An information security assessment is the process of determining how effectively an entity being assessed (e.g., host, system, network, procedure, person—known as the assessment object) meets specific security objectives. Three types of assessment methods can be used to accomplish this—testing, examination, and interviewing. Testing is the process of exercising one or more assessment objects under specified conditions to compare actual and expected behaviors.

(more…)

MITRE ATT&CK is an open framework and knowledge base of adversary tactics and techniques based on real-world observations ATT&CK provides a common taxonomy of the tactical objectives of adversaries and their methods Having a taxonomy by itself has many valuable uses, such as providing a common vocabulary for exchanging information with others in the security community But it also serves as a real technical framework for classifying your current detection efforts and identifying gaps where you are blind to certain types of attack behaviors.

(more…)

After a year of unprecedented disaster and turbulence – the Covid-19 pandemic and economic crisis, the global outcry over systemic racism and political instability – the 2021 Edelman Trust Barometer reveals an epidemic of misinformation and widespread mistrust of societal institutions and leaders around the world. Adding to this is a failing trust ecosystem unable to confront the rampant infodemic, leaving the four institutions – business, government, NGOs and media – in an environment of information bankruptcy and a mandate to rebuild trust and chart a new path forward.

(more…)

The coronavirus (Covid-19) pandemic has changed the way many organizations operate as remote work has become the norm. However, moving from a customary office to a home-based workstation — potentially as a long-term arrangement — poses new security risks for businesses as more threat actors attempt to capitalize on Covid-19-related unease.

(more…)

The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications and APIs that can be trusted. We advocate approaching application security as a people, process, and technology problem because the most effective approaches to application security require improvements in these areas.

(more…)