CA Community

As reported in Dark Reading, the recent indictment of a former TSA employee is continued proof that the need to control privileged users remains paramount. The employee, Douglas James Duchack, was terminated and in the two weeks following his notice he allegedly put malware code on a database server...

Few would question the value of collaboration to speed time to completion in any number of typical business processes. New technologies and Web connectivity have fueled the growth of this dynamic marketplace. IDC estimates that SharePoint’s growth was double that of the other tier one Collaborative Content...

This week I am at the ISACA Asia Pacific Conference in Mumbai, India where Audit, Governance and Security professionals are meeting at the sold out event to share information and knowledge. One of the topics being debated are the results of the survey released by ISACA this week which identified that...

I recently ran a number of seminars in EMEA. This gave me an opportunity to talk to many large mainframe users. And as always, it gives me a pretty good idea about the current state of IT. Even more than previous years, two issues are mentioned almost every time: Cost & Complexity. And it's especially...

Cybercrime includes many things among which we enumerate the so-called “mule recruiting” issue. “Mule recruiting” is the process of recruiting “money mules,” who are people that transfer money and reship high value goods that have been fraudulently obtained in one country, usually via the internet, to...

Many agencies have a good handle on IT security, with the FISMA guidelines spelled out in great detail. However, with the advent of the new financial stimulus packages, there is a greater impetus to streamline the process around managing financial controls. Traditionally, financial process controls and...

In my numerous discussions with clients, I tend to find a recurring theme of organizations attempting to bridge the gap between business policies tied to regulations and security controls through a process called “The Policy Lifecycle.” The origin of this lifecycle starts with any number of groups that...

On Jan 4, 2010, the RSA division of EMC announced the acquisition of Archer Technologies, a privately-owned GRC provider based in Kansas. The press release can be found here . Although an unexpected move, this acquisition is very understandable considering the market position of EMC/RSA and Archer. EMC...

I have spoken before on the issues of compliance and the cloud, and recently two of the big “kahunas” of security and compliance have published white papers on the topic. The first is an ISACA paper: “ Cloud Computing: Business Benefits with Security, Governance and Assurance Perspectives ." This...

If you haven't downloaded the December 2009 version of the Cloud Security Alliance's publication, Security Guidance for Critical Areas of Focus in Cloud Computing V2.1 , I encourage you to do so. It is a worthwhile read and more importantly a good reference as you are called upon to provide security...