BE - 2008 Survey on the IT Business Balance - Deloitte

A recent survey by Deloitte shows a remarkable lack of coordination between the CEOs and CIOs of companies when it comes to aligning IT and Corporate strategy and managing IT related risks. There's a question as to whether this reflects a lack of awareness of CEOs, which seems difficult to believe, a lack of priority, which may be more probable, or a hesitancy of IT departments to share all the risks with the CEO (quite plausible). BE - 2008 Survey on the IT Business Balance - Deloitte

Google Employees Warned Of Data Breach At Benefits Company -- Privacy -- InformationWeek

Another potential privacy breach related to outsourced data has reared its head. Google has reported that computers were stolen from its benefits administrator, along with sensitive data pertaining to its employees prior to 2005. The nature and amount of data is sufficient to make identity theft a real threat. This and other cases of the loss of outsourced data means tha IS Auditors must focus on large outsourcing contracts and identify the risks and analyze the safeguards in place to mitigate those risks. Google Employees Warned Of Data Breach At Benefits Company -- Privacy -- InformationWeek

Standards Documents Under Exposure

An update of the ISACA Auditing Guideline "Business-to Business E-Commerce Reviews" is up for exposure at the following link. The draft reflects several changes and comments are due by July 31, 2008. Standards Documents Under Exposure

The Six Best Practices of IT Security

Management of Systems Security is one of the basic and most important functions of risk mitigation. This article provides a pertinent summary of the essentials. It places an importance on Applications Security, pointing out that a number of the threats come from this source. The Six Best Practices of IT Security

Information Security Career Progression Survey Results

ISACA has released the results of a survey of the job responsibilities and career progression of those holding its Certified Information Security Manager (CISM) designation. The report provides an illuminating picture of the changing role of information security in organizations. While once viewed as an outgrowth of, and driven by, technology, the survey shows that information security is now driven by business needs, and by general business strategy. Information Security Career Progression Survey Results

IBM Systems Journal | Vol. 47, No. 2, 2008 - Real-Time and Event-Based Systems

The latest issue of the IBM Systems Journal deals with real time and event based systems. These are more common and present some real issues from an Assurance viewpoint. For example, are programmed response systems set up to respond to the right events, and in the right way? Are they able to recognize those events and interpret them properly? These can be technical issues with very practical implications. IBM Systems Journal Vol. 47, No. 2, 2008 - Real-Time and Event-Based Systems

Six hours to hack the FBI (and other pen-testing adventures)

Penetration testing - or ethical hacking - is often a good way for enterprises to test their security and to find unknown threats to their system. This article recounts some experiences of an experienced "pen-tester". The CICA's Information Technology Advisory Committee released a white paper on penetration testing in 2003 which is available for free download at www.cica.ca/itac. The white paper is called Using an Ethical Hacking Technique to Assess Information Security Risk. The article is at: Six hours to hack the FBI (and other pen-testing adventures)