Ponemon Institute has issued its annual report on the cost of data breaches. I wrote last year about using per record costs for data breaches. An excerpt: It is common when estimating costs of data breaches to quote costs “per…
Economics and Risk
Addressing the Advanced Persistent Threat (APT)
by Pete Lindstrom • • Comments Off
In the past few weeks, the Advanced Persistent Threat (APT) has been all the rage in the infosec world. Security professionals everywhere are taking sides about whether APT is new or not, despite (or perhaps due to) the lack of…
Quick and Dirty Risk Calculations – CSI Survey Edition
by Pete Lindstrom • • Comments Off
The Computer Security Institute recently released its 2009 survey results (must register). One of the charts in the executive summary lists the frequency of occurrence in the survey population. Without any other information more pertinent or specific to your organization,…
Should we change passwords every 90 days?
by Pete Lindstrom • • 1 Comment
[I was unsuccessful trying to post this as a comment on the Securosis blog so figured I'd post it here instead.] David Mortman at Securosis recently posted with the following challenge: Show me any reasonable evidence that changing all your…
ENISA Cloud Computing Security Project
by Pete Lindstrom • • Comments Off
Today, the European Network and Information Security Agency (ENISA) released its Cloud Computing Risk Assessment report. I enjoyed participating on the project and making a number of new friends. As with most workgroups, this project had its ups and downs…
Confirmation Bias at work?
by Pete Lindstrom • • 2 Comments
Evan Schuman has an intriguing blog post on the McAfee blog about whether the reduced number of data breach reports at DataLossDB.com are indicative of fewer actual data breaches. His answer is unequivocally “No.” His reasoning is as follows: Media…