Collaborate Disseminate
I am looking to know the best strategies to select the best MSSP solution provider. What things should we keep in mind while evaluating the best provider? How do develop the scoring matrix for the selection?
Continue reading Strategy to select best MSSP for my company [closed]
Please assume the following in responding:
Data being passed to vendor is subject to data protection laws in the USA such as GLBA
Data itself resides within the United States
Switching vendors will be difficult due to tight integration … Continue reading What strategies can I use to negotiate security terms in vendor contracts for vendors in high geopolitical risk countries?
Looking for everyone’s opinion here. One of my buddies was doing a vendor security review for a company that sells different types of software. The software allows you to create 3D models for home and office design (think HGTV home improve… Continue reading Vendor Security Review. When is it overkill?
On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in Information Security Compliance Certificat… Continue reading What are the (two?) definitions of SOC?
In the IT Security team where I work, we currently use the Standarized Information Gathering or SIG tool to evaluate IT security posture of prospective 3rd party vendors. What I like about the SIG is the questions are standarized and depen… Continue reading Evaluating security controls of smaller vendors
Which vendors of network products like firewalls, routers, switches, VPN softwares and similar are likely to be free from backdoors, already built in surveillance capabilities, secretly broken encryption keys inserted by NSA?… Continue reading Network product (software and hardware) vendors independent from NSA in 2018
As an IT auditor, part of my job duties includes vendor risk assessment / conducting security due diligence.
Based on documentation obtained from the vendor, (SOC 2 report, SIG survey ) , I and several members of the team, … Continue reading How should potential (unverified) security vulnerabilities be best reported?
I’m looking at replacing my very old android smartphone. Information security is increasingly a feature that I’m looking for. As well as being slow, I don’t think I can upgrade my current handset to the latest android version… Continue reading What security features are important when buying a smartphone?
A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents – and encryption keys, of course.
As an alternative to developing a custom solution around (st… Continue reading Criteria for Selecting an HSM
As with any tools purchase part of the outcome is in how good the evaluation criteria are, so it is important to understand the criteria people might use when assessing Security static analysis tools.
Obviously the weighting on each crite… Continue reading Criteria for Evaluating Static Analysis Tools