Penetration Testing vs. Vulnerability Scanning: What’s the Difference?

Preparing for an audit can be one of the best ways to fund and improve your security program, but this “stimulus package” for your compliance effort typically dwindles once an organization completes or passes an audit.

A reflection on how organizations lean on technology products as a cure-all for security problems they don't understand, buying standardized solutions that create a false sense of security.

Security metrics fall into effort, result, and environment types—from training hours to days since the last breach. Tracking them proves program value and helps justify budgets to leadership.

Do you know about ALL of the systems on your network? If so, you’re in the minority.

Integrating security checks and balances with your application development processes is certainly uncharted territory for many security professionals.

I attended the PCI-SSC community meeting this past week (September 22-24). There were three key issues discussed that showed that the PCI program is maturing and that a number of standards and regulations are converging (both in and outside the PCI world).