Articles In Security

By Nancy Rand, Posted in Security

The PCI Council has published a series of blogs on payment data security as part of their task force for small merchants.  Topics include: Back-to-Basics: Think Before You Click Back-to-Basics: Properly Configured Firewalls Back-to-Basics: Secure Remote Access Back-to-Basics: Use Strong Encryption Back-to-Basics: Keep Software Patched Back-to-Basics: Use Strong Passwords Back-to-Basics: Reduce Where Payment Data Can Be Found PCI SSC Shares Resources for Navigating Changing Payment Environmen... read more.

• September 08, 2021

By Nancy Rand, Posted in Infrastructure, Security

On August 5, 2021, the PCI DSS Council and the Cloud Security Alliance (CSA) issued a joint statement on the importance of cloud scoping. https://www.pcisecuritystandards.org/about_us/press_releases/pr_08052021 https://www.pcisecuritystandards.org/pdfs/PCI_Cloud_Security_Alliance_Cloud_Bulletin.pdf Best practices focus areas are discussed: Data protection, Authentication, Systems management, DevOps & DevSecOps, Data governance and Resiliency. These best practices are important to the security of clou... read more.

• September 02, 2021

By Ed Bratter, Posted in Infrastructure, Security

One of the benefits of Microsoft 365 is the ability for users to collaborate and share with co-workers, clients, vendors, partners, and people external to the organization. This benefit, however, comes with a downside; users can either purposely or inadvertently expose information that the organization would not want shared externally.   To complicate matters, newly established tenants leave the door wide-open for publishing data to external entities. As a result, users can share data with outside ind... read more.

• July 27, 2021

By Timothy Karl, Posted in Infrastructure, Security

With anti-malware scanning software it is very important to have the proper malware exclusions in place. A misconfiguration of these settings may lead to performance issues which can may cause outages of critical applications and services due to file contention and locking. IT administrators need to find a balance between a malware-free environment and affecting the reliability and performance of any applications or services. Anti-malware exclusions can come from a variety of sources. Each anti-malwar... read more.

• July 02, 2021

By Ken Phelan, Posted in Security

In response to a growing number of serious cyber threats and incidents, President Biden has issued an Executive Order (EO) regarding improving the nation’s cybersecurity. I don’t personally read a lot of EOs, but I read this one, and if you’re part of the cyber industry, you probably should too. Given that you probably won’t, I’ll do some summarizing for you. There’s stuff about cooperation and standards, but I’d like to draw your attention to the EO’s requir... read more.

• May 24, 2021

By Nancy Rand, Posted in Infrastructure, Security

The Cloud Security Alliance released two new research documents to provide guidance on Cloud Incident Response and Consuming and Providing APIs. https://cloudsecurityalliance.org/artifacts/cloud-incident-response-framework/?utm_source=email https://cloudsecurityalliance.org/artifacts/security-guidelines-for-providing-and-consuming-apis/?utm_source=email Cloud Incident Response provides a framework for handling the lifecycle of a security incident in the cloud and discusses what information is shared inte... read more.

• May 18, 2021

By Nancy Rand, Posted in Security

The PCI Security Standards Council, PCI SSC, published a new version of the Secure Software Standard and its supporting program documentation on 4/29/2021. https://www.pcisecuritystandards.org/about_us/press_releases/pr_04292021 This version includes a new Terminal Software Module that contains requirements for software used on PCI-approved PIN Transaction Security (PTS) Point-of-Interaction (POI) devices. There are currently two other modules in this Standard: The “Core” module that contai... read more.

• May 18, 2021

By Monica Jimenez, Posted in Infrastructure, Security

The combinations of authentication apps and thin clients are endless nowadays. With the many different types of technologies out there though, not every combination has been documented. At a recent customer engagement, there was a combination of products that isn’t very common, at least not yet, being implemented in an IGEL environment.  Customer Environment: IGEL devices on firmware 11.04.250.01 using the built-in default Citrix Workspace client are deployed within an environment configured fo... read more.

• March 02, 2021

By Nancy Rand, Posted in Security

The Cloud Security Alliance released their latest version of the Cloud Control Matrix (CCM) on 1/20/21. It is available from their website after answering a few questions. The mappings to Scope Applicability, Architectural Relevance, Corporate Governance Relevance, Cloud Service Delivery Model Applicability, Supplier Relationship, are not yet available, but the CSA has released the matrix to assist organizations to prepare to upgrade to version 4. https://cloudsecurityalliance.org/research/cloud-controls-m... read more.

• January 22, 2021

By Nancy Rand, Posted in Security

When preparing to securely work from anywhere, it is tantamount that a zero trust policy be adopted. Locations and assets are not to be inherently trusted. A system of policies and software are needed to protect from malicious intent.  In August 2020, NIST published SP 800-207, the final version of their Zero Trust Architecture. It is available for download from: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf The tenets of zero trust are presented in section 2.1. They are... read more.

• October 05, 2020