Aberdeen Group:Making Progress in PCI Compliance: Assessing Risk

"Aberdeen research has shown that Best-in-Class companies conduct vulnerability and risk assessments more frequently and more broadly than their Industry Average and Laggard counterparts. They also prioritize and remediate the most critical vulnerabilities found as a result of assessment scans more quickly, reducing their window of exposure for security issues by a factor of 1.7. Aberdeen's June 2008research on PCI DSS and Protecting Cardholder Data revealed that Best-in-Class organizations are between 40% and 90% more likely than lagging companies to conduct regular vulnerability and risk assessments for all system components in their card processing environment, as part of a sustainable approach to assessment, prioritization, remediation, and management." Aberdeen Group:Making Progress in PCI Compliance: Assessing Risk

Technology Review: Internet Security Hole Revealed

A researcher has discovered a flaw in the domain name system that could open the way for a greater incidence of fraud, including more effective phishing attacks. It's yet another area where IS professionals need to be aware. Technology Review: Internet Security Hole Revealed

globeandmail.com: Hackers mull physical attacks

The advent of powerful smart phones that can tap into wireless networks pose a security risk for companies. They can even be used as a sort of trojan horse, placed within a company secretly to check out its networks. If any of them are unsecured, look out! Once again, it points to the need to ensure that all wireless networks are encrypted. globeandmail.com: Hackers mull physical attacks

Laying the Foundation for ERP Implementation Success

ERP implementation has long been a minefield for trouble, and experience has shown that good control practices can make all the difference. Internal auditors can help in this area, and this article outlines how this is so. Laying the Foundation for ERP Implementation Success

BE - 2008 Survey on the IT Business Balance - Deloitte

"Today, CEOs are still insufficiently aware of the added value of strategic cooperation with the IT department in optimally gearing the IT strategy to the business strategy and managing business risks, such as safety, fraud and privacy. This is one of the remarkable findings of Deloitte’s yearly IT Business Balance Survey." The survey is available at the following site. BE - 2008 Survey on the IT Business Balance - Deloitte

SEC: Ex-CFO Used Spreadsheets for Fraud - Accounting - CFO.com

Spreadsheets are used extensively in business - so extensively that they have become a normal part of many organizational information systems. However, control over spreadsheets is particularly problematic because they can be easily manipulated by a single user, and often there are no controls over what the user does to a spreadsheet. In a recent fraud case, the former CFO of a company used spreadsheets to hide his manipulations intended to support false balances he had created in the records. He used white fonts and hidden rows to conceal his entries. It reminds us of a need not only to tighten controls over spreadsheets, but more importantly to limit their use in an information system. If spreadsheets are being used too much, then it means there is a shortcoming in the formal IS software that needs to be addressed. SEC: Ex-CFO Used Spreadsheets for Fraud - Accounting - CFO.com

YouTube - CISA AUdit Process 1 - 2 p2

Here's a video on developing secure systems which covers a lot of good points. YouTube - CISA AUdit Process 1 - 2 p2