Steve Riley on Security

Browse by Tags

Who should do your security audits? Or, how do you organize the security department?: An interesting question came up today. The group responsible for configuring and maintaining the firewalls at a customer also believes that they should be the only ones to audit their configurations. Others in the security department are uneasy with this, Read More...
Posted 07 February 08 02:25 by Steve Riley | 2 Comments
Filed under risk mitigation, security policies, security science
What's your data worth? More importantly, to whom?: This week, I'm attending and spoke at a cybercrime conference in Singapore. One of the presenters made a very good point, and I want to share it with you. When considering how to protect your data, don't consider how valuable it might be to an attacker. Read More...
Posted 24 October 07 11:49 by Steve Riley | 5 Comments
Filed under protection, risk mitigation, security policies, security science
Why administrative passwords will never be like nuclear missile launchers: During the past few months many people have lamented that Windows lacks a nuclear missile style control option for administrator passwords. Surely you've read about or seen photographs of missile silos where two operators, separated by a distance greater Read More...
Posted 21 November 06 02:16 by Steve Riley | 11 Comments
Filed under Active Directory, authentication, passwords, physical security, risk mitigation, security policies, security science
It's time to stop playing war games in the name of "security": Really interesting article. Military mindset no longer applicable in our line of work http://searchsecurity.techtarget.com/columnItem/0,294698,sid14_gci1171862,00.html My favorite bit: "Obviously, secrecy is important to business, as is the ability to Read More...
Posted 13 March 06 10:07 by Steve Riley | 4 Comments
Filed under security policies, security science
It's me, and here's my proof: why identity and authentication must remain distinct: My February Security Management column is posted: http://www.microsoft.com/technet/community/columns/secmgmt/sm0206.mspx No matter what kinds of technological or procedural advancements occur, certain principles of computer science will remain -- especially Read More...
Posted 16 February 06 09:41 by Steve Riley | 7 Comments
Filed under authentication, biometrics, identity, passwords, risk mitigation, security policies, security science
Return on security investment: Soon I will begin a research project into quantifying and expressing return on security investment. From conversations I've had with many conference attendees, there's a need for developing a basic understanding of how to measure ROSI so that budget money Read More...
Posted 03 January 06 10:40 by Steve Riley | 16 Comments
Filed under security policies, security science