-
01 Dec 2011You’re in charge of your own crisis
Whether or not you - or your management - believes you'll suffer a security incident it certainly pays to be prepared. Odds are that something is going to occur.Does your business have a solid incident response plan? What about a communications plan? Is an executive or business PR representative going to say "Um, well, uh you know - we got hacked and stuff..." to the eager media or are they ...
Continue Reading... -
29 Nov 2011
HDMoore’s Law, revisited
Here's a good read by Mike Rothman (@securityincite) on how we tend to bury our heads in the sand over the most obvious things including HD Moore's Law. For years, I've had a slide in my presentations titled "Future Trends" where I've talked about how exploits are getting easier for those with ill intent:Easier access to toolsLittle knowledge neededLess elaborate “hacks”More internal breachesMobile business → less controlGreater complexity → more ...
Continue Reading... -
27 Nov 2011
Don’t get mired striving for perfection
As we wind down 2011, here's a quote that relates to information security, incident response and overall risk management:“The person who insists upon seeing with perfect clearness before he or she decides, never decides.” -Henri Frederic AmielSo, do something to better your information security program. Any positive step forward - anything - is much better than getting mired in the desire for perfection and doing nothing at all....
Continue Reading... -
21 Nov 2011Don’t turn a blind eye on the basics
I'm all about shoring up the basics of Web security before throwing money at the situation. If you're interested in saving not only money but also time and effort, here are some new pieces I've written on Web security that you may be interested in: Explaining the why of Web application security Improving Web security by working with what you’ve got Not all Web vulnerability scans are created equal Why ...
Continue Reading... -
20 Nov 2011A new way to bleed
I was in New York City this past week for my final keynote and related presentations for our TechTarget & CDW information security roadshow. Wow, 10 cities in eight months - what a great way to end our year. Of course, being in New York I couldn't help but notice the *constant* coverage of the Occupy Wall Street protests that ended up turning a bit ugly on Thursday - the ...
Continue Reading... -
14 Nov 2011
For incidents, preparation is key…But you’ve been hacked, now what?
Here are some new pieces I've written for TechTarget and Security Technology Executive magazine on compliance that you may be interested in:Preparing for an incident at the workstation levelDevelop a Flight PlanHow to know if your website has been hacked As always, be sure to check out www.principlelogic.com/resources.html for links to all of my information security whitepapers, podcasts, webcasts, books and more....
Continue Reading... -
10 Nov 2011
Join me at the CDW – TechTarget seminars in Philly & NY next week
If you happen to be in or around Philadelphia, PA or New York City next week, I'd love it if you could join us for our TechTarget / CDW seminars: Predictive Security: Plan Ahead to Stay Ahead of the Next Threat.I'll be giving the keynote presentation and splitting the breakout sessions with Pete Lindstrom and other vendor experts. After the morning sessions and a great lunch, we'll get back together ...
Continue Reading... -
10 Nov 2011
Why compliance is a threat
Compliance as we know it is arguably one of the greatest threats to enterprise security. Here's why:It creates a heightened sense of self for those responsible for accomplishing a state of compliance.It can cost more to become "compliant" than it does to create a reasonably secure environment.It empowers government.All of the above create complacency and a false sense of security. Please tell me I'm wrong....
Continue Reading... -
09 Nov 2011
Wooo…HIPAA audits are coming & the irony of KPMG’s involvement
I've always believed that compliance is a threat to business [hence why I help businesses take the pain out of compliance by addressing their actual information security issues] and this new bit from HHS's Office of Civil Rights is no different. Apparently the HIPAA audits are coming...KPMG - an audit firm that has already proven they have trouble implementing the basic security controls they audit others against - scored a ...
Continue Reading... -
08 Nov 2011
Mobile devices are the new desktop, what to do now!?
Here are some new pieces I've written for my friends at TechTarget on mobile security that you may be interested in including a piece for TechTarget's new (I think) SearchConsumerization.com site:It's time we shift our thinking about endpoint protectionAct now to prevent smartphone security risks at your organizationCompliance officers' next big headache: Securing mobile applicationsYou know the deal, be sure to check out www.principlelogic.com/resources.html for links to all of my ...
Continue Reading...
Resources
Client Testimonials
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”
(IT managed services firm)
I’ve written/co-written 12 books on information security including one of the best-sellers of all time:
