-
13 Apr 2017Why SOC audit reports can be misleading, mobile app security gotchas, and more…
Here are some links to recent articles I've written regarding application security...if you take anything away from this, it's that you can't afford to take this part of your security program lightly. Dealing with vendors who want to push their SOC audit reports on you Explaining discrepancies in different security assessment reports Why DAST and SAST are necessary if software is solid from the get-go Nixing credential re-use across unrelated ...
Continue Reading... -
16 Sep 2015
My new content: Regulating security pros, network security, and locking down Windows
Here are some recent pieces I've written on information security that you might be interested in:Why regulating information security professionals is a bad thingYour network versus the cloud – what’s more secure?Solving major security infrastructure issues around interoperabilitySoftware-defined security: The future of network security?The biggest obstacle to securing Windows Server 2012Hidden vulnerabilities on your IIS 8 serversTighten Windows 8.1 security in five simple steps As always, my other information security ...
Continue Reading... -
18 Jul 2014
How to communicate Web security to management, must-have security testing tools, and compliance in the cloud
Check out these new pieces I've written and recorded on Web application and cloud security. If you follow the things I recommend on communication (first three links), you can absolutely transform your information security program and the way that people perceive you as an IT professional.Communicating with Management about Web Security, Part 1 - Knowing What You're Up AgainstCommunicating with Management about Web Security, Part 2 - Prioritization and Sending ...
Continue Reading... -
04 Jun 2014
More Web security vulnerability assessment, audit, and pen testing resources
I've been busy in the world of Web security testing - both with work and with writing. Check out these new pieces on the subject. I suspect I'll tick off a "researcher" or two given my business angle and 80/20 Rule-approach of focusing on the most problematic areas of Web security...Still, I hope that these are beneficial to you and what you're trying to accomplish in your organization: Key Web ...
Continue Reading... -
03 Mar 2014
Interesting sights at #RSAC 2014
I attended the RSA Conference last week...there was a lot of the same security nonsense (see my posts below) but a very good show nonetheless. You should attend next year, especially if you've never been. With 25,000+ attendees and more vendors than you can ever imagine in this space, it's a spectacle.Speaking of "vendors", one thing that struck me as interesting - what government employee was ballsy enough to use ...
Continue Reading... -
31 Jan 2014
Some stuff you need to know about Windows 8.x, Internet Explorer, BYOD/MDM, and malware removal
My goodness, I've let a lot of my articles on Windows 8, 8.1, patching, malware, and related desktop security topics stack up! Check these out:Don't ignore Windows 8 security when reviewing desktop vulnerabilitiesIT can tackle Windows configuration with a well-planned desktop auditWindows Server Update Services weaknesses you may not know about <=this is BIG, seriously!Why a Windows security scan is not enough to protect your workstationsFive steps to successful bot ...
Continue Reading... -
11 Nov 2013
My latest security content (lots of stuff on application security)
I thought you might be interested in my latest articles/tips on web and mobile application security:Why you need to pay attention to the slow HTTP attackLessons learned from a web security breachApplication security calls for a proactive approachUnderstanding the value of the OWASP Top 10 2013The Role Of An Automated Web Vulnerability Scanner In A Holistic Web Security AuditAre Obamacare’s health insurance exchanges secured? Likely not. Can software quality pros ...
Continue Reading... -
26 Apr 2013
Clueless in the cloud – think before you act
A recent Network World piece about an RSA 2013 panel that covered cloud forensics and whether or not your cloud providers will be able to come through for you in the event of a lawsuit or breach bringing some critical pitfalls of cloud computing. Two things are certain:If you're lucky enough for your business to be around for the long haul, odds are that it'll ultimately be hit with a ...
Continue Reading... -
27 Feb 2012
Live from #RSAC: Cloud computing’s got some kinks (but you knew that)
I'm attending the RSA Conference this week and just sat through a panel discussion on cross-jurisdictional issues in the cloud. It was part of the Cloud Security Alliance Summit 2012.Here's what I heard: there are tons of considerations around the management, access and even the e-discovery personal data in the cloud...lots of variables and just as many things still up in the air. I'm convinced that being an information privacy ...
Continue Reading... -
24 Feb 2012
CDW-TechTarget seminars are back this year – join me in Atlanta soon
Great news - I'll be speaking at the CDW-TechTarget roadshows again this year! Our first show kicks off in Atlanta on March 13th and then we start zig-zagging across the country every few weeks until late September. For most of the shows I'll be giving two presentations:Adapting Your Old-School Network Security Agenda to Today's New-School Security Challenges ...and:Ensuring Security Controls in an Anytime, Anywhere Access EnvironmentThere will also be vendor ...
Continue Reading...
Resources
Client Testimonials
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”
(IT managed services firm)
Kevin has written/co-written 12 books on information security including one of the best-sellers of all time:
