizations with a Valuable Identity

As a risk practitioner, have you ever tried to describe what you do for a living to a family member or a friend?

AI Practitioners: Our Future Is in Your Hands
Blog Post

AI Practitioners: Our Future Is in Your Hands

Imagine it is sometime in the 22nd century and that the future you is preparing for a complex surgical procedure at the local robot-run hospital, where it has become commonplace for robots to perform sophisticated, repeatable tasks, such as heart surgery, on human patients.
Jon Brandt
The Nexus Article

Routine Maintenance

I find that many outside of our profession believe cybersecurity is overly complicated and, frankly, nerdy. Because of this view, soft skills required to translate technical issues into business context are extremely important. This belief may also be dissuading youth from pursuing tech careers and, instead, steering them to be simply consumers of technology.

9 December 2019
When Everything Old is New Again: How to Audit Artificial Intelligence for Racial Bias
Blog Post

When Everything Old is New Again: How to Audit Artificial Intelligence for Racial Bias

You may not know it, but artificial intelligence (AI) has already touched you in some meaningful way.

IoT Security
ISACA Journal Article

Building Security Into IoT Devices

There will be more than 64 billion Internet of Things (IoT) devices by 2025.

Authors: Farbod H. Foomany and Nathanael Mohammed
AI and Healthcare: A Life-Saving Combination
Blog Post

AI and Healthcare: A Life-Saving Combination

Artificial intelligence (AI) and machine learning are common terms in the world of emerging technology. Although still sounding futuristic to some people, AI is already being deployed everywhere from fantasy football weekly recap emails, to retail environments, to advanced, state-sponsored surveillance systems.
Overcoming Legacy Thinking a Key Strategy for Actively Shaping The Future
Blog Post

Overcoming Legacy Thinking a Key Strategy for Actively Shaping The Future

The rapidly increasing pace of technology change and digital disruption leads to an unprecedented pace at which organizations must address opportunities and risks that could make or break their success. In the new decade of the 2020s, technology-driven exponential change will accelerate even more sharply. Unfortunately, most organizations are ill-prepared for what is to come, and will remain so unless they replace their reactionary approach to the technology landscape with an anticipatory one.
podcast
Podcast

Rise of the Digital Natives

The technology landscape of the 2020s is sure to include some sweeping changes. What impact might the rise of more digital natives to leadership roles within their organizations have on how organizations explore and deploy technology? On this episode of the ISACA Podcast's 50th Anniversary Series, guest Alicja Foksinska offers her perspective.

3 December 2019
Certified Information Security Manager
@ISACA Article

CISM: The Key to Moving From Auditor to Manager

In 2015, Ferry Haris, CISA, CISM, IT risk manager at APG Asset Management, decided that he wanted to branch out from his role as an auditor, but also continue to utilize his base of knowledge...

27 November 2019
Five Key Lessons Learned From Publicly Disclosed Data Breaches and Security Incidents
@ISACA Article

Five Key Lessons Learned From Publicly Disclosed Data Breaches and Security Incidents

Key lessons can be learned from publicly disclosed data breaches and security incidents. These lessons can help organizations more effectively focus their investments and efforts to prevent themselves from becoming victims in similar instances.

27 November 2019
Gain Insight Into Mitigating IT Risk
@ISACA Article

Gain Insight Into Mitigating IT Risk

IT risk management is essential as mitigating risk ensures that organizational value is kept intact. Join IS, IT and business professionals and experts for ISACA’s IT Risk Management Virtual Summit 2019.

27 November 2019
Pursuing a New Career With Passion: A Few Minutes With Zinet Kemal
@ISACA Article

Pursuing a New Career With Passion: A Few Minutes With Zinet Kemal

Zinet Kemal, CISA, CySA+, Network+, Security+, was a legal assistant in Ethiopia before moving to the United States 6 years ago. Once she arrived in the United States, her technology career journey began...

27 November 2019
Share Your Feedback on the ISACA Podcast
@ISACA Article

Share Your Feedback on the ISACA Podcast

The ISACA Podcast offers thought leadership, practical strategies and career guidance in a quick and easy-to-digest format. To better serve you, ISACA welcomes your feedback on the podcast. If you want to learn more about a specific topic...

27 November 2019
Why Auditors Rarely Find Fraud
@ISACA Article

Why Auditors Rarely Find Fraud

In today’s world where corporate scandals often make front-page news, fraud prevention and detection are becoming a priority for management and decision-makers.

27 November 2019
How Big Data Aids Cybersecurity
Blog Post

How Big Data Aids Cybersecurity

The increasing reliance on big data and the interconnection of devices through the Internet of Things (IoT) has created a broader scope for hackers to exploit.
Cyberresilience
ISACA Journal Article

Auditors Have a Role in Cyberresilience

Cyberthreats are an issue for any organization or individual anywhere in the world due to the increasing dependence on computer systems, infrastructure, the Internet, social media and technological innovation.

Author: Shemlse Gebremedhin Kassa
Podcast
Podcast

Dynamic Information Security in a Static Organizational Culture

Understanding an organization’s culture is essential when building a cybersecurity program. But how can security professionals learn about the culture, and how should that drive security programs? In this podcast, we discuss how to build a strong cybersecurity culture, how to leverage the organization’s culture when developing security initiatives and strategies to overcome impediments to a cyberculture.

27 November 2019
Ignorance is Not Bliss When It Comes to Defending Against the Dark Web
Blog Post

Ignorance is Not Bliss When It Comes to Defending Against the Dark Web

The dark web ecosystem continues to evolve as a place where cybercriminals can sell and access stolen data, purchase black-market items such as guns, drugs and hacking software, and connect with like-minded individuals.
Infosecurity-ISACA Conference Highlights: Hands-On Experiences and Dialogue Around Emerging Technologies, 2020 Predictions and Women in Tech
Blog Post

Infosecurity-ISACA Conference Highlights: Hands-On Experiences and Dialogue Around Emerging Technologies, 2020 Predictions and Women in Tech

Theresa Payton set the tone for the first day of last week’s Infosecurity ISACA North America Expo & Conference in New York City, delving into the multifaceted landscape of emerging technologies with the audience of information security professionals, and also sharing anecdotes from one of her most high-profile jobs, as White House CIO under the George W. Bush administration—including a story of negotiating with a cyber criminal on the dark web at her kitchen table over three nights.
Podcast
Podcast

Overcoming Complexity to Secure Critical Infrastructure

Complex interdependencies in the supply chain and elsewhere can make assessing risk difficult, particularly when it comes to protecting critical infrastructure. In this episode of the ISACA Podcast, guest Charlie Harry provides his perspective on how governments and organizations can overcome these challenges.

25 November 2019
Information Governance: You Have to Start Somewhere
Blog Post

Information Governance: You Have to Start Somewhere

Deborah Juhnke, senior consultant with Information Governance Group LLC, cited a definition of information governance as “an organization’s coordinated, interdisciplinary approach to satisfying information compliance requirements and managing information risks while optimizing information.”
Podcast
Podcast

Cyberattacks on Industrial Technology and SCADA Systems

An unsophisticated attack on industrial control systems can halt the operations of manufacturing plants, resulting in lost revenue and reputational harm. But a few simple steps can help organizations prevent attacks from happening and recover quickly when they do occur. In this podcast, we discuss the steps organizations can take to secure their operations.

21 November 2019
Podcast
Podcast

Cyberleadership in an Ecosystem Context

To tackle the complex challenges of the cyberlandscape, strong leaders are needed. But what makes someone a leader, and what should be expected of leaders? In this podcast, Matt Doan discusses how to be a leader, why more cyberleaders are necessary and why it’s beneficial to think of cybersecurity in an ecosystem context

21 November 2019
Cybersecurity
ISACA Journal Article

What the Board Needs to Know About the Organization’s Cybersecurity Status

Cybersecurity breaches have come to the attention of boards of directors (BoDs) because of their impact.

Author: Kumaragunta Harisaiprasad
Podcast
Podcast

Diving into Data with Computer-Assisted Audit Tools

Computer-assisted audit tools can help auditors improve testing and more efficiently deal with the barrage of data being created these days. Infosecurity-ISACA North America Expo and Conference presenter Rochelle Vargas discusses why she considers these tools to be game-changers for auditors.

20 November 2019
Podcast
Podcast

Seeing Beyond Taboos to Understand the Dark Web

Many organizations are intimidated by the dark web or don't think they have the needed expertise to counter security threats that originate there. In this episode of the ISACA Podcast, recorded from the Infosecurity-ISACA North America Expo and Conference, conference presenter Alex Holden makes the case for why organizations need to prioritize understanding the dark web, and explains how they can go about doing it.

20 November 2019
podcast
Podcast

New Paths in the Pursuit of Knowledge

Learning and certification have been at the heart of ISACA's 50-year history, but many of the ways in which technology professionals have pursued industry expertise have changed with the times. Guest Allan Boardman provides his perspective on what has changed and what has stayed constant for learners in ISACA's professional community.

19 November 2019
What Do You Expect in the Next Decade of Tech?
Blog Post

What Do You Expect in the Next Decade of Tech?

What are some of the major changes you expect to see in the technology landscape in the next decade?
Cybersecurity
ISACA Journal Article

Cybersecurity Takedowns

Information security programs are not easy or totally successful on a global scale.

Author: Larry G. Wlosinski
Podcast
Podcast

Examining the NordVPN Hack

The use of VPNs is often touted as a strong security measure, but what happens when the VPN service you use is compromised? In this podcast, Dustin Brewer and Frank Downs discuss the recent NordVPN hack, the importance of pen testing and auditing, and lessons learned from the incident.

15 November 2019
How Blockchain is Revolutionizing the Travel and Hospitality Industry
Blog Post

How Blockchain is Revolutionizing the Travel and Hospitality Industry

The potential of blockchain technology has inspired hype and buzz for years.
Tips for Improving Risk Assessment and Analysis
@ISACA Article

Tips for Improving Risk Assessment and Analysis

In honor of ISACA’s 50th anniversary, this column seeks to provide tips on an area of risk management that has been very slow to change—quantitative risk and decision analysis.

13 November 2019
Applying COBIT to Vendor Risk Management
@ISACA Article

Applying COBIT to Vendor Risk Management

Almost all enterprises today employ third-party vendors or suppliers. When outsourcing any product or service, risk must be assessed. Successful enterprises separate themselves from unsuccessful ones in how they govern and manage their risk...

13 November 2019
What Is in Store for the Next Gen Auditor?
@ISACA Article

What Is in Store for the Next Gen Auditor?

The IT audit profession is changing and evolving, and the IT auditor must change and evolve with it. The next generation of audit emphasizes looking toward the future rather than only examining the past.

13 November 2019
Invest in Your Future and Save With ISACA Membership
@ISACA Article

Invest in Your Future and Save With ISACA Membership

Continuing education and pursuing new certifications allows you to invest in your career and yourself. By joining ISACA you receive discounted access to global industry conferences, save on certification exams and prep materials...

13 November 2019
ISACA Gives Back Around the World
@ISACA Article

ISACA Gives Back Around the World

On 5 October 2019, 2,800 volunteers gathered around the world to give back to their communities during ISACA’s first-ever worldwide day of volunteerism, ISACA CommunITy Day.

13 November 2019
Information Security Roles and Responsibilities
ISACA Journal Article

Accountability for Information Security Roles and Responsibilities, Part 2

Part 1 of this article proposed a method using ArchiMate to integrate COBIT 5 for Information Security with enterprise architecture (EA) principles, methods and models to properly implement the chief information security officer’s (CISO’s) role.

Authors: Tiago Catarino and André Vasconcelos
Feeling Like A Fraud: Imposter Syndrome
Blog Post

Feeling Like A Fraud: Imposter Syndrome

“Imposter Syndrome can be defined as a collection of feelings of inadequacy that persist despite evident success.
Podcast
Podcast

Dispelling Myths About the Tech Workforce Gender Gap

The misconceptions about why women are underrepresented in the tech workforce are numerous – some cling to the notion that girls and women aren't as interested or proficient in tech fields, despite plenty of evidence to the contrary. In this SheLeadsTech Series episode of the ISACA Podcast, guest Beverly Allen addresses some of the misconceptions about the gender gap in technology fields such as cybersecurity.

12 November 2019
Value Professional Networking Early in Your Career
Blog Post

Value Professional Networking Early in Your Career

Depending on your personal interests, social skills and professional goals, professional networking may or may not be your favorite activity. Whether or not you enjoy networking, it should be a priority in your professional life – especially earlier in your career as you are building your professional network.
David Close
The Nexus Article

Tokenization: Your Secret Weapon for Data Security?

Consider this: 4.1 billion records have been compromised in the first half of 2019 alone, a 54% increase over the same period in 2018. Organizations in nearly every industry are facing an ever-growing and out-of-control cybersecurity crisis.

11 November 2019
Antonio Ramos
The Nexus Article

Third-Party Risk Management Vs. Provider’s Accountability

Lately, I have been reflecting on the need to assess third-party risk and how other business sectors have mitigated this risk in the past. I have concluded the origin for this need is what economists call a “market failure.”

11 November 2019
COBIT 2019
Governance Article

Transitioning From COBIT 5 to COBIT 2019 | ISACA

COBIT 5 was released in 2012 and, after 6 years, in November 2018, the first titles in the updated COBIT 2019 framework began to appear. Implementers observe that, in practice, enterprises often require several years to become familiar with an upgraded framework and adopt new guidance and standards.

11 November 2019
Podcast
Podcast

Using COBIT to Govern and Manage Third-Party Risk

Every organizations uses suppliers, and these suppliers (while adding value) also can pose a risk. In this podcast, Mark Thomas discusses some of the main challenges organizations face when managing their vendor and supplier risk, how to use COBIT to govern and manage this risk, and how organizations not using COBIT can put the tips presented in this podcast into practice.

8 November 2019
What I Wish I Knew When I Started in IT Audit
Blog Post

What I Wish I Knew When I Started in IT Audit

Who among us does not sometimes reflect on our journey and certain days that remain nailed to our memory, either because they were too tough to forget or too good to be true?

7 November 2019
Information Security for Biomedical Devices
Blog Post

Information Security for Biomedical Devices

Though device manufacturers have worked to improve the cybersecurity of their medical devices, there is still a long way to go. Improvements aside, there are distinct steps the IT information security department can take to reduce risk and improve cybersecurity for medical devices.
Podcast
Podcast

Using COBIT for Effective Digital Transformation

Digital transformation can give organizations a competitive edge and improve their operations. The COBIT framework can be used as a powerful tool for digital transformation efforts. In this podcast, we discuss how to use COBIT to guide your organization’s digital transformation efforts.

5 November 2019
AI or GDPR?
Blog Post

AI or GDPR?

Consider an organization adopting artificial intelligence (AI) as being represented by a self-driving car.

For Tech and IT Startups, Coworking Spaces Make the Most Sense
Blog Post

For Tech and IT Startups, Coworking Spaces Make the Most Sense

When most people think about coworking spaces, they immediately picture a bunch of freelancers and solopreneurs working on independent ventures at shared desks. But coworking spaces are more versatile than this.
Information Security Matters
ISACA Journal Article

Information Security Matters: Un-Privacy by Design

At the end of my last column, I allowed myself a bit of a sneer at the notion of “privacy by design.”

Author: Steven J. Ross
Data Auditing
ISACA Journal Article

Data Auditing: Building Trust in Artificial Intelligence

While IT risk management driven by standards/frameworks such as the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) ISO/IEC 27001:2005 Information technology—Security techniques—Information security management systems—Requirements, British Standard (BS) 7799-3 (2006) and ISACA’s Risk IT (2009) have been around for more than a decade, in reality, IT risk management can trace its roots back to the very reason for the establishment of ISACA 50 years ago.

Author: Guy Pearce
The Intelligent Audit
ISACA Journal Article

The Intelligent Audit

Artificial intelligence (AI) is a key contributor to recent technological innovations, including autopiloted cars.

Authors: Pascal A. Bizarro, Emily Crum and Jake Nix
The Network
ISACA Journal Article

The Network: Walt Blackwood

What is the biggest security challenge that will be faced in 2020?

Author: Walt Blackwood
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing Software Licenses

Those of you who have read my bio are aware that in addition to writing for the ISACA Journal, I am also a topic leader for the Audit and Assurance community on ISACA’s Engage Online forum.

Author: Ian Cooke
Security-Related Reminders
ISACA Journal Article

The Practical Aspect: Some Security-Related Reminders

As a discipline, information security has come a long way.

Author: Vasant Raval
Innovation Governance
ISACA Journal Article

Innovation Governance: Innovate Yourself

A couple of years ago, I made the statement during a presentation that the amount of information collected in auditing systems and controls is orders of magnitude greater than what we collected 10 years ago.

Author: K. Brian Kelley
Cyberrisk Auditing
ISACA Journal Article

Auditing the Crown Jewels From a Cyberrisk Perspective

Auditing standards require auditors to produce a documented risk-based audit plan, taking into account input from senior management and the board.

Author: Jaco Cloete
Audit Challenges and Strategies
ISACA Journal Article

Trends, Challenges and Strategies for Effective Audit in a Rapidly Changing Landscape

Traditional audit is a typically retroactive activity that identifies risk in running operations and proposes solutions.

Author: Spiros Alexiou
Risk in Adopting RPA
ISACA Journal Article

Inherent Risk in Adopting RPA and Opportunities for Internal Audit Departments

Many organizations are rapidly moving to implement robotic process automation (RPA) because it helps leverage multiple fronts, including cost advantage, workforce optimization, quality improvements, flexible and dynamic execution, speed, and agility.

Author: Gaurav Priyadarshi
Auditing
ISACA Journal Article

Preparing for the Next Generation of Auditing

Whether one is auditing a rapidly transforming organization, executing audits of emerging technologies, mentoring new auditors or guiding experienced auditors, an element shaping the 21st century business environment is an increased emphasis on data analytics.

Author: Grace Johnson
Rising Complexity, Higher Stakes for Enterprise Risk Management
Blog Post

Rising Complexity, Higher Stakes for Enterprise Risk Management

Cyber risk has understandably become a focal point for enterprise risk managers, but the risk landscape is multi-layered and extends beyond the realm of cybersecurity. In addition to contending with a daunting array of cyberthreats, enterprises are determining how much risk they are willing to accept in deploying emerging technologies, working through a heightened focus on customer privacy and adjusting to changes in the regulatory environment.
The Role of Data Strategy in Optimizing Organizational Processes
Blog Post

The Role of Data Strategy in Optimizing Organizational Processes

The relevance of data cannot be over emphasized in today’s world, where change is the only constant. Decisions that managers and executives tend to make emanate from the availability of data analysis.

Common Misconceptions About Radio Waves, Radio Frequency and Wireless Communication
@ISACA Article

Common Misconceptions About Radio Waves, Radio Frequency and Wireless Communication

Think about the last time you communicated via radio. Many people think they only listen to the radio in the car or think about the time when Morse code, walkie-talkies and teletype machines were more prevalent.

30 October 2019
Preparing for an IT Audit
@ISACA Article

Preparing for an IT Audit

As IT risk and regulations change, IT departments are tasked by auditors and compliance professionals to clarify IT processes, provide audit evidence and identify control issues.

30 October 2019
The Top Challenges Facing IT Auditors
@ISACA Article

The Top Challenges Facing IT Auditors

While innovation and emerging technologies are imperatives for any organization looking for a competitive edge, they have created challenges for the IT audit industry. To provide insights on the challenges that IT auditors face...

30 October 2019
ISACA Podcast Explores Parallels Between Environmental Sustainability and Digital Transformation
@ISACA Article

ISACA Podcast Explores Parallels Between Environmental Sustainability and Digital Transformation

To glean valuable industry insights, gain practical knowledge and keep up with industry trends, subscribe to the ISACA Podcast. In these podcasts, security experts, published authors, conference speakers and industry experts share...

30 October 2019
New Research Explores Critical Risk Categories and Overall Risk for Organizations Today
@ISACA Article

New Research Explores Critical Risk Categories and Overall Risk for Organizations Today

The turbulence in today’s risk landscape is unprecedented, and many organizations are wondering how their risk mitigation is faring relative to other enterprises. To examine risk management leaders’ insights on current organizational risk mitigation strategies...

30 October 2019
A Passion for SheLeadsTech: A Few Minutes With Karen Sandhu
@ISACA Article

A Passion for SheLeadsTech: A Few Minutes With Karen Sandhu

Karen Sandhu, CISA, CRISC, is a professional with 15 years of risk management experience in information security, data privacy, emerging technology risk, cloud security, security incident response, governance and internal controls.

30 October 2019
Technology Emboldening Innovators on the Ground, in the Air and Beyond
Blog Post

Technology Emboldening Innovators on the Ground, in the Air and Beyond

A future in which passengers order air taxis, victims of serious accidents tap neurotechnology to rise above limitations and AI/machine learning-fueled space exploration allows astronauts to trek deeper into the universe – for longer periods – was boldly presented on Monday, 28 October, at the Dare Mighty Things technology conference in Chicago, Illinois, USA.
Making AI GDPR Compliant
ISACA Journal Article

Making AI GDPR Compliant

As one of the strictest regulations related to data protection and privacy, the EU General Data Protection Regulation (GDPR) has attracted attention from countries all over the world.

Author: Andrea Tang
Practical Recommendations for Better Enterprise Risk Management
Blog Post

Practical Recommendations for Better Enterprise Risk Management

Based upon my experience in Enterprise Risk Management, I was not surprised to see respondents to new State of Enterprise Risk Management research from ISACA, CMMI Institute and Infosecurity identify risk identification and risk assessment to be the most employed risk management steps in their organizations
podcast
Podcast

Volunteerism: The Catalyst of ISACA’s Sustained Growth

From its proud but humble origins as a small group of auditors in the Los Angeles area, ISACA has evolved over the past 50 years into a thriving global association of business technology professionals. A spirit of volunteerism has been the catalyst, as explored in this episode of the ISACA Podcast with guest Michael Cangemi.

29 October 2019
Employing COBIT 2019 for Enterprise Governance Strategy
Governance Article

COBIT 2019 for Enterprise Governance Strategy | ISACA

Strategy is a plan for achieving a set objective. COBIT 2019 is here to help practitioners apply standard information and technology (I&T) controls to enterprise governance strategy. Mapping control objectives from the International

28 October 2019
CISOs and CMOs Joined At The Hip in the Era of Big Data
Blog Post

CISOs and CMOs Joined At The Hip in the Era of Big Data

Senior leaders in business and government ought to take note of ISACA’s State of Cybersecurity 2019 research, which details the findings of a global survey of cybersecurity professionals.
Senior IT Audit Leaders Discuss Cybersecurity Data Analytics
Blog Post

Senior IT Audit Leaders Discuss Cybersecurity Data Analytics

Senior IT audit leaders met to discuss a wide variety of topics, including audit analytics, IT audit’s role in cybersecurity and incident management, and agile/DevOps shops, at the recent IT Audit Leaders Summit in Geneva, Switzerland, as part of EuroCACS/CSX 2019. Participants shared opinions and best practices, and strategized on the path forward with new technologies and business practices.
Vendor Compliance
ISACA Journal Article

Ensuring Vendor Compliance and Third-Party Risk Mitigation

Implementing the EU General Data Protection Regulation (GDPR) is a significant challenge for most enterprises because it requires many to completely change their perception of personal data security.

Author: Jan Anisimowicz
Securing the SWIFT Cross Border Payment System Within Banks
Blog Post

Securing the SWIFT Cross Border Payment System Within Banks

A series of cyber-attacks involving the SWIFT banking network have come to light in recent years. The first public report of these attacks came from the Bangladesh Central Bank, and we have also seen attacks at State Bank of Mauritius, Cosmos Bank (India) and City Union Bank (India).
Podcast
Podcast

Addressing the Challenges Facing IT Auditors

Organizations that want to have a competitive edge must leverage the power of emerging technology, but this technology adds complexity to IT auditing. What can auditors do to address this complexity, and what is the role of business leaders when it comes to IT audit? This podcast, in partnership with Protiviti, discusses the results of the 2019 Global IT Audit Benchmarking Study and provides insights on the top challenges IT audit professionals face, how to address these challenges and the skills IT auditors must have.

22 October 2019
Is Your Organization Supporting Paths to Develop Women as Leaders?
Blog Post

Is Your Organization Supporting Paths to Develop Women as Leaders?

Is your organization supporting women in reaching leadership positions? Why is this important?
David Samuelson
Blog Post

Saluting the Spirit of Volunteerism That Made CommunITy Day a Success

On ISACA’s first CommunITy Day on 5 October, 2019 – a day in which our global professional community came together over one day to volunteer in their local communities – the passion, creativity and industriousness of ISACA’s professional community was on full display.
Third-Party Risk Management Vs. Provider’s Accountability
@ISACA Article

Third-Party Risk Management Vs. Provider’s Accountability

Lately, I have been reflecting on the need to assess third-party risk and how other business sectors have mitigated this risk in the past.

16 October 2019
What We Can Learn About Cybersecurity From Game of Thrones
@ISACA Article

What We Can Learn About Cybersecurity From Game of Thrones

Even after cybersecurity professionals have built “walls,” they can become obsessed with adding newer, bigger layers of defense. If you have watched Game of Thrones (GoT), you may notice this attitude is similar to the behaviors...

16 October 2019
Improving How Information Security and Risk Management Work Together
@ISACA Article

Improving How Information Security and Risk Management Work Together

Technology is essential for organizational success, but as technology and innovation evolve, risk grows. The increase in risk makes transparent risk management vital, and regular communication between the IT and risk management...

16 October 2019
Participate in Hands-On Experiences and Gain In-Depth Technical Knowledge at Geek Street
@ISACA Article

Participate in Hands-On Experiences and Gain In-Depth Technical Knowledge at Geek Street

16 October 2019
Establishing Credibility with More Experienced Clients and Business Partners
Blog Post

Establishing Credibility with More Experienced Clients and Business Partners

I graduated college with all the confidence in the world. However, I then entered Corporate America, and I had a rude awakening.
Information Security Roles and Responsibilities
ISACA Journal Article

Accountability for Information Security Roles and Responsibilities, Part 1

In recent years, information security has evolved from its traditional orientation, focused mainly on technology, to become part of the organization’s strategic alignment, enhancing the need for an aligned business/information security policy.

Authors: Tiago Catarino and André Vasconcelos
A Seat at the Table: Internal Auditors as Operational Partners and Organizational Strategists
Blog Post

A Seat at the Table: Internal Auditors as Operational Partners and Organizational Strategists

IT auditors new to the profession may hear references to a time when the internal audit function was viewed as the “police.” Years ago, it was not uncommon for organizations to perceive internal audit’s responsibilities of assessment and evaluation as being similar to that of a policing function.

Podcast
Podcast

Applying Environmental Sustainability to Digital Transformation

Environmental sustainability principles support a healthy ecosystem that sustains life. Much of the language used in environmental sustainability is also used in the digital ecosystem. In this podcast, we discuss how environmental sustainability principles can be applied in a digital transformation context to protect a valuable resource of modern times: information.

15 October 2019
ISACA’s SheLeadsTech™ Second Day of Advocacy in DC: Paving Pathways for More Women and Girls in Tech
Blog Post

ISACA’s SheLeadsTech™ Second Day of Advocacy in DC: Paving Pathways for More Women and Girls in Tech

More than 60 women and men gathered on Capitol Hill in Washington, DC, on 7 October for the SheLeadsTech program’s second annual Day of Advocacy.
Rob Lelewski
The Nexus Article

Email Warning Banners: Are We Using Them Effectively?

Imagine walking out to your mailbox on a sunny day. Most of us can relate to eagerly awaiting a package containing the latest gadget that you bought online. You reach into the mailbox, leaf though the contents and are likely disappointed that your postal carrier has deposited a pile of bills; it is a tragedy that occurs far too often.

14 October 2019
Jon Brandt
The Nexus Article

Securing Tomorrow: Investing in Digital Education

Scan your favorite news sources and you will see frequently repeated words such as “breach,” “compromise,” “exposure,” “identity theft” and “hacker.” Headlines routinely highlight the impact (or potential impact) to critical infrastructure, economic prosperity, financial markets, etc.

14 October 2019
Big Data Analytics Powering Progress in Animal Agriculture
Blog Post

Big Data Analytics Powering Progress in Animal Agriculture

There has been significant progress in technologies that can be utilized in the livestock industry. These technologies will help farmers, breeders associations and other industry stakeholders in continuously monitoring and collecting animal-level and farm-level data using less labor-intensive approaches.
ISACA Well-Positioned to Advance Learners’ Journeys
Blog Post

ISACA Well-Positioned to Advance Learners’ Journeys

I am the product of a liberal arts education. On the surface, what I learned in school has very little relevance to my day to day right now, yet, when you dig deeper, the communication and critical thinking skills that education instilled in me helped in ways beyond measure.
Regulatory Landscape Provides Added Incentive for Enterprises to Explore Blockchain
Blog Post

Regulatory Landscape Provides Added Incentive for Enterprises to Explore Blockchain

The increasing emphasis on data privacy gained widespread attention last year with the enforcement deadline of the General Data Protection Regulation (GDPR).
The Human Factor
ISACA Journal Article

The Human Factor in Information Security

Humans represent a mystery to be deciphered by security/cybersecurity experts because their behaviors, attitudes, beliefs, rituals and decisions (the general characteristics that define a culture) constitute a little-understood universe for executives and their heads of security.

Author: Jeimy J. Cano M.
Cybersustainability: Ensuring Digital Strategies That Protect Data
Blog Post

Cybersustainability: Ensuring Digital Strategies That Protect Data

Increasingly, security professionals use language that makes a distinct comparison between our physical environment and our digital infrastructures.

Will Women in Tech Benefit from Millennials Weighing in or Exiting Out of Overdemanding Tech Cultures?
Blog Post

Will Women in Tech Benefit from Millennials Weighing in or Exiting Out of Overdemanding Tech Cultures?

The tech industry has been burning through talent and losing IP for decades, but this is usually after years or even decades of contributions. Some suggest it is based on work-life balance challenges, but a recent ISACA study, Tech Workforce 2020: The Age and Gender Perception Gap, highlights how millennials factor into this equation, too.
Tips for the Novice IT Auditor
Blog Post

Tips for the Novice IT Auditor

Norman Ralph Augustine once said, “Two-thirds of the Earth’s surface is covered with water. The other third is covered with auditors from headquarters.” This highlights the rise of the auditing profession and the importance that more and more companies are placing on internal and external audits due to increasing regulatory requirements.
How the CISM and CISSP Certifications Can Complement One Another
Blog Post

How the CISM and CISSP Certifications Can Complement One Another

In 2003, I had just completed my MSc in Information Security. I was excited about my future career prospects as I believed I had obtained at least the minimum level of knowledge needed to enter the information security field.
Fighting Fraud
ISACA Journal Article

Fighting Fraud

Occupational fraud, e.g., internal theft, employee fraud and asset misappropriation, plagues enterprises of all sizes.

Authors: Chris Errington, Kevin M. Alvero, and Wade Cassels
Celebrating Success While Acknowledging Risk share
@ISACA Article

Celebrating Success While Acknowledging Risk share

During an IS audit, I had the opportunity to observe a financial organization’s disaster recovery drill. They had planned to run the business from an alternate site for 1 full day.

2 October 2019
Maintaining Cybersecurity Resilience
@ISACA Article

Maintaining Cybersecurity Resilience

As organizations continue to innovate with cloud technology and Internet of Things (IoT) devices, they must be diligent in securing these innovations. Technology will only continue to grow and change, and there are basic measures organizations...

2 October 2019
Maximize Your LinkedIn Experience
@ISACA Article

Maximize Your LinkedIn Experience

LinkedIn is essential in today’s digital world—as a personal branding, career advancement and networking tool. As you navigate LinkedIn, you may wonder how you can maximize the value of your LinkedIn profile to allow you to stand out in the eyes of potential employers and recruiters.

2 October 2019
How to Better Manage Third-Party and Enterprise Risk
@ISACA Article

How to Better Manage Third-Party and Enterprise Risk

Enterprise risk is affected by the overall vendor risk management program. As reliance on third parties to deliver products and services becomes greater over time, building sound enterprise processes and governance around third-party risk management becomes more critical.

2 October 2019
ISACA’s Newest Chapter: Ahmedabad, India
@ISACA Article

ISACA’s Newest Chapter: Ahmedabad, India

A desire to create more awareness about ISACA and its certifications led to the formation of the Ahmedabad (India) Chapter making it ISACA’s 222nd chapter. ISACA is currently represented by chapters in 96 countries across the world.

2 October 2019
Are We Asking the Right Questions When It Comes to the InfoSec Skills Shortage?
Blog Post

Are We Asking the Right Questions When It Comes to the InfoSec Skills Shortage?

Chatting with a colleague recently about local economic issues, she made a remark which I found profoundly interesting at the time.
Podcast
Podcast

Making Strides in Tech Workplace Culture

ISACA recently surveyed nearly 4,000 professionals in the tech workforce to find out what motivates them, what factors influence retention most and how perceptions about the workplace vary between women and men. In this SheLeadsTech Series episode of the ISACA Podcast, we delve into several of the survey findings.

1 October 2019
How 20 Minutes Can Lead to a More Inclusive Tech Workforce
Blog Post

How 20 Minutes Can Lead to a More Inclusive Tech Workforce

If perceptions were always reality, why would a company that has hired professionals after conducting reasonable background checks be wary of internally orchestrated fraud and other white-collar crime?
Who Should the CISO Report To? It Depends
Blog Post

Who Should the CISO Report To? It Depends

The information security challenges faced by enterprises are dependent on the unique characteristics of the business. This means there is no one “right” answer for where the CISO sits on the org chart.

Podcast
Podcast

Exploring Cybersecurity Misconceptions in Pop Culture

Popular culture depictions of cybersecurity, while entertaining, are often inaccurate, which could be dissuading people from exploring careers in cyber. In this podcast, we discuss some common misconceptions of cyber in pop culture, how that affects the cyberworkforce and how cyberprofessionals can draw people into cybersecurity careers.

26 September 2019
Digital Transformation
ISACA Journal Article

Sustainable Development for Digital Transformation, Part 2

Increasingly, organizations connect their on-premises infrastructures to cloud-based technologies, both from a Software-as-a-Service (SaaS) and an overarching infrastructure perspective.

Authors: Joe Raschke and Karen Walsh
The 2010s: A Decade of Growth and New Focal Points for ISACA
Blog Post

The 2010s: A Decade of Growth and New Focal Points for ISACA

The 2010s have seen remarkable growth at ISACA.
podcast
Podcast

Breaking Down Barriers in Mobile Security

The need for mobile security solutions has exploded in the 2000s, but many of organizations' traditional security considerations are insufficient when it comes to accounting for the proliferation of mobile devices. In this 50th Anniversary Series episode of the ISACA Podcast with guest Eric Green, we find out why it is so hard for individuals and their organizations to get it right on mobile security, and what can be done to break down those barriers.

24 September 2019
I Know What I Know (If You Know What I Mean)
Blog Post

I Know What I Know (If You Know What I Mean)

Edie Brickell (incidentally the wife of singer/songwriter Paul Simon) had a modest 1988 hit titled “What I Am.” The opening lines of the song contain the lyrics “I'm not aware of too many things. I know what I know if you know what I mean.”
What Capital One Got Right
Blog Post

What Capital One Got Right

The massive cyber breach of Capital One, reported in late July, quickly brought a chorus of condemnation of the company from a wide circle of pundits, concerned customers, competitors and potential investors. Lost in the media fray was Capital One’s exceptional incident response.
How Company Culture Helps Shape the Risk Landscape
Blog Post

How Company Culture Helps Shape the Risk Landscape

In today’s environment, companies all over the globe are experiencing culture risk.
Managing Third-Party Risk
@ISACA Article

Managing Third-Party Risk

Third-party vendors are integral to delivering products and services for many enterprises, and this can pose a risk to the organization itself.

18 September 2019
CISA: The Stepping Stone to an Auditor’s Success
@ISACA Article

CISA: The Stepping Stone to an Auditor’s Success

Dapo Ogunkola discovered the value of the Certified Information Systems Auditor (CISA) certification as an intern early in his career. While interning at a Nigerian bank in 2008, Ogunkola says, “I noticed all my mentors in the internal audit department were all CISAs...

18 September 2019
Leading as an Auditor and Woman in Tech: A Few Minutes With Deidre Melton, Internal Auditor and Investigator at Florida A&M University
@ISACA Article

Leading as an Auditor and Woman in Tech: A Few Minutes With Deidre Melton, Internal Auditor and Investigator at Florida A&M University

Deidre Melton, CISA, CRISC, CISM, CFE, CIA, serves as an assurance, risk assessor, investigator and advisory professional specializing in IT and cybersecurity at Florida A&M University (USA).

18 September 2019
Proactive Risk Management
@ISACA Article

Proactive Risk Management

While no one can predict the future, one can reasonably anticipate negative events and their outcomes, and even plan for appropriate responses. Risk management is a proactive planning process that mitigates and provides plans around negative events...

18 September 2019
Why COBIT 2019 Matters for Auditor
@ISACA Article

Why COBIT 2019 Matters for Auditor

The new publication COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution contains key concepts that can help auditors build prioritized audit plans.

18 September 2019
Cybersecurity
ISACA Journal Article

Factors Influencing the Adoption of Cybersecurity Situational Awareness Programs

The rapid and sustainable advancement of the IT environment has improved domestic and industrial operations and connectivity.

Author: David V. Hart
Sizing Up Email Security Protocols
Blog Post

Sizing Up Email Security Protocols

Given the many instances of email security compromises, it has become vital to provide additional security to emails from the domain administrator level. Security protocols such as Domain-Based Message Authentication, Reporting and Conformance (DMARC), Domain Keys Identified Mail (DKIM), Sender Policy Framework (SPF) and Brand Indicators for Message Identification (BIMI) to prevent address spoofing are considered below.
Has GDPR Been a Success So Far?
Blog Post

Has GDPR Been a Success So Far?

Since 25 May, 2018, the General Data Protection Regulation (GDPR) has been providing unified rules for data processing, requiring wider protection for the rights and interests of data subjects, and establishing important guidelines around the flow of information in the European Union.
Using COBIT 2019 Performance Management Model to Assess Governance & Management Objectives | ISACA COBIT 2019
Governance Article

Using COBIT 2019 Performance Management Model to Assess Governance & Management Objectives | ISACA

COBIT 5 was released in 2012 and, after 6 years, in November 2018, the first titles in the updated COBIT 2019 framework began to appear. Implementers observe that, in practice, enterprises often require several years to become familiar with an upgraded framework and adopt new guidance and standards.

16 September 2019
vThird-Party Vendor Selection: If Done Right, It’s a Win-Win
Blog Post

Third-Party Vendor Selection: If Done Right, It’s a Win-Win

The benefits that can be realized from using third parties to support the delivery of products and services are always part of any good sales pitch by prospective vendors. Often these benefits include reductions in operational spend, scalability, improved delivery time, specialized capabilities, and the availability of proprietary tools or software, all of which equate to a competitive advantage for companies leveraging third-party relationships effectively.
US Government Innovates Cyber Job Fulfillment
Blog Post

US Government Innovates Cyber Job Fulfillment

Cybersecurity professionals believe their teams are understaffed, many teams have unfilled positions, open positions often take six months or more to fill, and job candidates often are not qualified for the positions for which they applied, as evidenced in the last several State of Cybersecurity annual surveys conducted by ISACA.
Supply Chain Security
ISACA Journal Article

Call for Supply Chain Security

Awareness of the risk to enterprise information assets through the supply chain surged after the 2013 Target Corp. data breach.

Author: Tom Bray
CISOs Must Address Their Blind Spot for Effective Oversight of ICS Security
Blog Post

CISOs Must Address Their Blind Spot for Effective Oversight of ICS Security

Cybersecurity resilience of Industrial Control Systems (ICS), Building Management Systems (BMS) and other Operational Technology (OT) systems is falling behind, a critical challenge considering the potential impact of a cyberattack on ICS and OT could result in the loss of lives and/or major environmental damage.

How to Prepare for Taxation in a Digitalized Economy
Blog Post

How to Prepare for Taxation in a Digitalized Economy

While IT professionals and auditors are not required to be tax experts, they do need to have a certain level of mindfulness with regard to taxation within the digitalized economy going forward as tax collection is slowly but surely becoming part of the natural business ecosystem where taxation happens by default.
Improve ROI From Technology By Addressing the Digital Risk Gap
Blog Post

Improve ROI From Technology By Addressing the Digital Risk Gap

All too often, IT and risk management professionals seem to be speaking a different language—that is, if they even speak at all. Bridging the Digital Risk Gap, the new report jointly authored by RIMS, the risk management society®, and ISACA, promotes understanding, collaboration and communication between these professionals to get the most out of their organizations’ technological investments.
Cyber lock
The Nexus Article

A Key to Strengthening IT Security? Chaos

The chaos theory, a mathematics discovery first observed in the second half of the 20th century, aims to explain or even give some predictability to complex systems. At first glance, the chaos theory resembles most mathematical discoveries—a theoretical pursuit.

9 September 2019
How Responsible Are Cloud Platforms for Cloud Security?
Blog Post

How Responsible Are Cloud Platforms for Cloud Security?

These days, just about every software platform or app available has some kind of cloud functionality.
Innovating to Make a Difference and a Profit
@ISACA Article

Innovating to Make a Difference and a Profit

Automation has allowed machines to take over many jobs people used to perform, freeing humanity up to innovate and pursue more purposeful, meaningful careers. In this Off-Stage and Off-Script episode of the ISACA Podcast...

4 September 2019
Apocryphal Risk Management
@ISACA Article

Apocryphal Risk Management

Oftentimes, stories are widely circulated in organizations and serve as a source of truth. For instance, it could be an enterprise’s belief that an organizational apocalypse will occur if the website goes down.

4 September 2019
Complying With New Laws and Regulations Around the World
@ISACA Article

Complying With New Laws and Regulations Around the World

The EU General Data Protection Regulation (GDPR) inspired the US states of California and Washington to enact similar privacy laws, and many more states and countries are expected to follow suit.

4 September 2019
Join ISACA for a Global Day of Service on ISACA CommunITy Day
@ISACA Article

Join ISACA for a Global Day of Service on ISACA CommunITy Day

ISACA is committed to giving back and hopes to give ISACA members around the world a chance to make the world a better place during this new event, ISACA CommunITy Day on 5 October 2019. This inaugural event exemplifies ISACA’s purpose, promise and values with a day of volunteer service.

4 September 2019
Secure Your Networks Perimeter
@ISACA Article

Secure Your Networks Perimeter

Gaining perimeter access to networks can easily be accomplished via physical or proximity means. Some easy ways to thwart nefarious actors are to turn off your phone Wi-Fi when you leave your work or home ...

4 September 2019
Five Ways to Identify Early Leadership Opportunities as a Young Professional
Blog Post

Five Ways to Identify Early Leadership Opportunities as a Young Professional

It has been said that leadership cannot be learned and that it is an innate ability. While that may be true to a degree, there are steps young professionals can take to hone their innate leadership abilities through experience early in their careers.
Interesting Times Ahead: Why Young Professionals Should Consider Careers in Information Security
Blog Post

Interesting Times Ahead: Why Young Professionals Should Consider Careers in Information Security

About 10 years ago, when I was deciding on my major in university, I was very anxious about where my decision would lead me. I eventually chose Management of Information Systems, and fast forward 10 years later, I’m working as an information security consultant at a Big 4 firm.
HelpSource
ISACA Journal Article

HelpSource Q&A

Does the IT risk management process differ from organization to organization?

Author: Sunil Bakshi
Cybersecurity a Central Ingredient in Evolving Digital Business Models
Blog Post

Cybersecurity a Central Ingredient in Evolving Digital Business Models

About the only thing shifting as fast as the cyber threat landscape is the typical enterprise’s org chart.
Digital Transformation Oversight Extends Beyond Technology
Blog Post

Digital Transformation Oversight Extends Beyond Technology

Digital transformation. Digitalization. Digitization. Three business terms in common use today that describe the differences in scope of the organizational digital effort, in this case in order of decreasing scope.
Podcast
Podcast

Rebuilding Institutions for an Online World

Many of our institutions were created before the internet and major shifts on the technology landscape introduced unforeseen risks, threats and opportunities. In this Off-stage and Off-script edition of the ISACA Podcast, Infosecurity-ISACA North America Expo and Conference keynote speaker Jamie Bartlett provides his perspective on how to course correct.

3 September 2019
Digital Transformation Governance
ISACA Journal Article

Enhancing the Board’s Readiness for Digital Transformation Governance

Shortcomings in IT governance and in the skills and competencies of boards to provide the requisite direction for digital transformation (DX) mean that boards in general are ill-equipped for DX oversight and for the nature of the decisions required to effectively achieve it.

Author: Guy Pearce
Data Strategy
ISACA Journal Article

Value Creation Through Effective Data Strategy

It is often said that data are the new oil. This adage signifies not only how vital and valuable data are.

Author: Rajul Kambli
Data Privacy Laws
ISACA Journal Article

Information Security Matters: Why Do We Need Data Privacy Laws?

There has been no shortage of data privacy laws enacted in the past few years. The one that has received the most attention is the EU General Data Protection Regulation (GDPR).

Author: Steven J. Ross
Audit Committee Guidance
ISACA Journal Article

IS Audit Basics: Providing Audit Committee Guidance

The Directive on Security of Network and Information Systems (NIS Directive) has been transposed into law in many European countries.

Author: Ian Cooke
The Network
ISACA Journal Article

The Network: Adam Kohnke

What is the biggest security challenge that will be faced in 2020?

Author: Adam Kohnke
Interdisciplinary Auditors
ISACA Journal Article

The Practical Aspect: Today’s Interdisciplinary Auditors

The job of auditors has always been interdisciplinary. At the core of the auditor’s professional development is a multitude of disciplines—including accounting.

Author: Vasant Raval
Digital Security Architecture
ISACA Journal Article

The Need for a Digital Security Architecture

IT and security professionals tend to have a high degree of focus on tools and technology. While some place additional focus on processes.

Author: Jimmy Heschl
Digital Transformation of Taxation
ISACA Journal Article

Digital Transformation of Taxation

The advancement of technology from analog electronics and mechanical devices to the digital technology available today emerged in the 1980s, when the Third Industrial Revolution was born.

Author: Helena Strauss
Digital TransformationSustainable Development for Digital Transformation, Part 1
ISACA Journal Article

Sustainable Development for Digital Transformation, Part 1

Digital business models expand the numbers of an organization’s identities. Using new technologies to increase revenue and streamline business operations creates interconnected digital ecosystem.

Author: Joe Raschke
HelpSource
ISACA Journal Article

HelpSource Q&A

A speaker at a conference I recently attended stated that “Organizations must adopt digital transformation to stay ahead in business.”

Author: Sunil Bakshi
Know Who Your Customers Really Are or Prepare for Trouble
Blog Post

Know Who Your Customers Really Are or Prepare for Trouble

Recently in the UK, the women’s national football team manager, Phil Neville, called for all social media accounts to be verified and accountable as the result of a spate of racist postings, and asked for a boycott of social media until the situation is addressed.
Auditing Green IT
Blog Post

Auditing Green IT

Sustainability has become a key focus in the 21st century.

Trsar Family Helps Ensure ISACA’s Growth in ‘Good Hands’
Blog Post

Trsar Family Helps Ensure ISACA’s Growth in ‘Good Hands’

As ISACA celebrates its 50th anniversary in 2019, we are telling stories of the members, volunteers and staff who have contributed to ISACA’s growth and global impact. Below is an excerpt from a feature article on the ISACA staff father-son duo of Terry Trsar and Tim Trsar.
Keys to More Effective Vendor Risk Management
Blog Post

Keys to More Effective Vendor Risk Management

Certain industries have a better conceptual understanding of their supply chain than others. For instance, in manufacturing, it’s very clear that raw materials come in one end and out the other comes a completed, processed product for consumption.

Podcast
Podcast

How to Stay Motivated About Cybersecurity, Build Your Network and Earn CPE

Enthusiasm for cybersecurity helps professionals stay motivated, and finding a network of like-minded professionals can be invigorating. Conferences can help cybersecurity professionals learn more and stay excited about cyber, but the amount of information gained from them can be overwhelming. In this Cyber Pros Exchange podcast, we discuss how you can make the most of a conference experience.

28 August 2019
Ethics in IT: An Emerging Frontier in the Enterprise Governance of IT
Blog Post

Ethics in IT: An Emerging Frontier in the Enterprise Governance of IT

Trust. Privacy. Transparency. Three words that have invaded our technology lexicon. In an age of fashionable falsehoods, it is probably not surprising that these words permeate almost any aspect of our lives in technology, in government and even in our organizations.

Improving Cybersecurity Awareness Through Hacking
Blog Post

Improving Cybersecurity Awareness Through Hacking

Cybersecurity awareness is a topic that most organizations and leaders know is important, but is typically treated as a check box requirement to remain compliant with regulations or mandates placed on the enterprise. Most leaders will argue that cybersecurity awareness training is very important but only marginally effective.
How Cybersecurity Can Better Support Digital Transformation Business Goals
Blog Post

How Cybersecurity Can Better Support Digital Transformation Business Goals

Consumers are demanding we offer outstanding user experiences and technology interfaces, and we need to strategize how we both safeguard and leverage ever-growing portfolios of data and systems to differentiate ourselves from our competitors.

Learning to Secure AI
Blog Post

Learning to Secure AI

The trends appear to be presenting themselves all over the place; TV commercials, online ads, corporate product announcements, etc., are all saying the same thing: Artificial intelligence (AI) adoption and use are exploding.
Earn CPE While Learning About Emerging Trends at EuroCACS CSX Conference
@ISACA Article

Earn CPE While Learning About Emerging Trends at EuroCACS CSX Conference

Further your knowledge of information systems, business and cybersecurity at this year’s EuroCACS/CSX conference, 16-18 October 2019. This year’s event combines computer audit, control and security...

21 August 2019
Paving the Future of Tech With Cybersecurity Education Teen Cybersecurity Activist Kyla Guru
@ISACA Article

Paving the Future of Tech With Cybersecurity Education Teen Cybersecurity Activist Kyla Guru

Security and safety are primary needs for all people. The requirements for both have changed in the digital age and need everyone’s attention now more than ever.

21 August 2019
Systems Thinking in Risk Management
@ISACA Article

Systems Thinking in Risk Management

Systems thinking is the ability or skill to solve problems in a complex system. Systems thinking focuses on understanding the way subsystems and resources of a system are interrelated and identifying interdependencies of subsystems in the context of the organization.

21 August 2019
Using EDR to Address Unmanaged Devices
@ISACA Article

Using EDR to Address Unmanaged Devices

Endpoint detection and response (EDR) systems allow enterprise security managers to detect how and when an endpoint has been compromised. But what happens when the endpoint is an unmanaged device?

21 August 2019
Exploring COBIT 2019s Value for Auditors
Blog Post

Exploring COBIT 2019s Value for Auditors

COBIT 2019 is a terrific resource for a wide range of business technology professionals.
Effective User Access Reviews
ISACA Journal Article

Effective User Access Reviews

User access review is a control to periodically verify that only legitimate users have access to applications or infrastructure.

Author: Sundaresan Ramaseshan
Podcast
Podcast

Who Holds the Keys to Your Data

Data centers no longer look the same as they did years ago. More and more is being outsourced, and the involvement of third parties can create risk for organizations. In this podcast, we discuss the implications of an outsourced data center and what organizations can do to keep their data safe.

20 August 2019
In the Age of Cloud Physical Security Still Matters
Blog Post

In the Age of Cloud Physical Security Still Matters

As a security consultant, I’ve had the opportunity to assess the security postures of clients of all shapes and sizes. These enterprises have ranged in sizes from a five-man startup where all security (and information technology) was being handled by a single individual to Fortune 500 companies with standalone security departments staffed by several people handling application security, vendor security, physical security, etc. This post is based primarily on my experiences with smaller clients.
The Role of Ethics in Risk Management
Blog Post

The Role of Ethics in Risk Management

Most people are aware of and talking about risk management. However, barring a handful of high-profile and sophisticated IT organizations, for most enterprises, it is more talk vs. the actual implementation of risk management practices.
Digital Business Transformation Using COBIT 2019 | ISACA
Governance Article

Digital Business Transformation Using COBIT 2019 | ISACA

In today’s economy, digital business transformation is not an option—it is business imperative. Many enterprises develop a false sense of transformation security by running isolated digital projects and change initiatives that are not strategically transformational.

19 August 2019
The Film Industry and IT Security
Blog Post

The Film Industry and IT Security

For those in the ISACA community who are fans of popular culture, you might have noticed in recent years that, in many cases, film and TV stars are beginning to look more like you and I, and less like the muscle men of our youths.
Ethical Considerations of Artificial Intelligence
Blog Post

Ethical Considerations of Artificial Intelligence

Have you ever stopped to consider the ethical ramifications of the technology we rely on daily in our businesses and personal lives?

The Key Point Everyone is Missing About FaceApp
Blog Post

The Key Point Everyone is Missing About FaceApp

Much has been written in recent weeks about the widely publicized privacy concerns with FaceApp, the app that uses artificial intelligence (AI) and augmented reality algorithms to take the images FaceApp users upload and allow the users to change them in a wide variety of ways.

AI Revolution
ISACA Journal Article

Preparing for the AI Revolution

C-level executives, security professionals, IT technicians and audit managers face constant pressure to assess, assimilate and govern emerging technology, including artificial intelligence (AI).

Author: Adam Kohnke
Auditing a Migration Plan When Transferring from On Site to the Cloud
Blog Post

Auditing a Migration Plan When Transferring from On Site to the Cloud

Have you ever audited a computer system’s migration plan when transferring it from on site to the cloud? Here are some recommendations to keep in mind based on lessons learned from migration practices:
Applying Chaos Theory to Security
Blog Post

Applying Chaos Theory to Security

It has become almost impossible to face cybersecurity issues just by using the presently available countermeasures; hackers always find aways to bypass them.

The Digital Age: A New World of Purpose-Driven Opportunity
Blog Post

The Digital Age: A New World of Purpose-Driven Opportunity

Jon Duschinsky, an entrepreneur, social innovator and firm believer in leading a purpose-driven existence, will be the closing keynote speaker at ISACA’s EuroCACS/CSX 2019 conference, to take place 16-18 October in Geneva, Switzerland. Duschinsky recently visited with ISACA Now and shared his thoughts on why being purpose-driven is more realistic than ever in today’s digital age. For more of Duschinsky’s insights, listen to his recent appearance on the ISACA Podcast.
Jon Brandt
The Nexus Article

(Mental) State of the Security Practitioner

In today’s world, the need to take care of oneself is more important than ever. The “always on” mentality exerted upon many salaried employees—especially those charged with detecting, responding and recovering from incidents...

12 August 2019
Modernized Maritime Industry Transports Cyberthreats to Sea
Blog Post

Modernized Maritime Industry Transports Cyberthreats to Sea

If there is one universal truth we have learned from developments on the cybersecurity landscape in recent years, it is that none of us are free from cyberthreats. Attackers identify and exploit vulnerabilities wherever they might exist, regardless of the target’s geographic location, whether the target is an individual or an enterprise, or which industry sector the target represents.
Earn Up to 37 CPE Hours at Infosecurity ISACA Conference
@ISACA Article

Earn Up to 37 CPE Hours at Infosecurity ISACA Conference

This year, ISACA and Infosecurity Group have collaborated to debut the Infosecurity ISACA North America Expo and Conference. ISACA will leverage its Cybersecurity Nexus™ (CSX) workshops, certification prep and CSX Training Platform ...

7 August 2019
Homomorphic Encryption: Privacy Throughout the Data Life Cycle
@ISACA Article

Homomorphic Encryption: Privacy Throughout the Data Life Cycle

As cybersecurity experts, we are sometimes confronted with encryption techniques that go far beyond our understanding of the math involved.

7 August 2019
Learning to Navigate the Job Marketplace
@ISACA Article

Learning to Navigate the Job Marketplace

Looking for a new job can be daunting. You must determine where to start your search and what skills you need for certain positions. Then you must apply to openings, land an interview and receive an offer.

7 August 2019
Securing the Internet of (Kitchen) Things
@ISACA Article

Securing the Internet of (Kitchen) Things

The kitchen has become a testing ground for Internet-connected devices. While these devices can make cooking easier and more enjoyable, they also present a security risk. In the recent ISACA Podcast episode...

7 August 2019
ISACAs Global Impact To Be Celebrated on ISACA CommunITy Day
Blog Post

ISACAs Global Impact To Be Celebrated on ISACA CommunITy Day

On 5 October 2019, ISACA will conduct its inaugural ISACA CommunITy Day, a day of global service for ISACA members (through their chapters) and staff to give back to their local communities
Chaos to the Rescue
ISACA Journal Article

Chaos to the Rescue

The chaos theory was discovered in the mathematics field and began to be observed in daily life during the second half of the 20th century.

Authors: Jean Jacques Raphael, Jean Claude Célestin and Eric Romuald Djiethieu
Podcast
Podcast

Innovating with a Purpose

As automation has taken hold, more and more jobs that people used to perform are now taken care of by machines. That means humans have more opportunities to innovate and pursue purpose-driven careers that are meaningful to them on a personal level. In this Offstage and Offscript edition of the ISACA Podcast, EuroCACS/CSX 2019 keynote speaker Jon Duschinsky discusses why people and organizations should be enthused about the new professional landscape.

6 August 2019
FaceApp Puts Privacy Back Under Spotlight
Blog Post

FaceApp Puts Privacy Back Under Spotlight

There has been a heightened surge of questions about data privacy in recent weeks, especially in light of the app called FaceApp.

Measuring Risk Quantitatively
Blog Post

Measuring Risk Quantitatively

Quantitative risk has become a growing field of interest for information security professionals.

Impressions From Delivering COBIT 2019 Foundation Training for Auditors | ISACA
Governance Article

Impressions From Delivering COBIT 2019 Foundation Training for Auditors | ISACA

Due to the nature of their profession, IT auditors are some of the stakeholders most interested in COBIT. Delivering COBIT 2019 Foundation training to groups of IT auditors is a good way to glean insights and tips from the IT auditor’s perspective.

5 August 2019
Establishing a Foothold in the Professional World as a Young Professional
Blog Post

Establishing a Foothold in the Professional World as a Young Professional

Extracurricular activities have filled my schedule for as long as I can remember. I was always involved in academic clubs and societies, and in most I held leadership positions.
How To Land Your First Job in Cybersecurity
Blog Post

How To Land Your First Job in Cybersecurity

Taking that first step on the career ladder is a difficult challenge in pretty much any industry. Even for entry-level opportunities, employers generally look for some level of previous industry experience. The question is, how do you get experience without having experience?

2 August 2019
Where to Begin Addressing the Policy-to-Execution Gap
Blog Post

Where to Begin Addressing the Policy-to-Execution Gap

How do you transform security and privacy compliance requirements into practical steps that can be executed by a team?
Assessing Public Sector Cyber Risk
Blog Post

Assessing Public Sector Cyber Risk

The past decade has seen a significant advance in cyber risk assessment maturity.
Capital One Data Breach | Cybercrime | ISACA Blog
Blog Post

Capital One Data Breach | Cybercrime | ISACA Blog

What We Should Learn from the Capital One Data Breach. ISACA reviews how learnings presented an opportunity to understand & improve our own security operations.

IT Governance and Management
ISACA Journal Article

Auditing Green IT Governance and Management With COBIT 5

Today’s organizations find themselves facing a relatively new challenge—governing and managing sustainability—since sustainability has become an important issue and is increasingly essential for business.

Authors: J. David Patón-Romero, Maria Teresa Baldassarre, Moisés Rodríguez, and Mario Piattini
IoT Security
ISACA Journal Article

The IoT as a Growing Threat to Organizations

There is a new cyberthreat that is growing with the potential to have major impact on information security and personal privacy.

Author: Larry G. Wlosinski
Podcast
Podcast

Internet of Medical Things

Medical devices that are connected to the Internet can empower patients and help healthcare providers better monitor their patients’ health. But these connected devices also pose a great security risk as they collect personal health information. In this podcast, we discuss the risk and benefits of connected medical devices, the regulatory landscape surrounding Internet of Medical Things devices, and how to securely configure them.

31 July 2019
Peer Recognition of Outstanding Achievements Within ISACA Community
Blog Post

Peer Recognition of Outstanding Achievements Within ISACA Community

The prestige of the ISACA Awards Program is evident by the high caliber of recipients who are nominated and selected by their peers. Consider the eight Global Achievement Award recipients honored at North America CACS in 2019.
Addressing the Vulnerabilities of IoT Devices
Blog Post

Addressing the Vulnerabilities of IoT Devices

My recent Journal article on the Internet of Things (IoT) was inspired by an article I read on a botnet takedown that involved the digital recording devices that many people have connected to their television.
How to Approach Mitigating Third-Party Risk
Blog Post

How to Approach Mitigating Third-Party Risk

Vendor management comprises all processes required to manage third-party vendors that deliver services and products to organizations.
COBIT 2019 and Marathons
Blog Post

COBIT 2019 and Marathons

Training is important for marathon runners, but there are a number of specific factors that go into marathon runners achieving their personal best. Take a look at the examples below (and for you non-runners, your COBIT and digital transformation muscles will be exercised soon enough):
Tips for Prioritizing Risk in Your Risk Register
@ISACA Article

Tips for Prioritizing Risk in Your Risk Register

News outlets across the world report that organizations of all types continue to suffer grave impacts from cyberthreats and incidents.

24 July 2019
Learn, Network and Volunteer With Peers Around the World
@ISACA Article

Learn, Network and Volunteer With Peers Around the World

Engage—ISACA’s online portal in which professional community members can learn, network and participate—will celebrate its 1-year anniversary in September 2019.

24 July 2019
Listen and Learn More About the Baltimore Ransomware Attack
@ISACA Article

Listen and Learn More About the Baltimore Ransomware Attack

A ransomware attack leveraging an unpatched vulnerability affected several of Baltimore (Maryland, USA)’s, government services. In the recent Cyber Pros Exchange episode of the ISACA Podcast, Frank Downs and Dustin Brewer...

24 July 2019
Transitioning GDPR Preparations Into Operations
Blog Post

Transitioning GDPR Preparations Into Operations

While organizations may think that they have done everything needed to prepare for GDPR, they may not have thought about how they arrive at assurance over GDPR, especially considering that being prepared for GDPR is different from having GDPR as part of operations.
Podcast
Podcast

Cyber in the Kitchen

The kitchen has become a testing ground for Internet-connected devices. While these devices can make cooking easier and more enjoyable, they present a security risk. In this podcast, we discuss the risk of IoT-connected devices and how you can leverage their benefits while remaining secure.

23 July 2019
Cyber Lessons for Enterprises from the Equifax Breach and Record Fine
Blog Post

Cyber Lessons for Enterprises from the Equifax Breach and Record Fine

Government regulators and representatives of Equifax announced a settlement on penalties and consumer restitution related to the 2017 data breach that exposed sensitive information belonging to 148 million people.
The Need for Speed
Blog Post

The Need for Speed

In the 1980's movie Top Gun, the protagonist utters the phrase, “I feel the need, the need for speed!” Peter “Maverick” Mitchell was an F-14 Tomcat pilot, an interceptor jet capable of flying more than twice the speed of sound.
NIST Risk Management Framework: What You Should Know
Blog Post

NIST Risk Management: What you Should Know | ISACA Blog

In late December 2018, NIST published a second revision of SP800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.
Taking Precautions With Smart Home Gadget Security
Blog Post

Taking Precautions With Smart Home Gadget Security

Smart home gadgets have been among the most popular holiday, housewarming and any-occasion gifts for the last few years. Whether it’s an interconnected home security system, a pet camera, or a voice-activated assistant like the Amazon Echo, homeowners and renters alike love having these tech gadgets in their homes.
Corporate Governance
ISACA Journal Article

Redefining Corporate Governance for Better Cyberrisk Management

Corporate governance refers to the set of responsibilities to be fulfilled by the higher-level management structures of an organization, such as the management team, board of directors (BoD), and board and management committees.

Author: Vimal Mani
Reimagining the Enterprise Landscape Through Advanced Technology
Blog Post

Reimagining the Enterprise Landscape Through Advanced Technology

Stafford Masie, CEO of Google Africa (2006–09) and Non Executive Board Member at ADvTECH, will be the closing keynote speaker at the 2019 Africa CACS conference, to take place 19-20 August in Johannesburg. Masie, an inventor, mentor and keen observer of how to humanize technology, recently visited with ISACA Now to discuss how enterprises in Africa and beyond can take advantage of the major technological forces of the day, such as artificial intelligence and advances in fintech. The following is a transcript, edited for length and clarity:
Podcast
Podcast

Women in Technology: Starting Early to Address the Leaky Pipeline

As a high school student, Kyla Guru already has started her own cybersecurity education program and helped launch a conference for high school girls interested in technology. In this SheLeadsTech Series edition of the ISACA Podcast, Guru talks about how she became so engaged, so quickly, in cybersecurity and championing girls and women in technology.

16 July 2019
Defining the ROI of Automation
Blog Post

Defining the ROI of Automation

In his opening remarks to the general session of the Institute of Internal Auditors (IIA) 2018 Midyear Meetings in Orlando (Florida, USA), IIA Global Board Chairman Naohiro Mouri said that throughout his international travels while in office, he rarely heard from audit practitioners about the “pain of automation” despite the oft-cited benefits of automation technologies and their potential to revolutionize the internal audit function.
Getting Creative to Solve Security Challenges in Healthcare
Blog Post

Getting Creative to Solve Security Challenges in Healthcare

A recent article about information security challenges in healthcare pointed to the lack of resources many security teams report.
Why Peter Pan Hates COBIT 2019 | ISACA
Governance Article

Why Peter Pan Hates COBIT 2019 | ISACA

Why would Peter Pan have an opinion on COBIT 2019, and a dark one no less? No, COBIT is not the name of the newest deckhand working for Captain Hook. Rather, it can be explained by my experience in which many enterprises are averse to change and

15 July 2019
Practically Implementing DevSecOps
Blog Post

Practically Implementing DevSecOps

The explosion of DevSecOps has caused a lot of excitement and worry within the cybersecurity community. It is no longer of question of should an organization implement DevSecOps, but rather when and how?

Vendor Selection for ISO 27001 2013 Certification
Blog Post

Vendor Selection for ISO 27001 2013 Certification

The Information Security Management Systems Certification (ISO 27001:2013) helps organizations prove they are managing the security of clients’ and stakeholders’ information, and can generate the need for three types of vendors: certification body, internal audit and implementation.
Aligning Governance and Risk Management to Maximize Impact
@ISACA Article

Aligning Governance and Risk Management to Maximize Impact

Governance, risk management, control and business professionals from around the world can meet at the IIA and ISACA-hosted Governance, Risk and Control (GRC) Conference. This year’s conference, which takes place...

10 July 2019
Five Key Considerations When Developing Information Security Risk Treatment Plans
@ISACA Article

Five Key Considerations When Developing Information Security Risk Treatment Plans

Risk treatment plans are an essential component of an organization’s information risk management and security strategy program.

10 July 2019
Celebrating the 2019 ISACA Award Recipients and Nominating for the 2020 Awards
@ISACA Article

Celebrating the 2019 ISACA Award Recipients and Nominating for the 2020 Awards

The 2019 ISACA Global Achievement Awards were presented at North America CACS in May 2019. Recipients from around the world gathered to accept their honors after being nominated by their peers in 2018

10 July 2019
Are the British Airways and Marriott GDPR Fines a Tipping Point?
Blog Post

Are the British Airways and Marriott GDPR Fines a Tipping Point?

For many months, infosec and privacy colleagues alike have been telling me that the FUD (fear, uncertainty and doubt) about the terrifying levels of EU fines under the European Union General Data Privacy Regulation (GDPR) have disappeared from the boardrooms and executive management meetings.
Stripping Off the Monster Tag from IT Governance An Inclusive Approach
Blog Post

Stripping Off the Monster Tag from IT Governance An Inclusive Approach

It is said that anything with two heads is a monster. I usually think of this saying when carrying out IT governance reviews, as inclusive governance seems to be a missing link.
podcast
Podcast

The Staying Power of the CISA Certification

The Certified Information Systems Auditor (CISA) certification is ISACA's flagship certification and has played a major role in the organization's growth and global cachet over ISACA's 50-year history. In this 50th Anniversary Series edition of the ISACA Podcast, guest Thomas Phelps discusses how the CISA has remained relevant amid a dynamic and fast-changing technology landscape.

9 July 2019
Alen Beganovic
The Nexus Article

Qualified Certificates as a Foundation for Digital Transformation

Human tasks such as handwritten signing are an obstacle to digital transformation. These human tasks interrupt process digitalization and create the need for the implementation of expensive processes such as accessing, storing and archiving paper-based documentation.

8 July 2019
Rebuilding Institutions for an Online World
Blog Post

Rebuilding Institutions for an Online World

Author and journalist Jamie Bartlett will be the closing keynote speaker at the Infosecurity ISACA North America Expo and Conference, which will take place 20-21 November 2019 in New York City. Bartlett recently visited with ISACA Now to discuss his outlook on how technology is reshaping society, beginning with his contention that the internet is killing democracy. The following is an edited transcript of the interview:
Podcast
Podcast

Does IT Auditing Still Make Sense?

The role of IT auditors has changed as technology has changed. In this podcast, we discuss the role of IT audit and how IT audit can help strengthen information security and cybersecurity measures.

2 July 2019
Coincidence or History?
Blog Post

Coincidence or History?

On 23 October 1969—just a few months after Apollo 11 landed on the moon—the Electronic Data Processing Auditors Association (EDPAA), later to become ISACA, was incorporated.

Don’t Forget These Factors When Considering a Certification
Blog Post

Don’t Forget These Factors When Considering a Certification

Part of growing as a young professional is being willing to continually learn and knowing your education should never stop.

1 July 2019
Five Ways to Jump-Start Your Career in the Tech Workforce
Blog Post

Five Ways to Jump-Start Your Career in the Tech Workforce

Are you a student or an early-career professional seeking to kick-start your career in tech? Do you feel a bit overwhelmed by the possibilities out there, unsure of yourself, and lacking a clear idea not only of where you'd like to go, but how you can get there?
Securing Your Data The Crown Jewels of Your Enterprise
Blog Post

Securing Your Data The Crown Jewels of Your Enterprise

Every organization has data that is vital for its organizational growth. Typically, most organizations build security around infrastructure, network and applications. But with data leakage becoming more prevalent, organizations are now considering data to be their crown jewel.
Information Security Matters
ISACA Journal Article

Information Security Matters: Someone Else

Running an IT department used to be so simple. The programmers wrote programs; the technicians migrated the programs into production; and the operators ran them. Learn how this has changed.

Author: Steven J. Ross
Risk Assessment
ISACA Journal Article

Evolving From Qualitative to Quantitative Risk Assessment

It is only recently that quantitative risk for information security has been introduced as a possible evolution from qualitative risk methodologies.

Author: Benoit Heynderickx
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Lessons From History

So, and in case you have been living in a cave somewhere, ISACA is 50—a significant historical milestone. Here are the lessons we've learned along the way.

Author: Ian Cooke
Innovation Governance
ISACA Journal Article

Innovation Governance: The Balance of Speed and Protection in Innovation

Organizations embrace innovation in order to outcompete others in their space. The mission in audit is to protect the business.

Author: K. Brian Kelley
The Network
ISACA Journal Article

The Network: Brennan P. Baybeck

What is the biggest security challenge being faced in 2019?

Author: Brennan P. Baybeck
Compliance Risk in Finance and Banking
ISACA Journal Article

Understanding Compliance Risk in Finance and Banking

Banks need to design automatic & continuous risk assessments that align with compliance & regulatory issues.

Author: Muhammad Waheed Qureshi
The Pain of Automation
ISACA Journal Article

The Pain of Automation

Internal audit leaders are looking at automation technologies for many of the same reasons as business management.

Authors: Wade Cassels, Jane Traub, Kevin Alvero, and Jessica Fernandez
Digital Transformation Governance
ISACA Journal Article

Acknowledging Humanity in the Governance of Emerging Technology and Digital Transformation

Artificial intelligence (AI) and robotics have captured the imagination of humans. A quick search for AI and robotics in pop culture finds that it stretches back to Mary Shelley’s book.

Author: Guy Pearce
The Internet of Medical Things
ISACA Journal Article

The Internet of Medical Things—Anticipating the Risk

The Internet of Medical Things (IoMT) is and has been a driving force of the networked medical device landscape ecosystem.

Author: Mohammed Khan
Rethinking Risk
ISACA Journal Article

Rethinking Risk

Not all that long ago, getting the enterprise to invest in IT required some convincing.

Author: Rajesh Srivastava
DevSecOps Implementation
ISACA Journal Article

Three Strategies for a Successful DevSecOps Implementation

The DevSecOps methodology movement began in response to security concerns with the DevOps methodology.

Author: Taimur Ijlal
Agile Environment
ISACA Journal Article

Bridging the Gap Between Policies and Execution in an Agile Environment

With the perpetual occurrence of high-profile attacks and data breaches caused by software vulnerabilities, a new trend known as secure by design (“shifting left”) has gradually shaped the software world.

Authors: Mina Miri, Amir Pourafshar, Pooya Mehregan, and Nathanael Mohammed
Analyst and Adversary
ISACA Journal Article

Analyst and Adversary

Each year, reports of new threats and security breaches reveal the ever-increasing sophistication of attackers and their methods for outwitting available control mechanisms.

Author: Jeimy J. Cano M.
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

Is enterprise governance of IT (EGIT) relevant for SME organizations?

Author: Sunil Bakshi
Continuous Security Validation
Blog Post

Continuous Security Validation

No corporate executive should feel secure. Every day, we keep hearing about yet another company getting hacked or losing sensitive data.
Podcast
Podcast

Moving Risk Management From Fear and Avoidance to Performance and Value

Many organizations view risk management as an unpleasant process that has to be done to meet regulatory requirements. But what if risk management were leveraged to add value to organizations and strengthen their security measures? In this podcast, we discuss how to use risk management to improve performance and add value.

27 June 2019
North America CACS Conference Highlights Impact of Disruptive Technologies
@ISACA Article

North America CACS Conference Highlights Impact of Disruptive Technologies

The North America CACS 2019 conference took place 13-15 May 2019 in Anaheim, California, USA. This conference, which is held for IS audit, assurance, control, governance and security professionals...

26 June 2019
Can Organizations Afford Proprietary Models for Third-Party Assessments
@ISACA Article

Can Organizations Afford Proprietary Models for Third-Party Assessments

When implementing a third-party risk management or vendor risk management (VRM) program, there are many decisions that must be made: How many levels of criticality should there be?

26 June 2019
Take the Next Step in Your Cybersecurity Career
@ISACA Article

Take the Next Step in Your Cybersecurity Career

ISACA is introducing 3 new Cybersecurity Nexus™ (CSX) Cybersecurity Career Pathways course offerings to enable those with prior industry certifications and a strong IT/cybersecurity foundation to prepare for a new role or career advancement.

26 June 2019
The Sheer Gravity of Underestimating Culture as an IT Governance Risk
@ISACA Article

The Sheer Gravity of Underestimating Culture as an IT Governance Risk

Poor IT governance can be even worse than no IT governance. Managing IT risk as part of governance of enterprise IT (GEIT) is a key factor to IT governance success, as discussed in Guy Pearce’s ISACA Journal, volume 3, article...

26 June 2019
Understanding Technology Shifts in the Financial Sector
@ISACA Article

Understanding Technology Shifts in the Financial Sector

From mobile payments to the use of artificial intelligence (AI) to the introduction of new security risk, technology has had a profound impact on how the financial sector operates. In this 50th Anniversary Series episode of the ISACA Podcast...

26 June 2019
Extracting More Value from IoT Using COBIT 2019
Blog Post

Extracting More Value from IoT Using COBIT 2019

The time for making predictions about the number of IoT devices in future years and waiting for that time to come is long gone (however, if you really want to know, one source predicts there are going to be 75 billion IoT devices in 2025).
Podcast
Podcast

Examining the Baltimore Ransomware Attack

A ransomware attack leveraging an unpatched vulnerability affected several government services for the city of Baltimore (Maryland, USA). In this podcast, we discuss how this ransomware attack occurred, the services it affected and lessons learned from this attack.

25 June 2019
Lessons Learned While Combining COBIT 5 & ITIL | ISACA
Governance Article

Lessons Learned While Combining COBIT 5 & ITIL | ISACA

An engagement at a financial technology (fintech) organization provided a novel first-hand experience of working with COBIT 5. Despite more than 7 years’ experience in governance, risk and compliance (GRC) projects that involved COBIT 5

24 June 2019
How Small and Medium Businesses Can Leverage Cybersecurity for Client Value: Six Ways to Get Started
Blog Post

How Small and Medium Businesses Can Leverage Cybersecurity for Client Value: Six Ways to Get Started

Small and medium-sized businesses (SMBs) lack the resources of a large business, in both finances and personnel, making it more difficult to extract client value from a robust cybersecurity program.
How to Properly Review an SOC Report
Blog Post

How to Properly Review an SOC Report

As a follow-up to a blog post previously published by The Mako Group’s Chief Audit Executive, Shane O’Donnell, let’s dig a little deeper into what you should be reviewing when you receive your vendors’ SOC 1, SOC 2 or SOC 3 reports.
podcast
Podcast

Technology Shifts in the Financial Sector

From mobile payments to the use of artificial intelligence to the introduction of new security risks, technology has had a profound impact on how the financial sector operates. In this 50th Anniversary Series episode of the ISACA Podcast, Ashley Holmes analyzes the past, present and future state of fintech. Holmes notes that banks and others in the financial services sector have to manage a balancing act in embracing innovation and automation while not alienating customers that still expect a certain level of human-to-human service and accessibility.

18 June 2019
Brennan Baybeck
Blog Post

ISACA’s Future Brimming With Opportunity

As my relationship with ISACA unfolded through various volunteer roles for the past 25 years, I have had the privilege of seeing the organization evolve – through good times and challenging times – just as many of us have experienced in our personal lives and careers.
Patch Management Practice
Blog Post

Patch Management Practice

Unpatched systems represent a very serious IT security threat with potentially extremely important consequences, as documented in a large number of high-profile breaches that exploited known unpatched vulnerabilities.
Drive Your Own Destiny in Achieving Goals
Blog Post

Drive Your Own Destiny in Achieving Goals

An individual would be hard-pressed to debate that behaviors and habits individuals exercise in their personal lives have no bearing or effects on their professional career.
Three Steps to Begin Transforming Your Cybersecurity Program
Blog Post

Three Steps to Begin Transforming Your Cybersecurity Program

The nature of risk management has changed over the past 2 decades. Previously isolated IT infrastructures are more connected with the outside world, and organizations face an ever-expanding threat landscape.
4 Vs of Big Data
@ISACA Article

4 Vs of Big Data

Big data requires strong data handling processes in data-intensive systems. Today, with the incredible growth of data collection into systems of diverse kinds and sizes around the world, we need to understand big data basics for review, audit and security purposes.

12 June 2019
ISACA Podcast Now Available on Stitcher
@ISACA Article

ISACA Podcast Now Available on Stitcher

The ISACA Podcast, which provides coverage of and unique perspectives on IT audit, security, governance and risk issues affecting organizations today, is now available on the Stitcher app. Stitcher can be accessed through iOS devices, Android devices and through a web player.

12 June 2019
The Evolving Role of the CIO
@ISACA Article

The Evolving Role of the CIO

Interested in learning what the role of the chief information officer (CIO) is and how it is evolving? What are some of the challenges CIOs face in their daily work, and what are the required skills, knowledge and attributes needed to ...

12 June 2019
Rethinking Cost Analysis in the Era of Cloud Computing and Emerging Tech
Blog Post

Rethinking Cost Analysis in the Era of Cloud Computing and Emerging Tech

Have you thought about cost analysis in the era of cloud operation, combined with other emerging technologies? There is an orthodox way of considering cost analysis: Costs can be fixed, variable or some combination of the two. However, when it comes to analyzing IT costs, traditional cost analysis in the era of emerging technologies is inadequate.
A Look at CIS Controls Version 7.1
Blog Post

A Look at CIS Controls Version 7.1

CIS Controls Version 7.1, released in April 2019, was developed by Center for Internet Security (CIS), which consists of a community of IT experts.
Increasing Your Organizaton’s Cybermaturity
Blog Post

Increasing Your Organizaton’s Cybermaturity

Managing cyberrisk is critically important for organizations. Interconnectedness, digitization, the focus on utilizing data and providing enhanced client experiences expand the attack surface and expose an organization to increased cyberrisk.
Anna P. Murray
The Nexus Article

Data Security and Niche Software

Inside a large corporation, it is sometimes easy to forget that not everyone’s life revolves around SAP, Salesforce, Adobe Experience Manager or Microsoft Azure. Squadrons of software categories exist to help small and mid-size businesses operate in niche markets that do not align with (and, frankly, could not afford) the offerings of the larger players.

10 June 2019
Aleš Zupan
The Nexus Article

Building Cybersecurity Culture With Effective Awareness and Training Programs

Different information sources claim that 90% of cyberattacks are successful because of the mistakes made by information technology users.1, 2 The range of mistakes is broad and includes bad password practices, systems with open vulnerabilities, susceptibility to phishing and spear phishing attacks, risky information sharing practices and more.

10 June 2019
5 Steps for Auditing IT Risk Management Using IT Risk Management Audit/Assurance Program | ISACA
Governance Article

5 Steps for Auditing IT Risk Management Using IT Risk Management Audit/Assurance Program | ISACA

With the increasing complexity of IT systems and their widespread implementation in virtually all spheres of life (e.g., medicine, banking, manufacturing, education), managing IT risk effectively becomes extremely challenging.

10 June 2019
Integrating Human and Technical Networks in Organizational Risk Assessments
Blog Post

Integrating Human and Technical Networks in Organizational Risk Assessments

The US government’s recent efforts to ban the introduction of specific foreign IT vendors’ equipment in government networks is emblematic of the growing concern among organizational leaders posed by global supply chains, highlighting the broad interdependencies between technical and human systems
Innovation Is About People
Blog Post

Innovation Is About People

I was a member of an innovation team because of my expertise in servers, Active Directory and general information security practices.

MIT CISR Research Forum: Designing for Digital Leverage
Blog Post

MIT CISR Research Forum: Designing for Digital Leverage

The MIT CISR Research Forum (Europe), hosted by Heineken, recently was held in Amsterdam. As a partner of MIT CISR, ISACA was represented at the event. Presentation titles on the agenda like “Quick Look: What Is Your Digital Business Model?” by Joe Peppard, “Digitized Is Not Digital” by Jeanne Ross, “Managing Organizational Explosions During Digital Transformation” by Nick van der Meulen, and others, provided a good general sense of what the event would be all about.
The Role of Culture on IT Governance
Blog Post

The Role of Culture on IT Governance

It was 150 years ago that Sir Edward Tylor first referenced culture (in an anthropological sense) in his book Primitive Culture.

Why Don’t We Apply Due Diligence in Selecting Social Media Providers?
Blog Post

Why Don’t We Apply Due Diligence in Selecting Social Media Providers?

I’ve reviewed many social media implementations across a large variety of companies and, among the many concerns from a security perspective, is the total lack of due diligence over their selection.
Risk Analysis Requires Business Acumen
@ISACA Article

Risk Analysis Requires Business Acumen

It is relatively easy for those in information security to spend their entire careers without a solid understanding of how the organizations they work for make money. This is true whether they work in a for-profit or nonprofit organization.

29 May 2019
Learn to View Your Cybersecurity Program Holistically
@ISACA Article

Learn to View Your Cybersecurity Program Holistically

With the rise of cloud use, cybersecurity must adhere to more complex requirements. Organizations must consider third parties, IT systems, regulations such as the Payment Card Industry Data Security Standard...

29 May 2019
How to Implement Continuous Oversight and Monitoring of Your Enterprise’s Cloud Services
@ISACA Article

How to Implement Continuous Oversight and Monitoring of Your Enterprise’s Cloud Services

Cloud computing and cloud services are increasingly being used in the implementation of emerging technologies including artificial intelligence (AI), big data analytics and Internet of Things (IoT) devices.

29 May 2019
Risk Analysis: Then and Now
@ISACA Article

Risk Analysis: Then and Now

As part of ISACA’s 50th anniversary celebration, I am looking at the past and evaluating how risk analysis has changed by comparing the approach proposed in my recent IS Audit Basics column...

29 May 2019
ISACA and Protiviti Probe IT Audit’s Toughest Challenges and Best Practices in IT Audit
@ISACA Article

ISACA and Protiviti Probe IT Audit’s Toughest Challenges and Best Practices in IT Audit

IT audit individual professionals and teams worldwide face challenges with cybersecurity, privacy, data management and governance, building effective partnerships with the IT organization, dealing with ongoing digital transformation and disruption...

29 May 2019
Digital Ethics Rising in Importance
Blog Post

Digital Ethics Rising in Importance

The innovative capabilities of technology – as well as the potency of that technology – is advancing at a remarkable pace, creating new possibilities in today’s digital economy.

Build, Nurture Your Professional Network – And Start Early
Blog Post

Build, Nurture Your Professional Network – And Start Early

It can be surprising for professionals entering the workforce to realize that grades and knowledge is not the ultimate definer of your success.

28 May 2019
ISACA Opens Doors for Young Professionals with Early Leadership Opportunities
Blog Post

ISACA Opens Doors for Young Professionals with Early Leadership Opportunities

The value of being an active member in a professional organization such as ISACA cannot be overstated.

Sharpening the Axe
Blog Post

Sharpening the Axe

Internal auditors are under increasing pressure to add value to what is valued while, at the same time, helping to protect their enterprises from risk such as cyberattacks.
Tapping into ISACA’s Network to Shed Light on the Psychology of Information Security
Blog Post

Tapping into ISACA’s Network to Shed Light on the Psychology of Information Security

I was always fascinated by the complexity of the technology discipline. The truth is, it’s very broad. ISACA helps to define some of the career pathways for young professionals through its educational resources and certification program. This made me think about where I saw myself adding value to the industry.
Podcast
Podcast

Managing Unstructured Data

In an era of data overload, dealing with unstructured data poses distinct challenges to organizations. In this Off Stage and Off Script Series edition of the ISACA Podcast, North America CACS 2019 conference presenter George Khalil provides his perspective on which pitfalls should be avoided when it comes to managing unstructured data.

28 May 2019
David Samuelson
Blog Post

ISACAs Past Future Come Together at North America CACS

ISACA’s 50th anniversary year is about simultaneously honoring our past while visualizing how our professional community will innovate the future. Last week’s experience at our North America CACS conference in Anaheim provided tremendous inspiration on both fronts.
A Deeper Look Into the WhatsApp Hack and the Complex Cyber Weapons Industry
Blog Post

A Deeper Look Into the WhatsApp Hack and the Complex Cyber Weapons Industry

On 13 May, the Financial Times reported the discovery of a major security flaw in the popular messaging app, WhatsApp. The pervasive vulnerability, which affected both Apple and Android devices, allowed malicious actors to inject commercial spyware by ringing up unsuspecting targets using WhatsApp’s VOIP-based call function.
Podcast
Podcast

Protect Your Data Against Insider Threats

Most organizations know how to respond to malicious outsiders who may try to steal sensitive data. But what about the insider threat? In this podcast, we discuss ways to protect against the insider threat, and we use the example of a distillery to show the steps you can take to protect your data.

21 May 2019
The Role of Incident Management in Identifying Gaps During Stabilization Period
Blog Post

The Role of Incident Management in Identifying Gaps During Stabilization Period

Deploying an enterprise resource planning (ERP) system is challenging, and identifying gaps that could lead to risk is one of the most important aspects of stabilization.
Governing Digital Transformation using COBIT 2019
Governance Article

Governing Digital Transformation Using COBIT 2019 | ISACA

Many countries have launched ehealth initiatives as a response to public-sector transformation. It is one of the business sectors impacted by the vertical digitization movement that has become the trend in the last decade along with eeducation, ebanking, egovernment and more.

20 May 2019
Podcast
Podcast

Advancing Gender Diversity in Leadership Roles

While organizations increasingly understand the value of gender diversity in leadership roles, they don't always know how to make it a reality. In this episode of the ISACA Podcast's SheLeadsTech Series, Kellie McElhaney provides guidance on steps organizations can take to create meaningful inclusion in their leadership ranks.

17 May 2019
Controls in the Cloud Moving Over Isnt As Easy As Flipping a Switch
Blog Post

Controls in the Cloud Moving Over Isnt As Easy As Flipping a Switch

While this phrase is not new, it’s now said with regularity in relation to moving infrastructure to the cloud. Providers promise seamless transitions as if you were moving a server from one rack to another right next door.

The Backwaters of Technology
@ISACA Article

The Backwaters of Technology

There are backwaters of your enterprise that have technologies that have fallen out of favor like broken toys that have been forgotten.

15 May 2019
Use DNS to Secure the Cloud
@ISACA Article

Use DNS to Secure the Cloud

Today, users access cloud applications from anywhere and everywhere they may be. Data are no longer only stored in physical data centers.

15 May 2019
Videos Released to Help You Learn About Intelligent Automation
@ISACA Article

Videos Released to Help You Learn About Intelligent Automation

As more enterprises across multiple industries adopt automation and artificial intelligence (AI) to remain competitive, IT auditors must also understand the risk around AI, machine learning (ML) and robotic process automation (RPA) to keep their organizations safe.

15 May 2019
Time for Technology Organizations to Commit to Women in Leadership Roles
@ISACA Article

Time for Technology Organizations to Commit to Women in Leadership Roles

In the digital age, technology organizations face relentless pressure to innovate before they are out-innovated or wholly disrupted. But many tech organizations are undermining their ability to compete by not making a concerted effort to assemble diverse leadership...

15 May 2019
Use the ISACA Career Centre to Find New Career Opportunities and Talent
@ISACA Article

Use the ISACA Career Centre to Find New Career Opportunities and Talent

ISACA’s online Career Centre is designed to help members navigate a successful career in the IS/IT industry. Members can use this tool to post their resume in the online resume database and even use it to learn how to leverage ISACA training and certification resources for career development.

15 May 2019
Evolving From Accountant to IT Auditor With a CISA Certification
@ISACA Article

Evolving From Accountant to IT Auditor With a CISA Certification

As a professional who started his career as a chartered accountant, Sreekrishna Rao has encountered some resistance from stakeholders because he is not an IT engineer.

15 May 2019
Securing Major League Baseball - On and Off the Field
Blog Post

Securing Major League Baseball - On and Off the Field

Three strikes and you're out is one of the more well-known sayings in baseball, but it only takes one devastating cyberattack to inflict huge damage on Major League Baseball or any of its 30 teams.
The Evolution and Power of Disruptive Technology Insights From an Executive Panel at NA CACS
Blog Post

The Evolution and Power of Disruptive Technology Insights From an Executive Panel at NA CACS

At ISACA’s North America CACS conference Tuesday morning, an executive panel spoke on the past 50 years of tech disruption—and where technology is taking us in the future.
Podcast
Podcast

A New Rubric for IT Retention and Recruiting

The old methods of recruiting and retaining qualified IT professionals often disadvantages women and minorities. A new method of finding and keeping diverse candidates is needed.

14 May 2019
A Spectrum of Professions The World Needs Us
Blog Post

A Spectrum of Professions The World Needs Us

From the days of determining how to secure and derive value from early computers to today’s challenges as organizations enact digital transformation, it has been a remarkable 50 years for ISACA’s professional community.
IT Audit Stay Relevant or Perish
Blog Post

IT Audit Stay Relevant or Perish

“Victory awaits him who has everything in order – luck, people call it. Defeat is certain for him who has neglected to take necessary precautions in time. This is called bad luck.” –Roald Amundsen, The South Pole
Abstract network
The Nexus Article

Understanding and Implementing a Culture of Cybersecurity

Cultures have been studied by sociologists and anthropologists for a very long time. The fact that culture is an area of scientific study speaks to its importance and the need to understand culture and its impact on people and their behaviors.

13 May 2019
Driving or Driven by Disruption The AI Maturity Model
Blog Post

Driving or Driven by Disruption The AI Maturity Model

On 25 April 2019, Microsoft passed the trillion-dollar market cap threshold and passed Apple as the most valuable company in the world.
The Features and Challenges of IoT-Based Access Control
Blog Post

The Features and Challenges of IoT-Based Access Control

Employees and guests can use IoT-based access control for convenient access. Through their mobile device, they can be connected to a facility’s access control through digital ID securely.
podcast
Podcast

Professional Networking Over the Years

While social media has helped to reshape the professional networking landscape, some fundamentals of networking remain the same. In this 50th Anniversary series episode of the ISACA Podcast, ISACA member Matthias Kraft discusses what has changed, and what has not, when it comes to professional networking.

8 May 2019
ISACA-Infosecurity Keynoter Theresa Payton Design Security for Humans
Blog Post

ISACA-Infosecurity Keynoter Theresa Payton Design Security for Humans

Theresa Payton, former White House CIO and a prominent cybersecurity expert, will deliver the opening keynote address at the Infosecurity ISACA North America Expo and Conference, to take place 20-21 November 2019 in New York City. Payton recently visited with ISACA Now to reflect upon her time in the White House and provide analysis on how the technology and cybersecurity landscapes have evolved in her time since leaving the role. The following is a transcript of the interview, edited for length and clarity.
The Importance of Cyberresiliency
Blog Post

The Importance of Cyberresiliency

Cybersecurity is an endless process of chasing and preventing known attacks; anticipating attacks; and monitoring, alerting, patching, remediating and implementing solutions. It is becoming a maintenance function that trails hackers and other bad actors.
Putting Cyber Threat Intelligence Feeds to Good Use
Blog Post

Cyber Threat Intelligence Feeds | ISACA Blog

Cyber risk is business risk. Business are digitizing and governments are putting in place policies to promote digitalization and smart-city projects. While this helps citizens and organizations to adopt technology advancement, the continuous increase in cyberattacks, in both frequency and sophistication, pose significant challenges for organizations that must defend their data and systems from threat actors.
Small Business Interruptions
ISACA Journal Article

The Practical Aspect: Small Business Interruptions

According to the Allianz Risk Barometer 2019, for the seventh year in a row, executives and insurance experts worldwide are most concerned about business interruption risk scenarios.

Authors: Vasant Raval and Rajesh Sharma
Crowdsourcing Risk Management
ISACA Journal Article

Successful Outcomes by Crowdsourcing Risk Management

Crowdsourcing cybersecurity risk management across the enterprise presents opportunities for security leaders to bolster their program resilience through other resources.

Author: Mike Saurbaugh
Information Security Matters
ISACA Journal Article

Information Security Matters: Does IT Auditing Still Make Sense?

IT auditors are important to information security and have been since the auditing profession realized it needed to get hip to machines in the basement that were eating their balance sheets.

Author: Steven J. Ross
Risk Management
ISACA Journal Article

Moving Risk Management From Fear and Avoidance to Performance and Value

For cybersecurity professionals, the nature of risk management is evolving from an outside-in fear-and-avoidance approach to a strong inside-out approach.

Author: Brian Golumbeck
Developing the IT Audit Plan Using COBIT 2019
ISACA Journal Article

IS Audit Basics: Developing the IT Audit Plan Using COBIT 2019

The IT Assurance Framework (ITAF) requires that the IS audit and assurance function shall use an appropriate risk assessment approach and supporting methodology to develop the overall IS audit plan.

Author: Ian Cooke
Innovation and the Auditor
ISACA Journal Article

Innovation Governance: Innovation and the Auditor

Innovation teams research new and innovative ways for the business to compete. This usually means accelerating a development cycle.

Author: K. Brian Kelley
The Network
ISACA Journal Article

The Network: Mais Barouqa

What is the biggest security challenge that will be faced in 2019?

Author: ISACA
Quantitative Risk Management
ISACA Journal Article

The First Steps of Quantitative Risk Management

Things have been changing in the risk management arena these last few years.

Author: Ignacio Marambio Catán
Auditing Amazon Web Services
ISACA Journal Article

Auditing Amazon Web Services

As organizations increase adoption of cloud services for running enterprise architecture and applications, auditors are required to step up their game and learn new in-depth audit skills.

Author: Adam Kohnke
ISACA 50 Years
ISACA Journal Article

Guest Editorial: ISACA—50 Years of Keeping Pace With Changing Technology

Anniversaries always spark the desire to revisit the events that have taken us from then to now. ISACA’s 50th anniversary is no exception.

Author: Robert G. Parker
Technology Risk Analytics
ISACA Journal Article

Advanced Analytics for Technology Risk

Over the decades, information systems security has evolved in many ways.

Author: Mukul Pareek
What Is There in Terminology? Risk Analysis, Risk Assessment and Risk Evaluation
@ISACA Article

What Is There in Terminology? Risk Analysis, Risk Assessment and Risk Evaluation

Determining risk is common sense, and risk management is “common sense formalized.” Many times, we subconsciously determine risk to make decisions.

1 May 2019
Auditing Amazon Web Services
@ISACA Article

Auditing Amazon Web Services

With more and more organizations continuing to adopt cloud services and hosting on public cloud platforms, knowing how to audit these platforms becomes crucial.

1 May 2019
What Your Organization Can Do About Insider Threats
@ISACA Article

What Your Organization Can Do About Insider Threats

Insider threats hamper many organizations that find themselves unprepared to detect the threats posed by personnel they trust. Knowing the top motives for insider threats can help organizations be more prepared to implement the correct countermeasures.

1 May 2019
Meeting Consumers' Demand for Data Privacy
@ISACA Article

Meeting Consumers' Demand for Data Privacy

Consumers around the world are demanding better privacy rights and data protection. Many organizations are prepared for the EU General Data Protection Regulation (GDPR), but there are many more data privacy regulations on the horizon.

1 May 2019
Stakeholder Management: Push or Pull? (Or Is it More About Building Trust?)
Blog Post

Stakeholder Management: Push or Pull? (Or Is it More About Building Trust?)

Managing projects for the best possible outcome is a bit art and a bit science. From a high-level view, stakeholder management includes: identifying the people that could impact a project, understanding the expectations of the stakeholders and their impact on a project, and developing strategies for effectively engaging the decision-making project stakeholders.
Risk Transformation
ISACA Journal Article

A Model and Best Practices for Risk Transformation

Increasing globalization and the associated business transformation mean that enterprises are now complex networks dependent on both the nodes within other organizations and the nodes within the same organization.

Author: David Vohradsky
Access Controls
ISACA Journal Article

Access Controls Over Third-Party Applications

With an increasing focus on and potential exposure to confidential data, and every organization must take the appropriate precautions to secure customer data.

Author: Kathleen Martin
Risk Management
ISACA Journal Article

Bulletproof Risk Management to Thrive in the Digital Economy

Digital technologies have profoundly changed lives, blurring the lines between the digital and physical worlds.

Author: Sudhakar Sathiyamurthy
Incident Management
ISACA Journal Article

Incident Management for ERP Projects

A bad plan with good execution can be considered a dream come true, but a good plan with poor execution can be a nightmare.

Author: Rajul Kambli
Cyberrisk Management
ISACA Journal Article

Practical Cyberrisk Management

Cybersecurity and information security (cyber) professionals, staff, managers and board members are faced with the real issue of how to deal with cyberrisk, and this is a high priority for board members.

Author: Jaco Cloete
Patch Management and Mitigation
ISACA Journal Article

Practical Patch Management and Mitigation

Patches are quick fixes of known software bugs that presumably were not known at the time that the software was released.

Author: Spiros Alexiou
Enterprise IT Risk Management
ISACA Journal Article

The Non-IT Manager’s Role in Enterprise IT Risk Management

The impact of IT on business operations cannot be ignored in today’s business environment.

Authors: Nishani Edirisinghe Vincent, and Vinod U. Vincent
IT Governance Risk
ISACA Journal Article

The Sheer Gravity of Underestimating Culture as an IT Governance Risk

For those who may think that any form of governance of enterprise IT (GEIT) is better than no IT governance, it is important to consider the fact that poor IT governance is a significant, documented cause of IT failure.

Author: Guy Pearce
Cybersecurity Risk Management
ISACA Journal Article

Three Ideas for Cybersecurity Risk Management

The terms “information security” and “cybersecurity” are commonly used to address risk to information.

Author: Sakthivel Rajendran
Navigating Change An Imperative for Technology Professionals
Blog Post

Navigating Change An Imperative for Technology Professionals

The fast-changing technology and regulatory landscape calls for members of ISACA’s professional community to continually refresh their knowledge and training.
Podcast
Podcast

Combating Cyberattacks With a Culture of Cybersecurity

Cybersecurity’s role in recent years has grown considerably, but the most common exploits have remained the same over decades. Because of the sophisticated approaches many of these attacks use, people are unable to identify that phishing attacks today are fundamentally similar to the phishing attacks that occurred years ago. In this podcast, we discuss some common security attacks, building a security culture and the role of the C-suite in cybersecurity.

30 April 2019
Building an Audit Program for AWS
Blog Post

Building an Audit Program for AWS

When I produced my auditing Amazon Web Services (AWS) Journal article for volume 3, I was just wrapping up my very first audit against an AWS environment.
Five Software Programs To Improve the Security of Business Websites
Blog Post

Five Software Programs To Improve the Security of Business Websites

Cybersecurity may soon become an issue of higher concern than physical safety. We already share too much personal information online without paying attention.
Tips for Implementing COBIT in a Continuously Changing Environment | ISACA
Governance Article

Tips for Implementing COBIT in a Continuously Changing Environment | ISACA

There is a new term coined here: “COBITIAN.” It describes professionals who love COBIT and are excited and happy for the evolution to COBIT 2019, including its new governance and management objectives, design factors, and focus areas concepts.

29 April 2019
The ISACA Way How I Earned the CISM CISA CRISC and CGEIT in 10 Months
Blog Post

The ISACA Way How I Earned the CISM CISA CRISC and CGEIT in 10 Months

Earlier this year, when I earned the last one of the Fab 4 of ISACA certifications – CISM, CISA, CRISC and CGEIT – I decided to write a post about my experience and the lessons I learned along the way. I hope this will be useful for anyone preparing to obtain these industry-recognized credentials.
GRC Keynoter Patrick Schwerdtfeger Endless Insights Within Organizations Reach
Blog Post

GRC Keynoter Patrick Schwerdtfeger Endless Insights Within Organizations Reach

Patrick Schwerdtfeger, closing keynote speaker at the GRC Conference 2019, to take place 12-14 August in Ft. Lauderdale, Florida, USA, is a business futurist specializing in technology topics such as artificial intelligence, blockchain and FinTech. Schwerdtfeger recently visited with ISACA Now to discuss how these and other components of digital transformation will reshape the business landscape going forward. The following is a transcript of the interview, edited for length and clarity:
How to Get Your Employees to Care About Cybersecurity
Blog Post

How to Get Your Employees to Care About Cybersecurity

With each highly publicized data breach or cyberattack, it becomes increasingly evident that businesses can’t sit back and hope their security strategy is strong enough to withstand an assault.

The Impact of the Thailand Cybersecurity Law
Blog Post

The Impact of the Thailand Cybersecurity Law | ISACA Blog

In the past 5 years, the cybersecurity agenda has been raised and discussed and in many forums because cyberattacks have been developed for various purposes, and the number of cybersecurity incidents or data breaches have increased dramatically every year.

The Gap Within the Skills Gap What Does Cybersecurity Really Need
Blog Post

The Gap Within the Skills Gap What Does Cybersecurity Really Need

I recently took to LinkedIn to air my views on one of the most talked-about topics in the world of tech: the cybersecurity skills gap. The skill gap is often discussed in urgent terms and, given my job as a cybersecurity recruiter, I see how it plays out in practice.

Tips for Improving the Risk Management Process
@ISACA Article

Tips for Improving the Risk Management Process

The enterprise mission, strategy and objectives are the basis for understanding the dynamic risk landscape in which the enterprise operates.

17 April 2019
Using Continuous Oversight to Improve Security
@ISACA Article

Using Continuous Oversight to Improve Security

Monitoring information system security is an established management practice. It ensures compliance for both information security and privacy. Data protection and compliance maturity levels also help establish how to align with information assurance programs.

17 April 2019
New ISACA Podcast Episodes Now Posting Weekly
@ISACA Article

New ISACA Podcast Episodes Now Posting Weekly

To provide you with valuable industry insights in a quick and flexible manner, new ISACA Podcast episodes are now being released weekly.

17 April 2019
Call for Nominations: 2020 ISACA Awards
@ISACA Article

Call for Nominations: 2020 ISACA Awards

Do you know outstanding colleagues who have dedicated themselves to advancing ISACA’s core areas of audit, information security, risk and IT governance? Have you worked with an outstanding volunteer who has contributed to ISACA’s success?

17 April 2019
Phishing Awareness and Your Enterprise
@ISACA Article

Phishing Awareness and Your Enterprise

Email delivery is the primary source of malware dissemination. Cyberattackers rely on phishing attacks because they work and easily can target users several times a month.

17 April 2019
Why IT Teams Should Avoid Complacency
Blog Post

Why IT Teams Should Avoid Complacency

We are in 2019, and have all witnessed the effects of disruptive start-up companies, the growth and stability of the cloud market, the emergence of CI/CD practices and the simple need for agility. Inversely, there are organizations where none of what I mentioned is happening.
The Challenge of Assessing Security for Building Automation Systems
Blog Post

The Challenge of Assessing Security for Building Automation Systems

Building automation systems (BAS) have many characteristics that differ from traditional information processing systems, including different risks and priorities. Furthermore, these types of automation systems are subject to different performance and reliability requirements, and often employ operating systems, applications and configurations that may be considered unusual IT practices.
Enterprise Transformation to Cyberresiliency
ISACA Journal Article

Enterprise Transformation to Cyberresiliency

Serious cyberbreaches with criminal intent and attacks on enterprises are becoming more alarming due to their scale, magnitude of severity and progressive consequences. The average cost of each lost record rose from US $141 to US $148, the average cost of a breach of 1 million records was nearly US $40 million, and the cost of a breach of 50 million records was estimated to be US $350 million.

Author: Robert Putrus
podcast
Podcast

The Evolving Role of Technology Governance

As technology increasingly has become a central driver of business performance, the governance of that technology has become more challenging and more important for organizations. In this ISACA Podcast 50th Anniversary series program, ISACA board director Tichaona Zororo provides his perspective on how technology governance has evolved over the years and the impact that the COBIT framework has made for governance professionals.

16 April 2019
COBIT 2019 Hot Off the Press | ISACA
Governance Article

COBIT 2019 Hot Off the Press | ISACA

2019 is off to a strong start—there is an exciting year to come, and a refreshed and revitalized IT governance framework to explore. Released in December 2018, COBIT 2019 is a major revision of the well-established set of guides for effective IT governance.

15 April 2019
Tips to Prepare for ISACAs CRISC Exam
Blog Post

Tips to Prepare for ISACAs CRISC Exam

My motivation to pursue ISACA’s CRISC certification was to improve my skills, knowledge and understanding of enterprise and IT risk management.
ISACA Celebrates Volunteer Participation
Blog Post

ISACA Celebrates Volunteer Participation

It’s my favorite week of the year at ISACA – Volunteer Appreciation Week. It is a time when we all reflect on the important and impactful contributions members of our professional community have selflessly made to advance our organization and our industry. It is also a time to invite those who have not yet joined our volunteer corps to participate in ways that align with their interests and availability.
Podcast
Podcast

Another Win for Global Consumer Data Rights

There is a growing international movement advocating for the protection of consumer data and privacy. The EU passed the General Data Protection Regulation (GDPR), and not long after, the state of California passed a similar data protection law. In this podcast, we compare and contrast GDPR with California’s law and discuss the growing emphasis on privacy and what it means for organizations and individuals.

10 April 2019
Enterprise Risk Monitoring
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 2

An enterprise risk monitoring process requires the involvement of all the internal processes in the organization but under different perspectives, due to the processing of data having different degrees of granularity.

Author: Luigi Sbriz
Why I’ve Gone From Avid Skeptic to Avid User of Biometrics
Blog Post

Why I’ve Gone From Avid Skeptic to Avid User of Biometrics

My first job in security – and in fact my first job out of school – was for a biometrics company.

Global Passion for ISACA Comes Through Loud and Clear
Blog Post

Global Passion for ISACA Comes Through Loud and Clear

As I begin my time as ISACA’s new chief executive officer, having just completed my first week in the role, one thing continues to impress me – the passion our professional community feels for ISACA.

Simplifying Enterprise Risk Analysis
Blog Post

Simplifying Enterprise Risk Analysis

How many enterprise risk analysis reports must an organization release? A few years ago, I faced this question in light of cost, time and complexity of the solution.

Happy 50th to the Organization That Keeps Me Ahead of the Curve
Blog Post

Happy 50th to the Organization That Keeps Me Ahead of the Curve

Recently, I celebrated a birthday (no, I am not going to tell you which birthday), and my 6-year-old niece who called to wish me a happy birthday asked me if I was wise now.
David Samuelson Takes Reins as ISACA's New CEO
@ISACA Article

David Samuelson Takes Reins as ISACA's New CEO

David Samuelson became ISACA’s new chief executive officer on Monday, 1 April, bringing an extensive, successful leadership track record in learning products and services, technology innovation, and business strategy and execution to the position.

3 April 2019
Five Key Considerations When Evaluating Cyberinsurance
@ISACA Article

Five Key Considerations When Evaluating Cyberinsurance

Cyberinsurance can be a valuable tool and risk management capability in any small, medium or large organization’s tool box if properly understood and leveraged.

3 April 2019
Securing Your Enterprise's Digital Records
@ISACA Article

Securing Your Enterprise's Digital Records

Digital records are the way of the future. Organizations must adapt to this change in information storage and distribution by implementing the proper cybersecurity governance measures.

3 April 2019
Negotiate Your Next Job Offer
@ISACA Article

Negotiate Your Next Job Offer

When approaching your next job interview, know your market value and how to advocate for it. Coming up with a strategy to negotiate and being able to read the room while you are making your own deal are invaluable skills.

3 April 2019
Report of the Nominating Committee
@ISACA Article

Report of the Nominating Committee

The charge of the ISACA Nominating Committee, as described in section 4.5(c) of the ISACA bylaws, is to prepare a slate of candidates for the ISACA Board of Directors, consisting of a board chair, vice-chair, directors and past board chairs.

3 April 2019
Slate of 2019-20 Board of Directors - Article 6
@ISACA Article

Slate of 2019-20 Board of Directors - Article 6

ISACA will hold its Annual General Meeting (AGM) on 13 June 2019 in Seattle, Washington, USA, where it will install the 2019-20 Board of Directors.

3 April 2019
Auditing GDPR for Small and Medium Enterprises
@ISACA Article

Auditing GDPR for Small and Medium Enterprises

Enterprises of all sizes that handle European Union (EU) citizen’s data must comply with the EU General Data Protection Regulation (GDPR).

3 April 2019
Listen to How You Can Start Building Your Career Network Early With ISACA
@ISACA Article

Listen to How You Can Start Building Your Career Network Early With ISACA

In a recent 50th anniversary series episode of the ISACA Podcast, Mais Barouqa, CISA, CRISC, CGEIT, COBIT 5 Foundation, GRCP, ISO/IEC 27001:2013 LA, ITIL, discusses how ISACA credentialing and volunteer opportunities have helped her grow as a young professional.

3 April 2019
Applying Marketing Techniques to Raise Security Awareness
@ISACA Article

Applying Marketing Techniques to Raise Security Awareness

Security awareness and training is key to both the enterprise’s and its employees’ responses to security threats. Training employees on the proper response can help prevent security incidents.

3 April 2019
North America CACS Keynoter Sekou Andrews: Technology Pros Should Be Storytellers, Too
Blog Post

North America CACS Keynoter Sekou Andrews: Technology Pros Should Be Storytellers, Too

Sekou Andrews, a prominent poetic voice performer who blends inspirational speaking and spoken word poetry, will be the closing keynote speaker at ISACA’s 2019 North America CACS conference, to take place 13-15 May in Anaheim, California, USA. Andrews recently visited with ISACA Now, discussing why technology practitioners should also consider themselves to be storytellers and how changes on the technology landscape will lead to “a rediscovery of what it means to be human.” For more of Andrews’ insights on these and other topics, listen to his recent appearance on the ISACA Podcast.
Podcast
Podcast

How Technology Professionals Can Find Their Voice

Technology professionals sometimes struggle to connect on a human level when discussing their technology-driven business challenges and opportunities. In this Offstage & Offscript edition of the ISACA Podcast, 2019 North America CACS keynote speaker Sekou Andrews explains why finding ways to humanize their expertise better positions technology practitioners for success.

3 April 2019
Podcast
Podcast

The State of Cybersecurity, 2019

The role of cybersecurity is becoming increasingly important, and organizations need cybersecurity professionals with technical skills and business acumen. In this podcast, we explore the biggest cybersecurity challenges facing enterprises, the skills gap and how to draw people to careers in cyber.

3 April 2019
Proactively Embracing Innovation
Blog Post

Proactively Embracing Innovation

When looking at innovation, it may seem daunting to involve audit properly to protect the organization. With any new effort, there are a lot of unknowns. In traditional project processes, there should be enough time to discover major issues and handle the risk revealed.
IT GovernanceIT Governance for Dummies, Part 2 | ISACA
Governance Article

IT Governance for Dummies, Part 2 | ISACA

Both business and IT are “unconsciously incompetent” 1 when dealing with the issues relating to both the need for and scope of IT governance in this age of digital disruption. That is the thesis of the first installment of this 2-part series.

1 April 2019
Being an Effective Cybersecurity Leader Amid Increasing Pressure Expectations and Threats
Blog Post

Being an Effective Cybersecurity Leader Amid Increasing Pressure Expectations and Threats

It’s important to think about leadership in the cybersecurity realm through the lens of the “lines of defense” model.
Enterprise Risk Monitoring
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 1

The different business objectives and the specific structure of any organization prevent the possibility of adopting a single monolithic enterprise risk monitoring process suitable to control all its operations.

Author: Luigi Sbriz
Defining the Role of the CISO
Blog Post

Defining the Role of the CISO

Organizations have diverse understandings of what digital security is and is not. As a consequence, they wrestle with who is responsible and who is accountable for digital security.
Technology a Key Driver in UN Conclusions
Blog Post

Technology a Key Driver in UN Conclusions

It’s a wrap. At approximately 7.30 p.m. in New York City on Friday night, the final gavel fell on the negotiations at the 63rd session of the Commission on the Status of Women at United Nations headquarters.

How Security Improvements Can Lead to Business Process Optimization
Blog Post

How Security Improvements Can Lead to Business Process Optimization

Security improvements are often viewed skeptically, as they always seem to be associated with higher time requirements and rising costs.
Podcast
Podcast

What Is Information Security Worth?

Information security professionals understand the value of their work, but it can be difficult to show those outside information security how valuable it is. In this podcast, we discuss some ways that the information security practitioner can showcase the value of information security.

27 March 2019
The Next Challenge in IT Compliance Reporting: SOC2 2017 Trust Services Criteria
Blog Post

The Next Challenge in IT Compliance Reporting: SOC2 2017 Trust Services Criteria

In the aftermath of GDPR, the next big change in the IT compliance standards landscape is here. The period of applicability for the new System and Organization Controls for Service Organizations: Trust Services Criteria (SOC2 2017 Trust Services Criteria) has just begun – all SOC2 reports with an examination period ending on or after 15 December, 2018 will have to be issued as per the new standard.
podcast
Podcast

The Future of IT Audit

On this ISACA 50th Anniversary Series Podcast, Krysten McCabe, of The Home Depot, looks ahead to the future of the IT Audit profession, given the rise of automation and other changes to the technology landscape.

26 March 2019
AI in Audits
ISACA Journal Article

Productivity, Unexpected Outcomes and Opportunity When Using AI in Audits

Whether it is completely recognized or not, the age of artificial intelligence (AI) is here.

Authors: Avani Desai, and Doug Barbin
Five Considerations for Data Breach and Incident Reporting in the EU
Blog Post

Five Considerations for Data Breach and Incident Reporting in the EU

The increasing amount of cybersecurity incidents cause a serious negative impact on enterprises, prompting legislators around the world to explore new policies and regulations.
Vendor Risk Management An Essential Tool for GDPR
@ISACA Article

Vendor Risk Management An Essential Tool for GDPR

In 2018, the General Data Protection Regulation (GDPR) came into effect in the European Union, leading many organizations to continuously work to adhere to the regulation.

20 March 2019
Diving Into NIST Risk Management Framework Revision 2
@ISACA Article

Diving Into NIST Risk Management Framework Revision 2

The US National Institute of Standards and Technology (NIST) recently updated its Risk Management Framework (RMF). Revision 2 (V2) provides updates and changes to the 2014 NIST RMF that considers privacy, supply chain security, and software and system security.

20 March 2019
Find Talented Professionals and Employers at ISACA Online Career Fair
@ISACA Article

Find Talented Professionals and Employers at ISACA Online Career Fair

Finding the right match between employer and employee can be tricky. Whether you are a potential candidate or a potential employer, the ISACA Online Career Fair is for you.

20 March 2019
Accelerate Your Way to Becoming a CSXP
@ISACA Article

Accelerate Your Way to Becoming a CSXP

Based on the real day-to-day job tasks of the cybersecurity professional, ISACA has developed a new accelerated path to earning the Cybersecurity Nexus (CSX) Cybersecurity Practitioner (CSXP) credential.

20 March 2019
In Retrospect 33 Years of COBIT
@ISACA Article

In Retrospect 33 Years of COBIT

It was late 1995 when Erik Guldentops, my then boss at SWIFT, relentlessly insisted that his auditor team “think about the concept ‘control objective’ and how they would define it in simple words.”

20 March 2019
Why You Need to Align Your Cloud Strategy to Business Goals
Blog Post

Why You Need to Align Your Cloud Strategy to Business Goals

Your company has decided to adopt the cloud – or maybe it was among the first ones that decided to rely on virtualized environments before it was even a thing. In either case, cloud security has to be managed. How do you go about that?
How IT Teams Can More Efficiently Deliver Stakeholder Satisfaction
Blog Post

How IT Teams Can More Efficiently Deliver Stakeholder Satisfaction

Billy Beane was one of the first general managers in the history of Major League Baseball to use data to build out a successful team with a fraction of the budget relative to his peers. Like many IT leaders, he had to do more with less.
Defining Target Capability Levels in COBIT 2019 | ISACA
Governance Article

Defining Target Capability Levels in COBIT 2019 | ISACA

The COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution outlines a robust, logical and quantifiable process for designing a governance system over enterprise information and technology (I&T).

18 March 2019
Cybersecurity Culture
ISACA Journal Article

Implementing a Cybersecurity Culture

Culture is an important topic that has been studied by anthropologists and sociologists for years.

Authors: Luis Emilio Alvarez-Dionisi, and Nelly Urrego-Baquero
ISACA at RSA 2019: Sharing Research and Spurring Conversations
Blog Post

ISACA at RSA 2019: Sharing Research and Spurring Conversations

The theme of last week’s RSA Conference 2019, “Better,” gave ISACA the opportunity to engage with information and cybersecurity professionals on how we collaboratively move the technology field into a better future.
SheLeadsTech Returns to United Nations
Blog Post

SheLeadsTech Returns to United Nations

SheLeadsTech was back this week at the United Nations for the 63rd Session of the Commission on the Status of Women to continue the critically important work of empowering women and girls by providing access to social protection and appropriate infrastructure, including technology infrastructure.
C-Suite: The New Main Target of Phishing
Blog Post

C-Suite: The New Main Target of Phishing

We know that phishing attacks are on the rise, but did you know that more and more executives are falling for these phishing emails every day? New phishing campaigns targeting executives are intelligently crafted and difficult to spot.
Didn’t You Read My Email??’ and Other Security Awareness Fallacies
Blog Post

Didn’t You Read My Email??’ and Other Security Awareness Fallacies

I live in Austin, Texas, USA, where the bumper sticker quotient is fairly high, although diminishing with every vehicle that comes here from places like Dallas (no offense, Dallas — I don’t have any bumper stickers on my car either). One of my favorites is, “If you’re not appalled, you’re not paying attention.” I’m sure it was written with politics in mind, but it’s absolutely relevant for cybersecurity, too.
Podcast
Podcast

Attracting More Women to Cybersecurity

Organizations continue to struggle with filling open cybersecurity positions – a challenge that is particularly pronounced when it comes to bringing women aboard to fill cybersecurity roles. In this month’s SheLeadsTech Series edition of the ISACA Podcast, Australia-based cybersecurity recruiter Charlotte Osborne provides a recruiter’s perspective on why organizations struggle to attract and retain female practitioners, and offers some potential solutions enterprises can explore to put together stronger and more diverse teams.

13 March 2019
GDPR Audits for SMEs Are All About the Language
Blog Post

GDPR Audits for SMEs Are All About the Language

It is often said that a good auditor is a good communicator, and this is particularly true when dealing with smaller organizations.
Mark B. Cooper
The Nexus Article

10 Questions and Answers When Deploying a PKI

Public key infrastructure (PKI) is at the core of the enterprise IT backbone, and its integration with core IT applications is growing, according to the 2018 Global PKI Trends Study by nCipher Security and Ponemon Institute.

11 March 2019
Determining Emerging Risk
@ISACA Article

Determining Emerging Risk

Determining what is an emerging risk can be a very difficult prospect for organizations trying to get ahead of bad things that may be coming their way.

6 March 2019
Do You Know Your DNS Security Risk
@ISACA Article

Do You Know Your DNS Security Risk

If your enterprise has a Domain Name System (DNS) infrastructure, its security should be assessed.

6 March 2019
Auditing CASBs
@ISACA Article

Auditing CASBs

Cloud computing continues to rise in popularity due to its ability to cut costs, downsize data centers, personalize service coverage from cloud service providers (CSPs) and provision faster.

6 March 2019
Understand the Future of Data Protection and Privacy by Attending Virtual Summit
@ISACA Article

Understand the Future of Data Protection and Privacy by Attending Virtual Summit

Participate in dynamic discussions with fellow IS/IT professionals around critical issues affecting your data protection and stakeholder privacy in a free, half-day virtual summit

6 March 2019
Using Technology and Your ISACA Member Advantage
@ISACA Article

Using Technology and Your ISACA Member Advantage

Today, supercomputers are generating advanced algorithms and big data tools to provide intelligent vertical solutions for a wide range of industries.

6 March 2019
Artificial Intelligence and Cybersecurity: Attacking and Defending
Blog Post

Artificial Intelligence and Cybersecurity: Attacking and Defending

Cybersecurity is a manpower-constrained market – therefore, the opportunities for artificial intelligence (AI) automation are vast.
User Activity Monitoring
ISACA Journal Article

Conducting User Activity Monitoring Using Existing IT Infrastructure

The term “insider threat” has become commonplace in the lexicon of chief information security officers (CISOs).

Author: Max Alexander
Podcast
Podcast

The Cybersecurity Skills Gap

Having technical skills is no longer enough for cybersecurity professionals; enterprises are also looking for employees with business acumen. In this podcast, we discuss the shortage of skilled cybersecurity professionals, the impact that has on the industry and how people can get the skills they need to build a career in cybersecurity.

5 March 2019
COBIT
Governance Article

Designing Your Organization’s Custom COBIT

Governance over a complex and continuously evolving domain such as enterprise information and technology (I&T) requires a multitude of components, including processes, organizational structures, information flows, behaviors, etc.

4 March 2019
Cybersecurity Hiring Practices
ISACA Journal Article

Stop Looking for the Purple Squirrel

It is entirely possible, even probable, that the cybersecurity skills gap is, at least partly, something of our own making: our fixation with purple squirrels.

Author: Marcelle Lee
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing Cybersecurity

There are several rites of passage one goes through on the way to becoming an experienced IT auditor. After completing college, one gets a job, although not necessarily in audit.

Author: Ian Cooke
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

As a security manager, how can we build a cybersecurity culture?

Author: Sunil Bakshi
Innovation Governance
ISACA Journal Article

Innovation Governance: What Is Innovation?

Audit professionals must keep up with new IT practices within their organizations.

Author: K. Brian Kelley
Cybersecurity Awareness
ISACA Journal Article

How to Increase Cybersecurity Awareness

The development of information and communication technology is growing at a fast pace. As a result, the Internet has become easy to access.

Authors: Nipon Nachin, Chatpong Tangmanee, and Krerk Piromsopa
Security Product Investments
ISACA Journal Article

Sponsored Feature: Why Security Product Investments Are Not Working

Enterprises invested in firewalls to keep malicious actors out of the infrastructure.

Author: Sean Keef
Root Cause Analysis
ISACA Journal Article

How Root Cause Analysis Fits Into Various Audit Types

True audit work is not just finding the things that have gone or may go wrong, but also involves finding the root causes of the discoveries made by auditors.

Author: Amra Durmisevic-Mutapcic
Cybersecurity Culture
ISACA Journal Article

Moving Toward Better Security for Today and Tomorrow

Establishing an organizationwide culture of cybersecurity is top-of-mind for many security leaders.

Author: Mike Saurbaugh
The Network
ISACA Journal Article

The Network: Raef Meeuwisse

Consumer and shareholder trust are being eroded by the number of security failures and data breaches.

Author: ISACA
GDPR Adoption
ISACA Journal Article

The Two Key Challenges of GDPR Adoption

The day the EU General Data Protection Regulation (GDPR) went into effect, 25 May 2018, marked a real landmark regarding personal data protection for which much information and training has been distributed, more or less accurately.

Author: Ramón Serres
California Data Privacy Law
ISACA Journal Article

Another Win for Global Consumer Data Rights

The California Consumer Privacy Act (CCPA) of 2018 continues a growing global crusade for increased consumer privacy rights and data discretion in the wake of the EU General Data Protection Regulation (GDPR), and it will have a number of similar implications on organizations conducting business in California, USA.

Author: Dave Brunswick
Information Security Matters
ISACA Journal Article

Information Security Matters: What Is Information Security Worth?

I deliberately chose a title that poses a provocative question. By itself, it is unanswerable without some refinement. Whose security? From what? For what? How long? And what exactly do we mean by worth?

Author: Steven J. Ross
Digital Security
ISACA Journal Article

The Role of the CISO and the Digital Security Landscape

Organizations have diverse understandings of digital security. As a consequence, they wrestle with who is responsible & accountable for digital security.

Author: Robert Putrus
Podcast
Podcast

The Road to GDPR Compliance

Despite the GDPR compliance deadline having passed and the lofty noncompliance fines, many organizations are still unsure of how to address GDPR compliance. In this podcast, we discuss the scope of GDPR, customers’ growing concern for privacy and practical steps your enterprise can take to become GDPR compliant.

28 February 2019
Paying for Apps with Your Privacy
Blog Post

Paying for Apps with Your Privacy

Don’t look at your device when I ask you this question: How many apps do you have on your smartphone? Or, if you use your tablet more often, how many apps do you have on your tablet? Remember this number or write it down.
Environmental Drift Yields Cybersecurity Ineffectiveness
Blog Post

Environmental Drift Yields Cybersecurity Ineffectiveness

Your cybersecurity tools are working, optimized, and providing real, measurable, business value. They are successfully blocking attacks, detecting nefarious activity, and alerting the security team.
Information Security Benefits
ISACA Journal Article

The Benefits of Information Security and Privacy Awareness Training Programs

In today’s world of hackers and identity thieves, there is an underlying need for every government and commercial organization/business to have an awareness training program.

Author: Larry G. Wlosinski
podcast
Podcast

Building an Early Relationship with ISACA

Providing early opportunities for young professionals to accelerate their career paths and expand their networks has long been a hallmark of ISACA. In this 50th Anniversary Series episode of the ISACA Podcast, ISACA member Mais Barouqa discusses how ISACA credentialing and volunteer opportunities have helped her grow as a young professional.

26 February 2019
Three Keys to Improving Medical Device Security
Blog Post

Three Keys to Improving Medical Device Security

A report released in January by the Healthcare & Public Health Sector Coordinating Councils details the need for better security for medical devices, a topic infrequently discussed in healthcare until recently.

How to Ensure Data Privacy and Protection Through Ecosystem Integration
Blog Post

How to Ensure Data Privacy and Protection Through Ecosystem Integration

My recent ISACA Journal article, “Data Privacy, Data Protection and the Importance of Integration for GDPR Compliance,” describes how the movement and processing of personal data, along with the procedures around those workflows, are central to General Data Protection Regulation (GDPR) compliance.
Is Your GRC Program Ready to Thrive in the Digital Economy?
Blog Post

Is Your GRC Program Ready to Thrive in the Digital Economy?

Digital technologies have profoundly changed our lives, blurring the lines between the digital and physical worlds. From its humble beginnings, the current constellation of tools and technologies that empower organizations has grown smarter.

Certifications and the Paycheck: Trends and Truth
Blog Post

Certifications and the Paycheck: Trends and Truth

New highly validated data from 3,305 employers reveals that the average cash market value for hundreds of tech certifications is at its lowest point in four years. Meanwhile, pay premiums for non-certified skills in the same period have gained 6 percent in value on average.
The Risk FARM
@ISACA Article

The Risk FARM

In today’s ever-changing risk environment, there are always areas of consideration for the risk practitioner including the dynamic threat world, the many and continuous vulnerabilities that are ever-present, and the potential impacts on the enterprise and its activities

20 February 2019
Protecting Your Data in the Cloud
@ISACA Article

Protecting Your Data in the Cloud

The security provided using Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure as cloud services is better than you could expect from your organization’s personal data center.

20 February 2019
Preparing for Blockchain Technology
@ISACA Article

Preparing for Blockchain Technology

Blockchain is a distributed network system that is often associated with Bitcoin, the first global decentralized currency.

20 February 2019
The IT Auditors Take on the Future of IT Audit
@ISACA Article

The IT Auditors Take on the Future of IT Audit

In August 2018, ISACA surveyed IT auditors for The Future of IT Audit: Research Brief to gain insight on what the future of the audit profession may look like in the wake of emerging technology.

20 February 2019
Security Leaders Share Insights at ISACA’s Annual IT Security Leaders’ Summits 2018
@ISACA Article

Security Leaders Share Insights at ISACA’s Annual IT Security Leaders’ Summits 2018

In 2018, security leaders gathered in Las Vegas, Nevada, USA, and London, England, for ISACA’s annual IT Security Leaders’ Summits (formerly known as the CISO Forums).

20 February 2019
ISACA Congratulates 2019 ISACA Award Recipients
@ISACA Article

ISACA Congratulates 2019 ISACA Award Recipients

ISACA is proud to recognize the outstanding achievements of its individual contributors, chapters and certification exam takers who offer thought leadership, volunteer service and professional achievements that advance ISACA’s purpose and promise.

20 February 2019
Data Analytics in Internal Audit: State of the Data, 2019
Blog Post

Data Analytics in Internal Audit: State of the Data, 2019

Data Analytics in Internal Audit: State of the Data, 2019. ISACA reviews successful IT auditors can translate complex technical analytics or non-techies.

Moving Beyond Stubborn Reluctance to Comply with GDPR
Blog Post

Moving Beyond Stubborn Reluctance to Comply with GDPR

Last May marked the beginning of the application of the General Data Protection Regulation (GDPR), which harmonized and unified the rules governing privacy in the European Union. Leading up to and following the adoption of the regulation, data protection has been in the focus of attention all around the world
Getting Your GDPR Compliance Program Into Gear With Proper Record Keeping
Blog Post

Getting Your GDPR Compliance Program Into Gear With Proper Record Keeping

Compliance procedures are notoriously demanding, and European Union General Data Protection Regulation (GDPR) compliance programs are no different.

Agile GEIT, Building Trust & Maximizing Value Delivery: Pt 2 Practitioners Guide | ISACA
Governance Article

Agile GEIT, Building Trust & Maximizing Value Delivery: Pt 2 Practitioners Guide | ISACA

To minimize the impact that ever-increasing legal and regulatory requirements have on Agile’s ability to respond effectively and efficiently to customer needs and maximize value delivery in a timely manner require a governance of enterprise IT (GEIT) system equally focused on managing IT risk and the delivery of a value-add outcome to the organization.

18 February 2019
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

We are finding it difficult to hire security staff with appropriate skills.

Author: Sunil Bakshi
More on Password Dictionaries
Blog Post

More on Password Dictionaries

As a follow-up to our recent ISACA Journal article, “NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk,” we wanted to provide some additional thoughts on the password dictionary concepts.
Women in Cybersecurity Often Worth More Than They Realize
Blog Post

Women in Cybersecurity | ISACA Blog

Before beginning my career in cybersecurity recruitment, I worked in the female-dominant industry of travel public relations. I was largely oblivious to the challenges of being a female in the workplace because I was surrounded by other strong businesswomen on a day-to-day basis.
North America CACS Keynoter Guy Kawasaki Sizes Up Innovation, Entrepreneurship
Blog Post

North America CACS Keynoter Guy Kawasaki Sizes Up Innovation, Entrepreneurship

Guy Kawasaki, a Silicon Valley-based author, speaker, entrepreneur and evangelist, will be the opening keynoter at ISACA’s 2019 North America CACS conference, to take place 13-15 May in Anaheim, California, USA. Kawasaki recently visited with ISACA Now to discuss some of the themes he will explore at North America CACS, including innovation and entrepreneurship. The following is an edited transcript. For more of Kawasaki’s insights, listen to his recent interview on the ISACA Podcast.
Podcast
Podcast

The Ingredients of Successful Innovation

What drives successful innovation on the modern enterprise landscape? In this ISACA Podcast Behind the Curtain series program, 2019 North America CACS conference opening keynote speaker Guy Kawasaki addresses some of the key elements that contribute to organizations’ ability to innovate – such as creativity, hard work, opportunism and a little bit of good luck.

12 February 2019
5G and AI: A Potentially Potent Combination
Blog Post

5G and AI: A Potentially Potent Combination

Discover more about 5G and AI: A Potentially Potent Combination. Readapting to 5G and AI integration on smartphones chips for cloud & on-device processing.

For the Board, GDPR Compliance Implementation Reporting Is More Than Just About Exposure and Progress
Blog Post

For the Board, GDPR Compliance Implementation Reporting Is More Than Just About Exposure and Progress

Whether from a conformance (compliance) or performance perspective, 2 enterprise governance tasks of particular interest are knowing what questions to ask in the process of performing due diligence and knowing what data and information to request to support the due diligence process.
Philip Casesa
The Nexus Article

Five Questions to Ask in Your Next Cybersecurity Job Interview

Career development and advancement is important to most professionals and, in the case of cyberprofessionals, the current state of a wide range of available jobs and not enough skilled professionals to fill them can be a job seeker’s dream.

11 February 2019
New Cybersecurity Pilot Program to Expand Career Pathways for Women in Chicago
Blog Post

New Cybersecurity Pilot Program to Expand Career Pathways for Women in Chicago

Women in the Chicago area who are interested in exploring a career path in cybersecurity, particularly those who are underrepresented in the field, will now have the opportunity to join a pilot program launched last week by ISACA, along with AnitaB.org and the City Tech Collaborative.
Cybersecurity
ISACA Journal Article

Cybersecurity and Fintech at a Crossroads

Financial technology (fintech) is a prominent topic for the banking and financial services industry worldwide.

Author: Vimal Mani
How to Approach Blockchain Deployment While Mitigating Risk
Blog Post

How to Approach Blockchain Deployment While Mitigating Risk

Blockchain has emerged as one of the most promising technological developments of the past decade.
Improving Efficiency of Security Incident Response Using SOAR
@ISACA Article

Improving Efficiency of Security Incident Response Using SOAR

Managing IT is a fairly complicated task due to its complexity.

6 February 2019
Keep Your Organizations Data Private
@ISACA Article

Keep Your Organizations Data Private

New technologies have allowed more opportunities to access and misuse sensitive information.

6 February 2019
Build Your Organization's Awareness of Phishing
@ISACA Article

Build Your Organization's Awareness of Phishing

It only takes 1 uninformed employee to open an email with a link to a phishing website for malicious actors to bypass your organization’s security.

6 February 2019
The Future of Facing Cyberattacks as a CISO
@ISACA Article

The Future of Facing Cyberattacks as a CISO

Cybersecurity becomes more and more important in the face of the rising number of cyberattacks.

6 February 2019
Dynamic and Comprehensive: CSX Virtual Cyber Academy
@ISACA Article

Dynamic and Comprehensive: CSX Virtual Cyber Academy

The Cybersecurity Nexus™ (CSX) Virtual Cyber Academy is a comprehensive, real-world training solution that tests your skills in a live, dynamic network environment on a cloud-based learning platform.

6 February 2019
How to Protect Digital Data Privacy
@ISACA Article

How to Protect Digital Data Privacy

More personal data are available to enterprises than ever before due to the rise of automation, the Internet of Things (IoT) and artificial intelligence (AI).

6 February 2019
ISACA
Blog Post

ISACA Anniversary Celebration – and Social Media Campaign – Are Underway

ISACA’s yearlong 50th anniversary celebration is underway around the globe, and one of the best ways to be part of the global celebration is through social media.
Protecting Patient Records in 2019 and Beyond
Blog Post

Protecting Patient Records in 2019 and Beyond

A program called MyHealthEData was unveiled in 2018. Through this program, the US Centers for Medicare & Medicaid Services (CMS) is promoting the adoption of IT environments that allow simpler sharing of health data to outside organizations, as well as better access. The CMS will also allow easier access to claims data by medical beneficiaries.
A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption | ISACA COBIT Design Factors
Governance Article

A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption | ISACA

We are living in exciting times where the impact of disruptive technology is seen in all aspects of our professional and personal lives. We are witnessing the phenomenal pace of technology change and the resultant impact on enterprises in terms of innovative business processes facilitated by information systems with underlying technology

4 February 2019
User Privacy
ISACA Journal Article

How Google Voice and AI Can Interfere in Users’ Privacy

In the modern age of the Internet of Things (IoT), life is made easier for everyone by being connected to the Internet.

Author: John Mason
Incorporating Privacy into Data Protection Strategy
Blog Post

Incorporating Privacy into Data Protection Strategy

Nowadays, the term privacy echoes across boardrooms globally, where each country and enterprise races to update its laws and policies to keep up with the need for data privacy controls.
Podcast
Podcast

The Mother of All Breaches

The largest data breach to date was recently discovered. The Collection 1 data breach has 773 million records, and these data were found from a variety of sources. In this podcast, we discuss what makes the Collection 1 breach different from other breaches and what you can do if your information was compromised.

31 January 2019
CISA Certified Information Systems
Blog Post

Certification Spotlight with … Marco Schulz

The ISACA Now blog occasionally highlights the impact ISACA certifications have in the evolving business landscape, as well as how certifications have impacted individual members of the ISACA professional community. Today, we profile Marco Schulz, CISM, CISA, CGEIT, CEO at marconcert GmbH (Germany).
Google’s GDPR Fine Reinforces Need for Intentional Data Governance
Blog Post

Google’s GDPR Fine Reinforces Need for Intentional Data Governance

For those of us who work in information security, data privacy and governance, we seem to traverse daily from one headline to another. A new corporate victim announces they were breached to the tune of 100 million records.
IT Audit in 2019: Hot Topics and Trends
Blog Post

IT Audit in 2019: Hot Topics & Trends | ISACA Blog

The turn of the calendar to a new year is always a great time to take pause and reflect. Now that 2019 is in full swing, I wanted to take a quick snapshot of hot topics and trends for the IT audit field in 2019. And just to make sure I wasn’t completely winging it, I checked in with a couple valued industry contacts.
Practical DLP Implementation
Blog Post

Practical DLP Implementation

Practical implementation and management of data loss prevention or protection (DLP) solutions or a portfolio of solutions should follow a logical process to ensure the holistic protection of information resources.
Cost of a Data Breach
ISACA Journal Article

Cost of a Data Breach

Many know the adage, “time is money.” It is a sensible guide for anyone with persistent stress in their professional (and personal) lives. The IBM/Ponemon Institute 2018 Cost of a Data Breach Study...

Author: Salvatore J. Stolfo
How Tech Roles Provide Women Great Career Paths
Blog Post

How Tech Roles Provide Women Great Career Paths

I am often asked by women young and old, “Were you intimidated by technology or afraid to start your first job in tech?”
Cybersecurity and its Critical Role in Global Economy
Blog Post

Cybersecurity and its Critical Role in Global Economy

Cybersecurity and its critical role in the global economy – a very interesting topic indeed, and one that is taking center stage this week at the World Economic Forum in Davos after being identified as one of the top five global risks.
Expired TLS Certificates Must Be Used as a Learning Experience
Blog Post

Expired TLS Certificates Must Be Used as a Learning Experience

A recent report from the British research firm Netcraft showing that 80 US government websites had expired Transport Layer Security certificates during the ongoing US government shutdown rightfully has caused quite a stir, and ISACA members ought to be paying attention.
What to Consider When Implementing CCTV
@ISACA Article

What to Consider When Implementing CCTV

Today, it seems everyone is watching us. In the modern urban setting, there are more closed-circuit television (CCTV) cameras recording life than ever thought possible one generation ago. The volume of information captured is

23 January 2019
Combat AI Malware
@ISACA Article

Combat AI Malware

Cybercriminals have turned to artificial intelligence (AI) to access large-scale data illegally. With the potential for AI to be weaponized, cybercriminals can use AI to automate their cybercrime processes and forge video to transform the meaning of evidence and truth.

23 January 2019
Gain Insights on Managing Vendor Risk
@ISACA Article

Gain Insights on Managing Vendor Risk

Vendor risk management (VRM) is increasingly critical to protecting organizations that outsource products and processes to vendors. VRM helps to protect the organization’s assets while maintaining efficiency.

23 January 2019
Engage Offers Ways to Learn, Network and Participate
@ISACA Article

Engage Offers Ways to Learn, Network and Participate

ISACA’s new Engage portal offers opportunities to learn, network and participate at ISACA in a virtual environment. If you were part of ISACA’s online communities in the past, your discussion posts from the last year have migrated to the new platform.

23 January 2019
Cybersecurity Professionals
@ISACA Article

The Bank of Ghana Recommends ISACA Credentials for Cybersecurity Professionals

ISACA certifications are globally recognized and allow ISACA members to progress their careers, raise their earning potential and add value in their current positions. In October, the Bank of Ghana recognized ISACA certifications...

23 January 2019
IT GovernanceIT Governance for Dummies, Part 1 | ISACA
Governance Article

IT Governance for Dummies, Part 1 | ISACA

Before deciding not to read on, arguably, there are a lot of us out there showing little thought or judgement about what IT governance really means and what we should be doing about it. When reviewing some of the facts and figures herein, it appears that some people are doing things in a very careless manner.
Auditing the GDPR
Blog Post

Auditing the GDPR

Like in many professions, the new year is traditionally a time for planning for IT auditors. This year, I am willing to wager that many of your resulting IT audit plans include something to do with the EU General Data Protection Regulation (GDPR).
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

What are the best practices a CISO should ensure to provide assurance on application security?

Author: Sunil Bakshi
Big Data: Too Valuable and Too Challenging to Be Overlooked
Blog Post

Big Data: Too Valuable and Too Challenging to Be Overlooked

As the new year begins and business leaders refine their 2019 plans, how to effectively deploy technology increasingly will be a focal point of conversations in the boardroom and elsewhere throughout the enterprise.
Podcast
Podcast

Confronting Gender Bias in the Tech Workforce

Gender bias in the workplace plays out in a variety of ways – some obvious, others much more subtle. In this ISACA SheLeadsTech series podcast with guest JJ DiGeronimo, we discuss the ways in which enterprise leaders can make the tech workforce more welcoming to female practitioners and the key ingredients for success in programs designed to counteract gender bias in the workplace.

17 January 2019
GDPR Compliance as a Competitive Advantage
Blog Post

GDPR Compliance as a Competitive Advantage

Last year was a milestone in the field of privacy as the General Data Protection Regulation (GDPR) put privacy into the spotlight in and outside the European Union.
A New Approach to Finding Cybersecurity Talent for the Future
Blog Post

A New Approach to Finding Cybersecurity Talent for the Future

The cybersecurity profession is facing a shortage of qualified talent to fill an increasing demand for positions, as so many reports inform us. What I find self-fulfilling about our “talent dilemma” is the acknowledged rapid rate of technology change, yet the ongoing quest for specific technical experience and expertise. We seek plug-and-play people to match technology components, rather than individuals with foundational skills and an aptitude and desire to learn changing technology.
Continuous Modernization
ISACA Journal Article

Continuous Modernization

Blockchain, cognitive computing, artificial intelligence (AI) and virtual reality are revolutionizing the way people work.

Authors: Vinay Parisa, Biswajit Mohapatra, and Srividya Vinod
Strengthening Internal Audits Influence and Impact
@ISACA Article

Strengthening Internal Audits Influence and Impact

Boards, audit committees, senior executives, risk managers and the business need internal audit’s best efforts in today’s environment of ongoing disruption and increasing risk. These stakeholders also need internal audit’s objective

9 January 2019
Learn to Audit AI
@ISACA Article

Learn to Audit AI

Artificial intelligence (AI) will not only impact how enterprises do business, but will also impact society as a whole. Emerging AI technologies will cause disruptions to the way everyone, including IT auditors perform their work...

9 January 2019
ISACA Turns 50—Join the Celebration!
@ISACA Article

ISACA Turns 50—Join the Celebration!

ISACA is celebrating its 50th anniversary this year, and members are essential participants in the year-long celebration.

9 January 2019
ISACA’s Advocacy and Public Affairs Team Engages With EU Officials and Organizations
@ISACA Article

ISACA’s Advocacy and Public Affairs Team Engages With EU Officials and Organizations

Since its launch last year, ISACA’s Advocacy and Public Affairs team has engaged with key stakeholders and officials around the globe on behalf of the professions it serves through meetings ...

9 January 2019
podcast
Podcast

ISACA – 50 Years and Counting

ISACA is celebrating its 50th anniversary in 2019, having evolved from a grassroots, Los Angeles-based organization focused on electronic data processing in 1969 to the global business technology association it has become today, with 140,000 members and local chapters in more than 220 countries. In this 50th Anniversary Series podcast, ISACA board chair Rob Clyde addresses how the organization has changed – and what aspects have not changed – over the past 50 years, and what technological forces will help shape the organization’s future.

9 January 2019
Empower Auditors to Think Big Picture on AI
Blog Post

Empower Auditors to Think Big Picture on AI

The new white paper, Auditing Artificial Intelligence, provides an overview of what AI is, why auditors need to be aware of AI, and how the COBIT 2019 framework relates to AI auditing.
Agile GEIT Practitioners Guide
Governance Article

Agile GEIT Practitioners Guide, Part 1 | ISACA

Ever-increasing legal and regulatory requirements have an impact on Agile’s ability to respond to customers’ needs in a timely, effective and efficient manner.
Blockchain Technology
ISACA Journal Article

Blockchain Explained and Implications for Accountancy

Blockchain technology underlies cryptocurrencies such as Bitcoin and Ethereum and is capable of storing data that has notably useful characteristics, especially for accounting data.

Authors: Pascal A. Bizarro, Andy Garcia, and Zachary Moore
How to Hack a Human
Blog Post

How to Hack a Human

Have you ever wondered just how many ways there are to hack the human mind and just how effective each technique is? I did; so I set about collating all of the techniques for human control and influence:
Five Cost-Effective Ways for Small Businesses to Achieve Compliance
Blog Post

Five Cost-Effective Ways for Small Businesses to Achieve Compliance

In today's world, all large and small companies are required to show and prove constant compliance to do or sustain business. The task may be somewhat easy for large companies by hiring more employees to achieve; small businesses do not have the luxury to hire more people at competing rates with large companies as well as reduced revenue.

50th Anniversary Year Provides Inspiration to Look to ISACA’s Future
Blog Post

50th Anniversary Year Provides Inspiration to Look to ISACA’s Future

When ISACA – then known as the Electronic Data Processing Auditors Association – was incorporated by seven Los Angeles area professionals in 1969, “there was no authoritative source of information,” according to ISACA’s first president, the late Stuart Tyrnauer. There was “no cohesive force, no place to turn to for guidance.”
What Are Challenges in Deployment and How Can They Be Mitigated?
Blog Post

What Are Challenges in Deployment and How Can They Be Mitigated?

Transformation offers many key benefits, and any enterprise that would like to sustain and grow in this ever-changing, fast-paced world would be subject to the deployment of new systems.

IoT Security
ISACA Journal Article

Security Issues in IoT: Challenges and Countermeasures

Internet of Things (IoT)-connected devices have become an integral part of daily life. The IoT is quickly growing as more and more devices are attached to a global network.

Authors: Gokhan Polat, and Fadi Sodah
GDPR Compliance
ISACA Journal Article

Data Privacy, Data Protection and the Importance of Integration for GDPR Compliance

The EU General Data Protection Regulation (GDPR) guidelines require that organizations protect the personal data and privacy of EU citizens.

Author: Dave Brunswick
GDPR Compliance
ISACA Journal Article

Reporting on GDPR Compliance to the Board

Preparing for compliance with the EU’s GDPR, a multinational organization sought a simpler way to affect the complexity of the compliance matters facing the organization.

Author: Guy Pearce
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Assurance Considerations for Ongoing GDPR Conformance

How can we ensure that the newly developed GDPR processes and procedures transition into day-to-day practices and become business as usual?

Author: Ian Cooke
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

There are multiple regulations and laws requiring protecting the privacy-related data of customers and stakeholders.

Author: Sunil Bakshi
NIST's New Password Rule Book
ISACA Journal Article

NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk

The updated US NIST standards on password security published in the Special Publication 'Digital Identity Guidelines' represent a novel approach to improve IT security.

Authors: Bachman Fulmer, Melissa Walters, and Bill Arnold
ERP Applications
ISACA Journal Article

Sponsored Feature: Why Attackers Are Turning Their Attention Toward ERP Applications

Business-critical SAP and Oracle applications (also known as enterprise resource planning [ERP] applications) run the economy by managing the critical data and processes of large global organizations.

Author: Juan Pablo Perez-Etchegoyen
GDPR Compliance
ISACA Journal Article

The Road to GDPR Compliance: Overcoming the Compliance Hurdles

The passage of the EU General Data Protection Regulation (GDPR) has brought unprecedented attention to data protection legislation and the protection of personal privacy.

Author: Corlane Barclay
The Network
ISACA Journal Article

The Network: Tyler Hardison

What is the biggest security challenge that will be faced in 2019?

Author: ISACA
DLP Implementation
ISACA Journal Article

The Four Questions for Successful DLP Implementation

Information is a critical aspect of organizational success. Organizations with a better understanding of their information have been known to excel over those with a limited grasp of their information.

Author: Christopher Nanchengwa
Information Security Matters
ISACA Journal Article

Information Security Matters: Fifty Years of Information Security—A Recollection

This being the first issue of the ISACA Journal of 2019, which happens to be celebrating ISACA’s 50th anniversary!

Author: Steven J. Ross
GEIT Framework at Work, Part 6: Follow-Up & Continuous Improvement | ISACA Governance
Governance Article

GEIT Framework at Work, Part 6: Follow-Up & Continuous Improvement | ISACA

Readers of this series of articles have seen the progression of steps taken in the implementation of 1 particular element of governing and managing enterprise IT (GEIT): managing security, as defined in COBIT 5’s APO13 Manage security process.

26 December 2018
RPA Program
ISACA Journal Article

Launching a Value-Based Analytics and RPA Program

Many organizations are probably already using some form of data analytics in customer profiling, engineering or—hopefully—assessing IT risk.

Author: Chris Sanders
Mitigating Risk During Deployment
ISACA Journal Article

Identifying Challenges and Mitigating Risk During Deployment

Most people have come across the frequently used term “transformation” over last couple of years.

Author: Rajul Kambli
A New COBIT Is in Town and I Really Like How It Looks | ISACA COBIT 2019
Governance Article

A New COBIT Is in Town and I Really Like How It Looks | ISACA

ISACA released the latest version of the COBIT framework and I can tell you without hesitation that this latest structure is one of the best governance and management frameworks to date for the enterprise governance of information and technology (EGIT).

10 December 2018
Digital network
The Nexus Article

Closing the Skills Gap: Staying Current in a Changing Workplace

The cybersecurity skills gap has been a reality for organizations for several years and will be for the foreseeable future. The inability of organizations to close that gap is exacerbated by rapid evolution in the workplace.

10 December 2018
PowerShell
ISACA Journal Article

The Age of PowerShell

The IT industry is changing at a rapid pace, and gone are the days when administrators managed just a handful of servers. In today’s rapid deployments, system administrators are required to handle tens of hundreds of servers that are spun up or destroyed, as demand dictates.

Author: Ignacio Marambio Catán
Advancing COBIT
ISACA Journal Article

Advancing Information, Advancing Technology, Advancing COBIT

Information technology has changed the world, the way people work, and the way people communicate and live.

Author: Graciela Braga
The Network
ISACA Journal Article

The Network: Glory Ninsiima

How do you think the role of IT auditor is changing or has changed?

Author: Glory Ninsiima
Agile GEIT
ISACA Journal Article

Agile GEIT—Building Trust and Maximizing Value Delivery

The Agile methodology is defined as a set of principles and values that guide software development teams toward responding effectively and efficiently to customers’ needs, thereby reducing the business risk of irrelevance.

Author: Michael Bergman
Basic Lessons From COBIT Foundation Training | ISACA
Governance Article

Basic Lessons From COBIT Foundation Training | ISACA

The COBIT 5 Foundation course helps students prepare for a multiple-choice exam. However, the answer options offered on the exam are not the only choices the learner should be making.

26 November 2018
Podcast
Podcast

Addressing Tomorrow’s Threats Today

Threatcasting has indicated that IoT and AI are going to be some of the biggest security concerns in the future. But what can we do now to protect these home devices? And why does it matter if an Internet-connected appliance, like a smart coffee maker, is compromised?

20 November 2018
Maturity Assessment
ISACA Journal Article

Demand Management’s Evolution and Maturity Assessment

Economic recessions, globalization, offshoring and demographic changes are factors that have affected and shaped business strategies, organizational structures, markets and fortunes of people and enterprises.

Authors: Gianluca Giorgini, Stefano Aiello, Alberto Buffon, and Mariano Corso
podcast
Podcast

COBIT’s Impact on the Governance Profession

ISACA’s COBIT framework has helped practitioners around the world better manage and govern their information and technology for more than two decades. In this ISACA 50th Anniversary series podcast, we examine the impact COBIT has made for governance professionals and how the framework has evolved, including the recent launch of COBIT 2019.

13 November 2018
Governance
Governance Article

Board Support Can Revolutionize Cities. COBIT 5 Can Help Attain It

Most people, including many readers of this article, live in cities. Revolutionizing cities may seem like it is not an IT or technical issue, but smart sustainable cities are important for IT professionals.

12 November 2018
Mark B. Cooper
The Nexus Article

Digital Currency and the Need for Trust

For the first time in modern history, our civilization is on the verge of a new concept in monetary transactions with cryptocurrency. Cryptocurrency could be hugely disruptive to many industries and could completely change money transfer services industries, but trust must be the cornerstone before it can gain wide acceptance and be legitimized.

12 November 2018
Podcast
Podcast

Why We Failed

A centralized security approach for distributed systems has left many organizations vulnerable to attacks. In this Knowledge Series podcast, we discuss the ways in which security professionals have “failed” during the move toward decentralized processing.

12 November 2018
Growing a Cybersecurity Career
ISACA Journal Article

Growing a Cybersecurity Career

Those who have owned a house plant have probably noticed that no matter where the plant is placed, it grows toward the strongest source of light—a phenomenon called “phototropism.”

Author: Philip Casesa
Automation, Governance and Security
ISACA Journal Article

Automation, Governance and Security in a Software-Defined World

For more than 15 years, virtualization platforms have revolutionized computing by completely decoupling processing power from hardware resources.

Author: Julio Pontes
SOX Audit
ISACA Journal Article

Adding Increased Value—The IT Auditor’s Role in a SOX Audit

When a substantive audit is being performed where application controls are not being relied upon, could there be risk that needs to be tested, or at least identified, by an IT auditor even if application controls are not playing a role?

Author: Jeffrey T. Hare
Information Security
ISACA Journal Article

A Heightened Sense of Awareness

Each individual in an organization who manages information and information systems must fully understand his or her specific security responsibilities.

Authors: Wade Cassels, Kevin Alvero, and Randy Pierson
Cybersecurity
ISACA Journal Article

Future-Proofing a Career in Cybersecurity: The Skills Gap

Security professionals are in high demand, but the challenge is that there are not enough qualified employees to fill open enterprise requisitions.

Author: Mike Saurbaugh
Artificial Intelligence
ISACA Journal Article

Is Artificial Intelligence a Career Path for You?

Is the world changing too fast? Can society continue to do the best it can?

Author: Larry G. Wlosinski
The Practical Aspect
ISACA Journal Article

The Practical Aspect: Why Worry About IoT?

The Internet of Things (IoT) refers to physical objects that have embedded network and computing elements and communicate with other objects over a network.

Authors: Vasant Raval and Ranjit D. Thaker
Information Security Matters
ISACA Journal Article

Information Security Matters: How We Can Succeed

Just as the distributed model displaced the centralized (i.e., mainframe) one, I now believe that we are on the threshold of a new era, that of a multi-modal, utility, cloud-based, commercial, Software as a Service (SaaS) (choose any two terms at your pleasure) architecture.

Author: Steven J. Ross
Tools
ISACA Journal Article

Tools: Skill Acquisition in a Rapidly Evolving Workplace

The cybersecurity skills gap has been on the surface of employers’ awareness for several years.

Author: Robin Lyons
IT Audit Team
ISACA Journal Article

Effective Strategies for Creating and Maintaining a Diverse and Inclusive IT Audit Team

Broadly put, it is widely accepted in today’s corporate world that diverse organizations are preferable to their homogenous counterparts.

Authors: Julie Balderas, Asim Fareeduddin, Femi Richards, Ruwel Sarmad, and Jack Wall
Chief Digital Officer
ISACA Journal Article

Defining the Chief Digital Officer Using COBIT 5

The digital revolution’s pace is rapidly increasing, causing numerous disruptions and transformation in more and more industries.

Authors: João Catarino, Isabel Rosa, and Miguel Mira da Silva
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Affect What Is Next Now

To celebrate its 15th birthday, LinkedIn asked its members to share what they wanted to be when they were 15.

Authors: Ian Cooke and Martin Cullen
Introducing COBIT 2019: The Motivation for the Update? | ISACA
Governance Article

Introducing COBIT 2019: The Motivation for the Update? | ISACA

The upsurge of digital transformation has made information and technology (I&T) crucial in the support, sustainability and growth of enterprises.

29 October 2018
Cryptoviral Infections and Countermeasures
ISACA Journal Article

Evidential Study of Ransomware

Ransomware infections are rising exponentially. Attackers are motivated to extort money from individuals and organizations by infecting their systems with malicious code.

Authors: Aditya K. Sood, Pranshu Bajpai, and Richard Enbody
Cybersecurity
ISACA Journal Article

Red Teaming for Cybersecurity

Red teaming has been a buzzword in the cybersecurity industry for the past few years.

Author: Seemant Sehgal
Cybersecurity
ISACA Journal Article

It’s Time to Stop Today’s Cybersecurity Insanity

You may have heard the adage, “Insanity is doing the same thing over and over again and expecting different results.”

Author: Gregory J. Touhill
Podcast
Podcast

Examining the Facebook Breach

The recent Facebook data breach affected millions of users, and the way the exploit was carried out differed from many attacks in the past. In this security podcast, we discuss the Facebook security breach, how to respond to this kind of breach and the widespread impact this attack has.

10 October 2018
GEIT Framework at Work, Part 5: Confirming the Results | ISACA Governance
Governance Article

GEIT Framework at Work, Part 5: Confirming the Results | ISACA

There comes a point in any long-term initiative when the issues have been identified, the mitigation plans developed, the appropriate work products defined, and those products and plans have been implemented.

2 October 2018
COBIT 5
Governance Article

How to Prepare for the COBIT 5 Foundation Exam

The COBIT 5 Foundation course helps the student prepare for a multiple-choice exam. However, the answer options offered on the exam are the not the only choices the learner should be making.

1 October 2018
Podcast
Podcast

Digital Transformation? Boards Are Not Ready for It!

Any enterprise that wants to remain competitive must have a strong board of directors leading it toward digital transformation. Unfortunately, boards of directors may not always be knowledgeable enough to promote digital transformation. In this podcast, we discuss why boards of directors may not be able to how to prepare boards to lead digital transformation efforts.

30 September 2018
Digital Forensic Investigators
ISACA Journal Article

Lack of Oversight and Credentialing Process for Digital Forensic Investigators

Despite the phenomenal growth in the digital world and crimes committed using digital techniques and tools, there are literally no foundational requirements to perform digital forensic investigations.

Author: Nima Zahadat
Revolutionizing Cities
ISACA Journal Article

Using COBIT 5 to Get and Give Board Support for Revolutionizing Cities

Most people, including many readers of this article, live in cities.

Author: Graciela Braga
GEIT Framework at Work, Part 4: Outlining the Work Products | ISACA Governance
Governance Article

GEIT Framework at Work, Part 4: Outlining the Work Products | ISACA

No governance of enterprise IT (GEIT) initiative can be accomplished without careful attention to the work products and the project plan. They are the elements that deliver tangible results from GEIT.

17 September 2018
Podcast
Podcast

Making the Case for Workplace Gender Diversity

While many studies have shown the business benefits of gender diversity in the workforce, employees often are skeptical of the value of diversity, especially without strong sponsorship from the C-Suite. In this month’s ISACA SheLeadsTech podcast with guest Andrew McNeilis, chief commercial officer at Phaidon International, we look at recent research on this topic and explore strategies that can be deployed to strengthen organization-wide commitment to gender diversity.

17 September 2018
Effective Interactive Privileged Access Review
ISACA Journal Article

Effective Interactive Privileged Access Review

Most organizations would agree that it is a good practice, albeit not an easy one, to establish rules relating to the amount and type of access to provide to particular job roles.

Author: Sundaresan Ramaseshan
Cybersecurity Risk
ISACA Journal Article

Understanding Cybersecurity Risk

Progressive organizations know that risk is a fact of business. More than that, they recognize the need for integrated and sustainable solutions to address critical operational failures.

Author: Syed Alay Raza
Mark B. Cooper
The Nexus Article

Cloud Insecurity: The Need for Stronger Identity Management

With cloud usage growing exponentially, are we asking enough questions about cloud security for organizations to make informed risk management decisions?

10 September 2018
Podcast
Podcast

Exploring a Fun Career in Cybersecurity

Cybersecurity can be a very fun career. Even those who do not have technical backgrounds can thrive in a cybersecurity role. In this podcast, we discuss what makes a cybersecurity career fun, how to begin a cybersecurity career and why the perception of cybersecurity careers is so important.

10 September 2018
Cybersecurity Risk Reporting
ISACA Journal Article

Examining Cybersecurity Risk Reporting on US SEC Form 10-K

On 27 June 2017, A.P. Moller-Maersk, Merck & Co., Inc., TNT, WPP, DLA Piper, Rosneft, the Ukrainian state postal service and Princeton Community Hospital in West Virginia, USA, were among the numerous organizations...

Author: Grace F. Johnson
Tips for Implementing IT Governance With COBIT 5
Governance Article

Tips for Implementing IT Governance With COBIT 5 | ISACA

Underlying the implementation of a number of governance of enterprise IT (GEIT) initiatives are information governance and information management issues such as big data, analytics...

9 July 2018
Digital Strategy and Oversight
ISACA Journal Article

How Boards Engage in Digital Strategy and Oversight

Boards of directors (BoDs) are ultimately accountable for strategic decision-making and control in organizations.

Authors: Steven De Haes, Laura Caluwe, Anant Joshi, and Tim Huygh
Effective Change Management
ISACA Journal Article

Speeding Up Software Delivery With Effective Change Management

The value in software is realized only when the end product is in the hands of its intended users. Traditional software development can be slow.

Authors: Evan Bass and W. Noel Haskins-Hafer
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

Considering the changes happening in IT, I feel there is a need for updating my skills; however, I am not sure what studies I should pursue to ensure that my skills are not outdated.

Author: Sunil Bakshi
Bitcoin Boosting Business
ISACA Journal Article

Bitcoin Boosting Businesses

Love them or hate them, cryptocurrencies have been turning the financial world upside down over the past few years.

Author: Josh Wardini
Managing Risk
ISACA Journal Article

Guest Editorial: Digital Transformation Insight for 21st Century Organizations

In the IT and cybersecurity realms, change is inevitable. Digital advancements fuel innovative ways of doing things.

Author: Gregory J. Touhill
Mergers and Acquisitions
ISACA Journal Article

The Practical Aspect: Mergers and Acquisitions, Should Internal Audit Be Involved in Due Diligence?

Corporations today, especially large corporations, find acquisitions to be a crucial means to achieve their strategy.

Authors: Vasant Raval and Chandni Jalan
Information Security Matters
ISACA Journal Article

Information Security Matters: Why We Failed

The last time there was a shift…in the way information technology was organized occurred when we moved from massive centralization—mainframes to distributed processing.

Author: Steven J. Ross
Data and Analytics Progress
ISACA Journal Article

Data and Analytics Progress During the Last Four Years

In the last few years, there has been an increase in the usage, volume and importance of data and analytics.

Author: Angel Serrano
Digital Transformation
ISACA Journal Article

Digital Transformation? Boards Are Not Ready for It!

Boards of directors (BoDs) should be involved in directing and leading their organizations toward digital transformation, ever wary of the not inconsiderable risk scenarios along the way.

Author: Guy Pearce
Innovating Internal Audit
ISACA Journal Article

Sponsored Feature: Innovating Internal Audit to Unlock Value

As new businesses are created and old ones spun off, processes evolve, technologies are adopted, and regulatory demands fluctuate, the internal audit function must develop new approaches to advise management on key issues, anticipate risk and be more forward-looking.

Authors: Clay Young and Erik Kiaer
The Network
ISACA Journal Article

The Network: Kevin Murphy

How do you think the role of the cybersecurity professional is changing or has changed?

Author: Kevin Murphy
Impacts of Blockchain on the Auditing Profession
ISACA Journal Article

Impacts of Blockchain on the Auditing Profession

Blockchain’s disruptive effect is widely recognized in the financial sector, although the level of awareness in other sectors and their professions is still in its infancy.

Authors: Nathalie Brender and Marion Gauthier
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing the IoT

Determining the IoT pre-audit planning for the subject, objective, scope, and procedures for data gathering.

Author: Ian Cooke
Cyberconflicts
ISACA Journal Article

Cyberconflicts: Reflections and Implications for Today’s Enterprises

Cyberconflict, or the so-called cyberwar, is an issue that could be seen as falling into the category of being “a truth through plausible deniability.”

Author: Jeimy J. Cano M.
Podcast
Podcast

I Left My Security in the Office

Remote work is growing increasingly more common, and with good reason; it offers numerous benefits to enterprises that leverage it. But this new way of working also presents new security challenges. In this podcast, we discuss some of those challenges and how to combat them.

30 August 2018
Better the Process You Know Than the Gaps You Don’t | ISACA Governance
Governance Article

Better the Process You Know Than the Gaps You Don’t | ISACA

The FirstRand Group is a financial services provider in South Africa. It is one of the largest financial institutions in South Africa and the holding company of First National Bank (FNB), a retail and commercial bank.

20 August 2018
podcast
Podcast

The Elevation of Cybersecurity to a Board-Level Imperative

Cybersecurity has found its way onto board agendas for enterprises across all industries throughout the world, yet remains a mighty challenge. In this ISACA 50th Anniversary series podcast, we examine how cybersecurity came to command such high-profile attention and what organizational leaders can do to improve cyber preparedness.

20 August 2018
Cyberextortion
ISACA Journal Article

The Downstream Effects of Cyberextortion

In the mid-1800s, manufacturing was alive and well in the Chicago (Illinois, USA) area. Demand for industrial goods was growing.

Author: Tony Martin-Vegue
The Price of a Data Breach
ISACA Journal Article

The Price of a Data Breach

In this modern age, the volume of data shared among different platforms has exponentially increased as technology becomes more prevalent across all industry sectors.

Authors: Van Ha Le and Bianca Zamora
Ed Moyle
The Nexus Article

Combatting “Fileless” Malware

If you are a security practitioner, you do not need me to tell you how bad malware is. We all have war stories of critical system outages, angry users and other disruptions to the well-oiled machinery of our enterprise’s technology that occurred because of a particularly nefarious malware incident.

13 August 2018
Podcast
Podcast

IoT, Machine Learning and Artificial Intelligence: Nothing to Fear

When some people think of machine learning and artificial intelligence, their thoughts go immediately to Skynet or devices taking over humankind. But machine learning and artificial intelligence can significantly improve the quality of everyone’s life, whether it be through applications at home or during medical procedures. In this security series podcast, we discuss machine learning and artificial intelligence and the benefits and challenges they pose.

10 August 2018
IT Audits
ISACA Journal Article

Addressing the Challenges of IT Audits by Supreme Audit Institutions

Supreme Audit Institutions (SAIs) refer to the national agencies entrusted with ensuring accountability in the functioning of national governments through external audit.

Author: Shourjo Chatterjee
COBIT 5—How to Get Inspired
Governance Article

COBIT 5: How to Get Inspired | ISACA

Even best-in-class frameworks need to be half as inspiring as a good novel—and twice as inspiring for practitioners to read and use them! As a COBIT trainer, I use the following tips on how to capitalize on COBIT...

6 August 2018
Information Security
ISACA Journal Article

Data Spill Lessons From the Oil Industry

Historically, data management was a money outflow for organizations; the primary expense was allocated to data archival to comply with regulatory requirements.

Author: Sridhar Govardhan
Cybersecurity Employee Retention
ISACA Journal Article

Cybersecurity Employee Retention and Management Culture

Ask security leaders if they have enough cybersecurity professionals on staff and the likely response will be “no.”

Author: Mike Saurbaugh
GEIT Framework at Work, Part 3: Creating a Project Plan | ISACA Governance
Governance Article

GEIT Framework at Work, Part 3: Creating a Project Plan | ISACA

There is an old saying about the importance of planning: “Failing to plan is planning to fail.” While the saying has become almost a cliché from years of use, it is essentially true.

23 July 2018
Podcast
Podcast

How Women Can Capitalize on Opportunities in the Tech Workforce

While the disproportionately male nature of the tech workforce can be challenging for some women to navigate, many organizations are actively looking to bring more women into tech roles. In this ISACA SheLeadsTech Series podcast, we discuss how organizations can make those roles more appealing for women and why this might be a great time for women who are interested in joining the tech workforce.

20 July 2018
Podcast
Podcast

The Promises and Jeopardies of Blockchain Technology

Blockchain technology has the potential to change every industry, from finance to healthcare. However, blockchain presents some risk, and enterprises need to consider this risk if they are thinking about adopting blockchain technology. In this podcast, we discuss the benefits of blockchain and some of the challenges that it may present.

20 July 2018
Innovation Governance
ISACA Journal Article

Technology Innovation Dynamics: Innovation Governance

Complex adaptive system (CAS) cognations typically reflect bounded individual agents interacting and adapting to each other and the associated environment.

Author: Robert E. Davis
Podcast
Podcast

The State of Cybersecurity

With the increasing number of connected devices, the need for skilled cybersecurity professionals is even greater. In this Security series podcast, we discuss the most common cybersecurity threats, the skills gap and how the skills gap can be remediated.

11 July 2018
Securing the SWIFT Infrastructure
ISACA Journal Article

Securing the SWIFT Infrastructure Across the Cyber Kill Chain

Secure SWIFT infrastructure enabled by IT and information security functions.

Author: Vimal Mani
The Victorian Protective Data Security Framework and COBIT 5
Governance Article

The Victorian Protective Data Security Framework and COBIT 5 | ISACA

The amount of data being produced, processed, communicated and stored is larger than ever before. 1 Most people are well aware that information about them is typically held by a variety of organizations ranging from governments to private organizations.

9 July 2018
Tyler Hardison
The Nexus Article

Overexposed and Underprepared: Top Reasons to Consider SIEM Now

Who are the biggest targets for hackers and cybercriminals? You are. Intruders are finding the holes in your network, your devices, your applications—and they are accessing your data.

9 July 2018
Mark B. Cooper
The Nexus Article

Boost Security in Your Organization with Tactical Two-Factor Authentication

Social engineering is on the rise. Organizations are nearly 3 times more likely to get breached by social attacks than via actual vulnerabilities, according to Verizon’s 2018 Data Breach Investigations Report.

9 July 2018
Information Security Matters
ISACA Journal Article

Information Security Matters: I Left My Security in the Office

For many people, information technology has changed the very meaning of work.

Author: Steven J. Ross
Help Source Q&A
ISACA Journal Article

Help Source Q&A

Our organization is considering multiple projects for developing and implementing IT-based solutions.

Author: Sunil Bakshi
Blockchain Technology
ISACA Journal Article

The Promises and Jeopardies of Blockchain Technology

The idea of the distributed ledger of everything, which burst into the public scene in 2008 with the publication of the fascinating white paper, Bitcoin: A Peer-to-Peer Electronic Cash System, has transitioned from hype to reality much faster than many experts had predicted.

Author: Phil Zongo
IT Portfolio Management
ISACA Journal Article

The Power of IT Investment Risk Quantification and Visualization: IT Portfolio Management

Is it worth the incremental effort to determine IT financial investment risk as part of the IT investment business case?

Author: Guy Pearce
Information Security
ISACA Journal Article

Roles of Three Lines of Defense for Information Security and Governance

Assurance, governance, risk, compliance, information security and cybersecurity functions can all work in one way or another on information security and governance.

Author: Amelia Ho
Data Governance
ISACA Journal Article

Data Governance From the Actuary and Risk Management Perspectives

Data governance comprises a holistic management system that coordinates and manages how data move in the organization, responsibilities and data flows, and all risk and actions related to data.

Author: Mehmet Zeki Önal
Audit Tools
ISACA Journal Article

Tools: Using Audit Tools to Support Strategic Objectives

Organizations that seek excellence tend to maintain a sharp focus on their strategic objectives.

Author: Robin Lyons
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Add Value to What Is Valued

Enterprises have many stakeholders, and “creating value” means different—and sometimes conflicting—things to each of them.

Author: Ian Cooke
Cybersecurity
ISACA Journal Article

Getting the Basics of Cybersecurity Right

Security professionals understand and acknowledge that there are a myriad of challenges facing cybersecurity teams today.

Author: Ramón Serres
MFT Strategy
ISACA Journal Article

Protection From GDPR Penalties With an MFT Strategy

Companies facing the EU’s looming General Data Protection Regulation (GDPR) compliance mandate could benefit from a modernized managed file transfer (MFT) solution.

Author: Dave Brunswick
The Network
ISACA Journal Article

The Network: Rob Clyde

What do you see as the biggest risk factors being addressed by information security professionals?

Author: ISACA
Risk Management
ISACA Journal Article

Integrating KRIs and KPIs for Effective Technology Risk Management

Performance evaluation is a key element of any management system and a good governance practice.

Author: Rama Lingeswara Satyanarayana Tammineedi
NICE Framework
ISACA Journal Article

Cybersecurity Education Based on the NICE Framework: Issues and Challenges

The need for cybersecurity professionals and skills is growing rapidly in the United States and around the world due to several factors, including the continuous growth of the Internet, online social networks, smartphones, e-commerce and other global issues, such as cyberhacking and terrorism.

Author: Izzat Alsmadi
Tips for Making COBIT 5 Implementation Fit the Enterprise | ISACA COBIT
Governance Article

Tips for Making COBIT 5 Implementation Fit the Enterprise | ISACA

COBIT 5 in an organization is an ambitious aspiration and a noteworthy endeavor. It demonstrates the maturity, willingness and commitment to improve.

25 June 2018
Data Breaches
ISACA Journal Article

The Methods and Costs of Data Breaches

“Data breach” has become a common term, so much so that it seems as though not a day goes by without mention of a data breach occurring.

Author: Mohammed J. Khan
Cybersecurity
ISACA Journal Article

As Hospitals Get Smart, Cybersecurity Challenges Will Increase

Healthcare technology is at a critical juncture of rapid growth, seamless implementation and the need for constant adaptability.

Authors: Justine Bone, Violet Morris and Chadwick Williamson
podcast
Podcast

The Impact of Automation and Robotics

While there are concerns about the influence automation could have on the technology workforce, automation also can drive economic growth and create new types of technology jobs. In this ISACA 50th Anniversary Series podcast, we discuss the transformative impact of automation and robotics on the tech workforce and society in general.

18 June 2018
GEIT Framework at Work, Part 2: Plan the Solution | ISACA
Governance Article

GEIT Framework at Work, Part 2: Plan the Solution | ISACA

This article is the second in a 6-part series that looks at the practical application of a governance of enterprise IT (GEIT) framework. This article focuses on planning the resolution of the issue identified in part 1.

11 June 2018
Rob Lelewski
The Nexus Article

Train Barefoot Doctors in Your Organization

In the mid-20th century, rural China lacked basic healthcare services. This occurred for a variety of reasons, but the end result was obvious: without basic healthcare services, the ability to treat simple illnesses or educate the population on proper hygiene or family planning was limited or nonexistent outside of large urban areas.

11 June 2018
Insider Threats
ISACA Journal Article

Protect, Detect and Correct Methodology to Mitigate Incidents: Insider Threats

In terms of cybersecurity, many organizations tend to worry about external threats such as hacking or distributed denial-of-service (DDoS) attacks.

Author: Max Alexander
IT Risk Management
ISACA Journal Article

IT Risk Management Based on COBIT 5 for Risk at Deutsche Telekom AG

The purpose of risk management is to protect the values of an organization.

Author: Horst Moll
Update of System Audit Standard & System Management Standard in Japan | ISACA Governance
Governance Article

Update of System Audit Standard & System Management Standard in Japan | ISACA

The Japanese Ministry of Economy, Trade and Industry (METI) published the System Audit Standard and the System Management Standard in 2004. Despite significant changes to the IT environment after that date, no updates to these materials were published.

29 May 2018
Security
ISACA Journal Article

Building a Strong Security Posture Begins With Assessment

Hacked! Attacked! Leaked! Daily news headlines scream high-profile information security failures and their consequences.

Author: Tyler Hardison
Podcast
Podcast

Applying a Technological Integration

Innovation is required for any enterprise that wants to remain competitive. But how can innovation be balanced with other business goals? In this Knowledge Series podcast, we discuss the importance of innovation and a possible framework than can be leveraged to best utilize innovation.

18 May 2018
Podcast
Podcast

Mentors and Role Models in the Tech Workforce

A shortage of role models was cited in ISACA research as one of the roadblocks for women in the technology workforce. In this podcast with guest Jan Babiak, we discuss some of the steps both women and men can take to empower female practitioners and enhance gender diversity.

18 May 2018
Merging Internal Audit Departments
ISACA Journal Article

Merging Internal Audit Departments

As organizations try to keep up with rapid changes in technology, they are using acquisitions as a way to quickly develop entirely new lines of business or to simply close gaps in technological capability.

Authors: Kevin Alvero, Randy Pierson, and Wade Cassels
GEIT Framework at Work, Part 1: Identifying the Problem | ISACA
Governance Article

GEIT Framework at Work, Part 1: Identifying the Problem | ISACA

This article is the first in a 6-part series that looks at the practical application of a governance of enterprise IT (GEIT) framework. The starting point is discussed in this article—forming an awareness that a problem exists and how to approach it.

14 May 2018
Mark B. Cooper
The Nexus Article

PKI Explained: Why It Is Necessary and Relevant Now More Than Ever

Unauthorized access, unsigned applications (malware) and unsecured email. What can help prevent these top 3 cyberthreats impacting organizations today? Public key infrastructure (PKI). PKI enables a trusted environment by authenticating and ensuring the integrity of data and users.

14 May 2018
Information Security
ISACA Journal Article

Never Waste a Good Information Security Incident

Hospitals, major organizations and government offices across the globe had been hit by a massive wave of cyberattacks that seized control of computers until the victims paid a ransom.

Authors: Yuri Bobbert and Talitha Papelard-Agteres
SOC Use Cases
ISACA Journal Article

Event Category Catalog for SOC Use Cases

The majority of modern organizations have embarked on the path security operations centers (SOCs) are building.

Author: Aleksandr Kuznetcov
Cybersecurity
ISACA Journal Article

Cybersecurity vs. Master Data Management

The exposure of data for up to 14 million of Verizon’s customers in July 2017 was an enormous embarrassment, particularly for an organization that presents itself as a premium cybersecurity consultancy.

Authors: Chip Jarnagin and Sonja Hammond
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing Data Privacy

Determining pre-audit planning for the subject, objective, scope, and procedures for data gathering.

Author: Ian Cooke
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

How can we assess risk associated with blockchain technology?

Author: Sunil Bakshi
Information Governance
ISACA Journal Article

Building Bridges With the Board—Innovation in Information Governance

IT professionals and enterprise board members live in two very different worlds. Boards worry about strategic concerns such as revenue.

Author: T. Sean Kelly
Audit Tools
ISACA Journal Article

Tools: Active Defense

Every year, ISACA conducts its annual Global State of Cybersecurity research. The second part of the survey asks about security practices in the field: what is working and what is not.

Author: Ian Cooke
Secure Elections
ISACA Journal Article

Secure Elections in a Smart World

When people hear the term “cyberwarfare,” there are a few things that come to mind.

Author: Ed Moyle
Authorization Risk
ISACA Journal Article

Web Applications Authorization Risk When Using Windows Accounts

The use of Windows accounts to authorize users to applications introduces risk that an auditor should evaluate.

Author: Alex Quiles
Intellectual Property Protection
ISACA Journal Article

Intellectual Property Protection for High-Tech’s Crown Jewels

Theft of intellectual property (IP) is an emerging threat and a topic of boardroom conversation for organizations across the United States, particularly for those in the high-tech industry.

Authors: Ray Cheung, and Mike Porter
Security
ISACA Journal Article

Security in Depth

The methodology of network security has changed drastically due to the aggressive pace at which data have grown and the need for constant real-time access becoming the norm.

Author: Charles Hale
The Network
ISACA Journal Article

The Network: Lucio Augusto Molina Focazzio

How do you think the role of the IS audit professional is changing or has changed?

Author: ISACA
Healthcare Security
ISACA Journal Article

Healthcare Security—Three Paradoxes and the Need for a Paradigm Shift

Is the CIO role still relevant for IT security in healthcare? The world of information and data management is changing faster than anyone could have predicted.

Author: Giuliano Pozza
The Journal Transformation
ISACA Journal Article

Letter From the Editor: From Print to Digital—The Journal Transformation

As technology continues to transform the way people consume information, the work of ISACA’s professional community becomes more important—and challenging.

Author: Jen Hajigeorgiou
Information Security Matters
ISACA Journal Article

Information Security Matters: Security in the Migration to a Multi-Modal Environment

I have been a data center rat my whole career, starting as a systems engineer for a hardware vendor and, today, as a consultant.

Author: Steven J. Ross
Security
ISACA Journal Article

Clash of the Titans

One of the major challenges chief information security officers (CISOs) face in almost any organization is prioritizing information security interests with regard to IT interests.

Author: Ofir Eitan
Podcast
Podcast

Interview with Piotr and Matt Era

In this podcast, the president of the ISACA Warsaw (Poland) Chapter speaks with ISACA CEO Matt Loeb, CGEIT, CAE, FASAE, about the future of ISACA. Loeb also discusses the needs of ISACA members, GDPR preparation and how ISACA can best serve its diverse membership.

30 April 2018
GDPR Compliance
ISACA Journal Article

Complying With GDPR: An Agile Case Study

Designed to give European Union residents better privacy rights, the EU General Data Protection Regulation (GDPR) comes into force in May 2018.

Authors: Mina Miri, Farbod H. Foomany, and Nathanael Mohammed
AWS Migration
ISACA Journal Article

AWS Migration: Advantages, Risk & Mitigation Measures

It is no surprise that many enterprises, ranging from early start-ups to mature global enterprises, have considered or implemented a migration to Amazon Web Services’ (AWS) cloud computing services.

Authors: Ray Cheung, Vikas Sharma, and Bhupinder Singh
Seven COBIT 5 Implementation Pitfalls to Avoid
Governance Article

Seven COBIT 5 Implementation Pitfalls to Avoid | ISACA

Good practices are as good as those who practice them. As a COBIT trainer, I recommend the following tips which can help COBIT users become “good” COBIT 5 practitioners.

9 April 2018
Cybersecurity
ISACA Journal Article

Sometimes, Cyberattackers Are Going to Get In: The State of Cybersecurity 2018

The cybersecurity problem in a nutshell is that criminals are launching cyberattacks against the global attack surface comprised of the world’s people.

Author: Keith Price
Podcast
Podcast

Reasonable Software Security Engineering

Threat modeling is becoming a valuable security tool, especially in light of GDPR. In this podcast, we discuss the importance of threat modeling and the first steps your enterprise can take to begin leveraging it.

29 March 2018
Podcast
Podcast

Disaster Recovery Management in the Multimodal Era

The multimodal era of technology presents numerous benefits and challenges. In this podcast, we discuss what availability and disaster recovery management look like in the multimodal era.

29 March 2018
Corporate Innovation
ISACA Journal Article

Minimizing the High Risk of Failure of Corporate Innovation

Much of today’s new technology may not impact the organization’s business directly, but it almost certainly will impact it indirectly

Author: Guy Pearce
Improving the Service Desk by Using COBIT 5
Governance Article

Improving the Service Desk by Using COBIT 5 | ISACA

The IT service desk plays a significant role in the day-to-day operations of any organization. When it functions well, all other activities perform well.

26 March 2018
User Certifications
ISACA Journal Article

Rethinking User Access Certifications

Access certification involves a manager or system owner reviewing users’ entitlements (access) to a system or systems to ensure that the users have access to only what they need.

Author: Vincent J. Schira
E-Governance of Currencies
ISACA Journal Article

E-Governance of Currencies

Innovative ideas pave the way for efficient and seamless governance in any type of organization.

Author: Vijayavanitha Sankarapandian
Tyler Hardison
The Nexus Article

Three Milepost Markers on the Road to PCI Compliance

Compliance is a journey, not a destination—an ongoing, multistep process. It is not boxes to check off—check it and forget it—but milepost markers along the way to ensure that compliance is consistent, such as ensuring that device inventories and configuration standards are kept up to date.

12 March 2018
Rob Lelewski
The Nexus Article

Two Common Choke Points in the Incident Response Process

Many organizations simply do not have the luxury of maintaining an in-house incident responder or incident response staff. This leaves the organization with 2 options...

12 March 2018
Digital Ethics
ISACA Journal Article

Digital Ethics & the Blockchain

How the digital transformation turns out may depend on how well it supports core values such as prosperity, fairness, integrity, transparency and privacy atop an Internet that erodes some of these values.

Author: Dan Blum
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Innovation in IT Audit Process

In June 2015, ISACA began publishing a set of white papers titled “Innovation Insights.”

Author: Ian Cooke
HelpSource Q&A
ISACA Journal Article

HelpSource Q&A

Traditionally, our organization has a policy to adopt established technology solutions.

Author: Sunil Bakshi
Information Security Architecture
ISACA Journal Article

Information Security Architecture: Gap Assessment and Prioritization

A top-down approach to enterprise security architecture can be used to build a business-driven security architecture.

Author: Rassoul Ghaznavi-Zadeh
Assessing Cyberrisk Factors
ISACA Journal Article

The Missing Link in Assessing Cyberrisk Factors Through Supply Chains

In February 2014, one of the biggest discount retailers in the United States, Target Corporation, reported a data breach within its network system that caused the leak of 110 million customers’ financial and personal information.

Author: Ofir Eitan
Audit Tools
ISACA Journal Article

Tools: Five Linux Distributions With Tools for Audit

This article identifies Linux distributions that provide collections of hundreds or, in some cases, thousands of tools, many of which audit professionals might find valuable.

Author: Ed Moyle
Enterprise Risk Management
ISACA Journal Article

Technology’s Role in Enterprise Risk Management

The new COSO ERM framework document, Enterprise Risk Management—Integrating With Strategy and Performance, is expected to have a level of global influence similar to Internal Control–Integrated Framework.

Author: Jennifer Bayuk
Innovation Governance
ISACA Journal Article

Applying a Technological Integration Decision Framework to Innovation Governance

Innovation is the process of transforming an idea or concept into a functional and marketable value proposition reflecting creative opportunity.

Author: Robert E. Davis
IT-OT Security Management
ISACA Journal Article

Sponsored Feature: Centralized, Model-Driven Visibility Key to IT-OT Security Management

The threat landscape has changed significantly for operational technology (OT) environments as their connectivity to IT networks and the Internet has exponentially increased.

Author: Ron Davidson
The Network
ISACA Journal Article

The Network: Stephen Doyle

What is the biggest security challenge that will be faced in 2018?

Author: ISACA
Cyber Insurance
ISACA Journal Article

Why Cyber Insurance Needs Probabilistic and Statistical Cyberrisk Assessments More Than Ever

In 2016, there were instances where cybersecurity stocks did not fare well, and one reason attributed to this occurrence was that investors needed some high-profile breaches2 to lure them back into investing in cybersecurity stocks.

Author: Indrajit Atluri
Information Security Matters
ISACA Journal Article

Information Security Matters: Disaster Recovery Management in the Multimodal Era

The concept of an organization’s information systems operating in a space and on equipment owned by that organization has been replaced by systems residing in.

Author: Steven J. Ross
Here Comes the GDPR. Are You Ready? | ISACA
Governance Article

Here Comes the GDPR. Are You Ready? | ISACA

By now, most have at least heard of something called the EU General Data Protection Regulation (GDPR). If not, you may be in for a big surprise.

26 February 2018
Web Monitoring
ISACA Journal Article

Web Monitoring: From Big Data to Small Data Analysis Through OSINT

Every organization should know what information is circulating on the Internet about its activities so that it can use concrete actions to handle any potential threats.

Authors: Paolo Gasperi, Luigi Sbriz, and Marco Tomazzoni
Data Loss
ISACA Journal Article

Data Loss Prevention—Next Steps

Around 2007, it became obvious that the information security defenses that were implemented by the government and businesses to prevent data loss were not totally effective.

Author: Larry G. Wlosinski
Process Capability Assessment Using COBIT 5 as a Compliance Requirement
Governance Article

Process Capability Assessment Using COBIT 5 as a Compliance Requirement | ISACA

Governance and management of enterprise information technology (GEIT) is the practice of applying enterprise resources (enablers) to the creation and delivery of value to enterprise stakeholders.

12 February 2018
Internet of Transformation
ISACA Journal Article

Internet of Transformation: What Does IoT Mean for Your J-O-B?

While today everyone worships their smartphones as if the device itself demands their constant and public attention, there’s a new transformative technology that’s even more pervasive—practically inescapable—and yet largely invisible to the average person.

Author: Chris Poulin
Podcast
Podcast

Mistakes Happen—Mitigating Unintentional Data Loss

Data loss, whether intentional or accidental, is a concern for most enterprises, especially considering recent regulatory changes. In this podcast, we discuss ways to prevent data loss and how to address it if it happens.

1 February 2018
Portfolio, Program & Project Management Using COBIT 5, Pt 3 | ISACA Using
Governance Article

Portfolio, Program & Project Management Using COBIT 5, Pt 3 | ISACA

This is the continuation of a series of articles published in COBIT Focus beginning in September 2017. The first article 1 discussed the approach for mapping COBIT 5 with the Project Management Institute (PMI’s) standards and publication...

29 January 2018
COBIT 5
ISACA Journal Article

A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family

Determining the level of process maturity for a given set of IT-related processes allows organizations to determine which processes are essentially under control and which represent potential pain points.

Authors: Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto, Miguel Mira da Silva
Corporate Cyberintelligence Processes
ISACA Journal Article

Best Practices for Corporate Cyberintelligence Processes

Cyber Incident response is no different than any other type of warfare. It requires strategy, and tactics.

Authors: Ofir Eitan and Aviv Srour
Data Loss
ISACA Journal Article

Mistakes Happen—Mitigating Unintentional Data Loss

Nobody intends to lose data, and but it happens. Often. Immature processes, inadequate tools and unaware users reveal themselves as the weak links.

Author: Mike Van Stone and Ben Halpert
GDPR Countdown & COBIT 5 | ISACA
Governance Article

GDPR Countdown & COBIT 5 | ISACA

Compliance with the EU General Data Protection Regulation (GDPR) begins on 25 May 2018, giving us almost 6 months to finalize GDPR preparations. Doing nothing is not an option.

15 January 2018
Encrypted and Private Databases
ISACA Journal Article

Toward Encrypted and Private Databases

The number of data breaches annually totals thousands in the United States alone. More importantly, the total number of records exposed has reached the billions.

Author: Josh Joy
Tyler Hardison
The Nexus Article

The Top Four Security Vulnerabilities You Might Be Overlooking

Daily news headlines scream high-profile information security failures and consequences—Hacked! Attacked! Ransomware!—reinforcing that the severity of risk posed to sensitive information is unprecedented. Security threats can put your organization and your customers’ sensitive information at risk, costing you in customer loss, diminished trust in your brand and regulatory fines.

8 January 2018
Podcast
Podcast

Meltdown and Spectre Vulnerabilities

The recently discovered Meltdown and Spectre vulnerabilities affect nearly all computers and smart phones. In this podcast, we discuss these vulnerabilities, the responses to them and what you can do to be secure in light of this discovery.

8 January 2018
CRISP-DM Framework
ISACA Journal Article

The Machine Learning Audit—CRISP-DM Framework

Machine learning is revolutionizing many industries, from banking to manufacturing to social media.

Author: Andrew Clark
Data Privacy
ISACA Journal Article

When What Is Lost Is Lost Forever: Data Privacy

The “Kodak Moment” has been redefined from capturing and immortalizing memories on film to waking up the next day and seeing entire industries disappear.

Author: William Emmanuel
ISACA Privacy Principles
ISACA Journal Article

Book Review: ISACA Privacy Principles and Program Management Guide

ISACA Privacy Principles and Program Management Guide provides a comprehensive explanation of all things privacy.

Author: ISACA
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Backup and Recovery

ISACA reviews 4 backup and recovery principles as the technology evolves due to technological improvements.

Authors: Ian Cooke
HelpSource
ISACA Journal Article

HelpSource Q&A

The European Union (EU) General Data Protection Regulation (GDPR) will take effect in May 2018.

Author: Sunil Bakshi
Cloudifying Threats
ISACA Journal Article

Cloudifying Threats—Understanding Cloud App Attacks and Defenses

Cloud applications (apps) and services have revolutionized business productivity and efficiency by providing a robust and flexible environment in which to share and transfer data.

Authors: Aditya K Sood and Rehan Jalil
Big Data
ISACA Journal Article

Implementation of Big Data in Commercial Banks

Big data can be described as a huge volume of data that cannot be treated by traditional data-handling techniques.

Author: Adeniyi Akanni
Big Data
ISACA Journal Article

Big Data Deidentification, Reidentification and Anonymization

Big data seems indeterminate due to its constant use in intellectual data science fields and science, technology and humanities enterprises.

Author: Mohammed J. Khan
AI
ISACA Journal Article

Applying AI in Application Security

The use of artificial intelligence (AI) in cyber security will help organizations enhance existing application security capabilities.

Author: Kiran Maraju
Data Protection Tools
ISACA Journal Article

Tools: Data Protection Tools

Data protection is critical, but it can sometimes be less visible than other types of security controls.

Author: Ed Moyle
The Network
ISACA Journal Article

The Network: Sandy Fadale

What is the biggest security challenge that will be faced in 2018?

Author: ISACA
Information Security Matters
ISACA Journal Article

Information Security Matters: Managing Availability in the Multi-Modal Era

A few columns back, I wrote about the security of multi-modal IT environments, and in which applications and infrastructure are operated in colocation (colo) sites.

Author: Steven J. Ross
Portfolio, Program & Project Management Using COBIT 5, Pt 2 | ISACA Governance
Governance Article

Portfolio, Program & Project Management Using COBIT 5, Pt 2 | ISACA

This article illustrates how mapping of COBIT 5 with PMI standards helps provide assurance that the COBIT 5 framework can be used as a single integrated framework across organizations.

Big Data Analytics
ISACA Journal Article

Big Data Analytics and Its Transformational Effect on Global Business

In their capacity as a tool, computers will be but a ripple on the surface of our culture.

Author: Ravikumar Ramachandran
Podcast
Podcast

Governance, Risk, Compliance and a Big Data Case Study

Leveraging big data correctly can help enterprises gain value. That happened at a major bank a few years ago, but the regulatory landscape has changed, and that affects the way enterprises handle big data. In this podcast, we discuss a big data case study and explore how it may have differed given today’s regulations.

19 December 2017
An IoT Control Audit Methodology
ISACA Journal Article

An IoT Control Audit Methodology

An IoT Control Audit Methodology. As the IoT industry evolves, more controls can be added to the method as required.

Authors: Marcin Jekot and Yiannis Pavlosoglou
Podcast
Podcast

Anatomy of an IoT DDoS Attack and Potential Policy Responses

Attacks in the Internet of Things are becoming more prevalent, and it is crucial to know how to address them. In this podcast, we will discuss what an IoT DDoS attack looks like and some policy responses that could address it.

14 December 2017
Using Darknet Concepts for IoT Security
ISACA Journal Article

Using Darknet Concepts for IoT Security: Tor of Things

In today’s always-connected world, the concept of device connectivity, the Internet of Things (IoT), has already solidified.

Author: Mike Kuzminski
Drive Transparent and Measurable Value With COBIT 5 Process Metrics | ISACA Governance
Governance Article

Drive Transparent and Measurable Value With COBIT 5 Process Metrics | ISACA

COBIT 5 combines the goals cascade and the balanced scorecard (BSC) 2 perspectives to ensure that metrics at all levels track the achievement of overall objectives of the organization.

Delivering Disruptive Innovation Using the COBIT 5 Framework
Governance Article

Delivering Disruptive Innovation Using the COBIT 5 Framework | ISACA

Delivering Disruptive Innovation Using the COBIT 5 Framework. Helps define business continuity policy & scope based on the strategy and stakeholder objectives.
Assurance Across the Three Lines
ISACA Journal Article

Assurance Across the Three Lines: A Collaborative Defense

In day-to-day vocabulary, a line of defense is defined as a structure used to defend against attack.

Author: Ability Takuva
Petya/NotPetya
ISACA Journal Article

Petya/NotPetya: Why It Is Nastier Than WannaCry and Why We Should Care

US National Security Agency (NSA) hacker tools dumped on the dark net, based on the EternalBlue exploit, are continuing to evolve into attacks increasing in frequency and severity.

Author: F. Charlene Watson
Configuration Management
ISACA Journal Article

Book Review: Configuration Management: Using COBIT 5

Configuration Management: Using COBIT 5 provides a clear and concise walk-through of the configuration management process and associated threats, mitigation actions, COBIT 5 enablers and other useful information.

Author: ISACA
audit and assurance
ISACA Journal Article

Book Review: Security, Audit and Control Features: Oracle Database

Security, Audit and Control Features: Oracle Database 3rd Edition aims to assist assessors in reviewing the security of an Oracle database environment.

Author: ISACA
Creating and Defining a Culture of Security
ISACA Journal Article

Creating and Defining a Culture of Security: The Human Factor

The security of technology has become an increasing global concern.

Author: Pedro Alexandre de Freitas Pereira
Auditing Big Data in Enterprises
ISACA Journal Article

Auditing Big Data in Enterprises

There is no stagnation in information security. One major national incident often leads to more robust reporting requirements.

Author: Abdullah Al-Mansour
The Value of Certification
ISACA Journal Article

The Value of Certification

There are many insightful posts across the Internet that discuss certification. Do credentials matter? Do certifications lack value? Are industry credentials even worth pursuing?

Author: Thomas Johnson
Auditing Mobile Devices
ISACA Journal Article

IS Audit Basics: Auditing Mobile Devices

By the time this article is published, it will have been about 20 months since the US Federal Bureau of Investigation (FBI) unlocked the iPhone of the San Bernardino, California, gunman who killed 14 people.

Author: Ian Cooke
Digital Identity
ISACA Journal Article

Digital Identity—Will the New Oil Create Fuel or Fire in Today’s Economy?

Digital identity has the power to propel your enterprise forward…or it can cause you to crash and burn. How you govern and manage it will make all the difference.

Author: Dan Blum
HelpSource
ISACA Journal Article

HelpSource

We are in the process of selecting a data loss prevention (DLP) tool.

Author: Sunil Bakshi
Challenges of Security Log Management
ISACA Journal Article

The Practical Aspect: Challenges of Security Log Management

In the world of information systems, data has gained the most influential position. Data are about entities—resource.

Authors: Vasant Raval and Saloni Verma
Information Security Matters
ISACA Journal Article

Information Security Matters: Information Security in Context

I do not believe in information security.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Sarah Orton

How do you think the role of IS auditor is changing or has changed?

Author: Steven J. Ross
Making the SoA and Information Security Governance Tool
ISACA Journal Article

Making the SoA an Information Security Governance Tool

The ISO and the IEC’s ISO/IEC 27001:2013 standard has defined the requirements for an information security management system (ISMS).

Author: Daniel Gnana
Evasive Malware Tricks
ISACA Journal Article

Evasive Malware Tricks: How Malware Evades Detection by Sandboxes

Sandboxes are widely used to detect malware. They provide a temporary, isolated and secure environment to observe if a suspicious file attempts anything malicious.

Author: Clemens Kolbitsch
information-security
ISACA Journal Article

Sponsored Feature: The AICPA’s New Cybersecurity Attestation Reporting Framework Will Benefit a Variety of Key Stakeholders

As a relentless wave of cyberattacks continues, organizations are under intense pressure from key stakeholders and regulators to implement and enhance their cyber security programs to protect customers, employees and the valuable information in their possession.

Authors: Sandra Herrygers, Gaurav Kumar, and Jeff Schaeffer
Governance, Risk, Compliance
ISACA Journal Article

Governance, Risk, Compliance and a Big Data Case Study

By showing what would have changed if a previously successful big data analytics project was performed given today’s governance.

Author: Guy Pearce
Using COBIT in Government Departments
Governance Article

Using COBIT in Government Departments | ISACA

The government of India is focused on ensuring the effective delivery of government services to its customers who consist of citizens.

Security by Obscurity
ISACA Journal Article

Exposing the Fallacies of Security by Obscurity: Full Disclosure

It is unlikely that anyone is ignorant of the concept of full disclosure. While today we often see it applied to cyber security and the like.

Author: Kevin Johnson
Does Fully Disclosed Mean Fully Exposed?
ISACA Journal Article

Does Fully Disclosed Mean Fully Exposed? Nondisclosure

Every day, between 10 and 20 vulnerabilities are publicly disclosed, a few more than that are discovered, and an estimated 10-100 times that are created by software developers around the world.

Author: Pete Lindstrom
COBIT 5 to Assess IT Processes Capabilities & Evaluate Compliance World Lottery Association Security Control Standard | ISACA
Governance Article

COBIT 5 to Assess IT Processes Capabilities & Evaluate Compliance World Lottery Association Security Control Standard | ISACA

The internal audit team of one of the biggest gaming operators in Europe implemented a cloud-based governance.

Podcast
Podcast

Information Security in the Multi-Modal Era

As the traditional notion of a data center changes and enterprise data are being sent to numerous locations, the challenge of keeping data secure is evolving. In this edition of the ISACA Podcast, we discuss how to address security in a multi-modal era.

29 September 2017
The AREM Window
ISACA Journal Article

The AREM Window: A Strategy to Anticipate Risk and Threats to Enterprise Cyber Security

Businesses seeking to establish themselves in privileged positions in a digitally modified society must anticipate the competition and explore new opportunities in unstable environments.

Author: Jeimy J. Cano M
Focus on COBIT Adoption Rather Than Implementation
Governance Article

Focus on COBIT Adoption Rather Than Implementation | ISACA

Organizational change management (OCM) focuses on helping people adapt to change. Research shows that by acknowledging the importance of OCM and taking steps to address the people side of change.

Key Competencies of the Effective Governance Professional
ISACA Journal Article

Key Competencies of the Effective Governance Professional

Over the last 20 years, organizations have realized that they need to effectively manage and retain high-quality employees in order to be successful.

Author: Noman Sultan
A Risk-Based Management Approach
ISACA Journal Article

A Risk-Based Management Approach to Third-Party Data Security, Risk and Compliance

Process guidelines and a framework for boards of directors and senior management must be considered when providing oversight, examination and risk management of third-party business relationships in the areas of information technology, systems and cyber security.

Author: Robert Putrus
Minimize Identity Theft in Mobile Banking
ISACA Journal Article

Factors to Consider to Minimize Identity Theft in Mobile Banking

Using mobile devices to complete commercial transactions is a newer scientific advancement in the information and communication technology (ICT) sphere.

Author: Adeniyi Akanni
Portfolio, Program & Project Management Using COBIT 5 | ISACA Governance
Governance Article

Portfolio, Program & Project Management Using COBIT 5 | ISACA

Portfolio, Program and Project Management Using COBIT 5. COBIT 5 with PMI standards can be used as an “single integrated framework” across organizations.

Compliance vs. Security
ISACA Journal Article

Compliant, Yet Breached: Compliance vs. Security

“The hackers focused on overcoming our security controls while the security and compliance teams were measuring our security in terms of adherence with formal compliance certification.”

Author: Tony Chandola
Information Security
ISACA Journal Article

Design With the End in Mind

Innovations in the marketplace have accelerated sharply, and the implications have tremendous impact on the business environment.

Authors: Sudhakar Sathiyamurthy and Grant Thornton
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Doing More With Less

The Institute of Internal Auditors (IIA) defines internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.

Author: Ian Cooke
Addressing shared risk
ISACA Journal Article

Addressing Shared Risk in Products Application Vulnerability Assessments

Service organizations with a bespoke application in a regulated industry have special challenges in addressing application vulnerabilities.

Author: Michael Werneburg
Identifying Risk on the Road to Distributed Ledgers
ISACA Journal Article

Blockchain: Identifying Risk for Distributed Ledgers

Blockchain technology, commonly expected to drive the next wave of digital infrastructure and process innovation, is rapidly developing into maturity.

Author: Filip Caron
Information Security Matters
ISACA Journal Article

Information Security Matters: Information Security in the Multi-Modal Era

Data centers used to be so simple.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Justine Bone

How do you think the role of the cyber security professional is changing or has changed?

Author: ISACA
Instilling a Culture of Security
ISACA Journal Article

Instilling a Culture of Security Starts With Information Governance

A company facing privacy and security challenges can leverage culture to implement necessary procedural and technological transformations to strengthen security.

Author: T. Sean Kelly
Barriers and Enablers
ISACA Journal Article

Barriers and Enablers to Auditors Accepting Generalized Audit Software

Although generalized audit software (GAS) has been shown to significantly improve the efficiency and effectiveness of audits, many auditors do not use this technology.

Authors: Marianne Bradford and Dave Henderson
Penetration Testing Tools
ISACA Journal Article

Tools: Can Penetration Testing Tools Help an Audit?

Sometimes, it can feel as though auditors get the short end of the stick when it comes to the tools available to assist in the work that they do.

Author: Ed Moyle
Anatomy of an IoT DDos Attack
ISACA Journal Article

Anatomy of an IoT DDoS Attack and Potential Policy Responses

In recent years, the impact and frequency of cyberattacks have significantly increased, from millions of personal records compromised to hundreds of millions and even a billion records in the case of Yahoo.

Author: Hari Mukundhan
Blockchain Technology
ISACA Journal Article

A View of Blockchain Technology From the Information Security Radar

Blockchain is a distributed database that maintains a continuously growing list of records called blocks that are secured from any kind of tampering and revision efforts.

Author: Vimal Mani
Risk Quantification
ISACA Journal Article

Rethinking Cybervalue at Risk: A Practical Case for Risk Quantification

Cyberrisk is a universal issue. The trustworthiness of various risk assessment methods in pursuit of risk-based decisions is largely questioned in the marketplace.

Authors: Sudhakar Sathiyamurthy and Grant Thornton
Participatory Healthcare Security
Governance Article

Participatory Health Care Security

If you have ever wanted to be a doctor but ended up taking a different career path, participatory medicine may be just the new development for you.
New ISACA Paper Enables Enterprises to Use Cyberrisk Quantification to Improve Approach to Cybersecurity Risk
ISACA Journal Article

Building a Security Culture: Why Security Awareness Does Not Work and What to Do Instead

It is no secret that phishing has become a huge problem. In 2016, the Anti Phishing Working Group noted that there were 1,220,523 total phishing attacks.

Author: Joseph Opacki
Privacy Principles for GDPR Compliance | ISACA
Governance Article

Privacy Principles for GDPR Compliance | ISACA

Using ISACA Privacy Principles for GDPR Compliance. Demonstrate how the ISACA Privacy Principles could be mapped into the full set of COBIT 5 processes.

A Group IT Governance System Model With a Pair of Wheels
Governance Article

A Group IT Governance System Model With a Pair of Wheels: Oversight & Shared IT | ISACA

The financial industry in Japan has seen a growing number of organizing financial groups or conglomerates since the Japanese antitrust law was revised in the late 1990s.

Enterprise Security Architecture
ISACA Journal Article

Enterprise Security Architecture—A Top-down Approach

Enterprise Security Architecture—A Top-down Approach. SABSA, COBIT and TOGAF & their relationships with security framework for enterprises.

Author: Rassoul Ghaznavi-Zadeh
Demystifying Cyber Security
ISACA Journal Article

Demystifying Cyber Security in Industrial Control Systems

Industrial control systems (ICSs) are changing by relying more on off-the-shelf information technology (IT), thereby exposing these systems to more IT risk.

Author: Sri Mallur
COBIT 5 Aids Transition to Smart & Sustainable Cities | ISACA
Governance Article

COBIT 5 Aids Transition to Smart & Sustainable Cities | ISACA

A new edition of The Green Standards Week has finished, but the journey for cities has just begun.

ISO/IEC 27001 Standard
ISACA Journal Article

Proposal for the Next Version of the ISO/IEC 27001 Standard

In this article, the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) ISO/IEC 27001:2013 standard is introduced briefly and compared to ISO/IEC 27001:2005.

Author: Tolga Mataracioglu
Transforming Cybersecurity
ISACA Journal Article

Book Review: Transforming Cybersecurity

Transforming Cybersecurity, published by ISACA, should be read in the context of COBIT 5 for Information Security and the COBIT 5 framework.

Author: ISACA
COBIT 5 for Risk—A Powerful Tool for Risk Management | ISACA Risk Management
Governance Article

COBIT 5 for Risk—A Powerful Tool for Risk Management | ISACA

COBIT 5 for Risk—A Powerful Tool for Risk Management. There is only one globally accepted business framework in the IT domain. That framework is COBIT 5.

Podcast
Podcast

Social Media Rewards and Risk

Most enterprises use social media, and the use of these sites can help organizations be closer to their clients. But the use of social media also poses some threats to an organization. In this podcast, learn more about the benefits of social media, the risk associated with social media use and how to mitigate this risk.

3 July 2017
Implementing ITIL
ISACA Journal Article

Challenges and Lessons Learned Implementing ITIL, Part 2

The Emirates National Oil Company embarked on an initiative to realize value out of IT assets through Information Technology Infrastructure Library (ITIL) process implementation.

Authors: Mathew Nicho, Shafaq Khan, and Ram Mohan
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Audit Programs

ISACA reviews how to create an audit program, utilizing good reference resources & collaboration with IS peers.

Author: Ian Cooke
Auditing Attachment Fields in Access Databases
ISACA Journal Article

A Guide to Auditing Attachment Fields in Access Databases

Guide to Auditing Attachment Fields in Access Databases. Examples include customer records, employment records, inspection reports & patient records.

Authors: Joshua J. Filzen and Mark G. Simkin
Implementing ITIL
ISACA Journal Article

Challenges and Lessons Learned Implementing ITIL, Part 1: Realizing Value Through Business IT Alignment

A key issue often cited by information systems (IS) executives in the last three decades is aligning IT with business, which assists in realizing value from IT investments.

Authors: Mathew Nicho, Shafaq Khan, and Ram Mohan
Mobile Workforce Security
ISACA Journal Article

Mobile Workforce Security Considerations and Privacy

In 2012, a software developer who mainly worked remotely for a US firm had the idea of fully outsourcing his work to China.

Author: Guy Hermann Ngambeket
Information Security Matters
ISACA Journal Article

Information Security Matters: André Maginot’s Line

Some time ago in this space, I used an obscure statement by a nearly forgotten British Prime Minister to make some points about cyber security.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Theresa Grafenstine

How do you see ISACA growing and adapting to the constantly changing marketplace and needs of its constituents over the next year?

Author: Steven J. Ross
IT Governance
ISACA Journal Article

Exploring How Corporate Governance Codes Address IT Governance

IT governance, also referred to as governance of enterprise IT (GEIT) or corporate governance of IT, is a subset of corporate governance that is concerned with enterprise IT assets.

Authors: Steven De Haes, Anant Joshi, Tim Huygh, and Salvi Jansen
Information Privacy Planning
ISACA Journal Article

Key Ingredients to Information Privacy Planning

The metrics associated with privacy data breaches are astounding. In 2016, 554, and454,942 records were breached from 974 reported incidents.

Author: Larry G. Wlosinski
Social Media Rewards and Risk
ISACA Journal Article

Social Media Rewards and Risk

Social media is a powerful tool that gives organizations the ability to expand their brand value; it can also tarnish a brand overnight.

Author: Mohammed J. Khan
Mobile Security Tools
ISACA Journal Article

Tools: Mobile Security Tools on a Budget

Mobile has arisen as one of the most flexible—and most prevalent—business tools available. From email to calendaring to business applications.

Author: Ed Moyle
Help Source QA
ISACA Journal Article

Help Source Q&A

The question I have is what are the privacy issues associated with these mobile teams using their own devices for the organization’s work?

Author: Sunil Bakshi
Controls and Assurance in the Cloud
ISACA Journal Article

Book Review: Controls and Assurance in the Cloud: Using COBIT 5

Controls and Assurance in the Cloud: Using COBIT 5 provides comprehensive process practices and a governance framework to use when conducting an assessment of cloud computing, including its associated security risk.

Author: ISACA
Which Screws Have to Tighten?
Governance Article

Which Screws Have to Tighten?

When most organizations undertake an important process improvement effort (e.g., compliance, cyber security, governance), they typically refer to different standards and prepare a complex process to implement the improvement.
Better Security
ISACA Journal Article

Breach Your Castle for Better Security

Asymmetric warfare is “the application of dissimilar strategies, tactics, capabilities and approaches used to circumvent or negate an opponent’s strengths while exploiting his weaknesses.”

Author: Danelle Au
COBIT 5 for Risk: Making Sense of IT Risk Management. Each component of IT risk management is identified & helps practitioners find guidance in IT risk management. IT Risk Management
Governance Article

COBIT 5 for Risk: Making Sense of IT Risk Management | ISACA

COBIT 5 for Risk: Making Sense of IT Risk Management. Each component of IT risk management is identified & helps practitioners find guidance in IT risk management.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 7: The 5 Whys Tool

The 5 Whys tool has been around since the 1930s. It is simple and effective but unknown to many.

Author: Ed Gelbstein
Boosting Cyber Security
ISACA Journal Article

Boosting Cyber Security With Data Governance and Enterprise Data Management

The relationship between cybersecurity and the regulatory requirements for data governance, data stewardship and enterprise data management is set to strengthen.

Author: Guy Pearce
COBIT 5 and the GDPR
Governance Article

COBIT 5 & the GDPR | ISACA

COBIT 5 and the GDPR. Reviews how by applying the COBIT 5 enablers to the DPC road map, it is possible to determine the basic scope where COBIT can help.
information-security
ISACA Journal Article

The Benefits of the Statement of Applicability in ISMS Projects

The statement of applicability (SoA) is the main link between risk assessment and risk treatment in an enterprise or in an organization within an enterprise and, therefore, is a requirement for information security management system (ISMS) implementations.

Author: Jayakumar Sundaram
Security Considerations for Cloud Computing
ISACA Journal Article

Book Review: Security Considerations for Cloud Computing

Security Considerations for Cloud Computing provides a brief overview of cloud computing, its associated security risk and information for decision makers in an organization.

Author: Diana Hamono
HTTPS Posture Assessment
ISACA Journal Article

HTTPS Posture Assessment

HTTPS has been around since 1994. Historically, HTTP over Secure Sockets Layer (SSL)/Transport Layer Security (TLS) was treated as a dark and capricious form of magic best left undisturbed.

Author: Kurt Kincaid
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Data Management Body of Knowledge—A Summary for Auditors

A previous column reviewed the domains of data and information audits.

Author: Ed Gelbstein
Security Assurance
ISACA Journal Article

Security Assurance in the SDLC for the Internet of Things

During the Internet of Things (IoT) Village held at the DEF CON security conference in August 2016, 47 new vulnerabilities affecting 23 IoT devices from 21 manufacturers were disclosed.

Authors: Sivarama Subramanian and Balaji Swaminathan M.
IT Asset Valuation
ISACA Journal Article

IT Asset Valuation, Risk Assessment and Control Implementation Model

The first steps in information security strategic planning in any form of business are risk management and risk evaluation.

Author: Shemlse Gebremedhin Kassa
Managing the Risk of IoT
ISACA Journal Article

Managing the Risk of IoT: Regulations, Frameworks, Security, Risk and Analytics

Does the recent distributed denial of service (DDoS) attack on Dyn officially mark the passing of the Internet of Things (IoT) fear, uncertainty and doubt (FUD) stage, or is this still the beginning of the stage?

Author: Indrajit Atluri
Responding to Targeted Cyberattacks
ISACA Journal Article

Book Review: Responding to Targeted Cyberattacks

Organizations today are concerned about information security primarily due to the fact that the type and nature of attacks are undergoing a lot of changes that make them difficult to detect and prevent.

Author: ISACA
IoT Security
ISACA Journal Article

IoT Needs Better Security

The Internet of Things (IoT) is an ecosystem of connected things (stationary or mobile devices). 34 billion devices are to be connected to the Internet by 2020.

Author: Hemant Patel
Information Security
ISACA Journal Article

Information Security Matters: The End of the Beginning?

At each stage in the evolution of information security, there has been a problem—access control, viruses, hackers, data leakage, to name a few—that has seemed insuperable.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Jane Whitgift

How do you think the role of the information security professional is changing or has changed?

Author: ISACA
Safeguarding Mobile Applications
ISACA Journal Article

Safeguarding Mobile Applications With Secure Development Life Cycle Approach

In today’s age of bring your own device (BYOD), the smartphone is one of the preferred mobile devices to access enterprise information.

Author: Sakthivel Rajendran
Help Source Q&A
ISACA Journal Article

Help Source Q&A

Various surveys point out that 20 to 50 billion devices will be connected using the Internet by 2020.

Author: Sunil Bakshi
Importance of Recertification Completeness
ISACA Journal Article

Importance of Recertification Completeness in the Control Environment

Owners of critical business data need to ensure that all application and database user entitlements and privileges are recertified on a periodic basis to make sure that only authorized individuals have access to the enterprise’s data.

Author: Kathleen Martin
COBIT 5 Goals | Meeting Stakeholder Needs | ISACA
Governance Article

COBIT 5 Goals | Meeting Stakeholder Needs | ISACA

Applying the Goals Cascade to the COBIT 5 Principle Meeting Stakeholder Needs. Reviews meeting stakeholder needs with real-world examples.

The Validity of Penetration Tests
ISACA Journal Article

The Validity of Penetration Tests

Penetration (pen) tests are critical to operating and maintaining an effective information security program.

Author: Brent Michel
Podcast
Podcast

Sustainability

It is becoming increasingly important for enterprises to implement sustainable practices. But how can enterprises strike a balance between profitability and sustainability? In this podcast, we discuss what green IT looks like, the business benefits of sustainability and the role of an auditor in a sustainable enterprise.

13 April 2017
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Risk-based Audit Planning for Beginners

A young Certified Information Systems Auditor (CISA) asked for suggestions about where and how to start to plan an IS audit.

Author: Ed Gelbstein
Enterprise Vulnerability Management
ISACA Journal Article

Enterprise Vulnerability Management

Today’s enterprises have solutions in place to help with the detection and management of their information systems vulnerabilities, especially as it relates to system software and firmware.

Author: Trevor J. Dildy
How COBIT 5 Can Help Reduce the Likelihood and Impact of the Top 5 Cyberthreats
Governance Article

How COBIT 5 Can Help Reduce the Likelihood & Impact of the Top 5 Cyberthreats | ISACA

2017 is here with cyber breaches increasing, with their impacts rippling ever further into business and personal life.

Using Visual Models for Adopting IT Governance Practices | ISACA
Governance Article

Using Visual Models for Adopting IT Governance Practices | ISACA

IT governance (ITG) can be adopted using a mixture of various structures, and processes and relational mechanisms that encourage behaviors consistent with the organization’s mission.

Navigating the US Federal Government Agency ATO Process
ISACA Journal Article

Navigating the US Federal Government Agency ATO Process for IT Security Professionals

IT security professionals such as risk managers and information security managers maintain a US federal government agency’s information system using the Federal Information Security Management Act (FISMA) in a manner that is unique to the US federal government.

Author: Jo Anna Bennerson
Organizational Prudence & Wisdom Within Governance of Business and Enterprise IT | ISACA
Governance Article

Organizational Prudence & Wisdom Within Governance of Business and Enterprise IT | ISACA

COBIT 5 has integrated data management, risk management and IT governance into a governance and management framework that can provide strategic direction in a holistic and innovative manner.

Tools that add assurance value
ISACA Journal Article

Tools: Tools You May Already Have That Add Assurance Value

To understand how the business side of any organization intersects with technology, ask an internal auditor.

Author: Ed Moyle
Auditing Social Media
ISACA Journal Article

Auditing Social Media

Auditing Social Media. Social media risks include reputational damage, information leakage, regulatory noncompliance & loss of intellectual property.

Author: Paul Phillips
Agile Audit
ISACA Journal Article

Agile Audit

Time constraints are an integral part of every auditor's work.

Author: Spiros Alexiou
Creating Assurance in Blockchain
ISACA Journal Article

Creating Assurance in Blockchain

Blockchain—a distributed ledger technology that underpins bitcoin and is also being tested by a variety of companies to track ownership of assets without a central authority—is everywhere.

Author: A. Michael Smith
Audit Transparency in Action
ISACA Journal Article

Audit Transparency in Action

Professional trainers have many opportunities to speak to companies and organizations about leading practices in the internal/IT audit industries.

Author: Danny M. Goldberg
How Analytics Will Transform Internal Audit
ISACA Journal Article

How Analytics Will Transform Internal Audit

Many companies are just beginning to apply analytics techniques to internal audit challenges.

Author: Robert E. (Bob) Kress and Dave M. Hildebrand
Third-party Risk Management
ISACA Journal Article

The Practical Aspect: Third-party Risk Management

The business model of the early 20th century depicted a large, integrated company that owned, managed and directly controlled its resources.

Authors: Vasant Raval and Samir Shah
Dealing with Difficult Data
ISACA Journal Article

Dealing With Difficult Data

Applying data analytics (DA) techniques to the information systems (IS) internal audit process has moved from a desired activity to a required one.

Author: Michael T. Hoesing
Standardized Scoring for Security and Risk Metrics
ISACA Journal Article

Standardized Scoring for Security and Risk Metrics

With breaches and hacks in the news every day, information security is now firmly on the board’s agenda.

Author: Mukul Pareek
information-security
ISACA Journal Article

Information Security Matters: Do You Need a Disaster Recovery Plan…?

DRaaS offers a number of advantages over the use of commercial hot sites or internal recovery data centers.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Shan Senanayake

How do you think the role of the information security professional is changing or has changed?

Author: Steven J. Ross
Cloud Computing in Developing Countries
ISACA Journal Article

Cloud Computing in Developing Countries: Opportunities and Challenges

The number of fixed and mobile broadband subscribers, Internet users and cellular service consumers is on the rise globally.

Author: Awais Ahmed
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Auditors, IS/IT Policies and Compliance

Every organization tries to formalize aspects of its culture through policies. These policies define what is expected of members of the workforce and describe how noncompliance is dealt with.

Author: Ed Gelbstein
Retirement Profile
ISACA Journal Article

Retirement Profile: Farewell Ron Hale

How have you seen ISACA change over the years of your service to the organization?

Author: ISACA
Podcast
Podcast

COBIT 5 Principles Where Did They Come From

COBIT 5, a framework for the governance and management of enterprise IT, is a valuable resource that leverages proven practices, global thought leadership and groundbreaking tools. In this podcast, we discuss the COBIT 5 principles, where they came from and how enterprises can leverage the framework.

23 February 2017
Podcast
Podcast

Implementing the NIST Cyber Security Framework

The US National Institute of Standards and Technology’s Cybersecurity Framework can help enterprises secure their valuable information assets. The COBIT® 5 framework can be used to implement the NIST framework. In this podcast, we discuss the specific ways in which COBIT 5 can help enterprises that want to implement the Cybersecurity Framework.

23 February 2017
Podcast
Podcast

The Automation Conundrum

The increasing proliferation of artificial intelligence systems presents many concerns. But not adopting AI systems could result in enterprises falling behind and missing key opportunities. In this podcast, we discuss AI threats, how to prevent these threats and the benefits of adopting AI systems.

23 February 2017
Podcast
Podcast

The G7 and Cyber Security Podcast

A recent G7 meeting produced a document on cyber security, outlining international state cyber security behavior. While discussing cyber security at this level shows great progress, there is still room for growth. In this podcast, we discuss the G7 Principles and Actions on Cyber, why it is important, and areas for improvement.

23 February 2017
Podcast
Podcast

Addressing Cybersecurity Vulnerabilities

Internet security is a growing concern and IT leaders need to increase public awareness of cyber security. Unchecked cyber security risk factors can greatly harm enterprises. In this podcast, we discuss areas for improvement that could prevent cyberattacks.

22 February 2017
Podcast
Podcast

Are Software Flaws a Security Problem?

Who is responsible when customer-facing systems crash? Program crashes can cause security problems. In this podcast, we explore how many causes of unexpected downtime are the same as those that lead to security breaches.

22 February 2017
Podcast
Podcast

Auditing Agile: A Brave New World Podcast

Auditing Agile can be difficult, but auditing Agile and Scrum artifacts can provide considerable value to an enterprise. In this podcast, we discuss how to audit Agile and the myriad benefits it can provide.

22 February 2017
Podcast
Podcast

Balancing the Cybersecurity Battlefield

Cyber security is a priority for enterprises, but the skills shortage in security is a global concern. Women can provide a unique perspective on cyber security, but are still vastly underrepresented in information security. In this podcast, we discuss some of the challenges women in cyber security face and how to overcome these challenges.

22 February 2017
Podcast
Podcast

Benefits and the Security Risk of Software-defined Networking

The growth in connected devices is increasing the difficulty of managing devices and related network traffic. Software-defined networking can make the process of managing these devices more efficient. In this podcast, we discuss the benefits and challenges associated with software-defined networking.

22 February 2017
Podcast
Podcast

Challengeable Truths

There are many widely held information security beliefs, but do all of them hold true? In this podcast, we challenge some commonly held information security beliefs and explore whether or not they should be held as truths.

22 February 2017
Podcast
Podcast

Chief Cyber Officer

Chief information security officers are typically thought of as being responsible for cyber security. But is this structural model the most effective way to manage cyber security? In this podcast, we discuss the merits of creating the role of chief cyber officer to deal with cyber security issues.

22 February 2017
Podcast
Podcast

Cyber Privacy

Should cyberattacks be considered privacy violations? If cyberattacks are framed as privacy violations, the Generally Accepted Privacy Principles could be applied to cyberattacks. In this podcast, we use GAPP to provide insight on how privacy can be protected from cyberattackers.

22 February 2017
Podcast
Podcast

Cybersecurity for a “Simple” Auditor

Because cyber security and information security are often conflated, their audit processes might also be conflated. Despite the lack of cyber security standards, it is possible to develop a cyber security audit process. In this podcast, we discuss the ways to develop a process for cyber security audits.

22 February 2017
Podcast
Podcast

Cyberwhatsit

The word “cyber” is growing in usage, but there is a lack of verbal clarity with respect to what it actually means. This ambiguity can lead to uncertainty about how to handle cyberrisk. In this podcast, we discuss the definitions of cybertheft, cyberattacks, cyberthreats and cyber security and the implications of these definitions.

22 February 2017
Podcast
Podcast

Frameworkers of the World, Unite II

How are organizations complying with the US National Institute of Standards and Technology Cybersecurity Framework? In this podcast, we look at the framework as though it were a standard to determine how organizations can adhere to it.

22 February 2017
Podcast
Podcast

Performance Measurement Metrics for IT Governance

As technology evolves and transforms, enterprises rely more and more on technology resources and vendors. Because of this reliance, key performance indicators are necessary to measure the performance of IT service delivery. In this podcast, we discuss how to develop performance metrics, the criteria for good metrics and leveraging COBIT 5 to develop performance metrics.

22 February 2017
Podcast
Podcast

Protecting Information - Practical Strategies for CIOs and CISOs

Information is one of the most valuable assets of every organization. Protecting information typically a high priority for chief information officers, but better protection is more likely if the CIO works with a chief information security officer. In this podcast, we discuss the role of the CIO and CISO and provide a management and reporting structure.

22 February 2017
Podcast
Podcast

The Criticality of Security in the Internet of Things

The Internet of Things is evolving at a rapid pace, and it is becoming increasingly difficult to keep up with these “smart” devices. Because this technology is advancing so quickly, it is necessary to build security and privacy controls into connected devices. In this podcast, we discuss why these controls should be built in, how to incorporate security into device building and some of the barriers of developing with security in mind.

22 February 2017
Podcast
Podcast

Three Ways to Simplify Auditing Software Security Requirements and Design

Building security into software is a prerequisite for information assurance, and it is far cheaper to fix a defect in design than to fix it after production. Auditors can play a role in ensuring security is built into software. In this podcast, we discuss the ways in which organizations can incorporate security into the software design process.

22 February 2017
Podcast
Podcast

Unsung Security Heroes

Information security is no longer the sole responsibility of IT professionals. People across the enterprise contribute to keeping information safe. In this podcast, we discuss some roles that support information security, but are not typically thought of as security roles.

22 February 2017
Podcast
Podcast

Weary Willie's Guide to Cyberrisk Management

Cyberrisk can never be eliminated, but it can be minimized so that it is more manageable. In this podcast, we discuss the professionals who should be involved with cyberrisk management and what effectively managed cyberrisk looks like.

22 February 2017
Podcast
Podcast

Why Everyone Dislikes the IT Auditor and How to Change It

IT auditors have a very important role, but are often criticized by management or users of IT audit services. While some attitudes cannot be changed, auditors can work to gain the trust and respect of those whom they are auditing. In this podcast, we discuss some of the common critiques and how IT auditors can address these issues.

22 February 2017
SSH Keys
ISACA Journal Article

What Every CISO Must Know About SSH Keys

Secure Shell (SSH), also known as Secure Socket Shell, is a cryptographic network protocol for operating network services securely over an unsecured network.

Author: Tatu Ylonen
Privileged Access Management
ISACA Journal Article

Capability Framework for Privileged Access Management

The average total cost of a data breach is about US $4 million, whereas the average cost for a stolen record increased slightly from US $154 in 2015 to US $158 in 2016.

Authors: Richard Hoesl, Martin Metz, Joachim Dold, and Stefan Hartung
The Essence of Information
Governance Article

The Essence of Information | ISACA

I was taught that information was processed data. While the definition was useful, it was not very enlightening.

COBIT 5 for Business Benefits Realization
ISACA Journal Article

Book Review: COBIT 5 for Business Benefits Realization

COBIT 5 for Business Benefits Realization is part of the COBIT 5 body of knowledge, which covers audit and assurance, risk management, information security, regulations and compliance, IT operations, governance of IT (GEIT), as well as value from IT investments.

Author: ISACA
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Preparing for Auditing New Risk, Part 2

Part 1 of this column explored domains of risk that are rapidly becoming apparent as they take unprepared organizations (in terms of policies on how to deal with them) by surprise. Social networks and bring your own device (BYOD) are two notable examples.

Author: Ed Gelbstein
Extending COBIT 5 Data Security and Governance Guidance | ISACA
Governance Article

Extending COBIT 5 Data Security and Governance Guidance | ISACA

Organizations need the ability to seamlessly enforce security policies across the enterprise to protect sensitive data and control access to those data, regardless of where the data flow.

The Persistent Insider Threat
ISACA Journal Article

The Persistent Insider Threat: Is Enough Being Done?

In today’s world, and the main asset for businesses is the data they store. As enterprises become more dependent on technology and data.

Author: Rodney Piercy
Evolving Cyberrisk Practices
ISACA Journal Article

Evolving Cyberrisk Practices to Meet Board-level Reporting Needs

Imagine being an executive sitting on the board of directors for an organization. Of the following two risk report statements, which one would likely be more meaningful and useful?

Authors: Jack Jones and Chief Risk Scientist
Developing Business Capabilities Using COBIT 5 | ISACA Using COBIT 5
Governance Article

Developing Business Capabilities Using COBIT 5 | ISACA

Developing Business Capabilities Using COBIT 5. Identify control activities of business capabilities to satisfy control requirements for compliance objectives.

Smart Sustainable Cities
ISACA Journal Article

Smart Sustainable Cities Need Well-governed Disruptive IT, Not Just IT

Most people live in cities, so they enjoy or endure city attributes as part of their day-to-day lives.

Author: Graciela Braga
HelpSource
ISACA Journal Article

HelpSource

I have heard from vendors that cognitive technologies such as machine learning can assist in my risk management and security efforts.

Author: Sunil Bakshi
Smashing the Information Security Policy
ISACA Journal Article

Smashing the Information Security Policy for Fun and Profit

One of the chief components of an organization’s information security strategy is the security policy.

Author: David Eduardo Acosta R.
Kickstarting Cloud ROI
ISACA Journal Article

Kickstarting Cloud ROI

Many enterprises are quick to leap into cloud relationships. Very often, they do so without any analysis—formal or informal—of the value they expect to get in return.

Author: Cheryl Ritts
The Automation Conundrum
ISACA Journal Article

The Automation Conundrum

Learn how as intelligent systems increasingly take on vital business roles, the risk that crucial business decisions might be based on flawed algorithms invariably rises.

Author: Phillimon Zongo
Telemedicine Governance
ISACA Journal Article

A Machine Learning Approach for Telemedicine Governance

Telemedicine is a component of ehealth that uses information and communication technology (ICT) to deliver health care services to overcome distance and connect the provider and the patient.

Authors: Shounak Pal and Arunabha Mukhopadhyay
Indicators of Exposure and Attack Surface Visualization
ISACA Journal Article

Sponsored Feature: Indicators of Exposure and Attack Surface Visualization

Working with identified IOEs rather than vulnerabilities and other risk data allows security teams to use the power of contextual analysis to determine actions that will reduce their attack.

Author: Ravid Circus
Open Source Tools
ISACA Journal Article

Tools: Using Open Source Tools to Support Technology Governance

Most practitioners are already very accustomed to using technical tools for specific tactical purposes when it comes to security or assurance within their environments.

Author: Ed Moyle
Information Security Matters
ISACA Journal Article

Information Security Matters: State-on-state Cyberconflicts

In the second quarter of 2016, a colleague shared with me an article and a database titled “The Dynamics of Cyber Conflict Between Rival Antagonists, 2001–11,” written by Brandon Valeriano of the University of Glasgow and Ryan C. Maness of the University of Illinois.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Gail Coury

How do you think the role of the information security professional is changing or has changed?

Author: ISACA
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Preparing for Auditing New Risk, Part 1

This is the first of two articles attempting something unwise: predicting future risk arising from information systems and technology.

Author: Ed Gelbstein
Risk Management
Governance Article

Setting the Record Straight: Convincing Management of COBIT’s Value in Risk Management

Although COBIT remains an extremely valuable tool for IT risk management, many Latin American companies still find themselves slightly confused when trying to understand what it takes to carry out a complete or partial COBIT implementation.

Data Privacy Protection
ISACA Journal Article

An Ethical Approach to Data Privacy Protection

Privacy breaches disturb trust and run the risk of losing security. In this article, ISACA explains how to follow an ethical approach to data privacy protection.

Authors: Wanbil W. Lee, Wolfgang Zankl,and Henry Chang
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Challenges Addressed by Fundamentals

Challenges set before auditors today are imposing. With seemingly endless changes in technology and the resulting effect on organizations, there is a tendency to feel overwhelmed.

Author: Gordon Stoor
COBIT For IT Organizational Design | ISACA
Governance Article

COBIT For IT Organizational Design | ISACA

Using COBIT for IT Organizational Design. Reviews the organization design be done as per theory and then fine-tuned to accommodate the politics.

EU General Data Protection Regulation
ISACA Journal Article

The New EU General Data Protection Regulation—Benefits and First Steps to Meeting Compliance

The New EU General Data Protection Regulation—Benefits and First Steps to Meeting Compliance. Sets expectations for controlling personal data for EU citizens.

Author: Eva Sweet
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Domains of Data and Information Audits

In my early days as a practitioner, the use of computers was referred to as data processing and electronic data processing (EDP).

Author: Ed Gelbstein
COBIT 5 Mapping for Establishing Enterprise IT Strategy | ISACA Enterprise IT Strategy
Governance Article

COBIT 5 Mapping for Establishing Enterprise IT Strategy | ISACA

COBIT 5 Mapping Exercise for Establishing Enterprise IT Strategy. Explains how instituting controls can be used to establish IT strategy & IT goals BSC values.

Assessing the Board's Effectiveness
ISACA Journal Article

The Tone at the Top: Assessing the Board’s Effectiveness

Thought leaders have long recognized that strong leadership and ethical culture are foundational building blocks of enterprises with top-performing risk management programs.

Author: Gary Roboff
COBIT 5
Governance Article

COBIT 5: Creating Buy-in and Empowering Teams to Change

It is an inescapable fact that IT is changing the way organizations do business. There is a global emphasis on digital transformation.
Supplier Risk Management
ISACA Journal Article

Achieving Excellence in Supplier Risk Management

Achieving Excellence in Supplier Risk Management. Review of robust supplier risk management framework incorporating regulatory expectations.

Author: Shirali Vyas
Wearable Technology
ISACA Journal Article

The Dilemma for Workplace Usage: Wearable Technology

The Dilemma for Workplace Usage: Wearable Technology. ISACA community’s attitudes toward wearables’ potential risk & security impacts at work.

Authors: Craig Krivin, Sanjay Bhide, Sandeep Desai, Ravi Dhaval, Joe Norris, Amanthi D. Pendegraft, Susan E. Snow, and Dan Wagner
COBIT 5: Taking IT Governance and Management to the Next Level | ISACA
Governance Article

COBIT 5: Taking IT Governance and Management to the Next Level | ISACA

A Big 4 professional services firm in the Middle East was selected by a leading retail bank to assist in finding solutions to problems related to IT governance and IT management.

Vendor Management
ISACA Journal Article

Book Review: Vendor Management Using COBIT 5

Vendor Management Using COBIT 5. ISACA discusses life cycle management for third-party services and the overall vendor management process.

Author: ISACA
Information Security Matters
ISACA Journal

Information Security Matters: The G7 and Cyber Security

In May 2016, the G7 leaders met in Ise-Shima, Japan, and produced a document that has real meaning for all of us who care about cyber security.

Author: Steven J. Ross
Advanced Data Analytics
ISACA Journal Article

Advanced Data Analytics for IT Auditors

Advanced Data Analytics for IT Auditors. ISACA reviews data analytics techniques & tools that can help auditors discover hidden knowledge in data.

Author: Spiros Alexiou
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 6: Barriers to Learning to Learn

Previous columns have explored how to facilitate the process of learning to learn, and covering knowledge acquisition.

Authors: Ed Gelbstein and Stefano Baldi
Assessing Security Controls
ISACA Journal Article

Assessing Security Controls: Keystone of the Risk Management Framework

Assessing Security Controls: Keystone of the Risk Management Framework. Informed decisions involves risk-decision fidelity & risk acceptance.

Author: Lance Dubsky
The Network
ISACA Journal Article

The Network: Marcus Chambers

What is the biggest security challenge that will be faced in 2017? How should it be addressed?

Author: ISACA
Information Ethics
ISACA Journal Article

Information Ethics: Information Ethics in the Mid-21st Century

The emergence of cyberspace has produced a new crop of rather difficult-to-resolve dilemmas, although the precepts and paradigms to address them remain the same.

Author: Vasant Raval
Cyberrisk Assessment
ISACA Journal Article

Cyberrisk Assessment Using Bayesian Networks

Organizations are increasingly realizing that the management of cyber security risk in complex environments needs to be addressed using suitable decision-making techniques.

Author: Venkatasubramanian Ramakrishnan
Data Protection Compliance
ISACA Journal Article

Delivering Personal Data Protection Compliance on a Global Scale

The European Union (EU) General Data Protection Regulation (GDPR) was published in the Official Journal of the European Union and officially set an application date.

Author: Ilya Kabanov
IT Governance
ISACA Journal Article

Performance Measurement Metrics for IT Governance

Performance Measurement Metrics for IT Governance. Enterprises use key performance indicators (KPIs) to measure IT performance service delivery.

Author: Sunil Bakshi
Enhancing the Audit Follow-up Process
ISACA Journal Article

Enhancing the Audit Follow-up Process Using COBIT 5

Implementing an audit follow-up process using the COBIT 5 enablers and ISACA's Information Technology Assurance Framework (ITAF) 2 provide value to the enterprise.

Author: Ian Cooke
Ensuring Value From IT-enabled Investments | ISACA
Governance Article

Ensuring Value From IT-enabled Investments | ISACA

Ensuring Value From IT-enabled Investments. GEIT ensures benefit realization to the stakeholders by optimizing risk and resource utilization.

Data Lineage and Compliance
ISACA Journal Article

Data Lineage and Compliance

Learn how data lineage gained momentum as the volume of data, complexity of systems environments and compliance requirements continue to grow.

Author: Eva Sweet
Governance
Governance Article

A Partial Transition to COBIT 5 Demonstrates Value to IT

Several years ago, the IT department of the largest bakery factory in the world, with a presence in the United States, Mexico, Central America, South America, Asia, Europe, Canada and the United Kingdom, conducted a COBIT 4 assessment and implementation of a enterprise governance.

Cybersecurity Threats
ISACA Journal Article

Preparing Financial Firms for Cybersecurity Threats and Protecting Their Reputations

It is difficult to deny the impact of cyber security threats on businesses worldwide. In 2015, the average total cost of a data breach (including customer turnover, reputation losses and damaged goodwill) was US $3.79 million, up from US $3.52 million in 2014.

Author: Peter Tessin
Change Enablement for GEIT Implementation & Improvement | ISACA Governance
Governance Article

Change Enablement for GEIT Implementation & Improvement | ISACA

Frameworks, best practices and standards are useful only if they are adopted and adapted effectively.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 5: CPEs and Learning to Learn

The IS Audit Basics column that appeared in the volume 1, 2015, and issue of the ISACA Journal contained a table illustrating the impermanence of information systems.

Author: Ed Gelbstein
Boardroom Dynamics
ISACA Journal Article

Boardroom Dynamics: Group Support for the Board’s Involvement in a Smart Security Decision-making Process

Decision making during business meetings is an elusive phenomenon for a couple of reasons. Business meetings have been defined as …a gathering where people speak up.

Authors: Yuri Bobbert and Hans Mulder
Using COBIT 5: Enabling Information to Perform an Information Quality Assessment | ISACA Governance
Governance Article

Using COBIT 5: Enabling Information to Perform an Information Quality Assessment | ISACA

Information is considered a main resource for any organization as the evolution of information technology in recent decades has reached almost all organizations.

Geolocation Risks and Benefits
ISACA Journal Article

Geolocation—The Risk and Benefits of a Trending Technology

Geolocation is a trending technology that uses data to identify a user’s physical location. Check out our article to learn about the risk and benefits of geolocation.

Author: Betsie Estes
Introduction to COBIT Videos Provide Insights into COBIT 5 | ISACA
Governance Article

Introduction to COBIT Videos Provide Insights into COBIT 5 | ISACA

The Introduction to COBIT Video Series is a collection of short videos that explain, in a straightforward, simple manner, the many features, tools and benefits of the COBIT 5 framework.

Information Systems Security Audit
ISACA Journal Article

Information Systems Security Audit: An Ontological Framework

An information systems security audit (ISSA) is an independent review and examination of system records, activities and related documents.

Author: Shemlse Gebremedhin Kassa
Governance
Governance Article

Ambiguities in Translation of Information and Knowledge Concepts in COBIT 5

After the release of COBIT 5 in 2012, ISACA initiated translations of the framework into other languages by collaborating with chapters and volunteer contributors.

Auditing for FISMA and HIPAA
ISACA Journal Article

Auditing for FISMA and HIPAA: Lessons Learned Performing an In-house Cybersecurity Audit

Within the last two years, and the author’s research-oriented company installed a commercial, off-the-shelf (COTS) tool within its Moderate network to use for survey work.

Author: Craig R. Hollingsworth
Safeguard Selection Processes
ISACA Journal Article

A Critical Perspective on Safeguard Selection Processes

Safeguards have become an essential part of every IT environment. As companies become more reliant on modern technology.

Author: Stefan Beissel
Cyberattacks
ISACA Journal Article

Cyberattacks—The Instability of Security and Control Knowledge

In a world of accelerating change that is moving toward more digital tendencies, security and control practices have become an ongoing exercise in reinvention.

Author: Jeimy J. Cano M.
How to Audit the Human Element
ISACA Journal Article

How to Audit the Human Element and Assess Your Organization’s Security Risk

The 2016 Data Breach Investigations Report (DBIR), and Verizon’s ninth annual report, revealed some grim news—the human threat vector is more dangerous than ever.

Author: Tom Pendergast
Cyberthreat Monitoring
ISACA Journal Article

An Integrated Approach for Cyberthreat Monitoring Using Open-source Software

As cyberthreats evolve each day, and detecting these threats is becoming more important. Recent studies show that the time between a breach occurring and being detected is.

Author: Furkan Caliskan
Cyberinsurance
ISACA Journal Article

Cyberinsurance: Value Generator or Cost Burden?

Data are now considered a wealth generator for the 21st century. Consequently, the financial costs of data loss through cyberevents can be staggering.

Author: Syed K. Ishaq
Information Security Testing
ISACA Journal Article

Planning for Information Security Testing—A Practical Approach

Planning for Information Security Testing—A Practical Approach. Before an audit, it's important to know the types of information security testing.

Authors: Karina Korpela and Paul Weatherhead
Information Ethics
ISACA Journal Article

Information Ethics: The Challenge of Being “Good”

Moral behavior is, perhaps, and easy to talk about, but difficult to put in practice. The answer to the question Did I do the right thing? may not be unequivocal.

Author: Vasant Raval
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 4: Mind Mapping

Many years ago during a rainy November evening in London, England, I decided to browse a bookshop to keep dry and warm and also see what had been released recently.

Authors: Ed Gelbstein and Stefano Baldi
The Network
ISACA Journal Article

The Network: Leonard Ong

What is the biggest security challenge that will be faced in 2017? How should it be addressed?

Author: ISACA
Balancing the Cybersecurity Battlefield
ISACA Journal Article

Balancing the Cybersecurity Battlefield

History shows that women bring a different value to the work environment and improve overall operational effectiveness and financial results. In key financial metrics, companies with women on their boards of directors (BoDs) outperform those without women.

Author: Daksha Bhasker
IT Governance, Risk Management, Security and Privacy
ISACA Journal Article

Holistic IT Governance, Risk Management, Security and Privacy: Needed for Effective Implementation and Continuous Improvement

Holistic IT Governance, Risk Management, Security and Privacy: Needed for Effective Implementation and Continuous Improvement.

Authors: John W. Lainhart IV, Zhiwei Fu, and Christopher M. Ballister
Information Security Matters
ISACA Journal Article

Information Security Matters: Unsung Security Heroes

Long ago and far away, I was the president of the EDP Auditors Association, which, some years later, changed its name to ISACA. So here we are, 35 years after my term in office, and I marvel at what ISACA has become: 140,000 constituents in more than 200 chapters in 180 countries.

Author: Steven J. Ross
The Importance of Planning a Governance of Enterprise IT Implementation | ISACA Governance
Governance Article

The Importance of Planning a Governance of Enterprise IT Implementation | ISACA

There is plenty of anecdotal evidence describing failed GEIT projects and the problems associated with GEIT implementations. Here is the importance of planning.

Securing Mobile Devices
ISACA Journal Article

Book Review: Securing Mobile Devices

Securing Mobile Devices. Guide for security professionals & governance, risk & compliance in using COBIT 5 framework to obtain assurance in auditing.

Author: ISACA
governance
Governance Article

COBIT: The Road Ahead

Since its release, COBIT 5 has been downloaded tens of thousands of times, has been widely discussed on social media, and has been prescribed for use by national governments and municipalities alike.

Advanced Persistent Threats
ISACA Journal Article

Book Review: Advanced Persistent Threats

Advanced Persistent Threats: How to Manage the Risk to Your Business is available from the ISACA Bookstore.

Author: ISACA
Security Predictions
ISACA Journal Article

Security Predictions 2016: A Data Analysis Approach

The topic of information security has evolved to one of the top concerns among policymakers and corporations.

Author: Daniel Schatz
The Five A’s of Enterprise Governance of IT | ISACA Governance
Governance Article

The Five A’s of Enterprise Governance of IT | ISACA

At the 2016 COBIT Conference in New Orleans, many of the presenters talked about the need to adopt and adapt the framework.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 2

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 2. Key elements of the audit including audit strategy & derived plans chosen.

Author: Ed Gelbstein
Privacy
ISACA Journal Article

Privacy in the Era of Monitoring and Surveillance: A Conceptual Framework on Personal Data Protection

Many believe this is a period in human history in which geopolitical tensions perpetuate uncertainty.

Author: Jeimy J. Cano M.
Program & Project Management Approach | ISACA
Governance Article

Program & Project Management Approach | ISACA

ISACA An Appropriate Approach for Program and Project Management. COBIT 5’s BAI01 process, supporting materials, & documentation provide guidance for PMOs.

Privacy
ISACA Journal Article

The New Age of Near-zero Privacy

The New Age of Near-zero Privacy. ISACA examines the rapid loss of privacy & how to mitigate exposure risk of personal data and images.

Author: C. Warren Axelrod
Creating Value |Value of COBIT 5 | ISACA
Governance Article

Creating Value |Value of COBIT 5 | ISACA

In COBIT 5, we are taught that enterprises exist to create value for their stakeholders. A truism if ever there was one.

Windows Controls Environment
ISACA Journal Article

Finding the Dirt in the Windows Control Environment

For many information systems auditors, reviewing domain accounts in an Active Directory (AD) environment is sufficient for testing controls around user authentication.

Author: Vincent Kha
Software-defined Networking
ISACA Journal Article

Benefits and the Security Risk of Software-defined Networking

Benefits & the Security Risk of Software-defined Networking. Software-defined networking (SDN) uses virtualization to expand network efficiency.

Author: Tony Wang
Network Access Control
ISACA Journal Article

Network Access Control: Has It Evolved Enough for Enterprises?

Network Access Control: Has It Evolved Enough for Enterprises? Does it need a more usable technical solution before it is utilized everywhere?

Author: Trevor J. Dildy
Cloud Security
ISACA Journal Article

Data Science as a Tool for Cloud Security: Cloud Generation Visibility, Detection and Protection

Sharing, collaboration and anywhere access are the prominent features of modern cloud applications. However, cloud security faces scalability challenges.

Authors: Aditya K. Sood and Michael Rinehart
Security Requirements of Remote Code Execution
ISACA Journal Article

Inquiring Into Security Requirements of Remote Code Execution for IoT Devices

The Internet of Things (IoT) is an evolving concept and is described in various ways, and one of the most common being an infrastructure of interconnected objects.

Authors: Farbod Hosseyndoust Foomany, Ehsan Foroughi, and Rohit Sethi
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 1

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 1. IS/IT strategy steps for auditors to define, target, & determine resources needed.

Author: Ed Gelbstein
Audit Framework
ISACA Journal Article

Mobile App Security—Audit Framework

Mobile App Security—Audit Framework. For the proper controls on mobile apps to be developed & tested, one must first dissect the layers of risk.

Author: Mohammed J. Khan
Managing Cloud Risk
ISACA Journal Article

Managing Cloud Risk: Top Considerations for Business Leaders

Cloud adoption continues to grow at a rapid pace, and transforming businesses across the globe. Here are some top considerations for business leaders.

Author: Phil Zongo
Mobile Payments
ISACA Journal Article

Mobile Payments as a Security Control?

Ask any merchant and he/she will tell you that accepting credit card payments comes with its own set of security challenges.

Author: Rob Clyde
Network Evolution
ISACA Journal Article

From Static Networks to Software-driven Networks—An Evolution in Process

The networking industry is gradually transforming itself from a hardware-centric approach to a software-defined platform.

Author: Nikesh Dubey
Information Security Matters
ISACA Journal Article

Information Security Matters: Chief Cyber Officer

In this article, ISACA explains how there is no need for a chief cyber officer because the chief information security officer (CISO) performs that function.

Author: Steven J. Ross
The Network
ISACA Journal Article

The Network: Debbie Newman

What is the biggest security challenge that will be faced in 2016? How should it be addressed?

Author: ISACA
IT Audit Interview
ISACA Journal Article

The Interview as an Audit Tool During an IT Audit

Conducting onsite interviews is a critical part of any IT audit and can lead to the gathering of information not readily apparent through reading documentation and examining physical evidence.

Author: Henry Bottjer
Mobile Computing Device Threats
ISACA Journal Article

Mobile Computing Device Threats, Vulnerabilities and Risk Are Ubiquitous

Mobile Computing Device Threats, Vulnerabilities & Risk Are Ubiquitous. Review the actors, threats, vulnerabilities, & risk with mobile devices.

Author: Larry G. Wlosinski
Transforming Risk Culture Through Organizational Culture Leveraging COBIT 5 for Risk | ISACA
Governance Article

Transforming Risk Culture Through Organizational Culture Leveraging COBIT 5 for Risk | ISACA

Organizations must implement systems and mechanisms to drive change and achieve results in order to enable a workforce that understands and practices security as part of daily work life.

Incident Reponse
ISACA Journal Article

Application of Situation Awareness in Incident Response

With the exponential increase in security incidents due to known and unknown causes, the responsibilities of the computer security incident response (CSIR) team have become more complex.

Author: Teju Oyewole
Auditing Major Projects
ISACA Journal Article

Maximize Value, Adopt a Flexible Approach to Auditing Major Projects

For most organizations, project execution is the primary means of achieving business objectives—such as cost reduction.

Author: Joseph Zipper
Improving Business with COBIT 5
Governance Article

Improving Business With COBIT 5 | ISACA

Benefits realization of IT-enabled investments is a strategic imperative. In a 2008 study on benefits realization.

Security
ISACA Journal Article

Security in an Age of Distraction

In addition to the challenges that security awareness programs have always faced in obtaining the attention of participants and communicating information to promote secure behaviors, practitioners must deal with a new obstacle—individuals distracted by a multitude of electronic devices.

Author: Kerry A. Anderson
Root Cause Analysis | ISACA
Governance Article

Root Cause Analysis | ISACA

Buried in COBIT 5 processes such as APO11 Manage quality and APO12 Manage risk in the Align, and Plan and Organize (APO) domain.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 3

The first two parts of this series of articles on auditing IS/IT risk management covered the audit of activities looking back in time to identify opportunities for improvement.

Author: Ed Gelbstein
Black Swans
ISACA Journal Article

Black Swans—From Expecting Risk to Expanding Technology

In today’s world, and one of the fastest-growing and changing aspects of human lives is technology.

Author: Mustafa S. Poonawala
Implementing Segregation of Duties
ISACA Journal Article

Implementing Segregation of Duties: A Practical Experience Based on Best Practices

Implementing Segregation of Duties: A Practical Experience Based on Best Practices. Enforcing SoD is an effective risk management strategy.

Author: Stefano Ferroni
Creating Value with an Enterprise IT Governance Implementation Model Using COBIT 5
Governance Article

Enterprise IT Governance Implementation Model Using COBIT 5 | ISACA

Creating Value with an Enterprise IT Governance Implementation Model Using COBIT 5. Reviews service delivery from COBIT 5 with implementation in EITG.

Technology and Regulatory Compliance
ISACA Journal Article

Technology and Regulatory Compliance in Global Organizations: Stuck Between a Rock and a Hard Place

For big corporations, doing business in today’s world comes with the good (profits, and shareholder satisfaction) and the bad.

Author: Ola Bello
Monitoring, Evaluating and Assessing Compliance | ISACA Governance
Governance Article

Monitoring, Evaluating and Assessing Compliance | ISACA

A 2015 Deloitte Risk Services Report found that 35% of companies still do not actively measure the effectiveness of their compliance programme.

Are Your IT & Strategic Business Goals Aligned? | ISACA Governance
Governance Article

Are Your IT & Strategic Business Goals Aligned? | ISACA

Developing and using models to help represent relationships between business strategy and IT is an effective method to show the strategic effect of IT within the enterprise.

Ensuring Vendor Continuity
ISACA Journal Article

Ensuring Vendor Continuity

Ensuring Vendor Continuity. Vendor checklist for critical services should be considered during planning, request for proposal (RFP) & evaluation.

Author: Samuel Shanthan
Wireless Sensor Networks
ISACA Journal Article

A Secure Data-gathering Approach in Wireless Sensor Networks: Considering QoS Via Hashing Mechanism

Data collection is a challenging task in wireless sensor networks (WSNs) due to the limitations in communication bandwidth and the energy budget, but it provides a secure data-gathering approach.

Authors: Michael Roseline Juliana and Subramaniam Srinivasan
Protecting Information
ISACA Journal Article

Protecting Information—Practical Strategies for CIOs and CISOs

Organizations that don't position their information security group (ISG) strategically within the organization’s structure often fail to receive the desired benefits. Visit this article to learn more.

Author: Devassy Jose Tharakan
IT Governance Transparency
ISACA Journal Article

How Boards Realise IT Governance Transparency: A Study Into Current Practice of the COBIT EDM05 Process

In our increasingly digitised economy, IT has become fundamental to support, sustain and grow organisations.

Authors: Steven De Haes, Anant Joshi, Tim Huygh, and Salvi Jansen
Information Security Matters
ISACA Journal Article

Information Security Matters: Challengeable Truths

In information security, I have seen a vast revolution, from the days of “It cannot be done” to today’s “It must be done.” My enthusiasm about our profession has not only not abated, but it has increased enormously in the years—still just a few years—that the reality of the threat of cyberattacks has been recognized.

Author: Steven J. Ross
Cryptography Security
ISACA Journal Article

Can Elliptic Curve Cryptography be Trusted? A Brief Analysis of the Security of a Popular Cryptosystem

Can Elliptic Curve Cryptography be Trusted? A Brief Analysis of the Security of a Popular Cryptosystem for smart card, phone, IoT & Bitcoin

Author: Veronika Stolbikova
Logical Tool
ISACA Journal Article

Strengthening Value and Risk Culture Using a Real-time Logical Tool

The Basel Committee on Banking Supervision identifies the fact that the IT and data architectures used by banks were inadequate to support comprehensive management of financial risk.

Authors: Simon Grima, Robert W. Klein, Ronald Zhao, Frank Bezzina, and Pascal Lélé
EU Data Protection Law
ISACA Journal Article

The Complexity Is in the Details: New EU Data Protection Law Promises User Control

Four years after its introduction, the European Commission has recently come to agreement on the General Data Protection Regulation (GDPR) as organizations around the globe await the details, which should be released soon.

Author: Michael Vanderpool
Big Data
ISACA Journal Article

Big Data—Hot Air or Hot Topic?

There are many different definitions of the term ‘big data’, and concerns about whether it will necessitate significant changes in business operations in the short term.

Author: Angel Serrano
Information Ethics
ISACA Journal Article

Information Ethics: Moral Dialogue on the IT-leveraged Economy

In information ethics, we face moral questions in four spheres, or roles: as a person, and as an economic agent, as a company leader and beyond a firm’s boundaries.

Author: Vasant Raval
The Network
ISACA Journal Article

The Network: Khawaja Faisal Javed

What is the biggest security challenge that will be faced in 2016?

Author: ISACA
Going Beyond the Technical in SIEM
ISACA Journal Article

Going Beyond the Technical in SIEM

This article addresses an existing imbalance between technical issues and process aspects related to SIEM. This gap is the root cause of some skepticism with and disappointment in SIEM.

Author: Aleksandr Kuznetcov
Internet Security Audits
ISACA Journal Article

Internet Security Audits for Government: An Overview of the Lessons Learned in the Netherlands

Politicians are considering deploying IT audits to diminish the chance of a cyberattack on government websites. This article explains the lessons learned from the Netherlands cyberattacks.

Author: Jeroen van Lewe
Stuck Thoughts
Governance Article

Stuck Thoughts

The goal of continual improvement is to optimize efficiency, effectiveness and economic efficiency. You do this by continuously checking your processes, making improvements and sustaining those improvements.
Data Visualization
ISACA Journal Article

The Art of Data Visualization: A Gift or a Skill?, Part 2

Part 1 of this article covered the four layers to understand before starting to design visualizations. Those layers are know the data, know the message, know the audience and know the options.

Author: Karina Korpela
Enhancing Intelligence/Wisdom Within the COBIT 5 Governance of Information Model | ISACA
Governance Article

Enhancing Intelligence/Wisdom Within the COBIT 5 Governance of Information Model | ISACA

Pathways toward the WM vision must be addressed in relationship to knowledge, intelligence, creativity/innovation, learning, intelligence and wisdom, especially from DIKIW and semiotic perspectives.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 1

IS Audit Basics: Auditing IS/IT Risk Management, Part 1. Differences between conducting an IS/IT audit & an IS/IT risk management audit.

Author: Ed Gelbstein
Implementing COBIT 5 at ENTSO-E | ISACA
Case Study

Implementing COBIT 5 at ENTSO-E | ISACA

The IT director of the European Network of Transmission System Operators for Electricity (ENTSO-E) undertook a pragmatic approach toward implementing COBIT 5.

Information Technology Committees
ISACA Journal Article

Board-level Information Technology Committees

Board-level Information Technology Committees. Review of 23 companies with board-level IT committees and their roles & responsibilities.

Author: Nancy Lankton
Malicious Emails
ISACA Journal Article

Book Review: Phishing Dark Waters

With down-to-earth language, authors Christopher Hadnagy and Michele Fincher successfully explain the reasons why someone, though knowledgeable about technology and aware of the dangers of phishing schemes, can fall for simple attacks.

Authors: Christopher Hadnagy and Michele Fincher
A Governance & Management Model for the Public Sector Shared Services Center Based on COBIT 5 | ISACA Governance
Governance Article

A Governance & Management Model for the Public Sector Shared Services Center Based on COBIT 5 | ISACA

Shared services is an environment in which a company can absorb activities that support the principle processes of each of the company’s other business units.

Understanding Architecture Roles | ISACA
Governance Article

Understanding Architecture Roles | ISACA

When I teach classes on governance, I ask the class this: If you were newly made manager of something—security.

Securing the Virtual Environment
ISACA Journal Article

Book Review: Securing the Virtual Environment

Securing the Virtual Environment: How to Defend the Enterprise Against Attack explains that some advantages of virtualization include increased IT agility, greater hardware utilization, improved disaster recovery abilities and better business continuity capabilities.

Authors: Davi Ottenheimer and Matthew Wallace
ATM Risk
ISACA Journal Article

ATM Risk

ATM Risk - Criminals are known for using include ATM skimming, ATM hacking, & radio frequency identification (RFID) credit card skimming.

Author: Henry Santiago
Encryption
ISACA Journal Article

Encryption in the Hands of End Users

As a defense strategy, many organizations are expanding their usage of encryption which provides protection from unauthorized access and reduces the likelihood of data theft.

Author: Eric H. Goldman
Governance
Governance Article

Internal Controls White Paper Released

The objective of this white paper is to introduce internal control within the context of IT governance and management and to explain its use.

IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 2

Part 1 of this article described the commonalities, differences and possible overlaps between the IS/IT internal auditors and the IS/IT risk management functions managed by the CIO.

Author: Ed Gelbstein
Risk Analysis Process
ISACA Journal Article

Ataraxia and Premeditation as Elements of Judgment in the Risk Analysis Process

Typical cliché assumes that misfortunes are opportunities. Instead, one can prepare using tools to implement a realistic perspective without engaging in optimism in the management of uncertainty.

Author: David Eduardo Acosta R.
IT Frameworks
ISACA Journal Article

Essential Frameworks and Methodologies to Maximize the Value of IT

Essential Frameworks and Methodologies to Maximize the Value of IT. Practical guidance, benchmarks & tools to efficiently operate frameworks.

Author: Laurent Renard
Improving Cyberdefenses
ISACA Journal Article

Quick Fixes for Improving Cyberdefenses

There is an increasing trend of companies moving to e-business models with connectivity using multiple channels such as the Internet, mobile devices, social media, and the cloud in an anytime, anywhere, always-on model. Businesses, small or large, are part of cyberspace and are continually connected directly and indirectly.

Author: Sanjiv Agarwala
Data Privacy for the Smart Grid
ISACA Journal Article

Book Review: Data Privacy for the Smart Grid

The data privacy concerns raised by the authors are numerous and include being able to make assumptions about the health of the residents, which might be of interest to insurance companies.

Authors: Rebecca Herold and Christine Hertzog
Information Ethics
ISACA Journal Article

Information Ethics: Is Information Technology Responsible for Corporate Crises?

During the early 1990s, I was visiting with the president of a top-ranked graduate management institute in India.

Author: Vasant Raval
Risk Management
ISACA Journal Article

Risk Management in Agile Projects

Agile practices allow the management of a range of risks encountered in product development. In this article, we discuss an agile approach to risk management.

Author: Alan Moran
Optimizing Software Development
ISACA Journal Article

Optimizing Software Development With Lean Value Chain Analysis

Lean is a philosophy of continuous, and incremental improvement of business processes, products and services.

Author: Vimal Mani
Auditing Agile
ISACA Journal Article

Auditing Agile: A Brave New World

Auditing Agile: A Brave New World. Agile presents a unique conundrum from validating software development to documenting audit work papers.

Author: Chong Ee
Application Security
ISACA Journal Article

Application Security Risk: Assessment and Modeling

Why are breaches continuing despite cutting-edge solutions supported by compliance? ISACA explains the risks of assessment and modeling of application security.

Authors: Shubhamangala B. R. and Snehanshu Saha
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Is There Such a Thing as a Bad IS Auditor?, Part 2

In this column, the profiles of typical IS auditors (other than the timid) represent an increasing level of danger to the organization. There are overlaps among the various profiles.

Author: Ed Gelbstein
Prioritizing and Justifying Cybersecurity Investments
ISACA Journal Article

A Nontraditional Approach to Prioritizing and Justifying Cybersecurity Investments

Investments in cybersecurity tend to be fairly significant, so organizations continually seek ways to determine whether the investments were appropriate based on return.

Author: Robert Putrus
The Network
ISACA Journal Article

The Network: George Quinlan

What is the biggest security challenge that will be faced in 2016? How should it be addressed?

Author: George Quinlan
Information Security Matters
ISACA Journal Article

Information Security Matters: Weary Willie’s Guide to Cyberrisk Management

Looking at Emmett Kelly’s shtick after all these years made me think about cybersecurity. Now, the mind works in curious ways, and mine more so than most. I am probably the only one who sees cybersecurity in a clown’s act. What Weary Willie was telling me is that if we cannot eliminate a problem, we should make it small enough that it becomes manageable.

Author: Steven J. Ross
Help Source QA
ISACA Journal Article

HelpSource Q&A

My company uses a cloud-based email service provider for corporate email. The same vendor also provides storage space for all the employees to store data.

Author: Ganapathi Subramaniam
The Need for Sanctions
Governance Article

The Need for Sanctions

In many organizations, applying the COBIT 5 Culture, Ethics and Behavior enabler is hard. Many believe that all you need to do is write a policy, tell people about it and watch them change. However, it does not work that way in the real world.

IT Integration Risk
ISACA Journal Article

Evaluating IT Integration Risk Prior to Mergers and Acquisitions

Evaluating IT Integration Risk Prior to Mergers and Acquisitions. Review of Risk and Benefits associated with IT integration in M&A.

Author: Deepak Khazanchi
Initiating GEIT Using COBIT 5 at the Oman Ministry of Manpower | ISACA
Governance Article

Initiating GEIT Using COBIT 5 at the Oman Ministry of Manpower | ISACA

While attending one of the ISACA continuous professional education (CPE) sessions related to optimizing IT spending using COBIT 5 practices.

Security in the Payment Card Industry
ISACA Journal Article

Security in the Payment Card Industry: The Importance of Data Integrity

Security in the Payment Card Industry: The Importance of Data Integrity. Large retailers to mom & pops are vulnerable if proper data security is not in place.

Author: Mark Johnston
Tips for Understanding the COBIT 5 Enabler of Process | ISACA \
Governance Article

Tips for Understanding the COBIT 5 Enabler of Process | ISACA

The activities defined in a process are generally aided by a reference model such as COBIT 5 , ITIL or the CERT Resilience Management Model (CERT-RMM).

IS Audit Basics
ISACA Journal Article

IS Audit Basics: Is There Such a Thing as a Bad IS Auditor? Part 1

Previous columns explored what it takes for an audit to be successful and also the characteristics of a good auditor.

Author: Ed Gelbstein
Automated Compliance Monitoring
ISACA Journal Article

A Framework for Automated Compliance Monitoring in Oracle/SAP Environment

It is not uncommon for IT departments to be unaware of security best practices specific to SAP and to lack the business knowledge necessary to perform a segregation-of-duties (SoD) analysis.

Author: Balraj Thuppalay
Process Standardization
Governance Article

Process Standardization Is Key | ISACA

Our IT frameworks and methodologies have one thing in common. They all call for the development and standardization of processes.

Using Color to Enhance Spreadsheet Accuracy
ISACA Journal Article

Using Color to Enhance Spreadsheet Accuracy and Usefulness

Auditors often embed colored labels in spreadsheets to enhance accuracy and usefulness. This article presents ideas using Microsoft Excel 2013.

Authors: Joshua J. Filzen and Mark G. Simkin
Dubai Customs COBIT 5 Implementation | ISACA
Governance Article

Dubai Customs COBIT 5 Implementation | ISACA

The management at Dubai Customs endeavors to be on the leading edge of the latest management frameworks and it utilizes many global best practices to manage activities in all business processes.

Maturity Security Information Governance
ISACA Journal Article

Maturity Security Information Governance: Applied to the Telecom Segment in Brazil

Information security is a primary concern that pervades all organizations and comprises confidentiality.

Authors: Kleuber Tormim, Vitor Tormin Nishi, and Mauricio Rocha Lyra
Managing Data Protection
ISACA Journal Article

Managing Data Protection and Cybersecurity—Audit’s Role

Data protection and cybersecurity go hand-in-hand due to the nature of the risk involved. The underlying assumption is that all data.

Author: Mohammed J. Khan
Actionable Security Intelligence
ISACA Journal Article

Actionable Security Intelligence From Big, Midsize and Small Data

Actionable Security Intelligence From Big, Midsize and Small Data. Examines synergies among big, midsize & small data and provide chance to overtake the attackers.

Author: C. Warren Axelrod
Transforming the IT Audit Function
ISACA Journal Article

Transforming the IT Audit Function—Taking the Digital Journey

Today’s digital revolution is disrupting every corner of the business world and every function across the business enterprise.

Author: Robert (Bob) E. Kress
Auditing Cybersecurity
ISACA Journal

Auditing Cybersecurity

Auditing Cybersecurity. An approach to assess the adequacy of a firm’s cybersecurity posture. Taking the cyber vulnerability assessment approach.

Author: Martin Coe
PCI DSS and ISO/IEC 27001 Standards
ISACA Journal Article

Comparison of PCI DSS and ISO/IEC 27001 Standards

This article discusses the interoperability of PCI DSS 3.1 and ISO/IEC 27001:2013. The pros and cons of the PCI DSS and ISO/IEC 27001 standards are compared.

Author: Tolga Mataracioglu
Software-related Incidents
ISACA Journal Article

Seven Software-related Incidents and How to Avoid or Remediate Them

Verizon’s 2015 Data Breach Investigations Report, which addresses industry verticals such as education & entertainment, points to key incidents related to data breaches to watch for.

Author: Frederick G. Mackaden
IS Auditor
ISACA Journal Article

How to Be the Most Wanted IS Auditor

The audit profession is known to businesses of all kinds, especially those that are governed by regulation.

Author: Sanjiv Agarwala
Information Security Matters
ISACA Journal Article

Information Security Matters: Cyber/Privacy

There is a lot to be learned by considering certain cyberattacks as privacy violations. GAPP offers some guidance, but the principles are not a tight fit with the cybertheft of personal information.

Author: Steven J. Ross
Data Visualization
ISACA Journal Article

The Art of Data Visualization: A Gift or a Skill?, Part 1

The ability to create eye-catching visuals is not an inherited skill. The skills required for most effectively displaying information are not intuitive.

Author: Karina Korpela
COBIT 5
ISACA Journal Article

How COBIT 5 Improves the Work Process Capability of Auditors, Assurance Professionals and Assessors

How COBIT 5 Improves the Work Process Capability of Auditors, Assurance Professionals and Assessors with common tasks & activities to complete.

Author: Graciela Braga
The Network
ISACA Journal Article

The Network: Urmilla Persad

What do you anticipate being the biggest compliance challenge in 2016? How will you face it?

Author: ISACA
IT Auditor
ISACA Journal Article

Guest Editorial: Why Everyone Dislikes the IT Auditor and How to Change It

Well, to be truthful, not everyone dislikes the IT auditor. But there have been a lot of remarks made over the years.

Author: Tommie W. Singleton
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Trust, but Verify

There is much to be gained from an open, collaborative relationship between auditors and auditees in which both parties focus on understanding and managing business risk.

Author: Ed Gelbstein
People-centric Skills
ISACA Journal Article

Book Review: People-centric Skills

This book is written as an intriguing tale about the lives of a fictional audit team, their daily client interactions and their aspirations to grow into an excellent audit team. The authors highlight the work ethic, techniques and skill sets required of a high-performing, modern-day audit team.

Authors: Danny M. Goldenberg and Manny Rosenfeld
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 3: Dealing With Conflict

An auditor will sooner or later be faced with two kinds of conflicts: conflict of interest and interpersonal conflict.

Author: Ed Gelbstein
Cybersecurity
ISACA Journal Article

Developing a Common Understanding of Cybersecurity

Cybersecurity is frequently discussed, but the meaning and scope of the term have not been consistent.

Author: Deepak Rout
Does a COBIT 5 Self-assessment Help the Business to Get Control of a Shared Service Center? | ISACA
Article

Does a COBIT 5 Self-assessment Help the Business to Get Control of a Shared Service Center?

In the summer of 2014, the chief information officer (CIO) of a shared service center (SSC) owned by 3 different, culturally diverse types of companies asked the author to perform an assessment based on COBIT 5. The most pressing question the CIO needed to answer for...
Real-life Risk Theory
ISACA Journal Article

Real-life Risk Theory

Most IT professionals know the theory and importance of addressing and mitigating risk. Daily resource limitations and task prioritisation.

Authors: Mette Brottmann, Klaus Agnoletti, Morten Als Pedersen, Ronnie Lykke Madsen, Michael Rosendal Krumbak, and, Thor Ahrends
Information Ethics
ISACA Journal Article

Information Ethics: Transparency and the IT Professional

The word transparency originated in the field of engineering. It has to do with the physical property that allows the transmission of light through a material.

Author: Vasant Raval
Cloud Computing
ISACA Journal Article

Cloud Computing: Cloud Computing as an Enabler of New Business Models and Start-ups—Aligning On-demand SME Needs Through Cloud Computing

As a free and simple cloud-based contract management application for small and medium-sized enterprises (SMEs).

Author: Angelique Schouten
Device Security
ISACA Journal Article

Back to the Future in Device Security: Leveraging FIPPs to Proactively Manage IoT Privacy and Security Risk

The Internet of Things (IoT) represents an unknown set of forces. One known is that IoT-connected devices will generate exponential levels of new data leading to powerful insights.

Authors: Doron Rotman, Chris Kypreos, and Sarah Pipes
Information Security Matters
ISACA Journal Article

Information Security Matters: Cybersecurity for a “Simple” Auditor

A few issues back, I wrote about the US National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity. In that article, I pointed out that the framework conflates information security and cybersecurity, which I believe should be differentiated.

Author: Steven J. Ross
Cybersecurity
ISACA Journal Article

Revising Cybersecurity Skills for Enterprises

Cyberspace is a virtual environment. Today, it does not matter which device is used for connecting to the Internet.

Authors: Ivo Ivanovs and Sintija Deruma
The Network
ISACA Journal Article

The Network: Nickson Choo

What has been, or do you anticipate being, the biggest compliance challenge in 2015? How will you face it?

Author: ISACA
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 3: Can Auditors Prevent Project Failure?

This column focuses on a serious concern to business managers: What causes large software projects to have huge cost and timescale overruns and/or fail to meet expectations or.

Author: Ed Gelbstein
Internet of Things
ISACA Journal Article

Internet of Things—The Fate We Make for Ourselves

The fantasy once associated with science fiction films is becoming increasingly similar to modern life.

Author: Jim Seaman
Risk and Ethics in Cyberspace
ISACA Journal Article

Risk and Ethics in Cyberspace

Risk and Ethics in Cyberspace. How to minimize the vulnerability, eliminate the threat or mitigate the risk associated with the problem.

Author: Wanbil W. Lee
COBIT 5 Adoption: Understand & Be Understood | ISACA
Article

COBIT 5 Adoption: Understand and Be Understood

One of the most important discoveries for the human age was the Rosetta Stone. This piece of granite was the key element to decoding and understanding Egyptian hieroglyphs. Using this stone, it became possible to understand what the Egyptians wrote in their papyrus and allowed us to understand how the ancient Egyptians lived and thought...
Governance, Risk Management and Compliance
ISACA Journal Article

Book Review: Governance, Risk Management and Compliance

Those who peruse this book can gain a clear understanding of how the establishment of the right processes, organization and technologies can guarantee the accomplishment of corporate governance goals.

Author: Richard M. Steinberg
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 2: Can Auditors Prevent Project Failure?

This three-part series within the IS Audit Basics column continues a discussion on a matter that, over many years, has been of concern to business managers everywhere.

Author: Ed Gelbstein
Login Credentials
ISACA Journal Article

Vulnerability of Login Credentials at the Heart of Cyberhacks and Data Breaches

Corporate entities and retailers are scrambling to shore up network security by addressing the primary vulnerability of network security: the login. Unique behavioral biometrics may be the solution.

Author: Jeff Maynard
Podcast
Podcast

Stanley Baldwin’s Bomber

If organizations operate under British politician Stanley Baldwin’s declaration that “The bomber will always get through,” they can greatly improve their security posture. Assuming a breach will happen encourages organizations to build strong defensive measures. In this podcast, we discuss why organizations should assume attackers will always get in and steps they can take to remain strong in the event of a breach.

2 September 2015
Cybersecurity Vulnerabilities
ISACA Journal Article

Addressing Cybersecurity Vulnerabilities

Addressing Cybersecurity Vulnerabilities. 10 areas of improvement to help security professionals detect, prevent and address security incidents.

Author: Omar Y. Sharkasi
The Underground Threat
ISACA Journal Article

The Underground Threat

According to the Symantec Internet Security Threat Report (ISTR), the annual cost of cybercrime to consumers in the US is more than US $38 billion. Visit this article for more information.

Author: Larry G. Wlosinski
Information Security Matters
ISACA Journal Article

Information Security Matters: Stanley Baldwin’s Bomber

Stanley Baldwin was a British politician who won numerous national elections in the 1920s and 1930s.

Author: Steven J. Ross
Cyberinsurance
ISACA Journal Article

Cyberinsurance—The Challenge of Transferring Failure in a Digital, Globalized World

As organizations enter the international context and leverage their IT operations, their visibility increases.

Author: Jeimy J. Cano M.
HelpSource
ISACA Journal Article

HelpSource

How do I ensure that my organization has controls to protect itself from cyberrisk? In other words, what are the key controls that my company must implement to protect itself from cyberrisk?

Author: Ganapathi Subramaniam
Cybersecurity Detective Controls
ISACA Journal Article

Cybersecurity Detective Controls—Monitoring to Identify and Respond to Threats

Detective controls are a key component of a cybersecurity program in providing visibility into malicious activity and attacks on an organization’s IT environment.

Author: Fredric Greene
Access Management
ISACA Journal Article

Accelerating Access Management to the Speed of Hacks

Organizations grant network access nearly every minute of every day. Hackers frequently try to get inside networks using co-opted access credentials. Yet most IT departments still review access privileges only quarterly or semiannually.

Author: Chris Sullivan
Extending BCM Into the C-suite
ISACA Journal Article

Preparing for a Cyberattack by Extending BCM Into the C-suite

There are many steps that can be taken to avoid a cyberbreach, but statistically speaking, the odds are that every company has been or will be breached at some point.

Author: Gary Lieberman
The Network
ISACA Journal Article

The Network: Daniela Gschwend

What has been, or do you anticipate being, the biggest compliance challenge in 2015?

Author: ISACA
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 1: Can Auditors Prevent Project Failure?

Large software projects have been notorious because of: Their large budget and timescale overruns, Failing to deliver the promised benefits and more!

Author: Ed Gelbstein
Cybersecurity
ISACA Journal Article

Cybersecurity in the Quantum World

Most people probably lock their doors when they are not at home. They trust that the things they value—family photographs.

Author: Michele Mosca
Information Ethics
ISACA Journal Article

Information Ethics: Monitoring Morality—Is Assurance of Information Ethics Feasible?

My honest thought about monitoring is: I do not like being monitored! I am not alone. A large majority of individuals and organizations would assert that they do not like being monitored.

Author: Vasant Raval
IT Auditing
ISACA Journal Article

Book Review: IT Auditing and Application Controls for Small and Mid-sized Enterprises

Former US President John F. Kennedy said, “The Chinese use two brush strokes to write the word ‘crisis.’ One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger, but recognize the opportunity.”

Authors: Jason Woods, William Brown, and Harry Howe
COBIT 5

How COBIT 5 Helped Al Rajhi Bank to Meet Compliance and Regulatory Requirements

Founded in 1957, Al Rajhi Bank is one of the largest Islamic banks in the world with total assets of SR 288 billion (US $76.8 billion), a paid up capital of US $4.3 billion and an employee base of more than 8,400 associates. With more than 50 years of experience...
FISMA Compliance Handbook
ISACA Journal Article

Book Review: FISMA Compliance Handbook

FISMA Compliance Handbook is a valuable reference guide to compliance requirements in the United States.

Author: Laura Taylor
Cloud Computing
ISACA Journal Article

Cloud Computing Success Depends on the Right Network

In their ongoing quest to increase productivity, enhance operating efficiencies and reduce costs, more and more IT executives are moving to the cloud.

Author: Corey Eng
Cloud Computing
ISACA Journal Article

Cloud Computing: Cloud Application Enables ViralMint to Turn Potential Disaster Into Success

Social media marketing firm ViralMint rolled out a new feature that proved so popular that the increased customer traffic swamped the capabilities of the existing load balancer solution and greatly increased application response times.

Authors: Siva Mandalam and Rohan Dighe
Auditing Software
ISACA Journal Article

Three Ways to Simplify Auditing Software Security Requirements and Design

It is common knowledge that building security into software is an important prerequisite for information assurance.

Authors: Rohit Sethi and Ehsan Foroughi
Data Protection Act
ISACA Journal Article

Data Protection Act and GAPP Alignment

With increasing privacy laws and regulations, global data privacy risk has become one of the major drivers of spotlighting the role of IT auditors.

Author: Mohammed J. Khan
Deep Web Data Extraction
ISACA Journal Article

Deep Web Data Extraction Based on URL and Domain Classification

The rapid development of computer and networking technologies has increased the popularity of the web.

Authors: B. Aysha Banu and M. Chitra
Vendor Management
ISACA Journal Article

Vendor Risk Management Demystified

Outsourcing is often a default strategy for today’s businesses. While it has huge potential benefits to offer enterprises.

Author: Dipti Patel
Information Security Matters
ISACA Journal Article

Information Security Matters: Are Software Flaws a Security Problem?

I suspect I share with many readers of the ISACA Journal an annoyance with customer service people who tell me that they cannot give me any information because the system is down.

Author: Steven J. Ross
HelpSource
ISACA Journal Article

HelpSource

How should I go about establishing the security function and building a culture that is supportive to controls implementation?

Author: Ganapathi Subramaniam
Enterprise IT
ISACA Journal Article

State and Impact of Governance of Enterprise IT in Organizations: Key Findings of an International Study

Given the centrality of IT for enterprise risk management and value generation, a specific focus on governance of enterprise IT (GEIT) has arisen over the last two decades.

Authors: Steven De Haes, Anant Joshi, and, Wim Van Grembergen
Vendor Governance
ISACA Journal Article

Vendor Governance in the Age of Information Security

From businesses to government agencies, nearly every entity contracts some aspect of software development, system integration and hosting services—creating an emerging crisis in accountability.

Author: Arian Eigen Heald
The Network
ISACA Journal Article

The Network: Christos Dimitriadis

What is the biggest security challenge being faced in 2015? How should it be faced?

Author: Steven J. Ross
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Helping Auditees Prepare for an IS/IT Audit

IS Audit Basics: Helping Auditees Prepare for an IS/IT Audit. Suggestions for how to facilitate the preparation for & conduct of an IS/IT audit.

Author: Ed Gelbstein
Auditing Linux/Unix
ISACA Journal Article

Auditing Linux/Unix Server Operating Systems

Auditing Linux/Unix Server Operating Systems. This review covers auditing the physical security system, passwords, servers, & much more.

Author: Muhammad Mushfiqur Rahman
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditing Small IS/IT Organizations: When Is an IS/IT Organization Small?

IS/IT can be found virtually everywhere, and when it fails to deliver the services that people need, the result is discontent or worse.

Author: Ed Gelbstein
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 2

This issue examines a further set of soft skills that may require a longer period of time to acquire, that are likely to develop over time and that always leave room for improvement.

Author: Ed Gelbstein
COBIT 5
Case Study

COBIT 5 and ITIL Adaptation at a Saudi Municipality

Providing good service to citizens is the main aim of the municipality, and information plays a crucial role. The municipality has to pay proper attention to, and focus on, information management.

Security Mysteries in the Cloud
ISACA Journal Article

Security Mysteries in the Cloud

In the world of IT, “cloud” is a big buzzword. Many organizations are moving to cloud computing because of its on-demand service offerings over the Internet, virtualization and cost efficiency.

Authors: Sivarama Subramanian and Devaraj Munuswamy
COBIT 5
Case Study

Bahrain Government Embraces COBIT 5 Governance and IT Management

The Kingdom of Bahrain’s eGovernment Authority is focused on ensuring the effective delivery of government services to citizens, residents, businesses and visitors (collectively, the customers). The aim is to improve the lives of a nation’s citizens by doing much more than simply implementing technology...

18 May 2015
COBIT to Implement Information Security | ISACA
Case Study

COBIT to Implement Information Security | ISACA

Leveraging COBIT to Implement Information Security (Part 4). Shows how the requirements for certification of the ISMS framework using outlines in this 4-part series.

Information Security Matters
ISACA Journal Article

Information Security Matters: Frameworkers of the World Unite 2

Every now and again, I like to take a poke at standards, just to see what makes them work. Under consideration here is the cybersecurity framework published by the US National Institute of Standards and Technology early in 2014.

Author: Steven J. Ross
COBIT 5 in Sustainable Businesses
ISACA Journal Article

The Time for Sustainable Business Is Now: Leveraging COBIT 5 in Sustainable Businesses

Stakeholders expect that businesses create value, but at what cost? In the end, stakeholders and businesses are looking for the same thing: to protect their future.

Author: Graciela Braga
Knowledge Management
ISACA Journal Article

How to Evaluate Knowledge and Knowledge Management in the Organization Using COBIT 5

This article seeks to evaluate how the use of COBIT 5 can enhance the due diligence for knowledge management and knowledge evaluation within an enterprise.

Author: Bostjan Delak
Cloud Computing
ISACA Journal Article

Cloud Computing: Software-defined WAN Changes Retail Security Paradigm

The adoption of cloud-based retail applications, as well as increasing demands for agility, for example, with pop-up retail, is changing the requirements for network access.

Author: Steve Woo
Social Engineering Threat
ISACA Journal Article

The Underestimated Social Engineering Threat in IT Security Governance and Management

The Underestimated Social Engineering Threat in IT Security Governance & Management. Reviewing the human factor as a necessary part of IS.

Author: Roberto Puricelli
Cloud Automation as a Service
ISACA Journal Article

Evaluating Cloud Automation as a Service

Organizations have already discovered how cloud automation as a service can help them share applications and information regardless of the technology in use or their location.

Author: Andrew Evers
Gray Hat Hacking
ISACA Journal Article

Book Review: Gray Hat Hacking

Gray Hat Hacking: The Ethical Hacker's Handbook is written by a team of experts with advanced knowledge in gray hat hacking and penetration testing.

Authors: Allen Harper, Shon Harris, Jonathan Ness, Chris Eagle, Gideon Lenkey, and Terron Williams
IS Audit Basics
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge

ISACA Journal: IS Audit Basics: The Soft Skills Challenge. Reviews soft skills that do not appear in the Certified Information Systems Auditor examination.

Author: Ed Gelbstein
Governance Management Cycle
ISACA Journal Article

Navigating I/O Flows/Networks to Enhance the Governance Management Cycle

What constitutes true adoption of COBIT 5? Is it a minimum condition that at least one principle of COBIT 5 is adopted for true adoption of COBIT 5?

Author: Makoto Miyazaki
The Network
ISACA Journal Article

The Network: Opeyemi Onifade

What are your three goals for 2015?

Author: ISACA
Information Ethics
ISACA Journal Article

Information Ethics: The Limits of Rules

T. H. Green, a renowned ethicist, once said: “…Whatever moral capacity must be presupposed, it is only actualized through the habits, institutions, and laws, in virtue of which the individuals form a nation.”

Author: Vasant Raval
Secure Data Center Model
ISACA Journal Article

Toward a Secure Data Center Model

Toward a Secure Data Center Model. Defining data centers, security models, technical controls, consolidated frameworks and administration.

Authors: Brett van Niekerk and Pierre Jacobs
Integrated ISMS and BCMS
ISACA Journal Article

Simultaneous Implementation of an Integrated ISMS and a BCMS

The implementation of and certification to global best practice standards can be quite challenging for most organizations given the resources.

Author: Nurudeen Odeshina
COBIT 5
Article

COBIT 5 Principles and Enablers Applied to Strategic Planning

Two years ago in Mexico City, work was underway at an organization that offers managed print services and document solutions. This organization decided to start an effort to reinforce.....

20 April 2015
Cybersecurity
ISACA Journal Article

Book Review: Cybersecurity—The Essential Body of Knowledge

The book’s objective is to provide a comprehensive understanding of cybersecurity. Its target audience is anyone interested in the field of cybersecurity, ranging from students to educators and professionals.

Authors: Dan Shoemaker and William Arthur Conklin
COBIT 5
Case Study

COBIT Helps Organizations Meet Performance and Compliance Requirements

A consulting company in the United Arab Emirates worked with three different organizations to help each organization meet its governance, risk and compliance (GRC) requirements.

6 April 2015
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Auditor: About Yourself (And How Others See You)

This article begins an exploration of some of the human factors that play a role in an auditor’s success.

Author: Ed Gelbstein
COBIT 5
Case Study

Establishing a Governance and Management Structure for E-commerce Using COBIT 5

A company based in Lagos, Nigeria, is in the business of sales and distribution of its brand of shoes through physical outlets in the Lagos area. In a bid to expand its operations to areas outside of its physical outlets and to also have a better competitive showing in the Nigerian marketplace, ....
Fraud Prevention
ISACA Journal Article

Book Review: Fraud Prevention and Detection

The book covers preventive measures or controls, including the boards responsibility, the importance of good governance and robust enterprise risk management (ERM).

Author: Rodney T. Stamler, Hans J. Marschdorf, and Mario Possamai
Hybrid IT Governance Framework
ISACA Journal Article

ERP Implementation in the Education Sector: Using a Hybrid IT Governance Framework

Enterprise resource planning (ERP) aims to enhance business productivity, quality and efficiency by integrating operations and processes.

Authors: Manas Tripathi and Arunabha Mukhopadhyay
Checking the Maturity of Security Policies
ISACA Journal Article

Checking the Maturity of Security Policies for Information and Communication

The transformations experienced by organizations due to technological advances has made information.

Author: Mauricio Rocha Lyra
The Soft Edge
ISACA Journal Article

Book Review: The Soft Edge

How many times has it been asked if an initiative (e.g., a start-up, a new project, an audit, a security assessment) will be successful or, more generally, whether it would be possible to predict the future performance of a company?

Author: Rich Karlgaard
Cloud Insecurities
ISACA Journal Article

Cloud Insecurities

Information security events that affect cloud systems are occurring with no end in sight - the cloud should be treated as a non secure environment with numerous threats and concerns.

Author: Larry G. Wlosinski
Continuous Control Monitoring
ISACA Journal Article

A Practical Approach to Continuous Control Monitoring

This article describes how to create and view attachment fields, as well as how to audit attachment fields in Access databases.

Author: David Vohradsky
Information Security Solutions
ISACA Journal Article

Evaluating Information Security Solutions: Swapping the Cost of Failure for Success

One of biggest budget busters for an information security program is technology solutions that are not a good match for the organization.

Author: Kerry A. Anderson
Information Security Matters
ISACA Journal Article

Information Security Matters: Cyberwhatsit

I did a Google search on the word cyber and was told there are 467 million references to that term. This seems to me an awfully exact number, but I guess we can agree there are a lot of references.

Author: Steven J. Ross
Information Ethics
ISACA Journal Article

Information Ethics: Information Technology and Innovation Ethics

Entrepreneurship and small business are at the core of economic growth. After all, and new giants such as Google and Facebook germinated from humble beginnings.

Author: Vasant Raval
COBIT 5 Processes for Enterprise Security
ISACA Journal Article

Selected COBIT 5 Processes for Essential Enterprise Security

COBIT 5 processes can improve the effectiveness of enterprise security in an organization. In this article, we discuss how they are essential for enterprise security.

Author: Fredric Greene
Strategic Alignment
ISACA Journal Article

Strategic Alignment and E-health Governance

There has been rising interest in adopting e-health governance frameworks to obtain reassurance that investments return the expected results in health care.

Authors: Elena Beratarbide, Thomas W. Kelsey, and Hermenegildo Gil
The Network
ISACA Journal Article

The Network: Lilia Liu Chung

What are your three goals for 2015?

Author: ISACA
COBIT 5 Management Guide
ISACA Journal Article

Book Review: Governance of Enterprise IT Based on COBIT 5

When governance and management of enterprise IT (GEIT) is needed, COBIT 5 is frequently the framework of choice for organizations all over the world.

Author: Geoff Harmer
Internet of Things
ISACA Journal Article

Internet of Things Offers Great Opportunities and Much Risk

There are a number of definitions of Internet of Things (IoT), with all of them having slightly different meanings.

Authors: Marcelo Hector Gonzalez and Jana Djurica
HelpSource
ISACA Journal Article

HelpSource

What are the key controls that we must consider for assessing the third-party vendor?

Author: Ganapathi Subramaniam
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Successful Audits Do Not Just Happen

An online search for audit success criteria reveals few articles or books specific enough to be useful.

Author: Ed Gelbstein
COBIT 5
Case Study

COBIT and the CPA Firm, Part 2

Last year, part 1 of this article outlined how CPA firm Yount, Hyde & Barbour was using COBIT to help build processes to allow its IT department to better serve the enterprise’s needs. While progress has been slow...

23 February 2015
Book Review: The Fifth Domain—Wake Up Neo
ISACA Journal Article

Book Review: The Fifth Domain—Wake Up Neo

The Fifth Domain: Wake Up Neo, written by two chief information officers (CIOs), is an innovative experiment with the cybertechnology novel and is worth the attention of information security professionals.

Authors: Guiliano Pozza and John D. Halamka
Business Information Security Strategy
ISACA Journal Article

Porters’ Elements for a Business Information Security Strategy

Hackers and negative social media hypes have proven able to bring proud organizations to their knees, yet many information and communications technology (ICT) security managers lack a strategy to anticipate and overcome such unpredictable challenges.

Author: Yuri Bobbert
Cybersecurity for Industrial Control Systems
ISACA Journal Article

Cybersecurity for Industrial Control Systems

In June 2010 a computer worm known as Stuxnet, designed to attack industrial programmable logic controllers (PLCs) in target areas, such as nuclear power plants in Iran,1 was discovered.

Author: A. Krista Kivisil
COBIT 5
Article

Adopting COBIT 5 in a Government Entity

Imagine being on the ground floor of a new government agency in the United States, first conceived in 1994 and implemented in 2012, with the initial responsibility of developing an information system...

19 January 2015
Return on Security Investment
ISACA Journal Article

Return on Security Investment—15 Things to Consider

Managers frequently request a return on security investment (ROSI) calculation. While this is a usual business practice for significant investments, the practice is not free from controversy when applied to information security.

Author: Ed Gelbstein
Podcast
Podcast

Microwave Software

Outdated legacy software remains in many organizations and can pose a substantial risk. Security patches often do not exist for them, and many enterprises forget these old programs still have access to critical systems. In this podcast, we discuss how you can address the security challenges old software poses to your organization.

2 January 2015
Information Security Monitoring
ISACA Journal Article

Information Security Continuous Monitoring: The Promise and the Challenge

Combining an organization-applicable risk framework with an all-encompassing control set and an information security continuous monitoring (ISCM) methodology provides for a holistic approach to compliance and risk management by providing controls across a wide array of areas with a high level of detail and guidance on tailoring.

Author: Bill Hargenrader
Audit Accounting Data
ISACA Journal Article

Audit Accounting Data Using Excel Pivot Tables: An Aging of Accounts Receivable Example

Microsoft Excel’s pivot table options provide powerful tools for aggregating and analyzing accounting data, but so does alternate software such as ACL. So why use pivot tables?

Authors: Joshua J. Filzen and Mark G. Simkin
Auditing SQL Server Databases
ISACA Journal Article

Auditing SQL Server Databases Using CAATs

The following approach to auditing MS SQL Server databases using computer-assisted audit techniques (CAATs) in conjunction with information taken directly from the MS SQL Server database offers a solution to the issues identified.

Author: Ian Cooke
Understanding Software Metric Use
ISACA Journal Article

Understanding Software Metric Use

In the early 1990s, the baggage claim system at Denver International Airport (Colorado, USA) was designed to automate baggage handling by using software to direct baggage contained in unmanned carts running on a track.

Authors: David Henderson, Steven D. Sheetz, and Linda Wallace
User Threats vs. User Privacy
ISACA Journal Article

User Threats Vs. User Privacy: Striking the Perfect Balance

On the one hand, user-based attacks—whether from hackers using stolen credentials, careless third-party vendors, or negligent or even malicious insiders—represent the largest IT security threat to organizations.

Author: Dimitri Vlachos
Information Security Monitoring
ISACA Journal Article

Implementing an Information Security Continuous Monitoring Solution—A Case Study

The threats to government computer systems and networks continue to evolve and grow due to steady advances in the sophistication of attack technology, the ease of obtaining such technology, and the increasing use of these techniques by state and nonstate actors to gain intelligence and/or disrupt operations.

Author: Tieu Luu
Cyberthreat Management
ISACA Journal Article

Effective Cyberthreat Management Evolution and Beyond

Over the past few decades, cybersecurity has gained pivotal importance in the way businesses operate and survive in their value systems.

Author: Seemant Sehgal
Book Review: Cybersecurity and Cyberwar
ISACA Journal Article

Book Review: Cybersecurity and Cyberwar

Cybersecurity and Cyberwar: What Everyone Needs to Know is one of the few books that is completely up-to-date and analyzes the importance of cybersecurity beyond the realm of the Internet.

Authors: P. W. Singer and Allan Friedman
Cloud Computing
ISACA Journal Article

Cloud Computing: Are Your Data Secure in the Cloud

Enterprise architects have to build computing environments that support the general-use case of multiple, disparate business applications, also known as cloud computing.

Author: John Nye
IS Audit Basics
ISACA Journal Article

IS Audit Basics: Perspectives From a Seasoned Practitioner

It was a bit of a surprise and a huge compliment to be invited to contribute to this column after many years reading the words of Tommie Singleton in this space. I shall do my best not to disappoint.

Author: Ed Gelbstein
The Network: Timo Heikkinen
ISACA Journal Article

The Network: Timo Heikkinen

Timo Heikkinen is a senior audit manager for Nordea Bank in Helsinki, Finland.

Author: ISACA
Monitoring from the Cloud
ISACA Journal Article

Guest Editorial: Monitoring From the Cloud—Insights on Demand

Using a computer to automate and implement continuous monitoring (CM) in IT has been around for decades. It was adopted early by IT auditors and IT security specialists, and later used to monitor transactions by operations and financial managers.

Author: Michael P. Cangemi
Information Security Matters
ISACA Journal Article

Information Security Matters: Microwave Software

Let me tell you about my microwave. When I bought it, it was called a microwave oven and I was going to roast turkeys in it in half an hour. I am sure it was white then, but it has turned a pale, sickly yellow.

Author: Steven J. Ross
Help Source Q&A
ISACA Journal Article

HelpSource Q&A

Privacy is one area that has never been audited in my enterprise. Please provide your point of view on how privacy compliance can be assessed?

Author: Ganapathi Subramaniam
Book Review: Secure—Insights From the People Who Keep Information Safe
ISACA Journal Article

Book Review: Secure—Insights From the People Who Keep Information Safe

There is always a new information security issue to focus on, another area of key concern relating to IT security, data security or business continuity planning that security professionals need to be aware of to keep on top of the relevant risk.

Author: Mary Lou Heastings
Data Owners’ Responsibilities When Migrating to the Cloud
ISACA Journal Article

Data Owners’ Responsibilities When Migrating to the Cloud

Understanding who owns data is not as simple as it appears at first. It is easy to say that all data belong to the organization. This is correct, but it does not identify accountability for such ownership.

Authors: Ed Gelbstein and Viktor Polic
How Zero-trust Network Security Can Enable Recovery From Cyberattacks
ISACA Journal Article

How Zero-trust Network Security Can Enable Recovery From Cyberattacks

Managers looking for a strategy to comply with the US NIST Cybersecurity Framework requirements for response and recovery should give due consideration to Cyber DRaaS.

Author: Eric A. Beck
COBIT 5
Case Study

Creating Value With COBIT 5 at a Tokio Marine Group Company

Tokio Marine & Nichido Systems (TMN Systems) recently implemented a governance, risk and compliance ( GRC) system based on COBIT 5, which enables the organization to create significant value for its stakeholders as well as optimize risk and resources for value creation.

audit and assurance
ISACA Journal Article

Auditing Oracle Database

Data are a very decisive resource for any business due to shielding; regularly auditing the database should never be left to chance or patchwork solutions.

Author: Muhammad Mushfiqur Rahman
IS Audit Basics: The Core of IT Auditing
ISACA Journal Article

IS Audit Basics: The Core of IT Auditing

With the advent of the latest wave of information technologies such as big data, social media, technologies as a service and the cloud in general, it is worth taking the time to revisit the basics of IT audit.

Author: Tommie Singleton
risk
ISACA Journal Article

Seven Mistakes Being Made in SIEM and How to Fix Them

Seven Mistakes Being Made in SIEM and How to Fix Them. A foundation for evaluating and implementing essential security control solutions against cyberattacks.

Author: Flint Brenton
COBIT 5’s Flexibility Key to Success | ISACA
Article

COBIT 5’s Flexibility Key to Success | ISACA

Nine executives (including the author) were in a conference room, and when the vice president of IT operations stated that due to recent issues within the organization.

IS Audit Basics: What Every IT Auditor Should Know About Computer-generated Reports
ISACA Journal Article

IS Audit Basics: What Every IT Auditor Should Know About Computer-generated Reports

So many times, auditors of all types use a computer-generated report to perform some aspect of assurance. For example, financial auditors may pull a computer-generated list of accounts receivable ...

Author: Tommie Singleton
Manage What Is Known and What Is Not Known: A Road Map to Managing Enterprise Fraud Risk
ISACA Journal Article

Manage What Is Known and What Is Not Known: A Road Map to Managing Enterprise Fraud Risk

Organizations should establish and implement an organization wide fraud risk management framework that integrates counter fraud capabilities through organization and governance.

Authors: Zhiwei Fu, John W. Lainhart IV and Alan Stubbs
Improving the RFP and Contracts Process With COBIT 5 | ISACA
Article

Improving the RFP and Contracts Process With COBIT 5 | ISACA

Changing IT service providers is especially difficult when the company is responsible for processing meter reads and supporting the billing of more than four million customers.

Assessing and Managing IT Operational and Service Delivery Risk
ISACA Journal Article

Assessing and Managing IT Operational and Service Delivery Risk

Service resilience has gained a lot of importance in recent years. A resilient service is one that is capable of withstanding major and minor disruptions caused by natural and man-made sources.

Authors: Upesh Parekh and Jonathan Copley
Carry On—Sound Advice From Schneier on Security
ISACA Journal Article

Carry On—Sound Advice From Schneier on Security

A pessimistic prediction for the future of the RSA Conference, the somehow unfair public judgment of security agencies, the possibility of hacking a papal election, how to become a security expert...

Authors: Bruce Schneier, reviewed by Maria Patricia Prandini
COBIT 5
Case Study

Mapping COBIT 5 With IT Governance, Risk and Compliance at Ecopetrol

As part of an updated strategy, Ecopetrol S.A., a vertically integrated energy company, began a corporate transformation with the goals of growth and strengthening its internal control system.

1 July 2014
Law and Best Practice for a Sarbanes-Oxley Systems Review
ISACA Journal Article

Law and Best Practice for a Sarbanes-Oxley Systems Review

Any organization would like to have an optimal approach to a Sarbanes-Oxley Act review, whether it is the process used or the Sarbanes-Oxley review team's composition.

Author: Frederick G. Mackaden
An Enhanced Risk Formula for Software Security Vulnerabilities
ISACA Journal Article

An Enhanced Risk Formula for Software Security Vulnerabilities

As enterprises increasingly rely on IT to succeed, effective IT risk management has become an essential component of IT governance.1 In conjunction with this, there are various studies to address risk through the software development life cycle,2 while others are interested in risk in the production environment.

Author: Jaewon Lee
Fire Protection of Computer Rooms
ISACA Journal Article

Fire Protection of Computer Rooms—Legal Obligations and Best Practices Fire Protection of Computer Rooms—Legal Obligations and Best Practices

Considering that the issue of fire protection in computer rooms is not specifically addressed in many national regulations, the US National Fire Protection Association (NFPA) Standard for...

Author: Haris Hamidovic
Data Privacy and Big Data—Compliance Issues and Considerations
ISACA Journal Article

Data Privacy and Big Data—Compliance Issues and Considerations

The big data1 craze has taken the industry by storm. With the advent of cost-effective technologies and solutions for longer-term storage of vast amounts of transaction data, more and more companies are investing in keeping more and more data for longer and longer periods.

Author: William Emmanuel Yu
Big Data Analytics for Sophisticated Attack Detection
ISACA Journal Article

Big Data Analytics for Sophisticated Attack Detection

The number and complexity of cyberattacks has been increasing steadily in recent years. The major players in today’s cyberconflicts are well organized and heavily funded teams with specific goals and objectives...

Authors: Nikos Virvilis, Oscar Serrano and Luc Dandurand
Data Privacy—Protecting This Asset Is a Priority
ISACA Journal Article

Data Privacy—Protecting This Asset Is a Priority

Over the past few years, there has been a shift in the business world pertaining to assets that need to be protected. The digital world has brought with it complexity in terms of...

Author: Horace McPherson
Reinspecting Password, Account Lockout and Audit Policies
ISACA Journal Article

Reinspecting Password, Account Lockout and Audit Policies

Reinspecting Windows sounds like reinventing the wheel, but reviewing password policy, account lockout policy and audit policy proves that auditing is not a one-time exercise; rather, it, must be...

Author: M. Faisal Naqvi
Writing good risk statements
ISACA Journal Article

Writing good risk statements

A fundamental part of an information systems (IS) audit and control professional’s job is to identify and analyse risk. Furthermore, risk factors need to be stated clearly and concisely to support effective management of risk.

Author: Benjamin Power
Selecting the Right Cloud Operating Model: Privacy and Data Security in the Cloud
ISACA Journal Article

Selecting the Right Cloud Operating Model: Privacy and Data Security in the Cloud

Cloud-based services are on the rise. According to recent publications, the cloud is the future for the provision of a wide range of IT services.

Authors: Thomas Schaefer, Michael Hofmann, Peter Loos and Peter Fettke
COBIT 5
Case Study

DuPont Drives Continuous Improvement With COBIT 5 Process Assessment Model

Over time, business has increasingly advanced the application of IT to meet ever-changing business needs and regulatory requirements.

April 2014
COBIT 5 Processes From a Systems Management Perspective
ISACA Journal Article

COBIT 5 Processes From a Systems Management Perspective

COBIT 5 establishes a governance layer and does a good job of capturing stakeholder needs, driving enterprise, IT and enabler goals. COBIT 5 fosters the use of balanced...

Authors: Myles Suer, Chane Cullens and Don Brancato
Critical Information Systems Processes
ISACA Journal Article

Critical Information Systems Processes

Organizations maintain their operations with the help of processes that differ according to their organizational structure, business objectives and working styles.

Authors: Tugba Yildirim and Bilgin Metin
Internal Audit’s Contribution to the Effectiveness of Information Security (Part 1)
ISACA Journal Article

Internal Audit’s Contribution to the Effectiveness of Information Security (Part 1)

The internal audit and information security functions should play complementary roles in an organization’s information security program.

Authors: Paul John Steinbart, Robyn Raschke, Graham Gal and William N. Dilla
Communicating IT Governance—Does It Matter?
ISACA Journal Article

Communicating IT Governance—Does It Matter?

IT governance is an area in which IT and non-IT executives need to communicate at least with a basic understanding of each other’s positions.

Author: Giuliano Pozza
SCADA Cybersecurity Framework
ISACA Journal Article

SCADA Cybersecurity Framework

Supervisory control and data acquisition (SCADA) systems are rapidly changing from traditional proprietary protocols to Internet Protocol (IP)-based systems.

Author: Samir Malaviya
COBIT 5
Case Study

Information Security Management at HDFC Bank: Contribution of Seven Enablers

HDFC Bank operates in a highly automated environment in terms of IT and communication systems. All of the bank’s branches have online connectivity, which enables the bank to offer speedy funds transfer facilities to its customers.

January 2014
COBIT 5
Case Study

Middle East Bank Improves Information Security

As a result of its initiative to improve information security with the help of COBIT, a Middle East bank realized several benefits, including improved integration of information security within the organization.

1 January 2014
An Integrated Approach to Enterprise Risk
ISACA Journal Article

An Integrated Approach to Enterprise Risk

Today, most organizations continue to rely on a traditional approach to risk management. Such an approach is built on stovepipe-oriented risk management, in which the focus...

Author: Muhammad Mushfiqur Rahman
Integrating Security Analytics Into GRC Programs
ISACA Journal Article

Integrating Security Analytics Into GRC Programs

Business and security teams alike have seen breathtaking changes over the last few years with the rise of a digital universe that is global, social, mobile and interconnected.

Author: Yo Delmar
Key Considerations in Protecting Sensitive Data Leakage Using Data Loss Prevention Tools
ISACA Journal Article

Key Considerations in Protecting Sensitive Data Leakage Using Data Loss Prevention Tools

Protecting digital assets and intellectual property (IP) is becoming increasingly challenging for organizations. Looming patent challenges and court battles to claim ownership of IP illustrate the...

Author: Nageswaran Kumaresan
Importance of Forensic Readiness
ISACA Journal Article

Importance of Forensic Readiness

Almost all organizations are now dependent, one way or another, on information technology. This has led to a great deal of development as well as associated risk.

Author: Dauda Sule
Privacy Audit—Methodology and Related Considerations
ISACA Journal Article

Privacy Audit—Methodology and Related Considerations

Auditors should consider key risk and control points when performing privacy audits. The following methodology draws heavily on concepts presented in ISO 31000:2009 Risk management—Principles and guidelines.

Author: Muzamil Riffat
Risk Management in 4G LTE
ISACA Journal Article

Risk Management in 4G LTE

Fourth-generation Long Term Evolution (4G LTE) is a broadband wireless data technology designed to offer users access to technology-agnostic across carriers and geographic regions.

Author: Daksha Bhasker
JOnline: Embed With SFIA—Secrets From the Missing Framework
ISACA Journal Article

JOnline: Embed With SFIA—Secrets From the Missing Framework

Why is value so hard to sustain? What is the secret to making best practices stick? How does an organisation make process improvement and good governance last when the consultants leave?

Author: Simon Roller
COBIT 5
Case Study

COBIT and the CPA Firm

With the introduction of COBIT 5, the framework is moving toward a more global application to the enterprise. But, can a smaller organization still take advantage of COBIT 5 to help direct its IT function?

October 2013
COBIT 5
Case Study

Information and Communications Technology Study of Public Health Institutions in Mexico

In Mexico, 44 percent of the people perceive the main problem of health services to be poor quality, with the affecting factors being timely care services, quality of diagnosis and treatment.

October 2013
COBIT 5
Case Study

Use of COBIT 5 for ISACA Strategy Implementation

In 2009, ISACA developed a strategy focused on becoming the global leader in products and services that support trust in, and value from, information systems.

October 2013
A COBIT Approach to Regulatory Compliance and Defensible Disposal
ISACA Journal Article

A COBIT Approach to Regulatory Compliance and Defensible Disposal

The successful IT governance plan demands a modern and transparent approach to data retention and routine disposal. Today’s chief information officers (CIOs) face an unprecedented array of challenges...

Authors: Lorrie Luellig and Jake Frazier
How to Measure Security From a Governance Perspective
ISACA Journal Article

How to Measure Security From a Governance Perspective

Good governance relies on reports or measures that either assess the adequacy of information security, the security program and the return on security investment (ROSI) or the progress toward fixed objectives.

Author: Andrej Volchkov
How to Measure Security From a Governance Perspective
ISACA Journal Article

How to Measure Security From a Governance Perspective

Good governance relies on reports or measures that either assess the adequacy of information security, the security program and the return on security investment (ROSI) or the progress toward fixed objectives.

Author: Andrej Volchkov
JOnline: Mitigating Software Supply Chain Risk
ISACA Journal Article

JOnline: Mitigating Software Supply Chain Risk

Examination of risk related to software supply chains demonstrates that software supply chains are subjected to risk that is specific to software.

Author: C. Warren Axelrod
Key Elements of an Information Risk Profile
ISACA Journal Article

Key Elements of an Information Risk Profile

Information risk has become a top-of-mind issue for many business leaders and information risk management security (IRMS) professionals.

Author: John P. Pironti
COBIT 5
Case Study

Risk Assessment Management Using COBIT 5

The IT organization enjoyed a membership with Info-Tech Research group to access its best-practices research and vendor-selection guidance. Engaging with Info-Tech to conduct a COBIT-based operations workshop on risk management was a natural next step.

22 July 2013
DDoS Attacks—A Cyberthreat and Possible Solutions
ISACA Journal Article

DDoS Attacks—A Cyberthreat and Possible Solutions

Distributed denial of service (DDoS) is one of the most diffused types of cyberattacks that represent a great concern for governments and institutions today.

Author: Ajay Kumar
Man in the Browser—A Threat to Online Banking
ISACA Journal Article

Man in the Browser—A Threat to Online Banking

The popularity of online banking has been on the rise. In 2005, Bob Sullivan of MSNBC quoted research figures from the Pew Internet and American Life Project, which showed that 53 million US citizens were banking online in 2004, and that online banking was the fastest growing Internet activity.

Author: Ed Gelbstein
Quantifying Information Risk and Security
ISACA Journal Article

Quantifying Information Risk and Security

Conducting risk assessments and the calculation of a return on investment (ROI) on information security is challenging. ISACA’s Risk IT1 framework defines IT risk as “The business risk associated with the use, ownership, involvement, influence and adoption of IT within an enterprise.”

Author: Ed Gelbstein
Risk and Compliance—For Better or Worse?
ISACA Journal Article

Risk and Compliance—For Better or Worse?

In today’s business environment, many companies are required to comply with multiple industry and government mandates that govern IT security.

Author: Torsten George
IT Security Responsibilities Change When Moving to the Cloud
ISACA Journal Article

IT Security Responsibilities Change When Moving to the Cloud

How will an organization’s information security staff be affected if the organization’s computer systems are moved to a cloud environment?

Author: Larry G. Wlosinski
JOnline: An Introduction to Auditing HP NonStop Servers—Review of User Access
ISACA Journal Article

JOnline: An Introduction to Auditing HP NonStop Servers—Review of User Access

For at least 35 years, HP NonStop (previously known as Tandem) has been a widely used operating system (OS) to support critical services such as automated teller machines (ATMs), stock exchanges and the airline industry.

Authors: David Ramirez and Nikos Zarras
What Is Big Data and What Does It Have to Do With IT Audit?
ISACA Journal Article

What Is Big Data and What Does It Have to Do With IT Audit?

For many years, IT auditors have been able to rely on comparatively elementary data analysis tools to perform analyses to draw conclusions. With the recent explosion in the volume of data generated for business purposes (e.g., purchase transactions, network device logs, security appliance alerts), current tools may now not be sufficient.

Authors: Kumar Setty and Rohit Bakhshi
Common Myths of Service Organization Controls (SOC) Reports
ISACA Journal Article

Common Myths of Service Organization Controls (SOC) Reports

In today’s dynamic environment, organizations face multiple challenges in terms of various standards and compliance requirements.

Author: Deepa Seshadri
How to Properly Audit a Client Who Uses a Service Organization—SOC Report or No SOC Report
ISACA Journal Article

How to Properly Audit a Client Who Uses a Service Organization—SOC Report or No SOC Report

The new standards from the American Institute of Certified Public Accountants (AICPA) on service organization controls1 have created a situation in which IT auditors, especially Certified Information Systems Auditors (CISAs), are particularly needed and useful.

Author: Tommie W. Singleton
IT Policy Framework based on COBIT 5
ISACA Journal Article

IT Policy Framework based on COBIT 5

The COBIT 5 good-practice framework for governance and management of enterprise IT (GEIT) incorporates many widely accepted concepts and theories from general management and academic IT literature. Exploring how the core principles of the framework are derived from insights from theory and literature...

Authors: Steven De Haes, Roger Debreceny and Wim Van Grembergen
JOnline: Using Personal Mobile Devices in a Business Setting
ISACA Journal Article

JOnline: Using Personal Mobile Devices in a Business Setting

Mobile devices refer to a wide variety of handheld computing devices that allow people to access and process data by running various types of application software (apps).

Authors: Pascal A. Bizarro, Andy Garcia and Jacob Nix
privacy
ISACA Journal Article

Lack of Privacy Awareness in Social Networks

Social networks have opened up a new avenue of communication for millions of people around the world. The major attraction of this technology is the ease with which people can share their personal information with their friends.
Technology Risk Analysis
ISACA Journal Article

Using Scenario Analysis for Managing Technology Risk

In the world of market and credit risk, scenario analysis is used as a part of stress testing. Stress testing is mandated by national regulators and central banks, and takes the form of asking financial institutions to consider the effect of adverse scenarios on their capital and solvency.

Audit
ISACA Journal Article

What Every IT Auditor Should Know About Proper Segregation of Incompatible IT Activities

One element of IT audit is to audit the IT function. While probably more common in external audit, it certainly could be a part of internal audit, especially in a risk assessment activity or in designing an IT function.
Cloud Risk
ISACA Journal Article

Cloud Risk—10 Principles and a Framework for Assessment

Cloud Risk 10 Principles and a Framework for Assessment. Reviews cloud assessment road map of four principles: vision, visibility, accountability & sustainability.
Database Backup
ISACA Journal Article

Database Backup and Recovery Best Practices

Database data files should be backed up during cold backup as well as during online backup, using Oracle's Recovery Manager (RMAN) or, in Oracle Database.
privacy
ISACA Journal Article

Social Networks and Privacy—Threats and Protection

ISACA identifies, based on the motivations of Internet users visiting social networks, the risk of violating users’ privacy, and to analyze and evaluate the effectiveness of the control methods used.
Governance
ISACA Journal Article

JOnline: 10 Key Rules for Using the ITIL Framework Effectively

This article shares some of the practical challenges in IT service management (ITSM) and how the ITIL framework can be used to overcome those challenges.

Cloud Computing
ISACA Journal Article

Cloud Computing as an Integral Part of a Modern IT Strategy

Cloud Computing as an Integral Part of a Modern IT Strategy. Describes real cloud computing project case studies & important strategic decisions for IT managers.
audit and assurance
ISACA Journal Article

Project Portfolio Management

A program or project portfolio explains how an organization is implementing its strategy with projects. If product management answers the question “Are we managing the projects correctly?,” then project portfolio management answers the question “Do we have the right projects?”
Privacy
ISACA Journal Article

Fundamental Concepts of IT Security Assurance

Government and commercial organizations rely heavily on the use of information to conduct their business activities.

Data Transfer
ISACA Journal Article

Testing Controls Associated With Data Transfers

There are several IT-related functions that inherently have a rather high degree of risk. Some of those include custom application development, logical access and data transfers. The latter has been growing in volume and risk recently.
Auditing applications
ISACA Journal Article

Auditing Applications, Part 1

Auditing Applications Part 1. This two-part article describes one framework for performing effective audits of framework, plan, & objective applications.
Audit
ISACA Journal Article

Evaluating Access Controls Over Data

Evaluating Access Controls Over Data. This article offers some basic guidance to IT auditors in evaluating the access controls over relevant data files.
Risk Management
ISACA Journal Article

Information Risk Management for Supporting a Basel II Initiative

Effective January 2008, Basel II stipulates the minimum capital requirements that financial institutions must possess in order to manage their risks.
Governance
ISACA Journal Article

Key Issues, Challenges and Resolutions in Implementing Business Continuity Projects

Business continuity management (BCM) is a holistic process to ensure uninterrupted availability of all key business resources required to support critical business activities, whether manual or IT-enabled, in the event of business disruption.

Podcast
Podcast

Growing a Cybersecurity Career: Questions for the Job Interview

All job seekers, but especially those in cyber, should try to work for an organization that supports their professional growth. In this podcast, we discuss some questions to ask on a job interview to help you determine the growth potential of a role and if you can thrive at that enterprise.

11 December 2018
Governance
ISACA Journal Article

Data Integrity—Information Security’s Poor Relation

Data Integrity Information Security's Poor Relation. GIGO - Data governance needs the same degree of attention as IT governance for weak link risks.
Governance
ISACA Journal Article

JOnline: Identity and Access Management—Its Role in Sarbanes-Oxley Compliance

JOnline Identity and Access Management Its Role in Sarbanes Oxley Compliance. Article aims at simplifying the IAM & uncovering roles in Sarbanes-Oxley 404 compliance.
Backup and Recovery
ISACA Journal Article

What Every IT Auditor Should Know About Backup and Recovery

What Every IT Auditor Should Know About Backup and Recovery. Explains effective backup & recovery plans to provide guidance for conducting an IT audit.
audit and assurance
ISACA Journal Article

A Framework for Estimating ROI of Automated Internal Controls

Organizations are information-driven and operate in an interconnected economy. With increasing automation of critical business processes, information has become the lifeblood of any business.
audit and assurance
ISACA Journal Article

Auditing IT Risk Associated With Change Management and Application Development

Auditing IT Risk Associated With Change Management & Application Development. Provides the IT auditor with techniques to mitigate the risk associated with AppDev.
Audit
ISACA Journal Article

IT General and Application Controls: The Model of Internalization

IT General and Application Controls The Model of Internalization. Implementing in-house ITGC/ITAC for auditors to improve their knowledge for build IT governance.
Risk Governance
ISACA Journal Article

The Three Lines of Defence Related to Risk Governance

The Three Lines of Defence Related to Risk Governance. Challenge is aligning expectations & perceptions of risk governance & the senior risk committee.
governance
ISACA Journal Article

Analyzing IT Value Management at KLM Through the Lens of Val IT

Analyzing IT Value Management at KLM Through the Lens of Val IT. Provides insight to practitioners on how to introduce better value management approaches.
Cloud Computing
ISACA Journal Article

IT Governance and the Cloud: Principles and Practice for Governing Adoption of Cloud Computing

IT Governance and the Cloud - Principles and Practice for Governing Adoption of Cloud Computing. Strong governance & control are an essential part of cloud transition.
Governance
ISACA Journal Article

The Impact of Governance on Identity Management Programs

The Impact of Governance on Identity Management Programs. IDM has the potential to affect processes as roles, identities, & access to information security.
COBIT 5
Case Study

Maitland Utilizes COBIT to Improve ICT Governance

Increasing business oversight and accountability for the information and communication technology (ICT) asset is a cornerstone of Maitland’s future ICT governance state.

15 July 2011
Cloud Computing Risk Assessment
ISACA Journal Article

Cloud Computing Risk Assessment: A Case Study

Cloud Computing Risk Assessment A Case Study. This case study represents a one-time attempt at risk assessment of the cloud computing arrangement.
audit and assurance
ISACA Journal Article

Planning for and Implementing ISO 27001

Planning for and Implementing ISO 27001. An organization certified against the ISO 27001 standard helps to provide confidence to their customer base.
Information Security
ISACA Journal Article

JOnline: An Introduction to Information Security Incident Management Based on ISO/IEC TR 18044:2004

Incident management can be considered the emergency operations part of risk management. Poorly managed incidents have the capacity to become unmitigated disasters unless effectively managed.
Effective Security Awareness Training
ISACA Journal Article

JOnline: Impact of Security Awareness Training Components on Perceived Security Effectiveness

JOnline Impact of Security Awareness Training Components on Perceived Security Effectiveness. Help organizations implement effective security awareness training.
Questions for a Successful IFRS Implementation
ISACA Journal Article

Questions That Must Be Addressed for a Successful IFRS Implementation

For IT auditors and IT professionals, IFRS should be a priority because the demand will be high for those with technical knowledge to interpret and translate IFRS into IT requirements.
Audit
ISACA Journal Article

Understanding and Applying Benford’s Law

Understanding and Applying Benford's Law. Article describes what Benford’s Law is, when it could apply, & what constraints to consider applying to an IT audit.
Understanding the New SOC Reports
ISACA Journal Article

Understanding the New SOC Reports

With the transition from Statement on Auditing Standard (SAS) No. 70 reports to the new Service Organization Controls (SOC) reports, this issue’s column describes these reports to provide an understanding of them, and to explain the differences among them in order to prepare CISAs for the changes ahead.
What is the Value of Security
ISACA Journal Article

What Is the Value of Security?

What Is the Value of Security? Security professionals should state the worth of their contribution in monetary terms to establish the rationale for their activities.
Governance
ISACA Journal Article

An Introduction to ICT Continuity Based on BS 25777

Disruptions to ICT can constitute a strategic risk, damaging the organization’s ability to operate and undermining its reputation.
Risk Management
ISACA Journal Article

IT Scenario Analysis in Enterprise Risk Management

IT Scenario Analysis in Enterprise Risk Management. Scenarios will not provide all the answers, but help executives ask better questions & prepare for risk.
Guide to Career Success Using Soft Skills
ISACA Journal Article

A Young Professional’s Guide to Career Success Using Soft Skills

A Young Professional’s Guide to Career Success Using Soft Skills. This article examines the importance of soft skills & interview techniques for career success.
Auditing Security Risks in Virtual IT Systems
ISACA Journal Article

Auditing Security Risks in Virtual IT Systems

Virtualisation is a software technology that divides a physical resource, such as a server, into virtual resources called virtual machines (VMs).
Digital Records Management
ISACA Journal Article

An Introduction to Digital Records Management

The main objective of this article is to introduce the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition of records in an electronic environment, based on international standards ISO 15489.
Data Governance for Privacy
ISACA Journal Article

Data Governance for Privacy, Confidentiality and Compliance: A Holistic Approach

It is important to point out that the proposed approach to data governance for security, privacy, confidentiality and compliance does not call for modifying or replacing the organization’s existing information security management systems or IT governance processes.

IT Risk Management
ISACA Journal Article

Use of the Balanced Scorecard for IT Risk Management

Risk management, in its essence, is subjective. Though it is a structured approach to determine whether to accept, mitigate, transfer or avoid a risk, it is based on a subjective assessment of the business impact of the exercise on organizational vulnerability.
Risk Assessment
ISACA Journal Article

An Approach Toward Sarbanes-Oxley ITGC Risk Assessment

The US Sarbanes-Oxley Act is an old bandwagon for most of the publicly listed companies, as they have been riding on it since its inception in 2002. But, most companies face newer challenges every day with the birth of newer technology, rapidly changing business conditions, and/or mergers and acquisitions.
Giving Sustainability to COBIT P09
ISACA Journal Article

Giving Sustainability to COBIT PO9

This example shows one of the benefits that COBIT’s management guidelines bring when a decision has to be made about the scope of applicability of a particular process—in this case, PO9.
IT Risk
ISACA Journal Article

Mitigating IT Risks for Logical Access

Unauthorized access can lead to devastating effects. Entities can become victims of malicious activities such as identity theft, financial fraud, theft of data and attacks on systems, which can be especially harmful for online businesses.
Achieving Data Warehouse Nirvana
ISACA Journal Article

Achieving Data Warehouse Nirvana

Successful organizations expand the scope of information controls beyond the scope of the data warehouse by developing a companywide program for ensuring the enterprise information quality.
Using Microsoft Office in Analyzing SAP SoD and Beyond
ISACA Journal Article

JOnline: Using Microsoft Office in Analyzing SAP SoD and Beyond

Evaluating SoD in a business application system is important when evaluating SoD in interrelated processes. Learn how to use Microsoft Office in analyzing SAP SoD.
Synthesizing SAS 70 Audits
ISACA Journal Article

Synthesizing SAS 70 Audits and PMI’s Project Management Process Groups

All projects at some point will come under fire, and in an uncertain economy, increased pressures to derive optimal value emphasize the need to deliver project success.
Cloud Computing
ISACA Journal Article

IT Audits of Cloud and SaaS

Auditing cloud computing in one sense is like auditing any new IT—understand the IT, identify the risks, evaluate mitigating controls and audit the risky objects.
audit and assurance
ISACA Journal Article

Business Skills for the IT Audit and Assurance Professional

IT audit and assurance professionals bring valuable skills to audit, assurance and advisory assignments providing a perspective of technical issues, concerns, problems and solutions.
privacy
ISACA Journal Article

Top 10 Security and Privacy Topics for IT Auditors

IT auditors are reviewing their audit scope to ensure that the key risks facing the organization are being addressed. The following 10 topics should be on every IT auditor’s list for 2010-2011.
Risk Management
ISACA Journal Article

Developing an Information Security and Risk Management Strategy

Developing an Information Security and Risk Management (ISRM) strategy is a critical element in the maturation of information security capabilities. Learn more today!
Application Security
ISACA Journal Article

JOnline: Application Security Using the Role-based Access Control Model

Proper RBAC model implementation provides adequate controls that will minimize the risk of continuous occurrence of security breaches and privacy violations from the inside.
Governance
ISACA Journal Article

Availability Risk Assessment—A Quantitative Approach

Increased corporate governance requirements are causing enterprises to examine their internal control structures closely to ensure that controls are in place and operating effectively.
Governance
ISACA Journal Article

Criteria and Methodology for GRC Platform Selection

GRC platforms provide a single, federated framework that integrates organizational processes and tools, supporting those processes for the purpose of defining, maintaining and monitoring GRC.
Multivendor Outsourced IT Environment
ISACA Journal Article

Environment JOnline: Service Integration in a Multivendor Outsourced IT Environment

The combination of the guardian role and the CSPs applies the principle of having a single point of accountability for any activity, ensuring accountability and responsibility.
Test Accounting Data
ISACA Journal Article

Using Spreadsheets and Benford’s Law to Test Accounting Data

Accounting systems are popular targets of financial frauds because, in the words of bank-robber Willie Sutton, “that’s where the money is.”

Performing a Security Risk Assessment
ISACA Journal Article

Performing a Security Risk Assessment

The enterprise risk assessment methodology has become an established approach to identifying and managing systemic risk for an organization.

A vibrant blue light wallpaper with lines of code

The Link Between Data Sovereignty and Digital Identity

Data ownership is the foundation of data sovereignty. It requires clear and demonstrable attribution.

Author: Luigi Sbriz
Poonan Gupta
Risk Article

The Risky Business of Bots

There are numerous use cases across enterprises where the deployment of bots has resulted in improved efficiency and reduced costs.

8 November 2022
Industry Spotlight Podcast
Podcast

Foco de la industria - Arnulfo Espinosa Dominguez, Parte II

El vicepresidente del Capítulo Monterrey de ISACA y Director de Auditoría y Fraude de TI de uno de los Grupos Financieros más grandes de México, Arnulfo Espinosa Domínguez, se une a Jocelyn Alcantar de ISACA para compartir muchas cosas que ha aprendido durante sus 20 años de experiencia profesional en la industria.

23 September 2022
Industry Spotlight Podcast
Podcast

Foco de la industria - Arnulfo Espinosa Dominguez, Parte I

El vicepresidente del Capítulo Monterrey de ISACA y Director de Auditoría y Fraude de TI de uno de los Grupos Financieros más grandes de México

21 September 2022
Thomas Lenzenhofer
Security Article

The Impact of People on Today’s Information Security Landscape

There is much written about long lists of cybersecurity problems (most of which practitioners may already be aware) or even potential solutions, so perhaps it is beneficial to take a moment to reflect on how the state of information security has changed over the years.

22 April 2022
Jouke Albeda
Blog Post

Understanding Third-Party Management

Outsourcing IT to a platform as a service (PaaS) is incredibly popular with organizations that want to focus on other essential business processes.

5 October 2021
Embedding Security and Continuity Culture

Embedding Security and Continuity Culture

Even when an organization implements good policies, procedures, security setups and standards accreditations, without an organizationwide, positive information security and business continuity (IS&BC) culture, low effectiveness can be expected.

Author: Samuel Shanthan
j21v1-Reskilling

Reskilling Internal Audit

So much has changed in 2020 for internal audit teams. The COVID-19 pandemic has forced teams to adopt new ways of working, caused change in the risk profiles of the organizations they serve and, for many, has resulted in pressure on resources that...

Authors: Kevin M. Alvero and Stefanie Sullivan
Language: 日本語
El rol de riesgos en época de COVID-19, cambiando la forma de trabajo a una versión “agile”
ISACA Journal Article

El rol de riesgos en época de COVID-19, cambiando la forma de trabajo a una versión “agile”

Desde el Lunes 16 de marzo del 2020, Perú viene afrontando una cuarentena obligatoria designada por el Gobierno, a raíz de la pandemia mundial por COVID-19, lo cual ocasionó que se declare “Estado de Emergencia” a nivel nacional.

Author: Pierina Guizado
Avoid Having to Run Somewhere From Ransomware, Part 2
ISACA Journal Article

Avoid Having to Run Somewhere From Ransomware, Part 2: Top 10 Steps to Stay Protected

Ransomware can be defined as a malware deployed for the specific purpose of denying access to a victim’s systems and/or files until something of value is exchanged. The primary motivating factor for most ransomware attacks is clearly in the name, a ransom. Part 1 of this article series reviewed several prominent examples of the damage caused by recent ransomwares attacks...

Authors: Syed Ishaq and Faizan Mahmood
Avoid Having to Run Somewhere From Ransomware, Part 1
ISACA Journal Article

Avoid Having to Run Somewhere From Ransomware, Part 1: Understanding Ransomware and the Criminals Who Spread It

An average of 4,000 ransomware incidents occur daily in the United States at an annual cost of US$1 billion. The number of ransomware attacks more than doubled in 2019, with the average payment per incident coming in at US$41,198 (up from US$6,733 in 2018). Insurance companies are forecasting...

Authors: Syed Ishaq and Faizan Mahmood

Article Sources

ISACA is the thought leader on security, risk, governance, privacy and audit. We've created these offerings below to get you the information you need.

Illustration of a blog post ISACA Now Blog
Illustration of microphone and sound wave Podcasts
@ISACA Newsletter @ISACA
hand on a tablet - Industry News Industry News
ISACA Journal ISACA Journal