The Department of Homeland Security, which missed meeting last week's deadline for submitting a new cybersecurity strategy to Congress, could be months away from providing lawmakers with that policy, a top DHS cybersecurity official says.
Google has run out of patience with Symantec's digital certificate business. It has outlined a plan that over time will have its Chrome browser reject all of Symantec's existing digital certificates and force all of its future certificates to be reissued every nine months.
With the rapid changes in the threat landscape and the risks introduced by DevOps, the cloud and other new elements, organizations need to have a continuous vulnerability assessment program as a security baseline, says Richard Bussiere of Tenable Network Security.
Cloud services firm Coupa is one of the latest business email compromise victims, after a fraudster pretending to be its CEO faked out the HR department and stole all of its 2016 employees' W-2 forms. Security experts say rigorous training remains the only viable defense.
A federal watchdog agency review of the Massachusetts Medicaid information security program identified weaknesses that appear to be common at government agencies as well as healthcare organizations. What key vulnerabilities were identified?
Historically, the only way organizations could come close to capturing high-fidelity data about what's happening on their network was to invest in a packet capture system.
That's so yesterday.
Full packet capture systems were never designed to facilitate the detection or investigation of advanced threat actors....
In this white paper, Fidelis Cybersecurity will outline key steps to take in the first 72 hours of detecting an alert, how to distinguish what type of incident you are facing and the key differences on how to respond. Based on our firsthand experience, we provide lessons learned from the front lines to explain why it...
An important theme that emerges from the HHS Office for Civil Rights' dozens of HIPAA settlements is that all aspects of compliance are critical and subject to close scrutiny by federal regulators, says former OCR director Leon Rodriguez.
FBI Director James Comey worries about data corruption, and he's focused on hackers altering data. But if government leaders feed false information into computer systems, what should IT and IT security practitioners do to protect data integrity?
Security product testers have architectured their test suites to adhere to the technologies of the past 10 years. However, as endpoint security and the threat landscape continue to evolve, so must testing suites evolve as well. Advanced methodologies and a more robust testing criteria are essential to keep...
The latest version of the Trump administration's draft cybersecurity executive order would direct the federal government to take a risk-based approach to IT security and hold agency heads responsible for the security of their organizations' IT assets.
Certification and accreditation (C&A) has been like alphabet soup. As it transitions to assessment and authorization (A&A), it's time to sort through the confusion and identify which terms and processes apply in any given situation.
This paper sorts through the confusion to identify which terms, approaches, and...
The exploitation of known, but unmitigated, vulnerabilities is the primary method of compromise for most threats since attackers are able to easily and cost-effectively leverage existing vulnerabilities for effective and profitable outcomes. It's time to align your vulnerability management priorities with the biggest...
Karl West, CISO of Intermountain Healthcare, and Mike Nelson, vice president of healthcare solutions at DigiCert, provide an analysis of the FDA's recent guidance on cybersecurity for medical devices. They'll also be speaking on that topic at the HIMSS 2017 Conference in Orlando, Fla.