Patch Your Internet Router/Gateway!
Just a friendly fyi... if you're running an Internet router/gateway from Asus or Linksys, please make sure that you've updated the firmware recently! In some ways, this strikes me as another example of attacks on the Internet of Things (IoT). If you've been following IoT attack trends, then you may have read about the possibility that a refridgerator may have be found sending out spam.
RSAC 2014: Buyouts and Boycotts and Allegations, Oh My!
Unless you've been living under a rock, you've undoubtedly heard about the various revelations from the Snowden files, with which he absconded from the NSA. In a [Reuters article] last year it was alleged that RSA - the namesake and official owner of the RSA Conference (RSAC) - had accepted a single payment from the NSA to prominently place a flawed algorithm into their BSAFE crypto library (read more here). RSA has denied those allegations.
Rebooting the GRC Space
He's been talking about it for almost a year now, and this week we are starting to see some of the progress from the effort. For those of you who have followed the GRC (governance, risk management, and compliance) space, you'll know that it's a bit of a nightmare. It's been sub-divided, historically, between "IT GRC" and "EGRC" ("E" being for "enterprise"). There are also a couple other potential categories, like "Legal GRC" and "Financial GRC," but those have been far less prominent.
New Research on IT Risk Assessment and Analysis Methods
I'm pleased to announce that our new paper, "Comparing Methodologies for IT Risk Assessment and Analysis," is now available to Gartner for Technical Professionals subscribers! This research represents a few months of work, including many interviews with method owners and method implementers. The research process was quite fascinating and led to some unique insights.
