Filters

Article Type

Domain

Credentials

Subjects

Product Type

Level

Language

16 of 3915 Results

@ISACA Article

Five Key Considerations for Crafting Board Presentations on Information Risk and Security

Developing and carrying out effective board of director (BoD) presentations is a crucial skill for information risk and security leaders and professionals.

2 December 2024
@ISACA Article

Proven Strategies to Boost the Effectiveness of Your Cyber Assurance Function

Cybersecurity often gets a bad rap. It’s widely perceived as an endless parade of threats, incidents and breaches.

2 December 2024
Blog Post

The Role of the Chair vs. CEO

The Board Chair and CEO both have distinct responsibilities to drive ISACA forward yet extensive collaboration and communication between the two is critical.

27 November 2024
ISACA Journal Article

Data Abuse in Cyberwarfare: Dissecting the Attack Model

In cyberwarfare, data abuse is a potent weapon wielded by state actors, criminal enterprises, and hacktivist groups to achieve strategic objectives and create chaos.

Authors: Aditya K Sood and Sherali Zeadally
Blog Post

The Arrival of CMMC: Positioning Your Company for Success

The long-awaited arrival of the Cybersecurity Maturity Model Certification (CMMC) presents an opportunity for professionals to position their organizations as go-to resources for CMMC guidance and compliance.

25 November 2024
Blog Post

User Access Review Verification: A Step-by-Step Guide

Conducting a User Access Review Verification ensures that only authorized individuals are able to access an organization's key systems and data.

21 November 2024
Blog Post

ISACA Career Catalyst Stories: Chirag Joshi, Founder and CISO, 7 Rules Cyber

On his way to success as an author, entrepreneur and cybersecurity leader, Chirag Joshi has turned to ISACA for credentialing, community and thought leadership.

20 November 2024
ISACA Journal Article

Digital Age Auditing: The Synergistic Effect of Machine Learning on Auditing Practices

Machine learning (ML) is becoming a crucial asset in the field of auditing.

Authors: Kgodiso Chiloane, Fatih Isik and Eugene Zita
@ISACA Article

Top Takeaways from ISACA AI Innovation Workshop

Just as the internet created a sea change on the technology landscape, so, too will artificial intelligence.

18 November 2024
Blog Post

Adding Value with Risk-Based Information Security

It is achievable to manage multiple control frameworks at the same time, with the effort of managing only one.

18 November 2024
Governance Article

Cloud Data Sovereignty: Governance and Risk Implications of Cross-Border Cloud Storage

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

18 November 2024
@ISACA Article

Growing Cyber Defenses from Seed to System

There are many different ways to approach cybersecurity. One of the most effective ways to critically approach cybersecurity is by leveraging systems thinking.

18 November 2024
Blog Post

A Simplified Approach to Cost-Effectively Boost Security Around Digital Crown Jewels

Cybersecurity teams can protect their crown jewels more effectively by following a few critical steps and by collaborating effectively with business units and enterprise leadership.

14 November 2024
Emerging Technology Article

Revolutionizing CRM: How AI-Enhanced Security is Transforming Customer Data Protection

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

14 November 2024
Blog Post

Inside the Audit Committee: Roles, Responsibilities and Qualifications

Our Notes from the Boardroom blog series continues with a detailed look at the role and responsibilities of ISACA's audit committee.

13 November 2024
ISACA Journal Article

The Impact of 5G: Unpacking Security and Privacy Concerns

5G, or the fifth generation of cellular networks, is expected to transform wireless communication with features such as highspeed data transfer capability, extremely low latency, and higher connectivity.

Author: Mahmoud Mohamed
Load More
Blog Post

CrowdStrike Panel Explores Lessons Learned from Massive Outage

An ISACA conference panel dissected the massive CrowdStrike incident, dissecting what went wrong and lessons learned to help avoid similar incidents in the future.

11 November 2024
Blog Post

Machine Learning Knowledge Looms Large at a Time of Accelerated AI Transformation

New ISACA courses in machine learning will prepare practitioners to better understand the lifecycle of machine learning projects, large language models, neural networks, and more,

8 November 2024
Emerging Technology Article

Embracing the Future: The Quantum Computing Revolution Begins Now

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

7 November 2024
Blog Post

How Geopolitics Affects Cybersecurity Risk: A Primer

The geopolitical landscape can have a major impact on cybersecurity risk and provide alternate motivations for cybercriminals to the financial ones for which defenders tend to be more attuned.

6 November 2024
Blog Post

ISACA Career Catalyst Stories: Tatum Crisp, ISACA Auckland Chapter President

Tatum Crisp pursued ISACA chapter leadership to grow her communication and leadership skills, and the experience has paid even greater dividends than she anticipated.

5 November 2024
Emerging Technology Article

The Importance of AI Safety in Customer Experience Automation

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

5 November 2024
@ISACA Article

EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners

While the adoption of artificial intelligence (AI) can help enterprises operate more efficiently, there is significant risk associated with it, including lawsuits, AI misuse and biased data.

1 November 2024
@ISACA Article

Five Top Takeaways from Adam Grant’s Message to ISACA Members

Adam Grant, organizational psychologist and bestselling author, recently sat down with ISACA member and moderator R.V. Raghu for ISACA’s Member-Exclusive Speaker Series.

1 November 2024
Blog Post

The EU AI Act is Here: What You Need to Know and Do

Many different layers of compliance requirements are taken into consideration within the EU AI Act, including various AI use cases and models.

1 November 2024
Governance Article

Autopilot on Copilot: Governance Considerations and Pitfalls When Implementing Generative Artificial Intelligence

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

1 November 2024
ISACA Journal Article

Information Security Matters: Raising Standards

CSF 2.0 has a new emphasis on governance, supply chains, and smaller enterprises.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: Risk in the Shadows

Shadow IT represents a growing threat to most organizations, especially those with a digital presence.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Future Proofing With Situational Awareness

Trust professionals have a reputation for being averse to new and potentially disruptive change.

Author: Ed Moyle
ISACA Journal Article

IS Audit in Practice: Disruptive Technology—An ESG Enabler

There has never been such a promising time for technology and environmental change.

Author: Cindy Baxter
ISACA Journal Article

The Encrypted Truth is Already Out There

Quantum computing progress will alter the dependence on current classical cryptography to safeguard data and network transmissions.

Author: Eric H. Goldman
ISACA Journal Article

Clearing a Path: Anticipating Disruptive Innovation With an Eye Toward Compliance

Innovation vs. compliance is one of the trickier balancing acts that any organization must attempt.

Author: Kevin M. Alvero
ISACA Journal Article

Exploring Opportunities and Challenges: An IS Audit Perspective on Generative AI Adoption

Incorporating generative AI into IS audit engagements presents new opportunities and challenges.

Author: Rui Feng Isaac Lee
ISACA Journal Article

Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT

In the rapidly evolving digital age, enterprises are grappling with shadow IT.

Authors: Timothy D. Spivey and Timothy R. Mcilveene
ISACA Journal Article

Demystifying Quantum

Two key quantum developments have emerged in the cybersecurity space: post-quantum cryptography and quantum key distribution.

Author: Donavan Cheah
ISACA Journal Article

Securing LLMs: Best Practices for Enterprise Deployment

LLMs offer unprecedented capabilities in natural language processing, content generation, and decision support.

Author: Vaibhav Malik
ISACA Journal Article

Reassessing Risk: The Move to Third-Party Management

As global regulations evolve and reliance on third parties grows, today’s organizations find themselves navigating a complex risk environment.

Author: ISACA
Blog Post

Navigating the New Frontier: Mastering ESG Audits in Modern Business

Environmental stewardship, social responsibility and governance integrity represent three critical components of ESG audits.

31 October 2024
Audit Article

How Blockchain Technology is Revolutionizing Audit and Control in Information Systems

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

31 October 2024
Blog Post

What Type of Person Will Make a Good Cybersecurity Professional?

Beyond their technical know-how, effective cybersecurity professionals tend to have a range of other characteristics, such as adaptability, integrity and curiosity.

29 October 2024
Blog Post

Behind the Scenes with Adam Grant: The Opportunity of a Lifetime

A recent ISACA Member-Exclusive Speaker Event with Adam Grant presented new mindsets and approaches that can help professionals unlock more enjoyment and creativity in their work.

25 October 2024
Audit Article

Eight facility zones to consider while Auditing for Information, Physical, and Environmental Security Compliance

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

25 October 2024
Emerging Technology Article

Safely and Responsibly Using Emerging Health Technology

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

25 October 2025
Blog Post

Approaching Risk, Compliance and Security Through a Consistent Lens with Enterprise Training

ISACA enterprise trainer Thomas Phelps shares his perspective on how group training can help brings teams together and collectively uplevel their knowledge and performance.

24 October 2024
Audit Article

Beyond the Blockchain Bubble: Distributed Ledger Technology for a Resilient Audit Landscape

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

23 October 2024
ISACA Journal Article

Untangling the Supply Chain Web With ISO 27001

Enterprises are growing more concerned that they might be attacked via their supply chain.

Author: Hannah Hunt
Blog Post

How the Emerging Technology Landscape is Impacting Cybersecurity Audits

Embracing continuous auditing and focusing on risk-based approaches are among the ways to effectively deal with the increasing complexity of cybersecurity audits as the emerging technology landscape continues to evolve.

22 October 2024
@ISACA Article

Five ISACA Members Earn Inaugural Chair Fellowships

Five ISACA members have been designated as the inaugural recipients of the ISACA Chair’s Fellowship Award for the 2024-2025 Board of Directors term.

21 October 2024
@ISACA Article

Integrating Psychological Safety into COBIT 2019: A New Horizon in I&T Governance

In a world increasingly driven by technology, organizations must balance the need for innovation and efficiency with the well-being of their employees.

21 October 2024
Blog Post

Introducing the Chair’s Fellowship Program

ISACA's new Chair's Fellowship Program provides awardees with the opportunity to gain board leadership skills and become well-versed in best practices for a high-performing board.

21 October 2024
Blog Post

ISACA Career Catalyst Stories: Karen Franklin, Director, Compliance Analytics with Discover Financial Services

Karen Franklin, ISACA member and participant in the Mentorship Program, calls pursuing her CISA certification 'one of the most pivotal decisions' she made along her career journey.

18 October 2024
Security Article

Comparing the MITRE ATT&CK and NIST Cybersecurity Frameworks

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

17 October 2024
Blog Post

A Proactive, Continuous Approach to Automated Compliance

Automation and a compliance by design approach can empower organizations to build a more secure, compliant and efficient IT environment.

16 October 2024
Blog Post

Celebrating ISACA’s Cybersecurity Month Scholarship Recipients

Recipients of the ISACA Foundation's Cybersecurity Month scholarships share their aspirations for making their mark on the cybersecurity profession.

14 October 2024
Blog Post

Our Day in Court

ISACA prevailed in a recent court ruling, which will free up more time and resources to put the focus back where it belongs: on delivering value for members and certification-holders.

14 October 2024
Privacy Article

The Evolving World of Data Privacy: Trends and Strategies

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

14 October 2024
Audit Article

By The Importance of IS Audit: Lessons Learned from the Evergrande Crisis

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

11 October 2024
Blog Post

Is NIS2 In Danger of Becoming a Paper Tiger?

NIS2 is intended to improve cybersecurity resilience, but to reach its potential, there will need to be real consequences for organizations that are simply going through the motions.

10 October 2024
Security Article

DarkAngels Strikes Big: Record-Breaking Ransom Secured

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

10 October 2024
ISACA Journal Article

Managing Cyberrisk With the Help of GRC

Managing cyberrisk using GRC technologies can help align IT activities with business goals.

Author: Hemang Mehta
Blog Post

From Failure to Fulfillment: My Journey in Attaining the CRISC

Eight key takeaways that helped one CRISC-holder improve upon his first exam attempt and reach his goal of attaining CRISC certification.

8 October 2024
@ISACA Article

Accelerating Cybersecurity Maturity by Quantifying Risk

Organizations should embrace the benefits of modernity and avoid the assumption that they must first implement a low-fidelity qualitative risk program before transitioning to a quantitative one.

7 October 2024
@ISACA Article

Stress Levels on the Rise for Cybersecurity Professionals

Cybersecurity professionals increasingly are feeling stress, primarily in response to an escalating threat landscape, new ISACA research shows.

7 October 2024
Blog Post

Ready to Be a Board Director? Here are 12 Things You Should Know

Being an ISACA board director is much more than an honorary role, and requires expertise in a range of areas, including a strong command of global strategy.

7 October 2024
Governance Article

The Crucial Integration of CRM and Corporate Governance: A Key to Better Business Outcomes

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

7 October 2024
Blog Post

ISACA Career Catalyst Stories: Ejona Preci, CISO, Lindal Group

Ejona Preci, a Germany-based CISO, says she has met 'true powerhouses' through ISACA that have helped accelerate and enrich her career journey.

3 October 2024
Blog Post

Choosing Your Cybersecurity Path

Building a successful career in cybersecurity can be a smoother process by identifying organizations with healthy security culture, avoiding monotonous tasks, embracing continuing education and showing an ability to learn from failure.

2 October 2024
Blog Post

The Hidden Culture Crisis and Human Burden Undermining Cybersecurity Resilience

The cybersecurity industry is facing a growing internal crisis that is not rooted in technology or external threats but in the culture underpinning our current workforce.

1 October 2024
Risk Article

Navigating Risk When Transitioning to the Cloud

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

1 October 2024
Blog Post

The Importance of Establishing an Open-Source Ingestion Policy to Mitigate Threats

Open-source software can lead to many benefits while simultaneously introducing security risks, creating the need for a substantive open-source ingestion policy.

30 September 2024
Blog Post

Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel

The ISACA China Hong Kong Chapter recently featured a panel exploring how organizations can make artificial intelligence more trustworthy and more effective.

27 September 2024
Audit Article

The Evolution of Tech Assurance: Restructuring the IT Audit Function

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

27 September 2024
Blog Post

Cyber Resilience: What Shawshank Teaches Us About Security

A focus on prevention alone was not sufficient in The Shawshank Redemption and it is similarly not going to do the job in building successful, modern security programs.

26 September 2024
Blog Post

Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust

ISACA just published its Vision Paper on “Empowering Europe’s Digital Future with Cyber Resilience, Competitiveness and Digital Trust.

26 September 2024
Blog Post

Shaping the Future of Digital Trust and Cybersecurity Policy: How ISACA Contributes to the UK

ISACA’s UK Vision Paper 2024: A manifesto for bridging the UK’s digital skills gap and improving cyber resilience.

25 September 2024
ISACA Journal Article

Addressing Security Concerns in a Mobile Computing Environment

Given the sensitive nature of information stored on mobile devices, the consequences of a breach can be severe.

Author: Rachit Gupta
Blog Post

From Theory to Action: Building a Strong Cyber Risk Governance Framework

Knowing your organization's risk appetite is the first step toward effectively integrating cyber risk quantification into an organization's cyber risk governance.

23 September 2024
Blog Post

A Career Journey You Won’t Want to Miss

Joining ISACA means not only becoming better equipped to succeed in your current job, but also for future opportunities throughout your career journey.

18 September 2024
Security Article

From Hollywood to Hacking: Understanding Deepfake Scams

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

18 September 2024
Security Article

Centralized Services and Their Impact on Business Continuity

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

17 September 2024
Podcast

Addressing SAP Security Gaps

SAP systems are treated differently than many other enterprise applications from a cybersecurity perspective.

17 September 2024
@ISACA Article

Are You Technical or Non-Technical? Time to Reframe the Discussion

There is value in exploring the problematic nature of labeling someone as technical or non-technical and how this term is overly simplistic and potentially harmful.

16 September 2024
@ISACA Article

Is There a Market Failure in Cybersecurity?

There has never been a better time to be in the governance, risk and compliance (GRC) sector with ever-changing cybersecurity regulation.

16 September 2024
Blog Post

Leveraging Neurodiversity: Strategic Advantages in GRC

Recruiting and nurturing neurodiverse talent is a winning strategy for organizations looking to enhance their GRC and cybersecurity capabilities.

16 September 2024
Emerging Technology Article

Reidentifying the Anonymized: Ethical Hacking Challenges in AI Data Training

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

16 September 2024
Blog Post

Data Governance for AI: It Starts and Ends with Data

Understanding the relationship between artificial intelligence and data is critical for organizations as they increasingly leverage AI in their business operations.

13 September 2024
Blog Post

The Curious Case of the Complacent Commercial Chief: An Internal Auditor's Challenge

Internal auditors are not always met with open-minded attitudes from key stakeholders, but they can break down resistance by taking the right approaches.

12 September 2024
Blog Post

AI and Risk Management: A Strategic Guide for CIOs and CISOs in Financial Services

Artificial intelligence is having a large impact on the risk landscape in the financial sector, underscoring the need for AI governance frameworks and thorough AI risk assessments.

11 September 2024
ISACA Journal Article

Human Risk Management: A Practical Approach

Cybersecurity strategies must be based on the assumption that humans will continue to make mistakes.

Author: Grant Hughes
Blog Post

Cybersecurity Compliance Essentials: Balancing Technical and Non-Technical Skills

Technical acumen can be valuable in working toward cybersecurity compliance, but non-technical elements also play a significant role in achieving compliance.

9 September 2024
Blog Post

ISACA Career Catalyst Stories: Abigael Bada – Founder, Fortini Tech

ISACA’s Career Catalyst Stories showcase how members have been supported by ISACA throughout all stages of their careers. Today, we profile Abigael Bada, founder, Fortini Tech.

6 September 2024
Blog Post

The Never-ending Quest: Why Continuous Monitoring is Crucial for Cybersecurity

Systematically analyzing threats from the beginning of the design phase enables practitioners to build security into systems in time to make a difference amid a difficult threat landscape.

4 September 2024
Risk Article

Persuasive Technology: The Technology That Connects and Controls Us

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

4 September 2024
@ISACA Article

Emerging Technology: Key Challenges and Opportunities

Emerging technologies are those that are still under development or are just starting to be adopted on a large scale. They have the potential to significantly change the way we live, work and interact with the world around us.

3 September 2024
@ISACA Article

Ramifications Far-Reaching for Companies that Don’t Prioritize Digital Trust

Maintaining compliance and having strong security and privacy programs in place is good, but only goes so far if it does not add up to strong trust between organizations and their stakeholders.

3 September 2024
Blog Post

Preventing the Storage Limitation Principle from Becoming an Elusive Dream

Strengthening approaches to retention of personal data can lead to more business resilience, reducing risk of personal data exposure and sharper operational efficiency.

3 September 2024
Risk Article

A New Threat Actor Group Emerges: Understanding Lapsus$

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

3 September 2024
ISACA Journal Article

Information Security Matters: Cyber Impact Analysis

Whether it is a theft of data or an attack that renders systems inaccessible, cyberattacks are downright bad.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: When Risk Becomes Reality

Once trust is lost, business is often lost as well. Therefore, organizations must look closely at digital trust.

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Managing the Practical Risk Assessment

All risk is not the same. Industry dynamics, enterprise culture, and department risk tolerance all have enterprise impact.

Author: Cindy Baxter
ISACA Journal Article

Data Risk is Enterprise Risk: Good Data Practices as Risk Controls

There is no question that data risk equates to enterprise risk.

Author: Guy Pearce
ISACA Journal Article

Adding Value With Risk-Based Information Security

Effective IT security management system design must start with top management and include the entire perimeter of the supply chain, with special attention paid to ensuring compliance with all relevant laws.

Author: Luigi Sbriz
ISACA Journal Article

From Measurement to Management: Integrating Cyberrisk Quantification into Risk Governance

The inclusion of the governance domain was arguably the most notable addition to the NIST CSF 2.0.

Author: Jack Freund
ISACA Journal Article

Cybersecurity Risk Management Governance: An Agency Theory Perspective

An agency theory approach allows enterprises to have open dialogues and make informed cyberrisk management decisions.

Authors: Gerald F. Burch, Jordan Burch, and Mike McGarry
ISACA Journal Article

Continuous Auditing and Risk Monitoring: Implementation With Credit Line Management

Credit line management presents unique complexities for auditors.

Author: Terrence Cai
ISACA Journal Article

Building a Robust Third-Party Risk Management Program in a Connected Ecosystem

Third-party risk is an evolving problem characterized by steadily increasing complexities.

Author: Visveshwar Ramasubramaniam
ISACA Journal Article

Case Study: Achieving Greater Financial Efficiency at ISACA

When it came time to upgrade their FMS, ISACA teams had to be carefully coordinated.

Author: Katie Teitler-Santullo
Blog Post

The Often-Forgotten Organizational Dimensions of Resilience and Digital Trust

Bits don't know borders, meaning emphasis on building digital resilience and digital trust is paramount in this era to protect organizations and their reputations.

30 August 2024
Emerging Technology Article

Building a Secure and Compliant AI Infrastructure: Lessons from the Trenches

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

30 August 2024
Blog Post

DORA Compliance: Navigating the New EU Regulation

New regulations such as the Digital Operational Resilience Act (DORA) are intended to improve risk management and make operational resilience easier to attain.

28 August 2024
ISACA Journal Article

Collaborative Cybersecurity: Unifying Functions for a Secure Future

The complexity of cyberthreats often mirrors the fragmentation within a cybersecurity function. As threats evolve and diversify, cybersecurity functions cannot operate effectively in silos.

Author: Vishal Sharma
Governance Article

Auditors are Asking Better Questions—Organizations Should Have Better Answers

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

27 August 2024
Blog Post

NIS2 Directive: Strengthening Public Cybersecurity and Infrastructure Across Europe

The European Union’s NIS2 Directive will align key cybersecurity practices throughout the EU, increasing member-states' ability to prevent cyber incidents and lessen their impact.

26 August 2024
Blog Post

Top GenAI Success Stories for Risk and Assurance Professionals, and the Crucial Caveats You Need to Know

Generative AI comes with several promising applications for audits and risk professionals, who also must be mindful of the environment in which they are working and diligently steer clear of potential AI pitfalls.

22 August 2024
ISACA Journal Article

The Value of Diversity and Inclusion in Cybersecurity

A strategy based on diversity and inclusion in the workforce will help address the challenges around building a strong security capability in organizations.

Authors: Yuri Bobbert, Morgan Djotaroeno and Bas Van Gils
Blog Post

ISACA Career Catalyst Stories: Jay Hira, Director, Cyber Security – Financial Services, KPMG Australia

ISACA member Jay Hira has moved from continent to continent for various job roles, but finds his relationship with ISACA to be a constant wherever his career has taken him.

20 August 2024
@ISACA Article

Applying Risk Appetite and Risk Tolerance in the Age of AI

The adoption of artificial intelligence—from generative AI to computer vision—has become a competitive necessity, not merely an option.

19 August 2024
@ISACA Article

Material Matters: The SEC's Cyber Disclosure Reality Check

Cyber disclosures to regulatory and capital markets have become increasingly relevant in the face of ongoing ransomware threats.

19 August 2024
Blog Post

‘Cyberpandemic’ Strikes a Crowd

The recent Crowdstrike incident underscored the need to reduce complexity and limit risky interdependencies to avoid widespread outages.

19 August 2024
Blog Post

A Journey Through Integrated Risk Management

When assembling the elements needed for a successful integrated risk management program, organizations should start with their end goal in mind.

16 August 2024
Emerging Technology Article

AI Security Risk and Best Practices

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

15 August 2024
Blog Post

The Role of AI & Generative AI in Integrated Risk Management

The risk management space is undergoing big changes driven by the rise of artificial intelligence, resulting both in promising advancements and significant potential pitfalls.

14 August 2024
ISACA Journal Article

Protecting Enterprises From AI-Generated Deepfakes

In recent years, deepfakes have become a potent form of social engineering when used for exploitation and to disseminate misinformation.

Author: John Evans
Risk Article

Securing the Digital Landscape: Organizations Must Address Third-Party Risk Head-On

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

13 August 2024
Blog Post

For Better AI Governance, Begin with Education

AI governance expert Meghan Maneval shared best approaches for more effective AI usage on the enterprise landscape in a recent Ask Me Anything discussion on ISACA's Engage platform,

12 August 2024
Blog Post

From Chapter Engagement to Global Inspiration: How ISACA Muscat Ignited My Spark

Engagement with local ISACA chapters can be a springboard to further success both within and beyond the ISACA professional network.

8 August 2024
Blog Post

An Introduction to Post-Quantum Cryptographic Risks

Post-quantum cryptography algorithms will increasingly become a focal point for organizations as quantum computing makes strides forward.

7 August 2024
ISACA Journal Article

Cyber-ESG Synergy: Protecting the 4th Industrial Revolution

It is worth exploring the nuances of stakeholder vs. shareholder capitalism, the impact of ESG on corporate creditworthiness, and the specific methodologies used by rating agencies to assess ESG criteria, with a focus on governance.

Author: Jack Freund
@ISACA Article

Five Key Considerations for Defensible and Reasonable Risk and Security

Reasonability and defensibility are common themes in audits, legal contracts, regulations, and security assessments of information risk management and security (IRMS) programs, capabilities, and controls. The term “commercially reasonable” frequently appears in contractual agreements and regulatory guidelines, signifying common standards for security capabilities and controls.

5 August 2024
@ISACA Article

ISACA Releases AI Courses on Ethics, Audit, and Machine Learning

ISACA has released an online, self-paced introductory course to AI for auditors, alongside other new courses on ethics and machine learning for business enablement.

5 August 2024
Blog Post

Overcoming the Shortcomings of Modern Authentication

An ISACA white paper examining authentication challenges in the deepfake era identifies challenges organizations face and methods that can overcome them.

5 August 2024
Podcast

Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends

Traditional security questionnaires just aren't cutting it anymore.

2 August 2024
Emerging Technology Article

AI Algorithm Audits: Key Control Considerations

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

2 August 2024
Podcast

The Cyber Standard Podcast | Episode 3

Welcome to Episode 3 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the essential aspects of applying for and assessing candidates in the cybersecurity field.

2 August 2024
Blog Post

Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success

Focusing on robust communication, keeping current with the regulatory landscape and aligning with key business objectives are among the approaches that can set modern CISOs up for success.

1 August 2024
Podcast

What Enterprises Need to Know About ChatGPT and Cybersecurity

Many people are pondering whether generative artificial intelligence (AI) tool ChatGPT is a friend or a foe.

31 July 2024
ISACA Journal Article

Integrating Cybersecurity into Project Management: A Comprehensive Approach Across SDLC Phases

In an era when digital transformation is at the forefront of organizational strategies, the importance of incorporating cybersecurity into project management processes cannot be overstated.

Author: Rajanikanth Potturi
Blog Post

How Boards of Directors Can Better Prepare to Lead on Cyberrisk

Board directors need to be aware of key cybersecurity-related strategies and investments and make sure they are aligned with the organization's risk appetite.

30 July 2024
Blog Post

Cyber Resilience Through More Effective Design

There is a saying that I expect many have heard before: “How do you eat an elephant”? “One bite, one part at a time.”

26 July 2024
Blog Post

AI Ethics and Why It Matters

Artificial intelligence ethics considerations must be top-of-mind for organizations when leveraging AI as trust, bias, security, privacy and other important elements should not be overlooked.

24 July 2024
ISACA Journal Article

Developing Trustworthy AI: Understanding the Inputs

Bad AI training data leads to bad outputs, and these bad outputs lead to distrust and skepticism of AI systems. People may be more reluctant to use AI systems that they do not find trustworthy, decreasing the return on investment associated with AI.

Author: Safia Kazi
Blog Post

The Risk of Malicious Push Notifications in Augmented Reality Apps

Push notifications in augmented reality applications carry overlooked risks, and app developers should help mitigate them by working closely with privacy and legal experts

22 July 2024
Blog Post

How to Merge AI and Robots Responsibly

When it comes to merging AI and mobile robots, standards, guidance and testing are critically important to ensure that developers and other key players in the ecosystem are operating responsibly.

19 July 2024
Risk Article

Can Hardening Reduce Cyberrisk?

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

19 July 2024
Blog Post

Three Ways for Enterprise Leaders to Make Technology Transformations More Successful

Clear scope, vetting vendors carefully and retaining key resources can position organizations for success in technology transformation projects.

17 July 2024
ISACA Journal Article

Are AI BOMs the Future?

The rapid adoption of AI has introduced new attack surfaces that many digital trust professionals are only beginning to understand. AI BOM can help organizations better understand the provenance of AI components used to assess related risk.

Author: Ed Moyle
@ISACA Article

Introducing The Evolving Auditor

The world of finance is undergoing a digital revolution, and the role of the auditor is no exception.

15 July 2024
@ISACA Article

Ransomware Attacks Are Noisy. Learn How to Listen for Them.

During the initial intrusion stage of a ransomware incident, the attacker has the advantage.

15 July 2024
Blog Post

Why So Many Organizations Underestimate Insider Threats

Insider threats remain overlooked by many organizations even though they are potentially more devastating than many incidents coming from external attackers.

15 July 2024
Blog Post

Unlocking the Power of Digital Trust: Exploring ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework provides organizations with the guidance needed to build and maintain trust with customers and other organizational stakeholders.

12 July 2024
Audit Article

The Importance of Independent IT Audit

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

12 July 2024
Blog Post

The Looming Threat of Unsecured IoT Devices: A Deep Dive

A secure Internet of Things ecosystem demands a multi-faceted approach, including specialized security solutions and layered defense mechanisms.

10 July 2024
ISACA Journal Article

Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking

Within the complex modern financial system, banks are the guards that protect the assets and transactions of many people. Yet it is because of this status that they are the perfect victims of competent criminals.

Author: Maduabuchi Christopher Okonkwo
Blog Post

Empowering Women in Technology: ISACA’s Commitment to Bridging the Gender Gap

Through the ISACA Scholarship Program and the Digital Trust Workforce Inclusion Program, the ISACA Foundation helps to create equitable access to education, training, and career opportunities.

8 July 2024
Blog Post

Ten Pivotal Moments in an Internal Auditor's Career

Learning to navigate disagreements, adapting to emerging technology and keeping up to date on key regulations are among many pivotal factors in an internal auditor's career success.

3 July 2024
@ISACA Article

Examining the Risks of IT Hero Culture

The allure of the "IT hero" is compelling. IT heroes are individuals who, like the Avengers or Batman, seem to single-handedly save enterprises day after day.

1 July 2024
@ISACA Article

ISACA Announces 2024 Annual General Meeting

ISACA’s 2024 Annual General Meeting of the Membership will be conducted in person in Schaumburg, Illinois, USA on 24 July at 8 a.m. Central Daylight Time at the ASA Auditorium and virtually.

1 July 2024
ISACA Journal Article

Information Security Matters: Carving an Elephant

Zero trust architecture is based on core principles including least privilege and network segmentation. But it is also based on certain assumptions.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—Automation and Its Impact

How we implement automation, the controls we establish, and the areas we choose for automation implementation, all influence the level of digital trust in our organizations.

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Orthopedics and Machines—It's an Orchestra

Of all industries, medicine is a centerpiece for the hope fostered by technical innovation.

Author: Cindy Baxter
ISACA Journal Article

Should We Be Relying on AI-Driven Mobile Robots?

AI and robots were created to assist humanity in its evolution. But robots unchecked have the potential to pose a danger to humanity.

Author: Larry G. Wlosinski
ISACA Journal Article

When Computer Says No

The risk inherent in AI systems can exacerbate the phenomenon of users having blind faith in technology. As AI becomes increasingly complex and autonomous, there is greater potential for unforeseen errors, biases, or ethical lapses to occur.

Author: Richard Clapton
ISACA Journal Article

Beyond the Cell Walls: Cybersecurity Insights Form The Shawshank Redemption

Inspiration can be drawn from the timeless tale of perseverance in the film The Shawshank Redemption by exploring the parallels between the prison walls of Shawshank and the digital fortresses constructed to protect data.

Author: Abdelelah Alzaghloul
ISACA Journal Article

The Pivotal Role of AI in Navigating the Cybersecurity Landscape

A holistic approach, merging AI with human expertise and robust governance, alongside continuous monitoring, is essential to effectively combat evolving cyberthreats.

Author: Robert Putrus
ISACA Journal Article

What is Resilience and How Does It Promote Digital Trust?

Resilience means moving away from technology to mitigate cyberrisk, and this requires collaboration among technology, people, processes, and enterprises.

Author: Alex Sharpe
ISACA Journal Article

Security Challenges and Opportunities of Crowdsourcing for Data Annotation

Many LLMs rely heavily on labeled data for training and have a high demand for annotated data, which crowdsourcing can help meet in a flexible and cost-effective manner. However, this approach also comes with several challenges.

Author: Pranav Kumar Chaudhary
ISACA Journal Article

Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors

The BoD assumes a pivotal role in the orientation and direction of organizations to select the best business strategies that not only allow them to challenge current business plans, but also inspire the necessary transformations in the executive teams.

Author: Jeimy J. Cano M.
ISACA Journal Article

System Overload

Enterprises rely on systems, and systems sometimes fail. A system can either break down during one of its component processes or initiate processes that run smoothly but fail to produce the desired result/output.

Author: Kevin M. Alvero
ISACA Journal Article

From Humble Beginnings: How the CISO Role Has Evolved

The CISO role has undergone a considerable transformation, adapting to ever-changing technological advancements, regulatory requirements, emerging threats, and increasingly sophisticated threat actors.

Author: Brian Vasquez
Blog Post

CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success

ISACA's new Certified Cybersecurity Operations Analyst (CCOA) credential prepares early-career cybersecurity professionals for a range of in-demand roles in the field.

28 June 2024
Emerging Technology Article

Leveraging AI for Information and Cybersecurity

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

28 June 2024
Blog Post

ISO 27001 Shines Bright As a Beacon of Trust

The ISO 27001 Risk Assessment is not just a standard or certification; it can serve as a beacon of trust for a range of stakeholders.

27 June 2024
ISACA Journal Article

AI Risk and Mitigation: Tips and Tricks for Auditing in the AI Era

Inadequately controlled AI can make mistakes that are high-impact, yet subtle in their appearance. This can result in significant damage, especially if a human review is considered difficult or impossible.

Author: Spiros Alexiou
Blog Post

Building an AI Risk Management Program: A Security & Audit Team Perspective

Implementing trustworthy artificial intelligence requires enterprises to put in place a solid governance structure and a comprehensive framework of controls.

25 June 2024
Blog Post

European Union Artificial Intelligence Act: An Auditor’s Perspective

Organizations will need to identify the needed audit and governance resources and skill sets in order to make implementation of the EU AI Act successful.

24 June 2024
Podcast

The Cyber Standard Podcast: Episode 4

Welcome to Episode 4 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the world of cybersecurity standardization.

21 June 2024
Blog Post

Navigating the Challenges of Cybersecurity in the Modern Data Landscape

With exponential growth in data, addressing the related privacy, risk and security implications on the data landscape needs to be a top priority for digital trust professionals.

20 June 2024
ISACA Journal Article

Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge

The transition to ISO/IEC 27001:2022 is a strategic process that requires careful planning and execution. 

Author: Jayakumar Sundaram
Blog Post

Governance Key to Taming Evolving Risk Landscape

The risk landscape continues to transform, highlighting the need for cross-functional collaboration, leveraging of frameworks and effective third-party risk management.

18 June 2024
ISACA Journal Article

Yet Another Risk Depiction (YARD)

Whether risk presents in a new form or one that has already been observed, a precise formula for predicting it has not yet been discovered.

Author: Luigi Sbriz
@ISACA Article

How to Maintain Your ISACA Certifications

Attaining an ISACA certification is crucial to anyone’s career and, as such, you wouldn't want to lose that certification that you have worked so hard to achieve.

17 June 2024
@ISACA Article

Integrating Climate Change Considerations into ISO Standards: A Paradigm Shift

In an era marked by growing environmental consciousness, organizations worldwide are reevaluating their business practices to align with sustainable principles.

17 June 2024
Blog Post

Security Professionals Face Big Challenge in Evolving Ransomware Landscape

The shifting ransomware landscape places responsibility on security professionals to keep pace with new attack types and trends that are especially targeting vulnerable industries.

17 June 2024
Blog Post

Managing AI’s Transformative Impact on Business Strategy & Governance: Strategies for CISOs

Gain a firmer handle on AI risks, controls design, needed detection and monitoring capabilities, and best practices for AI implementations.

14 June 2024
Security Article

Cloud Security Challenges in the Pharmaceutical Industry

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

14 June 2024
ISACA Journal Article

Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors

Cybersecurity adds complexity for investors, financiers, and buyers in the acquisition market, necessitating more thorough due diligence regarding an enterprise’s technology stack. There are three methods proposed herein to relieve this burden.

Author: Yuri Bobbert
Blog Post

The Numbers Whisper, But Stories Captivate: Rethinking Audit Communication

Auditors need to go beyond the cold, hard facts and incorporate time-tested storytelling methods to make their reports resonate more deeply with stakeholders.

11 June 2024
ISACA Journal Article

Agile: The X Factor of Internal Auditing

There is a need to make internal audits more adaptable and iterative beyond what a linear waterfall approach allows. Enhancing the adaptability and iterative nature of audits is essential to moving beyond the constraints imposed by a linear waterfall approach.

Author: Thomas J. Bell III
Blog Post

AI for Auditors: Challenges and Opportunities for Career Advancement

An ISACA training course on AI for auditors explores categories of AI algorithms that auditors will encounter, relevant regulations, how to audit third-party AI dependencies and more.

10 June 2024
Risk Article

Has the Digital Journey Added to the Risk of Using Third Parties?

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

7 June 2024
Blog Post

More Responsible Data Usage Through Privacy-Enhancing Technologies

ISACA's new white paper on privacy-enhancing technologies describes popular PETs, explores regulatory perspectives for using PETs for compliance and provides examples of how the technologies are being used.

6 June 2024
ISACA Journal Article

Cryptographic Advancements Enabled by Diffie–Hellman

Symmetric key cryptography was enabled by concepts first proposed in 1976 in “New Directions in Cryptography.” The concepts proposed have evolved; however, the core ideas remain relevant and can provide valuable insights into how the research community can address security needs.

Author: Srikanth Ambatipudi
Blog Post

A Toolkit to Facilitate AI Governance

ISACA's AI Audit Toolkit helps auditors to verify that artificial intelligence systems meet needed benchmarks for governance and ethical responsibility.

4 June 2024
ISACA Journal Article

The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations

Enterprises must recognize and understand the virtuous circle of attackers, wherein adversaries generate asymmetries that create blind spots and enable cyberattacks, resulting in instability, uncertainty, and chaos across an organization.

Author: Jeimy J. Cano M.
@ISACA Article

Attaining Peace of Mind Under the Digital Trust Umbrella

Establishing digital trust with customers and stakeholders remains elusive for many organizations, as reinforced by new ISACA research.

3 June 2024
@ISACA Article

Five Tips for Success on ISACA Certification Exams

Five strategies for tackling ISACA certification exams in one shot .

3 June 2024
Blog Post

ISACA Member Finds Newfound Career Optimism Through Mentorship Program

ISACA member George Goodwin credits his ISACA Mentorship Program mentor, Karen Franklin, with giving him the confidence and encouragement he needed at a critical juncture of his career.

3 June 2024
Blog Post

Security-as-Code: A Key Building Block for DevSecOps

Security-as-Code can ensure that key security protocols and good practices are automated and integrated directly into all components of the software development lifecycle.

31 May 2024
Security Article

Understanding Sandworm, a State-Sponsored Threat Group

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

31 May 2024
Blog Post

Password Hygiene: The Present and Future State

Best practices for password hygiene remain fluid as many professionals eye a future where passwords will no longer be a fixture on the security landscape

30 May 2024
ISACA Journal Article

Breaking Down Operational Barriers Between IT, Information Security, and the Business

Effective collaboration, rooted in clear and open communication, is not only crucial for the seamless operation of the organization but also essential to instill a sense of fulfillment and the satisfaction of a job well done.

Author: Kenneth Abbott
Blog Post

Bridging the Digital Trust Gap: An Urgent Imperative

Organizations that do not prioritize building digital trust open themselves up to significant business and reputational risks, as underscored by ISACA's 2024 State of Digital Trust research.

29 May 2024
Blog Post

Five Key Takeaways from the 2024 RSA Conference

The growing influence of artificial intelligence on the security landscape was top of mind for many presenters and attendees at the recent 2024 RSA Conference.

28 May 2024
ISACA Journal Article

AI-Infused Foresight: Unveiling Megatrends for Strategic Adaptation

AI plays a significant role in shaping megatrends, guiding enterprises to incorporate AI into strategic planning for a competitive edge, effective risk management, and innovation potential.

Author: Robert Putrus
Blog Post

Rethinking Cybernetics: Why and How

When it comes to the looming arrival of quantum computing, the creation of a new Turing machine will be the necessary starting point.

24 May 2024
Blog Post

AI AIn’t Human

Many of the guardrails that exist in the context of human thinking are not in place for artificial intelligence, which presents a range of significant challenges.

23 May 2024
ISACA Journal Article

Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology

Secure platforms enabled by techniques such as secure multiparty computation (SMPC) allow partners to derive insights and optimize media campaigns without pooling or exposing raw data.

Author: Puneet Gangrade
Blog Post

Are We In Control of Our Digital Lives?

Technology is neither inherently good or bad, but it can be addictive, and digital trust professionals have a role to play in countering the harms that can result.

21 May 2024
Governance Article

Reinforcing IT Governance in the Face of Constant Threats

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

21 May 2024
ISACA Journal Article

Resilience Challenges, Metrics, and Responses in Today’s Landscape

Although enterprises strive to take mitigating measures, the question remains: Will they be enough when—not if—a major disruption occurs?

Author: Spiros Alexiou
@ISACA Article

ISACA Releases New AI Insights, AI Training Courses

Three in five respondents to a new ISACA survey on artificial intelligence are worried or very worried that bad actors will exploit generative AI, yet only 35 percent say AI risks are an immediate priority for their organization.

20 May 2024
@ISACA Article

The 6 Key Questioning Methods for Internal Auditors

Internal auditors are vital guardians of organizational integrity, scrutinizing processes, identifying risks and suggesting solutions.

20 May 2024
@ISACA Article

The Reason Why Cybersecurity is Still Everyone's Job

As a cybersecurity professional, I have sat through many years of boring, bare-bones and dry security awareness training in which I learned enough to meet compliance requirement and pass the annual training to meet business metrics.

20 May 2024
Blog Post

Unlocking Digital Transformation in Pharma: A Least-Vendor Approach with the 3A-3C Framework

A least-vendor strategy can bring big benefits to organizations as they undergo digital transformation projects that otherwise can become complex and strain resources.

17 May 2024
Blog Post

Solving the First Conversation Problem in AI

Solving The First Conversation Problem in AI can go a long way toward companies having greater impact in leveraging the promising technology.

16 May 2024
ISACA Journal Article

Future Ready: Utilizing OKR for Audit Engagement Planning

Embracing balanced management approaches can position internal audit as a key player in driving organizational innovation.

Author: Noam Koriat
Blog Post

The Benefits of National Digital Health in a Short Story

When properly designed and implemented, patient-centric digital healthcare brings transformative potential to healthcare patients around the world.

14 May 2024
Blog Post

Navigating the AI Maze: An IT Auditor’s Guide Utilizing ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework helps auditors and other digital trust professionals ensure that AI is implemented in a way that strengthens the organization and inspires trust with stakeholders.

13 May 2024
Blog Post

The $8,000 SOC 2 Conundrum

While the typical cost of a standard SOC 2 audit is going down, the skill level required for auditors to effectively perform them is increasing.

10 May 2024
Security Article

SAP Security Maturity: A Crash Course

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

9 May 2024
Blog Post

A Pathway to an Actionable AI Governance Roadmap

A new ISACA course on artificial intelligence governance can help professionals learn to design, develop, implement and monitor trustworthy AI within their organization.

8 May 2024
ISACA Journal Article

Building a Resilient and Successful Enterprise: Key Attributes and How to Measure Them

A manufacturing enterprise recently experienced disruption and near collapse after a fire destroyed its main production facility.

Author: Mahmoud Mohamed
Blog Post

A Better Path Forward for AI By Addressing Training, Governance and Risk Gaps

New ISACA survey data on artificial intelligence realities show that companies need to ramp up training and policies to deal with emerging risks from the powerful technology.

7 May 2024
@ISACA Article

Eight Overlooked Emerging Tech Risks and How to Mitigate Them

Emerging technologies refer to rapidly evolving advancements that can transform industries and society by introducing unique capabilities, processes or products. However, these technologies.

6 May 2024
@ISACA Article

The Role of the Risk Sin Eater

While cybersecurity professionals may be experts in cyberrisk and mitigation, business decision makers must weigh the pros and cons of the broader business interests against many forms of risk, of which cyber is only one.

6 May 2024
Blog Post

Unlocking AI’s Potential: How COBIT Can Guide Your Business Transformation

The COBIT framework can help organizations implement artificial intelligence more responsibly and in ways that ultimately will create more value for the enterprise.

2 May 2024
ISACA Journal Article

AI and Automation in Cybersecurity: Future Skilling for Efficient Defense

The ever-evolving threat landscape poses significant challenges, requiring innovative approaches to defend against sophisticated attacks. One approach gaining traction is the integration of artificial intelligence (AI) and automation into cybersecurity practices.

Author: Singirikonda Manikanta
ISACA Journal Article

Information Security Matters: The Inhibitors to Zero Trust Architecture

The essential premise of Zero Trust is that users must be verified every time they attempt to access information resources, not only at the point at which they sign in.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: To Build Digital Trust, Start With Resiliency

The ties between resiliency and both technical architecture and security make sense. So how does digital trust apply to resiliency?

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Resilient Architecture

Today resiliency still means the business continuity and backup plans, but the buzz has moved to environmental considerations when one thinks of resilience.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Leveraging Application Service Architectures for Trust

There is often a disconnect between those of us chartered with fostering digital trust and optimizing risk and those tasked with building out the applications that service internal users, customers, partners, and other stakeholders.

Author: Ed Moyle
ISACA Journal Article

Overcoming Cyberresilience Design Challenge

From a risk perspective, cyberresilience is intended to help reduce the risk of dependence on cyber resources.

Author: Larry Marks
ISACA Journal Article

Case Study: Building a Cyber Line of Defense and Empowering Team Members

Global competition, technological disruptions, economic fluctuations, geopolitical threats, and public health crises have created an imperative for enterprises to become more resilient and adaptive if they hope to survive and thrive.

Author: Katie Teitler
ISACA Journal Article

European Financial Industry Shifts Toward Digital Operational Resilience

Digitalization is essential for financial institutions to remain competitive, meet evolving customer demands, and achieve sustainable growth in an increasingly digital environment.

Author: Kilian Trautman
ISACA Journal Article

Evaluating the Promise and Problems of Data Fabrics

The growing expanse of data makes it harder for analysts to find the right data, convert it, and archive it in a useful form using traditional database designs.

Authors: Nikos Orth and Gerald F. Burch
ISACA Journal Article

How to Build Digital Trust in AI With a Robust AI Governance Framework

The widespread adoption of AI brings forth multifaceted risk, including privacy breaches, data security vulnerabilities, and ethical dilemmas.

Authors: Carol Lee, Terence Law Tom Huang, and Lanis Lam
ISACA Journal Article

User Susceptibility to Malicious Push Notifications in Augmented Reality at the Workplace

As studies of AR security have primarily explored privacy concerns rather than social engineering and other threats, the combined risk factors of push notifications within an AR setting warrant deeper investigation.

Author: Sarah Katz
ISACA Journal Article

Navigating PCI DSS Compliance in the AWS Cloud

PCI DSS v4.0 introduces significant changes that are particularly relevant to cloud computing. These changes reflect the standard’s adaptation to the evolving digital payment landscape and the growing use of the cloud for processing payment data.

Author: Vijay Kasibhatla
Blog Post

2023 ISACA Annual Report Shows How ISACA is Fueling Future

The 2023 ISACA Annual Report provides updates on ISACA's finances, leadership and important progress made throughout the year by ISACA's global community.

30 April 2024
Blog Post

Three Reasons Why You Should Not Wait to Take the CISA Exam

There are several benefits for rising IT auditors to take the CISA exam even before they have the full years of experience required to complete their certification.

29 April 2024
Security Article

Navigating the Cyber Elephant in the Boardroom

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

29 April 2024
Blog Post

Performing an ATM Security Audit

In preparing for an ATM security audit, auditors will need to prioritize understanding core governance and business processes impacting ATM management.

26 April 2024
Blog Post

ISACA Award-Winner Embraces Shared Vision for Safer Digital World

Sushila Nair, ISACA Technology for Humanity award-winner, sizes up the intersection of technology and humanity and what drew her to the cybersecurity field.

24 April 2024
ISACA Journal Article

The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century

In the fast-developing digital landscape of the 21st century, the deep web is a baffling hidden world where cybercriminals orchestrate a variety of illicit activities.

Author: Azad Mammadov
Blog Post

The Need For AI-Powered Cybersecurity to Tackle AI-Driven Cyberattacks

Artificial intelligence can help security professionals counter the threats from cyberattacks that also are increasingly boosted by AI.

23 April 2024
Blog Post

Volunteer Appreciation Week: ISACA Volunteers Share Their Stories

ISACA volunteers share their motivations and career benefits they have received through their volunteer activities.

22 April 2024
Blog Post

Vanity Gone Rogue: The Rise of Exploits Targeting Custom Blockchain Addresses

The Vanity Address Attack is an under-the-radar automation capable of confusing blockchain users and opening the door to digital fraud.

19 April 2024
Blog Post

Audit Career Insights: Letter to My Younger Self

Embracing change, drawing inspiration from others and staying curious are among the recipes for success and longevity in the audit profession.

18 April 2024
Audit Article

Managing Compliance in 2024: Best Practices to Secure Cloud Access and Stay Audit-Ready

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

18 April 2024
ISACA Journal Article

Enabling Security Success Through IT Partnerships

Former US President Harry Truman once said, “It is amazing what you can accomplish if you do not care who gets the credit.

Author: Seth Earby
Blog Post

Evolving Threats to Cloud Computing Infrastructure and Suggested Countermeasures

Cloud misconfigurations and insecure APIs are among the major threats to cloud computing infrastructure that need to be remediated.

16 April 2024
@ISACA Article

ISACA Puts Forward New Policy Template Library

A policy template library from ISACA provides enterprises with the ability to build and customize the principles needed for their specific environments and compliance requirements

15 April 2024
@ISACA Article

Navigating the Virtuous Path: Avoiding the 7 Deadly Sins of Internal Audit

Submitting incomplete work and auditing with an agenda are among the 'sins' that internal auditors should be sure to avoid.

15 April 2024
Blog Post

When it Comes to Controls, It’s the Little Things That Matter

Getting certain foundational, baseline control requirements right, including a tailored approach to risk management, benefits organizations of all types.

12 April 2024
Blog Post

How Will AI Impact Our Jobs in Digital Trust Fields?

Artificial intelligence can be a constructive force on the jobs landscape, especially for those in digital trust professions, with the right approach and commitment to ongoing learning.

10 April 2024
ISACA Journal Article

Cybersecurity Risk of AI-Based Applications Demystified

The introduction of OpenAI’s ChatGPT was a tipping point in the field of artificial intelligence (AI) and, perhaps, a watershed moment in history.

Author: Varun Prasad
Blog Post

DTEF Takes Center Stage in ‘Ask Me Anything’ Conversation with ISACA Hall of Famer

Digital Trust Ecosystem Framework expert Mark Thomas recently shared his perspective on DTEF and digital trust during an Ask Me Anything conversation on ISACA's Engage community.

8 April 2024
Security Article

Using a Functional Cybersecurity Exercise to Test Incident Response Plans

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

8 April 2024
Blog Post

Why You Should Get Your CRISC

The evolving risk and technology landscapes has made the knowledge and expertise of the CRISC credential all the more valuable for risk practitioners.

4 April 2024
ISACA Journal Article

Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement

Security is everyone’s responsibility. And although instilling a security culture in an organization is not always easy, it is essential.

Author: Jayakumar Sundaram
Blog Post

Addressing Artificial Intelligence Threats and Risks from the Board of Directors Perspective Using COBIT 2019

The COBIT framework can be useful for enterprises as they look to responsibly operationalize and govern artificial intelligence.

2 April 2024
@ISACA Article

Creative Approaches to Gaining Cybersecurity Experience

Volunteering, joining industry associations and finding creative ways to gain hands-on experience can all position those interested in breaking into cybersecurity for opportunities in the field.

1 April 2024
@ISACA Article

Five Key Benefits of Using a Third-Party Incident Commander for Security Incident Response

Third-party incident commanders are able to coordinate and govern incident response resources effectively, along with bolstering incident response plans and capabilities

1 April 2024
Blog Post

The Struggle of IT Risk Management in Micro, Small and Medium-sized Enterprises

Limited resources, misaligned priorities, lack of awareness, complexity of IT ecosystems and regulatory pressures are among the factors that make risk management especially challenging for small and medium-sized enterprises.

29 March 2024
Blog Post

Shaping the Future with CMMI

The 2024 CMMI Conference will spotlight recent updates and improvements that position the CMMI community for increasingly high impact.

28 March 2024
Blog Post

Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance

The ISACA China Hong Kong Chapter contributed to a panel discussion with a focus on the potential impact of cyber commanders in the security governance ecosystem.

27 March 2024
ISACA Journal Article

A Proposed High-Level Approach to AI Audit

Artificial intelligence (AI) has become ubiquitous in daily life, from healthcare and finance to virtual assistants and autonomous vehicles.

Author: Denis Piazzi
Blog Post

Meet ISACA’s Women’s Month Scholarship Winners

ISACA Foundation Women's Month Scholarship Award winners share their motivations and future ambitions for making their mark on digital trust professions

26 March 2024
Security Article

Five Steps to Secure an Enterprise Against Insider Threats

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

26 March 2024
Blog Post

Get Grounded in AI

A new ISACA resource on artificial intelligence provides valuable insights applicable both to those beginning their journeys in AI as well as those with knowledge and experience.

25 March 2024
Blog Post

How to Instill a Culture of Data in Internal Audit Function

Asking the right questions and meaningfully addressing business challenges through analytics can set internal auditors on the right path toward establishing a culture of data

20 March 2024
ISACA Journal Article

Enhancing Collaboration to Improve Cybersecurity Practices

The cyberthreat landscape is continually expanding as more enterprises and critical infrastructures increase their attack surfaces owing to their connectivity to the Internet.

Authors: Yasmin Nakhleh Jubran, Parsa Sadeghi, Kevin Melecio, Felipe Casabianca and Brian K. Ngac
Blog Post

Quick Scoping: How to Easily Frame Your Environment from a Compliance Lens

Lessons learned from theft prevention in a retail environment have surprising relevance when it comes to compliance and access management.

19 March 2024
@ISACA Article

Best Practices for Auditable Security Controls

Strong identity and access management practices enable organizations to build a strong security posture, as cloud security expert Varun Prasad explains in this Q&A interview.

18 March 2024
@ISACA Article

Common Sense Risk

Only by applying common sense can practitioners stop managing cybersecurity using the equivalent of mythology.

18 March 2024
Blog Post

Why AI Might Not Make the Best Coding Buddy

The information you upload in a public AI engine is public domain from the moment you press enter: what are the consequences for IT and corporate governance?

15 March 2024
Blog Post

How AI Is Transforming Audit, Risk and Compliance

Whether optimizing coverage in your compliance program, identifying similar risks across various business units or seeking more efficient risk management, AI-driven insight can help to connect the dots.

14 March 2024
Privacy Article

Optimize Enterprise Data and Uphold Privacy With ISACA’s DTEF

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

14 March 2024
ISACA Journal Article

The Ethical Challenge of IT Silos

Enterprise governance of information and technology (EGIT) and business-IT alignment are crucial to create value and achieve the goals and objectives of IT. 

Author: Rajesh Srivastava
Privacy Article

Achieving Ethical Protection of Data Privacy

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

12 March 2024
Blog Post

The Symbolic Dance: Exploring the Role of AI in Cloud Computing

The convergence of artificial intelligence and cloud computing offers big opportunities for organizations alongside potential security and privacy risks.

11 March 2024
Blog Post

Refreshed Mission, Renewed Energy Around SheLeadsTech Program

ISACA's SheLeadsTech program has a refreshed focus and renewed commitment to offering expanded opportunities for women to make their mark on digital trust professions.

8 March 2024
@ISACA Article

Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships

A new framework from ISACA positions organizations to build more trustworthy relationships with customers while simultaneously operating more cost-efficiently and making better use of emerging technology.

6 March 2024
@ISACA Article

Do You Overthink? How to Avoid Analysis Paralysis in Decision Making

Establishing clear decision-making criteria can help organizations from becoming bogged down by regularly over-analyzing decisions.

6 March 2024
Blog Post

Countering Identity Takeover Incidents

Protecting individuals' identities in the aftermath of a privacy incident begins with important communication from banking, credit, government and employment organizations.

5 March 2024
Blog Post

Digital Trust Ecosystem Framework a Valuable Complement to COBIT, Other Frameworks

The Digital Trust Ecosystem Framework and COBIT work well in tandem, with each playing a significant role in allowing organizations to build a stronger foundation for success.

4 March 2024
ISACA Journal Article

Assertion-Based Financial Audit Procedures Related to Crypto Assets

Auditors must learn practical approaches and procedures for auditing crypto assets to manage the audit risk associated with such assets effectively.

Author: Kilian Trautmann
ISACA Journal Article

Information Security Matters: Information Security Architecture—From Access Paths to Zero Trust

Zero Trust Architecture will not stop all cyberattacks, but it can ensure that organizations do not fall victim to the easiest of attacks or fail to discover a breach for months or even years.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: How Managers Can Help Employees Thrive in Today’s Data Environment

No one faces the challenges of the data environment more than the front-line contributors in the audit and compliance professions.

Author: Cindy Baxter
ISACA Journal Article

The Digital Trust Imperative: The Data Bare Minimum Is Not Enough

If an organization has competitors willing to show that they go beyond the bare minimum, the organization doing just enough to be compliant is going to find it hard to compete.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Planning for the New Data Ecosystem

The rules of what we think we know about data are being rewritten. Several converging trends represent a seismic shift in our understanding of the technology ecosystem.

Author: Ed Moyle
ISACA Journal Article

Data Interoperability: Addressing the Challenges Placing Quality Healthcare at Risk

The data interoperability challenge in global digital health, as experienced in the context of the variety of national electronic health record (EHR) deployments around the world, should have been avoidable.

Author: Guy Pearce
ISACA Journal Article

Financial Clouds on the Horizon: Reassessing the Economics of Public Cloud Adoption for Financial Institutions

In an era characterized by rapid technological advancement and evolving customer demands, financial institutions face new challenges to remain competitive.

Author: Matthew Ryan
ISACA Journal Article

Addressing the Privacy, Security, Risk, and Operations Aspects of the Data Ecosystem

Data privacy, security, risk management and operations are complex aspects of the global data ecosystem, and enterprises should address them with solutions based on research and best practices.

Author: Mathura Prasad
ISACA Journal Article

Building Compliance Resilience Amid a Patchwork of Data Protection and Privacy Laws

Organizations operating across multiple states or countries must contend with multiple privacy laws and regulations consisting of nuanced, divergent or even conflicting obligations and requirements.

Author: Corlane Barclay
ISACA Journal Article

Key Considerations To Effectively Plan And Determine The Scope Of An ATM Security Audit Based On PCI DSS

ATMs have become more evolved self-service platforms, helping people pay bills, transfer funds, and exchange currencies. The increase in the number of services offered by ATMs also increases their risk.

Author: Aleksei Panov
ISACA Journal Article

Rethinking Cybernetics

The goal is by no means to reject the Turing machine, but rather to integrate it with a machine made more complex by the phenomenal advances in modern technology.

Authors: Jean Fayot,  Claude A. Laborde and Jean Claude Célestin
ISACA Journal Article

Blockchain Smart Contracts, Part 4: How to Audit

Traditional financial auditing practices must evolve as blockchain technology and Web 3.0 technology become standard.

Authors: Samuel Zaruba Smith and Andy Garcia
Blog Post

ISACA Award-Winner Stands at Crossroads of Theoretical and Practical

Oleksii Baranovskyi, of Ukraine, recipient of the ISACA Educational Excellence Award, is proud to simultaneously be a security professional and an educator.

29 February 2024
Blog Post

Harmony in Cyberleadership: Navigating the Gen Z Rhythm

Cybersecurity leaders should be mindful of the composition of their security teams, including common characteristics of Gen Z cyber professionals, when devising their approaches to leadership.

28 February 2024
ISACA Journal Article

A Factory Model Approach to Technology Control Testing

Technology control testing is a comprehensive evaluation of an enterprise’s technological infrastructure, systems and processes.

Author: Michael Powers, PH.D., CRISC
Blog Post

Third-Party Termination: Understanding Technology and Information Security Risks

Mitigating the technology and information security risks from terminating third parties calls for organizations to formulate nuanced security strategies.

27 February 2024
Security Article

The Top 5 Cybersecurity Threats and How to Defend Against Them

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

27 February 2024
Blog Post

Fallout from Viamedis, Almerys Attack Does Not End with the Data Leak

A major breach in France reinforces the need for sharpened security practices and the overarching imperative to drive toward strengthening digital trust.

26 February 2024
Blog Post

A Cybercriminal is Sentenced. Will It Make a Difference?

Ransomware often targets small-to-medium enterprises, so security teams need to take action to be more prepared for this potentially devastating line of attack.

23 February 2024
Blog Post

CMMC: A Global, Resilient Cyber Supply Chain Standard

The Cybersecurity Maturity Model Certification standard helps businesses to examine their computing ecosystem and enhance capabilities for stronger supply chain resilience.

22 February 2024
@ISACA Article

Strategies to Prepare for US State Privacy Law Compliance

Absent a major breakthrough on a federal privacy law, more US states are likely to enact privacy laws that will add to an already complex policy patchwork.

21 February 2024
@ISACA Article

The Commoditization of Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) is posing new, difficult challenges for organizations and law enforcement organizations alike.

21 February 2024
@ISACA Article

The Skills Combination We Need to Address the Global Cybersecurity Skills Gap

Embracing the right blend of hard and soft skills can position professionals to find opportunity in the cybersecurity profession.

21 February 2024
Blog Post

Broad, Regulatory Frameworks Needed to Responsibly Harness AI

As regulatory frameworks for the AI era continue to evolve, governments around the world will need to find a shared sense of purpose and collaborate on the best way forward.

21 February 2024
ISACA Journal Article

The Three Lines Model in Cybersecurity Governance and Risk Management

A solid cybersecurity governance structure (inclusive of cyberrisk management) should entail clear accountability for cybersecurity and unequivocal authority for cyber decision making within an organization.

Authors: Ivano Bongiovanni, PH.D., Sergeja Slapniičari, PH.D., CPA, Micheal Axelseni, PH.D., CPA and David Stockdalei, PH.D.
Blog Post

The Key Steps to Successfully Govern Artificial Intelligence

Accounting for key characteristics of trustworthiness and considering perspectives from a range of stakeholders are among the needed ingredients to strengthen AI governance.

19 February 2024
Blog Post

Eight Things NOT To Do When Preparing for the CISA

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

16 February 2024
Blog Post

The Digital Trust Game-changer: Get Ready for the Digital Trust Ecosystem Framework

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

15 February 2024
Blog Post

The Surge in AI Development: Boon or Bane

Responsible development of artificial intelligence that recognizes the need for a balance between AI and human capabilities is the path to ensure the powerful technology's good outweighs the bad.

14 February 2024
Blog Post

Auditing Social Engineering: A Practical Approach

By asking the right questions around people, processes and technical controls, auditors can gather the evidence and documentations they need to successfully audit social engineering.

13 February 2024
Security Article

Navigating the Shifting Ransomware Landscape

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

13 February 2024
Blog Post

Securing the Future: Enhancing Cybersecurity in 2024 and Beyond

Prioritizing comprehensive cybersecurity strategy in support of overarching enterprise goals can position enterprises for success, even amid challenging threat and regulatory environments.

12 February 2024
Blog Post

AI and Patents: More Questions Than Answers

Court rulings that AI cannot be granted patents provided needed short-term clarity but there are still many open questions about how AI should be viewed in legal, ethical and practical contexts.

9 February 2024
ISACA Journal Article

Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model

Organizations across a variety of industries can benefit from a well-planned GRC strategy.

Author: Robert Putrus
Podcast

A View into CTEM Exposure Management: Reducing your Attack Surface 3x

Organizations can no longer rely on legacy vulnerability management solutions to protect against even basic attacks.

7 February 2024
Blog Post

Digital Proficiency: Not Only for Individuals

Technology-minded countries around the world can learn a lot from Rwanda, which, despite limited resources, has become a digital benchmark through an impressive set of initiatives and ingenuity.

6 February 2024
@ISACA Article

Five AI Priorities for Digital Trust Professionals to Put on Their 2024 To-Do List

Greater awareness of potentially unethical AI usage and adapting to evolving AI regulations are some of the considerations that should be top-of-mind for digital trust professionals in 2024.

5 February 2024
@ISACA Article

US Congressman Visits ISACA for CMMI Update, AI Policy Discussion

A recent visit by a United States congressman to ISACA's office in Schaumburg included discussion of artificial intelligence policy and updates on how CMMI is sharpening enterprise performance.

5 February 2024
Blog Post

Threat Modeling and Secure-By-Design Applications

Identifying the flows, assets and vulnerabilities are among the key building blocks when threat modeling for software applications.

5 February 2023
Blog Post

Taking Action to Create a Future Where AI Benefits Us All

Artificial intelligence is a human creation that reflects the people who developed it, meaning we must guard against humans' shortcomings and biases resulting in AI furthering inequality and other societal harms.

2 February 2024
Security Article

How CISOs Can Take Advantage of the Balanced Scorecard Method

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

2 February 2024
Blog Post

Global Experts Weigh in On Australia’s ‘Six Cyber Shields’ – Sharing Insights on Achieving a Safe Digital World

Global cybersecurity practitioners share their perspectives on Australia's new cyber shields strategy to provide more robust protection of digital assets in the coming years.

31 January 2024
ISACA Journal Article

Strengthening SIF Detection: Leveraging Social Media Footprints

SIF is a growing problem for financial institutions. At the same time, the monetary losses from SIF are difficult to quantify, with estimates ranging between US$20 billion and US$40 billion.

Authors: Mario Bojilov, PH.D, CISA, Kishore Singh, PH.D and Peter Best
Risk Article

Navigating the Treacherous Waters of IT Risk

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

30 January 2024
Blog Post

‘Just for Control’: the True Power of Controls

Ill-designed controls can waste organizations' time and resources, so make sure implementing controls is more than just a power move.

29 January 2024
Blog Post

Responsible AI Governance in Traditional and Emerging Ecosystems

Organizations implementing artificial intelligence into their operations will need strong governance in place to ensure transparency and trust in their AI usage.

25 January 2024
Blog Post

Executing A Well-Executed Risk and Control Self-Assessment

When executed properly, risk and control self-assessments become enablers for organizations to more effectively navigate the risk management landscape.

24 January 2024
ISACA Journal Article

Securing the First Line of Defense

Cybersecurity awareness for employees is nonnegotiable. It helps protect both individuals and organizations by mitigating cyberthreats and protecting sensitive information, which strengthens the overall security posture of an organization.

Author: Hadi Manasrah
Audit Article

Five Controls to Consider When Auditing a Vendor Management Program

Vendor management is a fundamentally critical function that impacts an organization's operational success, efficiency, reputation and risk exposure.

23 January 2024
Blog Post

The Top 10 Things Every Cybersecurity Professional Needs to Know About Privacy

As the intersection between cybersecurity and privacy increases, security professionals can benefit from gaining a solid understanding of core privacy terminology and privacy principles.

22 January 2024
Blog Post

Privacy in Practice: Dissecting the Global Trends That are Shaping the Profession

Challenges on the privacy landscape can be successfully addressed through upskilling, privacy by design principles and solid training and awareness programs.

18 January 2024
@ISACA Article

New Timing for ISACA Newsletter

The @ISACA newsletter will distribute on the first and third Mondays of the month in 2024, while a new monthly digest of top ISACA content will make its debut.

17 January 2024
@ISACA Article

Projecting 2024 Cybertrends and C-Suite Responsibilities

Anticipated trends on the 2024 cybersecurity landscape provide opportunities for C-suite leaders to position their organizations to effectively and securely leverage emerging technology.

17 January 2024
Blog Post

Mentorship: The Missing Ingredient in Your 2024 Goals?

The ISACA Mentorship Program has proven to be rewarding for mentors and mentees alike, allowing for valuable connections to propel ISACA members' careers to new heights.

17 January 2024
ISACA Journal Article

Increasing Security and Improving Performance With Network Managed Service Providers

Managing enterprise networks to meet increasing business requirements in the face of consistent cost reduction pressures can be demanding

Author: Oluwafemi Adeyemo Adeleke
Podcast

Leveraging Agile Concepts for Neurodiverse Auditors

In this ISACA Podcast episode, we’ll explore how leveraging Agile concepts can mitigate common workplace challenges for neurodiverse auditors.

17 January 2024
Blog Post

Post-Quantum Cryptography: Are We Ready for Q Day?

Focusing attention on understanding and building confidence in post-quantum cryptography now can save the security community major problems in the years to come.

16 January 2023
Audit Article

Six Benefits of a Cybersecurity Audit (and 6 Steps to Perform One)

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

16 January 2023
Blog Post

Nurturing Responsible Innovation: ISACA’s DTEF Recognized for Advancing Trust in AI Environments

ISACA’s Digital Trust Ecosystem Framework (DTEF) empowers organizations to build and sustain digital trust in the age of artificial intelligence and other impactful technological advancements.

12 January 2024
Blog Post

Modeling Identity Trust

An identity system based on trust in a third party could better protect personal data and improve trust throughout the digital ecosystem.

10 January 2024
ISACA Journal Article

Fog Computing and Edge Computing as Alternatives to the Cloud

Fog computing and edge computing have great potential to play major roles in the real-time processing of data.

Author: Kishan Sathyanarayanan
Security Article

Building Cybersecurity Resilience With the Power of Habit

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

9 January 2024
Blog Post

ISACA’s Exciting 2024 is Underway

New ISACA digital trust resources, thought leadership, and upcoming events, both in-person and virtual, are among the coming attractions in 2024 for the ISACA community.

8 January 2024
Blog Post

Workforce Resilience: A Critical Asset for Organizations in Today’s Dynamic World

Promoting a culture of ongoing learning and upskilling is part of the equation for organizations looking to develop a more capable and resilient workforce

5 January 2024
Blog Post

Building a Great Security Operations Center

Defining and articulating a clear strategy for a security operations center (SOC) will make it much more likely that organizational leaders and other key stakeholders will support the SOC on an ongoing basis.

4 January 2024
@ISACA Article

Cultivating Digital Trust and Sustainability in IoT Devices

Explore strategies to secure your IoT devices in the aftermath of the holidays, in alignment with ISACA’s goal of ensuring digital trust.

3 January 2023
@ISACA Article

Emotional Cyberrisk Management Decisions

Emotions can complicate or even impair organizations' need for rational approaches to cyberrisk but that does not mean there is no place for emotion in the equation.

3 January 2024
Blog Post

The Intersection of Change Management and Cybersecurity: A Paradigm Shift in Protection

Given its focus on human behavior in an organizational change context, change management can lead to a fresh and valuable perspective on cybersecurity

2 January 2024
Podcast

Minimizing Risk and Audit Requests

With the increasing demand for audits and risk assessments, artifact requests will not be going away anytime soon. However, the burden these activities bring to the organization can be drastically reduced when audit and risk work together.

3 January 2024
ISACA Journal Article

Information Security Matters: Who Put the Zero in Zero Trust?

Zero trust is quite supportive of digital trust; they overlap to a great extent.

Author: Steven Ross
ISACA Journal Article

IS Audit in Practice: A Collaborative Approach to Assessing AI Risk

Ethical AI occurs when the business, risk and compliance teams not only evaluate the business opportunity that AI brings but carefully consider its impact by sitting in the shoes of users, policymakers and financial market managers.

Author: Cindy Baxter
ISACA Journal Article

The Digital Trust Imperative: AI’s Impact on Digital Trust

Given the proliferation of AI/ML solutions, it is important to understand potential areas of concern, especially ones that affect the reputation and trustworthiness of organizations and individuals within the digital ecosystem.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Free Resources for Hardening AI and ML

If your organization is exploring ways to derive business value from AI and ML, even just maintaining an awareness of the space and becoming educated about the security, assurance, risk, and governance implications is helpful.

Author: Ed Moyle
ISACA Journal Article

Harnessing the Power of Large Language Models

Organizations must understand how to use these new large language models without creating negative societal impacts.

Authors: Meike Hofmann, Gerald Burch and Jana Burch
ISACA Journal Article

Securing the Future: Mitigating Data Security Concerns in Artificial Intelligence Models

Although AI can save time and effort, many users remain unaware of the potential risk to an enterprise’s sensitive data.

Author: Sharad Verma
ISACA Journal Article

Deploying Responsible AI

With the impending adoption of regulations such as the EU AI Act, organizations must adopt holistic responsible AI programs.

Author: Joshua Scarpino
ISACA Journal Article

The Potential Impact of New AI Regulations

There is a need for impactful regulations as well as a general awareness on how these regulations can positively improve the field of AI.

Author: Shini Menon
ISACA Journal Article

Subverting AI's Intellect: How to Thwart Data Poisoning

As AI systems proliferate and gain more widespread adoption, safeguards to thwart data poisoning attacks and ensure decisions that reflect human values become more important.

Author: Prithiv Roshan Sudhakar
ISACA Journal Article

Filling AI’s Cybersecurity Best Practice Gap

There are fundamental considerations necessary to creating a security and privacy risk management baseline for any AI implementation or deployment.

Authors: Joe Cozzupoli and John Salomon
ISACA Journal Article

Help Wanted: Evolving Privacy Roles and the Widening Privacy Skills Gap

This growing importance of privacy in organizations has led to a shift toward more technical privacy roles, where demand for such roles exceeds talent supply.

Author: Nandita Rao Narla
Blog Post

Cultivating a Culture of Inspiration: ISACA’s Member-Exclusive Speaker Series

Kristi Hedges, a Fortune 500 leadership coach and author, shared her perspective on how to inspire others during the ISACA Member-Exclusive Speaker Series.

29 December 2023
Blog Post

Supporting Privacy, Security and Digital Trust Through Effective Enterprise Data Management Programs

Organizational silos, poor data quality and improper data storage are among the challenges enterprises need to overcome to build effective data management programs and strengthen digital trust.

28 December 2023
Blog Post

ISACA Award Winner Advocates for ‘Life or Death’ Matter of Information Management

Castlepoint Systems, an Australian organization focused on data protection, compliance and risk management, was recognized with the 2023 ISACA Innovative Solutions Award.

27 December 2023
ISACA Journal Article

Securing the AI-Enabled Supply Chain With Vendor Management

Securing the AI-enabled supply chain will enable organizations to gain a competitive edge by ensuring a secure and reliable supply chain ecosystem.

Author: Anuj Choudhary
Blog Post

Top Management Considerations for Zero Trust

A new zero trust audit program from ISACA can help organizations transition from traditional network security architectures to ones that are better equipped to handle the modern threat landscape.

26 December 2023
Security Article

Track These 7 Trends for Proactive Cybersecurity in 2024

As 2024 looms near, digital threats are expected to increase in sophistication. Consequently, the tools and strategies cyberprofessionals use to counter them must also adapt.

26 December 2023
Blog Post

API Security: An Internal Auditor’s Quick Reference

Effective usage of Application Programming Interfaces (APIs) calls for diligence in related security controls and audit considerations.

21 December 2023
@ISACA Article

Defective CISOs: Lock Them Up?

The possibility of legal exposure for CISOs in the current climate reinforces the perils of an already stressful and difficult role.

20 December 2023
@ISACA Article

The Window of Exposure: A Critical Component of Your Cybersecurity Strategy

Understanding the nuances of the window of exposure when systems are at risk and is critical for security professionals to effectively protect their organizations.

20 December 2023
Blog Post

Significantly Improving Security Posture: A CMMI Case Study

Adopting CMMI has led to performance improvements across the board for Phoenix Defense, including a significant reduction in network attacks.

20 December 2023
ISACA Journal Article

Understanding CISO Management Styles

CISOs and CIOs can adopt a variety of management styles, depending on the individual’s personality and personal preferences, leadership styles, the organizational culture and context, and the specific needs of the enterprise.

Author: Jayakumar Sundaram
Blog Post

Protecting Your Organization from Cybersquatting

Registering and trademarking your internet domain, and monitoring for registrations with confusingly similar domain names, are among the ways organizations can protect themselves from cybersquatting.

19 December 2023
Security Article

Quishing: The Invisible Threat in QR Code Technology

When quishing occurs, unsuspecting individuals are lured into scanning malicious QR codes that link to fraudulent websites or malware downloads. Awareness surrounding this new threat must be raised to protect personal data and digital safety.

19 December 2023
Blog Post

How Business Leaders Can Responsibly Embrace Generative AI

A Forbes article by Phillimon Zongo lays out how enterprise leaders can help their organizations responsibly leverage generative artificial intelligence.

18 December 2023
Blog Post

Five Things for Governance Professionals to Put on Their 2024 To-Do List

In an era of increased complexity, formalizing data governance frameworks and data management protocols should be increasingly top-of-mind for governance professionals.

15 December 2023
Blog Post

Five Things for Privacy Professionals to Put on Their 2024 To-Do List

Gaining a better understanding of fast-evolving privacy regulations is a good starting point for privacy practitioners who are looking to position themselves for success in 2024.

14 December 2023
@ISACA Article

Serving Up Your 2024 To-do List

ISACA experts provide 2024 to-do lists for professionals looking to update their skill sets and expertise in the fields of IT audit, risk management, cybersecurity, privacy and IT governance.

13 December 2023
Blog Post

Five Things for Cybersecurity Professionals to Put on Their 2024 To-Do List

Incorporating artificial intelligence capabilities and sharpening the ability to architect security solutions in cloud settings can help cybersecurity professionals thrive in 2024.

13 December 2023
ISACA Journal Article

Using Security Controls to Mitigate Privacy Risk When Employees Use ChatGPT

If employees use generative AI, employers should implement effective information security controls and data protection measures and then monitor and assess the design and operating effectiveness of those controls to ensure compliance with security policies, contractual obligations and privacy regulations.

Author: Oluwafemi Adeleke
Blog Post

Five Things for Risk Professionals to Put on Their 2024 To-Do List

Embracing the role risk management can play in supporting the strategic growth of the business is among the items risk professionals should place on their 2024 to-do lists.

12 December 2023
Security Article

Rethinking Cybersecurity Training to Build a Resilient Workforce

There is much to be gained by exploring various approaches to ensuring benefits realization for any cybersecurity training program.

12 December 2023
Blog Post

Five Things for Audit Professionals to Put on Their 2024 To-Do List

Prioritizing upskilling, participating in mentoring programs and authentic engagement with stakeholders are among the approaches that can get IT auditors off to a good start in 2024.

11 December 2023
Blog Post

Secure Software Development Lifecycle Cannot Achieve its Purpose Without Third-Party Risk Management

Treating security as a core element of the design, build and implementation of software products takes intentional action, and understanding the impact that third parties play in achieving the desired level of product security is a step that not everyone is prepared for.

8 December 2023
Blog Post

Adapting Leadership for the Changing Technology and Cybersecurity Landscapes

The increasing prominence of technology in today's digital ecosystem calls for different approaches to organizational leadership, including creating an environment where innovative mindsets are encouraged.

7 December 2023
Blog Post

ISACA’s Top 10 Content Resources of 2023

Discover 10 ISACA resources from 2023 that resonated at a high level with our professional community

6 December 2023
@ISACA Article

Lions and Tigers and Office Politics – Part 2: How to Successfully Join a New Organization, Team or Function

Insights on addressing the learning of politics of a new organization and how to ensure you don’t make mistakes.

6 December 2023
Blog Post

The Leadership Benefits of Emotional Fluency and Vulnerability: ISACA’s Member-Exclusive Speaker Series

A recent installment of the ISACA Member-Exclusive Speaker Series focused on vulnerability and managing emotions in a workplace and leadership context.

6 December 2023
ISACA Journal Article

Lessons Learned From the Bangladesh Bank Heist

This cyberheist serves as a reminder that financial institutions worldwide need to rethink their cybersecurity strategies, risk management protocols and collaborative efforts to protect against similar cyberthreats.

Author: Mohammad Sami A Kabir
Blog Post

The Essentiality of Cybersecurity for Small Businesses: Applying Zero Trust Principles

Applying zero trust principles can be every bit as essential for smaller businesses to protect themselves as for large enterprises.

5 December 2023
Security Article

The Grim Reality of a Cyberattack: From Probability to Certainty

The outlook is grim for organizations that wish to keep their data secure. It is necessary to understand practical methods for reducing the impact of suffering from an attack.

5 December 2023
Blog Post

Diverse, Experienced Board a Must for ISACA to Be at its Best

Nominations and applications are being accepted for the ISACA Board of Directors for the 2024-25 term

4 December 2023
Blog Post

The Yellow Brick Road to Certifications: ISACA’s Mentorship Program and Exam Success

Finding a mentor through ISACA's Mentorship Program can help certification candidates on their path toward passing their exam, among a range of other benefits.

1 December 2023
Blog Post

How to Create a Healthy Security Culture

Incentivizing reporting, collaborating on solutions and reframing teaching points in positive fashion are all elements that can improve an organization's cybersecurity culture.

30 November 2023
@ISACA Article

Cybersecurity and Burnout: The Cybersecurity Professional's Silent Enemy

The demands on cybersecurity professionals can lead to mental health challenges, making it important that practitioners integrate mindfulness and proactively find ways to reduce burnout.

29 November 2023
Blog Post

The Benefits of Hiring Entry-level Cybersecurity Professionals

Many organizations are reluctant to hire relatively inexperienced people for cybersecurity roles but that approach is often misguided, according to recent ISACA Ask Me Anything expert Naomi Buckwalter.

29 November 2023
ISACA Journal Article

How to Build a Great SOC

It is imperative for the purpose, scope and objectives of an SOC to be clearly defined and communicated from the start, otherwise the investment in the SOC can be difficult to demonstrate and the SOC may not support the organization’s objectives.

Author: Grant Hughes
Blog Post

ISACA Advocacy Partnering with Policymakers to Work Toward More Trustworthy Digital Ecosystem

The ISACA Advocacy team spent recent months engaging with influential policymakers, with a focus on bolstering the cybersecurity workforce and creating a healthier digital ecosystem.

28 November 2023
Risk Article

Third-Party Risk Management: The Security Blind Spot No One Wants to Discuss

Third-party risk analysis services and customer security questionnaires are no longer sufficient for risk management. Trust professionals must explore alternative solutions for mitigating risk.

28 November 2023
@ISACA Article

Three Proactive Measures to Prevent Accounts Payable Fraud

As businesses grapple with complex transactions and multiple vendor relationships, the risks of accounts payable fraud grow, threatening both financial health and organizational reputation.

22 November 2023
@ISACA Article

‘Tsunamis’ to Change Course of Security Workforce

Emerging technologies, changes in the global economy and workforce transformations accelerated by the pandemic are reshaping the outlook for professionals in security and other digital trust fields.

22 November 2023
Blog Post

ISACA Advisory Groups Help Shape Programs

A range of volunteering opportunities through ISACA provide professionals meaningful opportunities to strengthen the profession while also earning CPE credits.

22 November 2023
Blog Post

My Journey to Cybersecurity and My Route to ISACA’s ITCA Certification

A journey to prepare for ISACA's ITCA credential was not without its challenges but ultimately proved to be transformative.

22 November 2023
ISACA Journal Article

The Risk and Control Self-Assessment

Risk and control self-assessments offer a vital framework for organizations to proactively identify, assess and mitigate risk.

Author: Anthony Oteri
Risk Article

Optimizing Risk Transfer for Systematic Cyberresilience

As security professionals navigate the present cyberthreat horizon, it is crucial to understand the emerging dangers and fortify digital defenses with cyberinsurance to ensure a secure digital future.

21 November 2023
Blog Post

Renovating Healthcare IT (or any IT): Building the Foundation for Digital Transformation

Modern systems, architectures and technologies, in addition to staff expertise in cloud, hybrid and on-premise solutions, are all important for organizations aiming to digitally transform, but getting there often requires an IT renovation.

20 November 2023
Blog Post

New Measures in Mainland China for Generative AI and Implications for Global AI Governance

New measures on generative AI in Mainland China have substantial implications for the evolution and use of generative AI not only in China but elsewhere around the world.

17 November 2023
Blog Post

Incorporating Agile Audit: Practical Tips

Establishing clear expectations and customizing the approach are among the steps that can facilitate a successful Agile audit implementation.

16 November 2023
Podcast

Scaling Your Threat Modeling Program

Understanding product security risk starts before a single code line is written. Teams can discover threats to the architecture of a system early in the development life cycle with Threat Modeling.

16 November 2023
ISACA Journal Article

The Benefits of Achieving Workforce Resilience

Organizations would benefit from focusing on how to use relevant frameworks and upskill their teams to build a resilient workforce.

Author: Hakan Kantas
Blog Post

Navigating Security Threats with IT Inventory Management

An efficient, current IT inventory is a foundational component of effective IT management and puts an enterprise in position to better leverage threat intelligence.

14 November 2023
Audit Article

Three Skills for Succeeding as an IT Auditor in the 21st Century

There are 3 skills that a modern IT auditor must possess to add value to the technology teams being audited and to avoid being seen through a negative lens by senior leadership.

14 November 2023
Blog Post

Using Machine Learning to Help Detect Sensitive Information

Leveraging machine learning has enabled Adobe to detect categories of sensitive documents and put in place automated real-time detection and response to properly flag any detected documents.

13 November 2023
Blog Post

Sustainability in Emerging Technologies: A Focus on Blockchain, AI

Implementations of artificial intelligence, blockchain and other emerging technologies should be done with sustainability considerations in mind.

10 November 2023
Blog Post

Raising Security Awareness in Cross-Cultural Work

In an increasingly complex and global security landscape, chief information security officers need to be in regular contact with the board and other key enterprise stakeholders to drive effective security culture and collaboration.

9 November 2023
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 2

Log management, malware defense, data recovery, security training and incident response are among the security areas for which organizations have to have solid approaches in place.

8 November 2023
@ISACA Article

How to Build Trust in a Distrustful Digital Era

Consistent and transparent communication, remaining committed to your brand values, and promoting the good things your company is doing can all help create trust in a distrustful digital era.

8 November 2023
ISACA Journal Article

Modeling an Identity Trust System

Basing digital identity recognition on trust is possible if the actors who request access and those who provide a service have the availability of a usable, secure and transparent mechanism.

Author: Luigi Sbriz
Blog Post

Is the CIO Just an IT Manager?

In a time when the rapidly evolving technology landscape is recalibrating business models, the CIO must balance internal IT activities with those that are outsourced, and map the needed controls accordingly.

7 November 2023
Security Article

From Chaos to Confidence: The Indispensable Role of Security Architecture

Similar to a high-rise building, a cybersecurity defense needs a solid foundation to avoid putting long-term stability at risk.

7 November 2023
Blog Post

DogeRAT: The Disturbing Malware Disguised as Your Favorite Apps

DogeRAT malware reinforces the growing sophistication and multi-faceted nature of cyberthreats, through its camouflage techniques, social engineering components, and its ability to imperil privacy and financial security.

6 November 2023
Privacy Article

What the Past Tells Us About the Future of Privacy in the United States

Because information can be replicated, exfiltrated or deleted in a matter of seconds, consumers and organizations need to implement steps to prevent, detect, respond to and remediate data breaches.

6 November 2023
Blog Post

Cyber Advisors, Security Services Providers Can Use Zero-Sum Game Theory Framework to Benefit Clients

The zero-sum game theory is worth considering for organizations, who should rethink the costs they face relative to the cybercriminals that often inflict damage without taking on any real risk.

3 November 2023
Blog Post

IT Risk and IT Audit: A Partnership

Providing leadership with pertinent data can go a long way toward building support for the cross-functional collaboration between the audit and risk functions that can put organizations in a much stronger position to succeed.

2 November 2023
Security Article

What Is Considered a Material Cyberrisk Under the New US SEC Rules?

The cyberevent disclosure rules introduced by the US SEC in July 2023 have sparked a wave of concern among cybersecurity professionals and BoDs.

2 November 2023
ISACA Journal Article

Learning While Earning: A New Way to Upskill the Workforce

Organizations must prioritize training and reskilling their workforces by implementing learning and development initiatives.

Author: Arjun Gopalakrishna
@ISACA Article

Key Considerations for Developing Organizational Generative AI Policies

Few organizations have comprehensive policies in place on the usage of generative AI, which could prove perilous with increasing usage of the powerful and popular technology.

1 November 2023
@ISACA Article

Lions and Tigers and Office Politics – Oh My

The term 'office politics' often makes people think about toxic or unethical workplace behavior, but office politics are actually a necessity that, if handled artfully, can boost people's careers and help drive progress.

1 November 2023
Blog Post

ISACA's Digital Trust World Europe Conference

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more.

1 November 2023
ISACA Journal Article

Three Top Cybersecurity Trends for the Next Decade

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more

Author: Shankar Nishant
ISACA Journal Article

Information Security Matters: A Little Security

Small enterprises need to adopt security at scale, consiering minimum security requirements first and additional tactics commensurate with level of risk.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Future Skills Needed in Audit, Cybersecurity, Privacy and Emerging Technology

Technology advances rapidly and practitioners must adopt a learning mentality to keep pace with change.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Embracing SDLC Controls and the Inevitability of Automation

Acceleration and automation of software development and release processes necessitates changes to how practitioners assure and secure the output of these processes.

Author: Ed Moyle
ISACA Journal Article

The Digital Trust Imperative: Skills Training—A Prerequisite for Digital Trust

One often overlooked aspect of digital trust is the appropriate skilling of staff and whether they are poised to succeed in an ever-changing technology landscape.

Author: K. Brian Kelley
ISACA Journal Article

Lifelong Learning: An Essential Attitude for Career and Life Success

The seeds and roots of lifelong learning should be planted and established so that people at all stages of their careers can embrace the lifelong learning journey.

Author: Grace Johnson
ISACA Journal Article

Developing Lifelong Learners to Ride the AI Wave

Taking advantage of the AI revolution benefits will require organizations to provide the necessary culture and resources that encourage individuals to become self-directed lifelong learners.

Authors: Katharina Schlembach, Norman Csavajda, Gerald Burch and Jana Burch
ISACA Journal Article

Emotional Intelligence Outweighs Technology Skills for Cybersecurity Teams

Prioritizing emotional intelligence over technology skills can help organizations identify the right talent for the right job and thus gain better visibility into their threat landscape.

Author: Christine Whichard
ISACA Journal Article

Optimizing a Career Trajectory Through Personal Accountability

GRC and cybersecurity professionals must demonstrate strength with regard to personal accountability to effectively manage their careers and ensure that they keep pace with technological advancements, associated risk factors and new techniques employed by bad actors.

Author: Adam Kohnke
ISACA Journal Article

To Fear or Not to Fear: How to Create an Optimal Security Culture

It is important to understand the different levels of employee fear, the factors that contribute to it at each level and the implications for security to effectively manage fear to create a culture of security within an organization.

Authors: John Batchelor, Timothy Spivey and Timothy McIlveene
ISACA Journal Article

Future Ready: Toward a Sound Agile Audit Framework

Agile is an essential practice to adopt and a critical competency that cultivates digital business agility, enabling internal audit to be highly aware, make informed decisions and act promptly.

Author: Noam Koriat
ISACA Journal Article

Case Study: Launching an SOC to Improve Cyberthreat Detection

Raython Missiles and Defense needed to build out a security operations center (SOC) alongside the technology used to prevent physical threats, with RMD’s cybercapabilities matching the level of security required for physical assets.

Author: Katie Teitler
ISACA Journal Article

Safeguarding Enterprises from Cyberrisk with ESG

Cybersecurity is a critical element of ESG and can be used to measure the maturity of the governance of an organization; thus, cybersecurity must be added to the ESG reporting framework.

Author: Rima Bose
ISACA Journal Article

How to Gamify Cybersecurity Learning on a Budget

Gamification makes cybersecurity learning more interactive and enjoyable because it adds elements of competition, rewards and progression, which can enhance motivation and engagement.

Author: an Soon Chew
ISACA Journal Article

The Intricate Web of Third-Party Cybersecurity Risk

IT security and risk management professionals must prioritize cybersecurity within their organizations by constantly advising management on best practices for protecting their organizations’ sensitive information and strategies to manage risk effectively.

Author: Jacob Peng
Blog Post

Sizing Up Some of the Spookiest Cybersecurity Incidents of 2023

2023 has been another frightful year on the cybersecurity landscape - explore some of the most perilous incidents and what security professionals can learn from them

31 October 2023
Security Article

The Importance of Security Logistics in Software Development

Organizations must understand how security measures work, are implemented and behave—and under which circumstances they fail.

31 October 2023
Privacy Article

Legally Permissible Does Not Mean Ethical

Treating compliance as an aspiration and collecting excessive amounts of information is harmful to consumers; privacy professionals must help their enterprises’ privacy practices be more ethically focused.

30 October 2023
Blog Post

Saluting ISACA Foundation's Cybersecurity Month Scholarship Winners

ISACA Cybersecurity Month Scholarship recipients share what motivated them to pursue careers in cybersecurity and how they see their futures in the field taking shape.

27 October 2023
Blog Post

Re-aligning Employees to Strategic Goals with Enterprise Training

An ISACA enterprise training instructor provides insights on some of the main benefits of team trainings and how enterprise training can enable organizations to elevate their performance.

26 October 2023
Emerging Technology Article

How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech

Companies increasingly are on the lookout for new professionals with skills and background in emerging technologies and how to implement them in the enterprise setting.

26 October 2023
Blog Post

ISACA AI Survey Results: What Do Infosec Professionals REALLY Need to Know?

It is quite hard to find quality information about artificial intelligence (AI) right now, especially when it comes to how AI should and is being approached in the field of cybersecurity. Thankfully, ISACA has just completed a survey of thousands of members of the global infosec and digital trust community.

25 October 2023
ISACA Journal Article

Improving Information Security Through Organizational Change

To effectively combat cybercrime, CISOs must report to the highest level of the organizations they serve to ensure they are heard and their message is taken seriously by all stakeholders.

Author: Scott Rosenmeier
Blog Post

Risk Quantification 101: The Fundamentals to Getting Started

Tapping into existing risk data can enable organizations to build the needed infrastructure to put in place an effective cybersecurity risk management process.

24 October 2023
Blog Post

Collaborative Mindset Change from Compliance to Risk

Transitioning from a compliance-based focus to a risk-based approach is useful as enterprises aim to best align resources in the modern business and regulatory environments.

23 October 2023
Blog Post

Best Practices for Navigating Emerging Technologies: My Journey as an Auditor

Proactively learning about emerging technologies and understanding them in a business context can go a long way toward making auditors more effective in their engagements.

20 October 2023
Blog Post

In Cybersecurity, to Err Is Human, But to Err for No Reason Is a Shame

Organizations would be well-served to be more intentional about designing systems and processes with human factor engineering in mind, lessening the probability of people making mistakes that lead to cybersecurity incidents.

19 October 2023
@ISACA Article

Internal Auditors as Catalysts in DevSecOps

Internal auditors have an important part to play for organizations to implement DevSecOps successfully.

18 October 2023
@ISACA Article

Using COBIT and Google Maps to Integrate Any Framework, Standard or Model With Enterprise Apps

Mapping the functionality of popular applications can allow organizations to better understand how to make frameworks, standards and models support their apps and improve user experience.

18 October 2023
Blog Post

Proactive IT Risk Management in an Era of Emerging Technologies

As emerging technologies and new business models transform the business landscape, the need for proactive risk management practices should be top of mind for enterprise leaders.

17 October 2023
Security Article

What Enterprises Need to Know About ChatGPT and Cybersecurity

It is the responsibility of security professionals to act now to determine how to safely leverage AI—if they wish to do so at all.

17 October 2023
Blog Post

How Cybersecurity Best Practices are Evolving to Manage Ongoing Threats

Regular penetration testing and a culture of proactive threat analysis and management can help organizations evolve their cybersecurity programs in a difficult climate for cyber defenders.

16 October 2023
Emerging Technology Article

Generative AI With Cybersecurity: Friend or Foe of Digital Transformation?

Generative AI requires significant training and cultural change to ensure confidential data is not compromised, and the security data model training infrastructure requires significant investment and strong business support.

16 October 2023
Blog Post

Quantum-Resistant Cryptography Not a Matter of ‘If’ but ‘Right Now’

Establishing crypto-agility should be a major priority for organizations as advancing quantum computing capabilities are changing the paradigm of the threat landscape.

13 October 2023
Blog Post

Data Management Proficiency: Practical Insights for Quality, Security and Trust

Evaluating quality, security and trust in the context of emerging technologies and current business practices is critical for organizations to have effective data management and governance.

12 October 2023
@ISACA Article

Artificial Intelligence: Privacy and Information Security Risk Considerations

Gaining business benefits from artificial intelligence while also mitigating the related risks requires a holistic, multidisciplinary approach that draws upon the expertise of professionals from several disciplines.

11 October 2023
@ISACA Article

The Value of Near Misses in Risk Management

Like it or not, sometimes it takes a harrowing near miss for enterprises to learn what can become highly valuable lessons in risk management.

11 October 2023
Blog Post

CMMI Offers New Credentialing Pathway and Enhanced Flexibility, Resources

New CMMI credentialing pathway aligns with ISACA’s tools, systems and best practices.

11 October 2023
ISACA Journal Article

Raising Security Awareness in Cross-Cultural Work and Collaboration

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Vanessa Britt Perez Revilla
Blog Post

Victory by Surveillance Isn’t Possible—To Win, Engage the Adversary

Traditional approaches to cybersecurity have not been enough to protect companies, so it's time to make attackers face real consequences for their malicious behavior.

10 October 2023
Security Article

Profiling a SAP Hacker

To mitigate the risk of cyberattacks, organizations must keep their SAP systems up-to-date with the latest security patches and updates.

10 October 2023
Blog Post

The Shifting Importance of Soft Skills in a Time of AI Systems, Large Language Models and Global AI Regulations

Integrity, decision-making capabilities, communication and other so-called 'soft skills' should not be overlooked in organizations' ongoing efforts to bolster their cybersecurity teams.

9 October 2023
Blog Post

Beyond Barbie’s Dreamhouse: Navigating Glass Barriers in the Tech Workforce

Many of the themes that made the Barbie movie so resonant are also relevant to the tech workforce, where underrepresentation from women and minority groups remains a major liability.

6 October 2023
Emerging Technology Article

The Human and AI Partnership: Collaborating for Enhanced Cybersecurity

Both generative AI and precision AI hold promise in helping organizations defend against ever more sophisticated cyberattacks.

6 October 2023
Podcast

Secure your Supply Chain with an Effective Vendor Security Program

Security risks introduced by vendors have become a top-of-mind concern for executives today, driven by recent supply chain incidents that have exposed organizations to operational and reputational risks.

6 October 2023
Blog Post

IT Certification: A Powerful Career Catalyst

IT, cybersecurity, privacy, risk, audit and related digital trust professionals are looked to for the latest knowledge and insights on the impacts of emerging technology; however, they must have reliable resources to ensure they have updated and accurate information about these topics.

5 October 2023
Blog Post

How To Comply with Multiple Security Standards and Frameworks

Complying with every standard or requirement in the current regulatory environment is no easy task, but implementing a global information security management system can provide a sound foundation.

4 October 2023
ISACA Journal Article

Reducing Barriers to Adoption of CCM Through Alarm Management

Continuous controls monitoring has the potential to save time and free internal audit teams to undertake more strategic and value-adding audits, and a key component of this is the management of alarms.

Authors: Peter Best, Kishore Singh, Ph.D., and John Halliday
Podcast

Cultivating Inspired Leaders with Kristi Hedges

Are you wondering about the ever-changing landscape of IT compliance and risk management? Look no further. Hyperproof, a leading SaaS compliance operations provider, conducts an annual survey of over 1,000 IT risk, compliance, and security professionals to uncover their top challenges.

4 October 2023
@ISACA Article

ISACA’s State of Cybersecurity 2023 Report Pinpoints Pressing Workforce Gaps

ISACA's 2023 State of Cybersecurity Report spotlights the skills most needed to strengthen the cybersecurity workforce and the extent to which hiring and retention remain a challenge across the industry.

2 October 2023
@ISACA Article

Protecting and Improving Your Career: Time for A Career Check-up!

Performing periodic career check-ups through simple steps such as updating goals and professional profiles can go a long way toward sustaining career success over the long-haul.

2 October 2023
Blog Post

Common Privacy Dark Patterns and Ways to Improve Digital Trust

ISACA’s Eliminating Deceptive Privacy Practices white paper explores what dark patterns are in a privacy context and what organizations should do to address these trust-eroding tactics.

2 October 2023
Blog Post

State of Cybersecurity 2023: Navigating Current and Emerging Threats

ISACA's 2023 State of Cybersecurity report shows substantial workforce challenges remain and brings into focus the skills and backgrounds that are most heavily in demand.

2 October 2023
ISACA Journal Article

Forensic Investigations and Computer Forensics in the Age of Blockchain

As more enterprises adopt blockchain technology, these professionals must stay up to date with the latest developments and create new tools and techniques to investigate crimes committed on blockchain.

Author: Anuj Choudhary
Podcast

Exploring the Benefits of Neurodiversity within Cybersecurity

Neurodiversity within cybersecurity offers many benefits but requires organizations and hiring managers to re-evaluate hiring practices and job descriptions typically structured for neurotypical applicants.

29 September 2023
Blog Post

Six Things DevOps Wants from InfoSec

By working more openly and intentionally with developers, information security professionals can build a strong relationship that will be a win-win situation for all involved.

28 September 2023
@ISACA Article

Where Does Zero Trust Fall Short? Experts Weigh In

Security experts weigh in on potential shortcomings in zero trust security, whether real or perceived, and what enterprises should keep in mind if implementing zero trust approaches.

27 September 2023
Blog Post

The Career-Elevating Impact of CISA

CISA credential-holders share how becoming CISA-certified has shaped their career advancement and made them more effective in their roles

27 September 2023
ISACA Journal Article

Assessing the Shortfalls of DeFi Platforms

Considering the significantly increasing crimes and scams targeting DeFi platforms, financial services regulators should start enforcing exclusive financial crime prevention controls and coding standards.

Author: Vimal Mani
Blog Post

Lessons Learned from Microsoft’s Massive Data Exposure Incident

The need for meticulous cloud configurations was among several key takeaways in the aftermath of the recent data breach involving Microsoft AI researchers.

26 September 2023
Audit Article

Internal Audit Data Analytics for Beginners

There are 2 phases and associated steps that auditors can take to begin the journey of utilizing data analytics.

26 September 2023
Blog Post

Are AI Chatbots a Weak Security Link?

Enterprises increasingly are making use of AI chatbots, but related security risks and the potential to undermine customer trust when they do not function as intended must be accounted for.

25 September 2023
Blog Post

How to Mitigate Emerging Technology Risk

Understanding the business strategy and conducting risk assessments are among the building blocks for successfully mitigating enterprise risk from emerging technology.

21 September 2023
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 1

Implementing a cybersecurity framework is a useful starting point for enterprises seeking to establish a sturdier foundation on which to build their cyber defenses.

20 September 2023
@ISACA Article

Organizations Need Sense of Urgency in Dealing with AI Risks

A new ISACA white paper provides analysis of the risks and opportunities stemming from artificial intelligence and why enterprises need to gain swift alignment on their AI goals and policies.

20 September 2023
Blog Post

Achieving Digital Trust Through IT Governance and Cybersecurity

Developing a cybersecurity strategy and governance program that supports digital trust provides a solid starting point for organizations seeking to strengthen their trustworthiness.

20 September 2023
ISACA Journal Article

Harnessing the Potential of Blockchain and AI for Process Performance Management With COBIT

Blockchain offers a secure and transparent way of managing IT transactions, and AI can automate routine IT processes, improve decision-making and predict potential IT risk.

Author: Ahmet Efe
Blog Post

Salary Premiums Reflect IT Skills in Hot Demand

Skills associated with ISACA's Information Technology Certified Associate credential are in-demand, as reflected by pay premiums for several of the skills covered by the certification.

19 September 2023
Security Article

Improving Security While Enabling Market Access With a CCF

Cloud service providers should consider creating a common cloud controls framework—a central information security compliance and certification methodology that can include certifications such as SOC 2, ISO 27001, C5, ENS, ISMAP, IRAP, and more.

19 September 2023
Blog Post

The Secrets to Successful Engagement: ISACA’s Member-Exclusive Speaker Series

In a recent installment of ISACA's Member-Exclusive Speaker Series, Scott Gould shared insights on audience engagement, creating a welcoming community and more.

18 September 2023
Blog Post

Balancing the Risks and Rewards of AI

Many enterprises understandably are taking a cautious approach when it comes to establishing their approach toward artificial intelligence, but delaying on meaningful action comes with its own set of risks.

15 September 2023
Blog Post

What to Know About the SEC’s New Disclosure Requirements

New disclosure requirements from the Securities and Exchange Commission likely will leave cybersecurity, risk and compliance professionals in the US with some key questions that need to be addressed.

14 September 2023
Privacy Article

The Privacy Pros and Cons of Anthropomorphized AI

There are privacy-related pros and cons to anthropomorphized AI, and certain considerations need to be made for enterprises that leverage consumer-facing generative AI.

14 September 2023
@ISACA Article

The Importance of Connections in the Tech Industry

The complexity of today’s technology landscape dictates that technology professionals should look to a variety of sources to become better prepared for the evolving challenges that they will face.

13 September 2023
Blog Post

Subservice Organization Controls Management

Not all vendors are subservice organizations, whose operations have a clear impact on the organizations with which they collaborate.

13 September 2023
ISACA Journal Article

Understanding Top Cybersecurity Technology Trends

By analyzing the status of existing technology as it is developed and deployed, future trends in technology development can be predicted.

Author: Yunchuan Wei
Blog Post

Examining the Effectiveness of Recent Privacy Laws on Big Tech

While the United States does not have a comprehensive privacy regulations like the EU does with GDPR, there are signs that more mature privacy policy is beginning to take shape that could limit the harms from data misuse by big tech companies.

12 September 2023
Security Article

Seventy Questions to Assess Cybersecurity Risk on a Rapidly Changing Threat Landscape

There are 70 questions that can be asked to determine whether an enterprise has most defensive principles covered and has taken steps to reduce risk (and entropy) associated with cybersecurity.

12 September 2023
Blog Post

Internal Auditing with an Agile Scrum Approach

By utilizing an Agile Scrum approach to internal audit, organizations can empower the audit function for more effective performance.

11 September 2023
Blog Post

Using Near-Miss Incidents as Risk Indicators

Oftentimes organizations fail to give risks the proper consideration until it is too late.

8 September 2023
Blog Post

Driving Digital Transformation Through Innovative Solutions and a Practical Framework

Yoshimasa Masuda, Ph.D., CISM, CGEIT, shares the history of his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation from innovative solution to practical framework, and its connections across industries, healthcare and academia.

7 September 2023
@ISACA Article

Are We Ready for a World Without Passwords?

The degree of ease with which cybercriminals are able to swipe online credentials brings into focus a future in which passwords will no longer be a routine method of authentication.

6 September 2023
@ISACA Article

New Job. Red Flags. How Long Do You Give It?

Starting a new job is often challenging, but how can new job-starters determine whether the unease is part of the normal adjustment period or if legitimate red flags exist that might mean it's time to move on quicker than they had planned?

6 September 2023
Blog Post

Nine Practical Tips for Using Internal Audit to Drive Organizational Innovation

Internal auditors can help to spur innovation at their organizations by taking a forward-looking mindset, embracing agile culture and keeping up to date on evolving forces on the technology landscape.

6 September 2023
Governance Article

Understanding the EU AI Act

By examining the nuanced details of the EU AI Act, IT auditors and other information security professionals can better understand how it might affect their future work.

6 September 2023
ISACA Journal Article

Measuring and Evaluating the Effectiveness of Security Awareness Improvement Methods

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Eszter Diána Oroszi
Blog Post

Governance and Board Oversight Do Matter

Boards of directors have a growing set of responsibilities in today’s business climate, including keeping abreast of evolving technology trends and how the organization is preparing for a growing set of cybersecurity risks.

5 September 2023
Blog Post

Contending with Artificially Intelligent Ransomware

Artificial intelligence is already impacting the ransomware landscape, with greater potential for AI to significantly impact the pace and complexity of ransomware threats in the near future.

1 September 2023
ISACA Journal Article

Letter From the CEO

It is rare to find a group of people as connected, involved, passionate and dedicated as this one.

Author: Erik Prusch
ISACA Journal Article

Information Security Matters: Organizing for Cyberresilience

There is a need for a committee to oversee both the development and execution of plans to keep an organization going should it be attacked.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Outsourcing vs. In-House Getting—the Most Out of the Business Case and RFP

How do you find a trusted vendor and build the monitoring steps that will ensure a successful project?

Author: Cindy Baxter
ISACA Journal Article

The Digital Trust Imperative: Digital Trust and an Eye on Reliable Operations

Any operational issue can affect an organization’s digital trustworthiness; therefore, neglect operations at your own peril.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Digital Trust and Adopting Generative AI

Large Language Models and other AI tools have tremendous promise and potential, but care and forethought are required to ensure that organizations optimize risk while maximizing value.

Author: Ed Moyle
ISACA Journal Article

Future Fitting Operational Compliance

By embracing technology, fostering a forward-looking compliance culture and building a diverse team, operational compliance can ensure it is well positioned to handle emerging regulations, work collaboratively with operations teams and stay critical contributors to its success.

Author: Kevin Alvero
ISACA Journal Article

A Risk-First Approach to Setting an Information Security Budget

Information security managers can use a risk-first approach to make informed decisions based on where the organization's greatest risk lies.

Authors: Peter Grosser and Gerald Burch
ISACA Journal Article

Extended Accountability of the CIO

If the CIO's role is limited to compliance with technology objectives and cost containment, not all current business expectations will be appropriately or sufficiently addressed.

Author: Luigi Sbriz
ISACA Journal Article

IT Risk and IT Audit Working Together to Reduce the Burden on the Business

To decrease duplication of efforts and let the business do what it does best, the third line of defense (internal audit) and the second line (risk) must work together.

Author: Benjamin Bartz
ISACA Journal Article

Case Study: Incident Response Automation Through IRP Implementation

To improve incident response and, thus, cybersecurity and risk management, IT asset management, localization automation and incident repsonse platform functionality were implemented.

Authors: Katie Teitler and Aleksandr Kuznetcov
ISACA Journal Article

How to Elevate the SOC to the Next Level

SOC analysts must enhance their skills in these emerging technologies, integrate them into the SOC framework and establish specific detection methods to effectively identify and counter threats to this diversified infrastructure.

Author: Shweta Kshirsagar
ISACA Journal Article

Harmonizing Cybersecurity Practices: The Requirements and Challenges of the EU NIS2 Directive

Enterprises in the eurozone must understand the NIS2 Directive challenges and be proactive in complying with the incident notification requirements to enhance their cybersecurity posture and protect critical infrastructure and digital services.

Authors: Antonio Villamor and Yianna Danidou
ISACA Journal Article

Avoiding a Compliance-First Mindset and Choosing a Risk-First Attitude

Moving from a focus on compliance to developing a risk-first attitude results in improved security, better decision-making and senior management support and investment in security controls that reduce risk.

Author: Karen MacDougall
Blog Post

A Cybertransformation Program to Secure Broadcast Media Networks

Fixed start dates, a skills shortage and insufficient security maturity of broadcast devices are key challenges that broadcast media networks face in securing high-profile broadcasts.

31 August 2023
@ISACA Article

ISACA Offers Blueprint for Ransomware Preparations and Defense

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Blog Post

Sustainability, Inclusivity and Team Bonding Through Volunteering: CommunITy Day 2023

ISACA’s 2023 CommunITy Day is upcoming on 7 October, and the Auckland, New Zealand, chapter, has a pair of events in its sights, with a focus on sustainability and nature.

30 August 2023
ISACA Journal Article

Three Lessons From 100 Years of Data Management

Ninety-three percent of enterprises believe that collecting, managing, storing and analyzing data must improve, confirming that major efforts are needed to address the global state of data management.

Author: Guy Pearce
@ISACA Article

Busting the Top 5 CMMI Myths

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Blog Post

Ramping Up for Greater Impact

A laser focus on the products, programs and resources the ISACA community finds the most value from is coming into sharper focus.

29 August 2023
Risk Article

Tools and Best Practices for Improving IT Issue Management

It is worth exploring the importance of IT issue management and highlighting best practices and tools that organizations can use to understand, measure and mitigate IT risk.

29 August 2023
Blog Post

Four Mistakes to Avoid When Taking Your First Certification Exam

By avoiding some common mistakes, certification exam-takers can increase their chances for success on exam day and smooth their path to attaining valuable industry credentials.

28 August 2023
Blog Post

Cyber Fraud on the India Business Landscape: A Growing Threat

A recent escalation of cyber incidents in India highlight the urgent need for comprehensive, updated cybersecurity strategies on the Indian business landscape.

25 August 2023
Blog Post

Six of the Best Cybersecurity Blogs

Regularly reading industry blogs can be an entertaining and useful way to keep up to date on the latest happenings and defense techniques on the cybersecurity landscape.

24 August 2023
@ISACA Article

Five Ways to Fund Your Information Technology Certifications Journey

Certifications are a worthwhile career investment, and there are several ways certification candidates can make the costs associated with gaining their credential more affordable.

23 August 2023
@ISACA Article

Seven Steps to Empowerment With Data Analytics

Data analytics is becoming a must-have capability for technology professionals, enabling them to be more efficient and impactful with their time, knowledge and skills.

23 August 2023
Blog Post

Building a Strong Security Culture for Resilience and Digital Trust

Cultivating a robust security culture can enable organizations to mitigate cyber risk, strengthen trust with customers and sharpen organizational compliance posture.

23 August 2023
ISACA Journal

The Role of Human Factors Engineering in Cybersecurity

Incorporating human factors engineering early into the design process of systems and processes will lead to fewer errors in the use of the product in the field.

Author: Ranjit Bhaskar
Blog Post

ChatGPT and IT Auditing: Opportunities, Threats and Challenges

ChatGPT presents opportunities for IT auditors to be more efficient and productive, but a variety of security, privacy and ethical considerations should be addressed as part of auditors' approach

22 August 2023
Security Article

An Executive View of Key Cybersecurity Trends and Challenges in 2023

To more effectively defend against attacks, it is important for cyberprofessionals to understand current trends and challenges that exist in the field of cybersecurity.

22 August 2023
Blog Post

Digital Trust Enhancing Identity Access Management in Cloud Environments

ISACA's Google Cloud Audit Platform Program explores issues of identity and access management, and connection points between cloud audit and digital trust.

21 August 2023
Blog Post

Four New CMMI Adoption Pieces Available for Community

Several new adoption pieces will enable CMMI to be even more effective at helping organizations across numerous industries rapidly and effectively build capability and improve their performance.

18 August 2023
Blog Post

You Made the Team, But Are You Really in the Game? Exploring Differences Between Diversity and Inclusion

Diversity, equity and inclusion, when properly prioritized and implemented, can be a major difference-maker in cybersecurity and other fields that struggle with underrepresentation, both in terms of performance and the ability to attract and retain talented professionals.

17 August 2023
Privacy Article

Lessons Learned From a Controversial Terms of Service Update

Enterprises are obligated to have clear and up-to-date terms of services in place.

17 August 2023
Podcast

Internal Audits That Create Stakeholder Value Adopting an Agile Mindset

Agile Scrum is a lightweight framework that promises to significantly improve internal audits by creating a mindset that generates stakeholder value through adaptive solutions for complex auditing problems.

17 August 2023
@ISACA Article

Balancing Privacy with Businesses’ Need for Data

Nandita Rao Narla provides her perspective on timely trends and challenges on the privacy landscape, including the need to strike a balance between supporting businesses' need for data with implementing sound privacy practices.

16 August 2023
@ISACA Article

The Risk of Quantifying Cyberrisk

Cyberrisk quantification is designed to alleviate communication problems and translate technology for executives but leveraging it effectively can be a challenge for many organizations.

16 August 2023
Blog Post

The Business Benefits of Becoming an ISACA ATO

By becoming an ISACA Accredited Training Organization, enterprises gain access to a robust community of global learners seeking highly in-demand certifications in fields such as security, risk, IT audit, privacy and governance.

16 August 2023
ISACA Journal Article

Subservice Organization Management— IT Controls for Peace of Mind

Enterprises must address the minimum controls an enterprise and subservice organization should consider implementing; these can then be customized to better suit specific operational needs.

Authors: Alina Archibald and Josh Ditto
Blog Post

Compliance and Information Security: Collaborating to Enable the Business

Compliance and information security functions can each make the other stronger, including by collaborating on making business cases and shared budgetary priorities.

15 August 2023
Audit Article

How IT Auditors Can Embrace Neurodiversity in the Workplace With Agile

With the right environment and a handful of changes, neurodivergent individuals can be assets to any audit team.

15 August 2023
Podcast

Strategies for Avoiding Burnout

Chronic workplace stress can lead to burnout, which poses a significant risk to the mental health of busy professionals, such as auditors. But how can these professionals protect themselves from burnout? And how can their employers help them do so?

15 August 2023
Blog Post

How to Assess Workplace Culture

Workplace culture can be difficult to measure, but factors such as the organization's risk habits, the tone at the top, attrition rates and employee feedback can provide useful indicators for those charged with assessing culture.

14 August 2023
Governance Article

Navigating Regulatory Trends and Best Practices for Ethical AI Governance in Mainland China

It is essential for organizations and technology risk professionals to understand the evolving AI regulatory landscape shaping the future of AI in Mainland China.

14 August 2023
Blog Post

Is ESG Auditable?

Auditing ESG transcends the traditional dimensions of financial efficiency, legal matters and technical effectiveness to deal with increasingly recognized areas of importance such as environmental protection, corporate social responsibility and governance of business behavior.

11 August 2023
Blog Post

How Organizations Can Help Auditors Avoid Burnout

Organizations have several measures they can take to help auditors avoid burnout on the job and improve their mental health, including allowing them to focus on the parts of the job that add the most value.

10 August 2023
@ISACA Article

New Audit Program Focuses on Google Cloud Platform

A new audit program from ISACA sets up auditors who are tasked with assessing the Google Cloud Platform for success.

9 August 2023
@ISACA Article

New Job? Here’s How to Start Off On the Right Foot

The ISACA community provides a wealth of tips for new hires on how they can better acclimate and build strong relationships when starting their new job.

9 August 2023
@ISACA Article

Supercharging Internal Auditors with Data Science: Lessons and Takeaways

Auditors and data scientists interested to make the best use of data science in internal audit can benefit from deeper and more intentional collaboration between the areas.

9 August 2023
Blog Post

The Role of Deepfake Technology in the Landscape of Misinformation and Cybersecurity Threats

Deepfake technology creates new urgency to revisit and reinforce security protocols, including multi-factor authentication and behavioral biometrics, which can be challenging to replicate.

9 August 2023
Blog Post

Embracing the ‘Pedagogy of Error’ in Cybersecurity Education

Jeimy J. Cano, the 2023 ISACA Educational Excellence Award for his educational work that empowers students to pursue careers advancing technology, shares his story and motivations in this Q&A interview.

8 August 2023
Privacy Article

Afraid of Leaking Business Data? Sit Down. We Need to Have "The Talk" About Data Management and Access Control

Data management and access control measures should be integrated into every aspect of an organization's operations, creating robust defenses against data leaks.

8 August 2023
Blog Post

Top 3 Cyberthreats Facing the Financial Sector

Ransomware, supply chain threats and phishing attacks are among the leading cybersecurity challenges faced by organizations in the financial sector.

4 August 2023
ISACA Journal Article

Addressing Emerging Audit Challenges

Traditional audit methods may no longer be adequate; auditors must keep up with new developments and challenges and adapt their audit approach as needed.

Author: Ignatius Ravi
Blog Post

The More I Learn, the More Excited I Am to be at ISACA

In his first 50 days, new ISACA CEO Erik Prusch has been doing a lot of studying, listening and preparing to gain a deeper understanding of how to best serve the ISACA community in the months and years to come.

3 August 2023
Podcast

The Danger of Distraction in Augmented Reality

While users of technology are becoming more educated in how to avoid cyberattacks such as phishing, a distracted user might be more prone to missing signs of social engineering.

3 August 2023
@ISACA Article

Eight Ways to Streamline IT Ops Despite Staffing Challenges

There are numerous ways to improve your IT operation that are not time-intensive but could make a big difference in improving the IT department's efficiency and productivity.

2 August 2023
@ISACA Article

Steps New IT Audit Professionals Can Take Before Earning a CISA

Newcomers to the IT audit field have an array of steps they can take to advance their careers as they accumulate the needed professional experience to pursue the CISA.

2 August 2023
Blog Post

Building a New Way to Look at the Universe

Dr. Erika Hamden, the closing keynote speaker at GRC Conference 2023, visits with the ISACA Now blog to share stories from her career, and her passion for science and innovation.

2 August 2023
ISACA Journal Article

Decoding Log4j Vulnerability Lessons Learned

Organizations and vendors alike struggled to discover where they used Log4j, and hackers compounded the problem by combining vulnerabilities, which contributed to confusion and response fatigue.

Author: Ninad Dhavase
Blog Post

What to Do While You Wait for Your CISA, Part 3: 6 Months Forward and the Continuous Game

Having a plan and communicating it to others can set up early-career professionals for success as they prepare to accelerate their career development.

1 August 2023
Emerging Technology Article

Generative AI and the Potential for Nefarious Use

Organizations must be aware and ready to combat the possibility of generative AI being used to conduct cyberattacks.

1 August 2023
Risk Article

Reviewing the 2023 OWASP API Top 10

To ensure that enterprises are not subjected to the nightmare that is an API security breach, the updated OWASP API Top 10 list is worth examining.

1 August 2023
Blog Post

How to Conquer Your Cloud Governance Maturity Journey

Scott Reynolds, senior director of enterprise cybersecurity at ISACA, and John Richards, head of developer relations at Paladin Cloud, explore the cloud landscape and its impacts on digital transformation.

31 July 2023
Blog Post

Navigating Digital Transformation While Cultivating a Security Culture

Scott Reynolds, senior director of enterprise cybersecurity at ISACA, and John Richards, head of developer relations at Paladin Cloud, explore the cloud landscape and its impacts on digital transformation.

28 July 2023
Podcast

Managing Human Risk Requires More Than Just Awareness Training

A comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

28 July 2023
@ISACA Article

Navigating Supply Chain Challenges in Audit, Risk and Governance

Supply chain attacks are top-of-mind for organizations, and professionals in audit, risk and governance have important parts to play in mitigating growing threats throughout the supply chain.

26 July 2023
@ISACA Article

Top Benefits of Upskilling and Training Your Team

Enhancing your team's credibility with key stakeholders and strengthening organizational alignment are among the major benefits enterprises can reap from group training.

26 July 2023
@ISACA Article

What We Can Learn from Australia’s 2023-2030 Cybersecurity Strategy

New cybersecurity policy being implemented in Australia provides several useful insights for the global security community.

26 July 2023
Blog Post

ISACA: The Right Place to Do the Right Thing

ISACA’s network of digital trust professionals is uniquely positioned to help organizations around the world do the right thing at a time when “the right thing” is much easier said than done.

26 July 2023
Privacy Article

Protecting Children and Privacy Is Not a Zero-Sum Game

Privacy professionals who can be advocates for privacy and encourage people to think more critically about what is posted online can help create an online experience that protects children and preserves privacy.

26 July 2023
ISACA Journal Article

Analyzing Privacy Policies as Data

Text mining allows enterprises to improve controls related to privacy policies by considering the proper use of privacy terms, developing a common vocabulary for a particular industry or sector and observing the use of relevant terms prescribed by regulators.

Author: Thiago De Oliveira Teodoro
Blog Post

What to Do While You Wait for Your CISA Part 2: Setting Up Your Foundation for Success

Engaging with a local ISACA chapter, seeking out a professional mentor and pursuing the IT Audit Fundamentals Certificate are among the steps early-career audit professionals can take while waiting until they meet the experience requirements for the CISA.

25 July 2023
Podcast

Preparing for Interruptions, Disruptions and Emergence Events

This podcast speaks about how an Information Systems (IS) Auditor can prepare for the Interruptions, Disruptions and the Emergence events that happen to the business and to technology.

21 July 2023
Blog Post

The Value of Following a Methodical Approach for SIEM Implementation

Despite many organizations having invested in SIEM solutions, data breaches and other cybersecurity impacts continue to wreak havoc on the enterprise landscape.

24 July 2023
Blog Post

GRC Keynote Speaker: Time to Go Bold

Shawn Kanungo, author and opening keynote speaker at GRC Conference 2023, shares his views on disruptive technologies, innovation and the importance of being bold in this Q&A with the ISACA Now blog.

21 July 2023
Blog Post

Emerging Cloud Security Threats: Fileless Attacks on the Rise

A sharp climb in fileless attacks has added to the challenge enterprises face in securing their cloud environments.

20 July 2023
@ISACA Article

ChatGPT and Digital Trust: Navigating the Future of Information Security

The rise of ChatGPT gives information security professionals even more to account for while also underscoring critical connection points between security and the overarching need for digital trust.

19 July 2023
Blog Post

The Commitment to Continuous Improvement: A CMMI Case Study

ISACA's CMMI maturity model practices have helped Avantare focus on capabilities like ensuring quality, delivering and managing services, sustaining habit and persistence, and more, as a recent case study illustrates.

19 July 2023
ISACA Journal Article

A Candid Look at the Shifting Landscape of Change Management for Audit

For automated systems to operate effectively and achieve the desired outcomes, it is essential to have more sophisticated change management controls.

Author: Kishan Sathyanarayanan
Blog Post

What to Do While You Wait for Your CISA: Part 1, Understanding the CISA and Its Requirements

ISACA’s Certified Information Systems Auditor (CISA) certification requires several years of experience, but there are several steps newcomers to the IT audit and assurance field can take to position themselves for success in the meantime.

18 July 2023
Risk Article

Managing Human Risk Requires More Than Awareness Training

A comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

18 July 2023
Blog Post

Strengthening Collaboration for Cyber Resilience: The Key to a Secure and Resilient Organization

Ongoing communication and strong relationships between the security and audit functions can lay an important foundation in an organization's efforts to strengthen its cyber resilience.

17 July 2023
Blog Post

From Sci-Fi to Reality: AI At All Stages of Your Career

Artificial intelligence is not just impactful for rising professionals in digital trust fields: AI has an increasingly important part to play at all levels of the career cycle.

14 July 2023
Blog Post

Top Effective 10 Data Governance Tools

The rise of ChatGPT gives information security professionals even more to account for while also underscoring critical connection points between security and the overarching need for digital trust.

13 July 2023
Podcast

IS Audit in Practice: Data Integrity On Demand

On this podcast, ISACA's Hollee Mangrum-Willis and special guest Cindy Baxter discuss the disparities between American communities and access to electronic health records.

13 July 2023
@ISACA Article

The Challenges and Rewards of Zero Trust Privacy

Privacy expert Lisa McKee lays out the rationale for zero trust privacy implementation while sizing up related challenges and the need for cross-functional support.

12 July 2023
Blog Post

Compliance Tips for SaaS Startups

SaaS organizations getting started with compliance can benefit from some key tips that will help them successfully navigate the compliance landscape.

12 July 2023
Security Article

The US SEC’s Proposed Cybersecurity Crackdown

The SEC has proposed amendments aimed at bolstering and standardizing the disclosure requirements related to cybersecurity risk management, strategy, governance and incident reporting for public companies.

12 July 2023
ISACA Journal Article

Mitigating Emerging Technology Risk

To mitigate the risk associated with the speed of technological change, organizations can invest in technology foresight and monitoring efforts to stay informed about emerging technologies and their potential risk.

Author: Tarnveer Singh
Blog Post

The Future of Cybersecurity Assessments

Data-driven security assessments are gaining momentum and are shaping up to become a valuable component in the future of security assessments.

11 July 2023
Blog Post

Decoding AI: Insights and Implications for InfoSec

Artificial intelligence is reshaping the cybersecurity landscape, but considering the technology is clueless in some important ways, humans' capacity for intuition, empathy and understanding remain key components of the equation for effective security.

10 July 2023
Governance Article

The EU AI Act: Adoption Through a Risk Management Framework

The AI Act is an important step in the development of an effective and responsible regulatory framework for AI in Europe.

10 July 2023
Blog Post

A New Way to Keep Pace with Privacy

ISACA's Privacy Regulatory Lookup Tool can help practitioners keep pace with a privacy landscape that increasingly is being shaped by new regulations taking effect around the globe.

6 July 2023
Governance Article

The Interplay of IGA, IAM and GRC for Comprehensive Protection in Cloud Transitions

It is critical that organizations pay attention to the significance of governance, risk and compliance in their identity and access management journey.

6 July 2023
@ISACA Article

Achieving Digital Trust in an AI Economy

Businesses operate over long waves of innovation cycles. In each cycle, companies must reckon with disruptions brought about by the technologies of the time.

5 July 2023
@ISACA Article

ISACA’s New Privacy Regulatory Lookup Tool

In a quickly evolving regulatory environment, it is important that privacy professionals stay abreast with the latest legislation that may affect them and their businesses.

5 July 2023
@ISACA Article

Resume Ethics in Digital Trust

How do hiring leaders perceive a lapsed certification that is not identified as such; the inclusion of a degree that isn’t quite finished without that additional detail; experience that is not what it is stated to be; and other untruths?

5 July 2023
Blog Post

What Do Cybersecurity Analysts Do?

Cybersecurity analysts work in security operations centers, where they review alerts and logs in search of suspicious activities, among many other tasks to protect the enterprise.

5 July 2023
Risk Article

Where Data and Behaviors Meet: The Internet of Behaviors

As is the case with any new technology, IoB has both benefits and risk

5 July 2023
ISACA Journal

Log Management as an Enabler for Data Protection and Automated Threat Detection

A proposed framework can be used to fast-track a log management program, which will ultimately improve the overall security and risk posture of any organization.

Author: Grant Hughes
ISACA Journal Article

Information Security Matters: Selling Security’s Value Proposition

We have been valuing and evaluating security based on the absence of breaches. A much more positive approach is to project the value of security in terms of quality, reliability and value to the customer.

Author: Steven Ross
ISACA Journal Article

The Network: Balancing Risk and Innovation

As the incoming chair of the ISACA Board of Directors, how do you see ISACA growing and adapting to the constantly changing workplace and needs of its constituents over the next year?

Author: John De Santis
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—An Enterprise Approach

The DTEF spans all parts of the enterprise, as can be clearly seen by examining either the Culture or Architecture domains.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Making the Software Supply Chain Practical

A look at the software supply chain through the lens of an SBOM—what it is, how it can help you, and how you can adapt your own program to practically incorporate it.

Author: Ed Moyle
ISACA Journal Article

Effective Governance and Board Oversight in a Globalized Information Environment

Board committees focused on technology and cybersecurity, when properly constituted, have a better ability to provide effective governance and critical scrutiny, which guides management in identifying and mitigating cyberrisk.

Author: Allen Ari Dziwa
ISACA Journal Article

Solving Standards Implementation Issues With a Global ISMS

To make compliance efficient and effective, all neccessary requirements must be combined, baselines established and one global information security management system developed.

Author: Sarantos Kefalas
ISACA Journal Article

Internal Audit as a Driver of Innovation

To remain innovative, the internal audit function needs to adjust its activities and value propositions to align with the demands of the 4IR era.

Author: Noam Koriat
ISACA Journal Article

An Evolutionary Strategy for Leveraging Data Risk-Based Software Development for Data Integrity

Updating the traditional software development methodology to include data risk-based development enables organizations to avoid any penalties that may be imposed due to a lack of controls and noncompliance with regulations and laws.

Author: Sasidhar Duggineni
ISACA Journal Article

Cooperating With Fear

By acknowledging the complexities of security and cooperating with the element of fear, enterprises are empowered to focus on their most critical sources of risk.

Author: Jacob Zwicki
ISACA Journal Article

Case Study: Bank’s CyberOps Team Wins EDR Buy-In

The Israeli government’s new demands on financial institutions tasked a cyber operations manager employed at one of the largest financial institutions in Israel with establishing a new cyberops team within the infosec department to develop a plan for achieving compliance, among other responsibilities.

Author: Mick Brady
ISACA Journal Article

Using Near Miss Incidents as Risk Indicators

Performance and risk indicators are essential sources for measuring the effectiveness of the protection measures adopted.

Author: Luigi Sbriz
ISACA Journal Article

The Digital Twin Advantage in Automotive Manufacturing Systems

Digital twin technology using AI and ML in the automotive industry can enhance the overall design and efficiency of automotives; however, these technologies pose cybersecurity risk.

Authors: Karthik Trichur Sundaram and Divya Karthik
Blog Post

Protecting Phones, Data, and Your Business from Juice Jacking Risks

Recent warnings about the security risks of using public charging stations, such as at airports, hotels and hospitals, reinforces the value of juice jack blockers and using personal charging devices.

29 June 2023
ISACA Journal Article

Convergence of the Physical and Digital Worlds: The Metaverse and AR/VR for Training and Education

The education sector has embraced new technological advancements such as AR and VR technologies as they can be used to change teaching and learning methodologies to improve learners’ understanding.

Author: Brigitte Collier
Blog Post

Laying the Groundwork for the Future of Girls and Women in STEM

Chiaka Ben-Obi, who earned the 2023 ISACA Technology for Humanity Award for serving as a mentor for young women seeking careers in STEM fields, shares her motivation and vision for a more equitable tech workforce.

29 June 2023
@ISACA Article

Five Ways AI is Likely to Change How Organizations Approach Information Risk and Security

Existing and emerging AI technology will recalibrate the enterprise risk and security landscapes in some promising ways

28 June 2023
ISACA Journal Article

Auditing the Unauditable: Ethics and Culture

Internal audit functions can play a role in evaluating several factors that are indicative of presence and proper implementation of good organizational policies related to work ethics and culture.

Author: Sumedha Adavade
Blog Post

Leveraging Technology to Help Enhance Trust in Internal Controls Amid Rising Material Weaknesses and Resource Constraints

The rise of material weaknesses leads to significant risks for enterprises and can diminish trust from key stakeholders. Understanding the causes of material weaknesses is an important precursor to developing the needed mitigation strategies.

27 June 2023
Blog Post

Trust is Not Being Destroyed – Just Changing Form

ISACA Europe Conference: Digital Trust World keynote speaker Rachel Botsman explains why she thinks trust is not being destroyed but rather changing form.

26 June 2023
Blog Post

Fortifying Zoom Phone Security: A Comprehensive Threat Modeling Analysis

Zoom Phone has emerged as a robust communications tool but utilizing threat modeling and arriving at a better understanding of the attack surface is needed for the tool to reach its potential.

23 June 2023
Podcast

Processes of Engagement with Scott Gould

Scott Gould is the author of 'The Shape of Engagement: The Simple Process Behind how Engagement Works.' In this podcast, Scott will discuss the essential frameworks for understanding and operationalizing engagement and building enduring connections with your networks and communities.

23 June 2023
Blog Post

Building Effective Defenses Against Social Engineering

By understanding how social engineering works and developing targeted defenses, cybersecurity practitioners can mitigate this perennially damaging threat.

22 June 2023
@ISACA Article

Switching the Blame for a More Enlightened Cybersecurity Paradigm

Placing blame on users for security mistakes can be both unfair and counterproductive - it's time to embrace a new cybersecurity paradigm

21 June 2023
Blog Post

Pay for ISACA Certifications is on the Rise

Pay for several ISACA certifications in 2023 tells a promising story for certification-holders, according to recent salary data from Foote Partners LLC.

21 June 2023
ISACA Journal Article

Internal Audits That Create Stakeholder Value

The Agile Scrum mindset places a strong emphasis on stakeholder engagement by actively involving stakeholders in the internal audit process and seeking feedback, which can improve communication and collaboration, resulting in better audit outcomes.

Author: Thomas J. Bell III
Blog Post

Top Benefits of Becoming an ISACA Accredited Training Organization

ISACA Accredited Training Organizations provide a range of benefits, including increased credibility and access to unique training materials and programs.

20 June 2023
Risk Article

Rethinking IT Asset Valuation, Risk Assessment and Control Implementation

Risk management and evaluation are critical to every enterprise’s strategic planning for information security.

20 June 2023
Blog Post

Ransomware Attacks on the Rise in India: The Need for a Global Culture of Crisis Management

Growing instances of ransomware attacks in India are instructive both of the extent of this threat around the world and the measures that organizations need to put in place to mitigate the risks.

16 June 2023
Blog Post

TSA’s Plans to Expand Facial Recognition at Airports: A Privacy Perspective

The advancement of facial recognition technology raises an array of privacy concerns, as underscored by the recent expansion of a program through the US Transportation Security Administration.

15 June 2023
Podcast

Delivering Security Value to Product Teams Using the Power of Data

In security, aligning with product teams has never been more important, especially when outmaneuvering adversaries.

15 June 2023
@ISACA Article

Getting More Value from Risk Assessments

Conducting IT risk assessments is valuable for enterprises but the variance in how frequently enterprises conduct them shows more awareness-building is needed about how they fit into the risk management equation.

14 June 2023
@ISACA Article

Seven Steps for Digital Trust Professionals to Develop Analytical Thinking

Exploring different angles and dimensions of a problem and learning to ask the right questions are solid starting points for digital trust professionals to take to develop analytical thinking skills.

14 June 2023
Blog Post

Using Agile Practices for Internal Audit

The value in modern audit is timely data that can be leveraged to improve operating processes and business continuity, tied heavily to the enterprise risk lifecycle

14 June 2023
ISACA Journal Article

Mitigating Auditor Burnout With an Energy Management Mindset

Auditors need to change their mindsets and focus on managing energy rather than time to avoid burnout.

Authors: Elena Klevsky and Melissa Walters
Blog Post

IT Risk Assessments: A Process Your CIO or CISO Will Thank You For

Identifying and quantifying risk can be made more straightforward by following six key steps for IT risk assessments.

13 June 2023
Emerging Technology Article

AI Systems Training Pause Sought

The decision of the GPDP to inhibit the use of an innovative tool based on generative AI, such as ChatGPT, may seem questionable; therefore, it is important to understand the motivation.

13 June 2023
Blog Post

Common Cybersecurity Risks to ICS/OT Systems

Organizations need to protect their industrial control and operational technology systems from cyberthreats, including through regular vulnerability assessments, network segmentation and providing ongoing training on cybersecurity best practices.

12 June 2023
Blog Post

Join Me in Welcoming ISACA CEO Erik Prusch!

Erik is the right person to lead ISACA into the future. It is clear that he has a values-driven approach, a steady presence, the right vision and a clear focus to take us forward.

12 June 2023
Blog Post

How ATO and Chapter Training Can Help You Pass Your Certification Exam

ISACA's chapters and Accredited Training Organizations (ATOs) offer prime opportunities for certification candidates to prepare for success on their certification exams.

8 June 2023
@ISACA Article

A Security Globetrotter’s Lessons Learned from Boots on the Ground in Over 100 Countries

Creating awareness of the full digital trust ecosystem is an important starting point for organizations as they look to build the sound practices and procedures needed to build and sustain digital trust throughout the enterprise.

7 June 2023
@ISACA Article

How to Manage Job Offers Like a Pro

Landing a job offer is naturally the goal of candidates who are engaged in the hiring process, but when it's offer time, there's much more to the back and forth between candidate and prospective employer than just saying yes or no.

7 June 2023
Blog Post

New Use Case Highlights Promising MDDAP Results

A new case study demonstrates a successful, real-life application of ISACA’s Medical Device Discovery Appraisal Program (MDDAP).

7 June 2023
ISACA Journal Article

Securing Next-Generation Broadcast Media Enterprises Against Cyberthreats

It is essential for broadcast media enterprises to develop a cyberresilience strategy when broadcasting high-profile live events and determine what are cybersecurity challenges the enterprise faces specifically related to core broadcast business services.

Author: Muhammad Malik
Blog Post

Disaster Recovery and Business Continuity Preparedness for Cloud-based Start-ups

Business continuity plans for start-up companies prepare them for unexpected events that may disrupt operations and can protect critical data, as well as the company's reputation.

6 June 2023
Audit Article

The Increasing Importance of IT Audits to the BoD

How can the BoD ensure that it is adequately meeting requirements? One of the best ways to identify gaps in what an organization is doing vs. what it is expected to do is to conduct a thorough IT audit.

6 June 2023
Blog Post

ChatGPT’s ‘Perfect Storm’: Managing Risk and Eyeing Transformational Change

Organizations looking to make ChatGPT implementations successful need to be mindful of interdisciplinary collaboration that taps technological expertise, regulatory compliance, risk management and operational understanding of the powerful AI chatbot.

5 June 2023
Blog Post

Understanding and Implementing Digital Trust Effectively

Creating awareness of the full digital trust ecosystem is an important starting point for organizations as they look to build the sound practices and procedures needed to build and sustain digital trust throughout the enterprise.

2 June 2023
Podcast

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

Organizations today struggle with vulnerability management. More specifically, remediating vulnerabilities in a timely manner poses a challenge.

1 June 2023
@ISACA Article

Europe Sets the Stage for AI Regulations

While the topic of regulating artificial intelligence is gaining traction around the globe, Europe is showing leadership in this area with a new proposal that could become the global standard

31 May 2023
@ISACA Article

Unpacking the World’s First AI Act

The European Union's proposed Artificial Intelligence Act takes a risk-based approach toward AI systems and applications while establishing legal requirements for high-risk AI systems.

31 May 2023
Blog Post

Digital Trust as a Differentiator: Insights from ISACA Digital Trust World Panel

A recent ISACA conference panel in Boston explored how digital trust can become a competitive advantage and how the entire organization must rally around the concept for trust to be delivered.

31 May 2023
ISACA Journal Article

Risk in the Digital Era and the Skills Required for a New Environment

Creating a specialized safety and security culture is essential to protect customer data and develop plans to prevent and mitigate IT and cybersecurity risk.

Author: Pierina Guizado
Blog Post

Defensive Programming for Industrial Control Systems

Modern industrial control systems are exposed to the internet, making a proper code environment, defining rule sets and conducting verification increasingly important to protect these critical systems.

30 May 2023
Blog Post

The 3A-3C Approach to Digital Solutions in the Pharmaceutical and Healthcare Sector

The digital health market is expanding, and cost, compliance and user comfort are essential elements to ensure related digital transformations are going to plan.

26 May 2023
Blog Post

Digital Trust World Conference: A Fabulous Convergence of Security, Emerging Tech and Lobster Rolls

ISACA's Digital Trust World conference in Boston left me excited about the future of the security profession despite many open questions about how AI and other emerging tech will reshape the profession.

25 May 2023
Emerging Technology Article

Navigating the Hype and Risk of Emerging Technologies

By taking a risk-informed approach, security and risk professionals can navigate the path forward in a way that balances the potential benefits of emerging technologies with the risk they may pose.

25 May 2023
@ISACA Article

Identity as a New Security Perimeter

The rapid shift towards global digitalization has brought inherent risk to people, things and systems that traditional security perimeters cannot keep up with, which is why embracing identity as a new security perimeter is crucial.

24 May 2023
ISACA Journal Article

Improving Governance at a National Bank With COBIT

Employees organizationwide can harness the potential of I&T for value creation—not merely the IT department.

Author: Bruno Horta Soares
Blog Post

Identity as a Service Audit Implications and Best Practices

Identity as a Service can have major implications for audit by dictating the way that organizations manage user identities and access their applications and IT workloads.

23 May 2023
Blog Post

Securing an AI Ecosystem: The Next Big Cybersecurity Challenge

As artificial intelligence becomes an increasingly prominent part of our professional and personal lives, security and control protocols must keep pace with the evolving ecosystem.

24 May 2023
Blog Post

Where Does Digital Trust Begin? An AMA with World Economic Forum’s Daniel Dobrygowski

Daniel Dobrygowski, the head of governance and trust for the World Economic Forum, was featured in a recent Ask Me Anything discussion on ISACA's Engage community, with a focus on building digital trust and its key implications in business and civil society.

22 May 2023
Audit Article

Managing Data Privacy and Information Security With IT Audits

Ensuring that data are protected and secured in the most efficient and economical manners possible are constant battles due to the increasing sophistication of cybersecurity threats and the amount of data protection regulations.

23 May 2023
Podcast

The True Cost of a Data Breach

Guests Jack Freund and Natalie Jorion discuss the need for additional data for quantitative risk analyses and methods to derive that data when it does not exist. They cover how this was done in the past and their updated method for interpolation of such data from record losses and other firmographic data.

23 May 2023
@ISACA Article

The AI Revolution is Already Here

The artificial intelligence revolution is already here, meaning enterprises that are strategic in their use of AI and diligent about mitigating related risks and navigating ethical concerns will be well-equipped for this new era of business.

17 May 2023
@ISACA Article

The Role of Hanlon’s Razor in Cybersecurity

The Hanlon's Razor adage, 'Never attribute to malice that which can be adequately explained by stupidity,' might be more applicable to the world of cybersecurity than you think.

17 May 2023
Blog Post

Five Tips to Prepare for ISACA’s CDPSE Exam

Top CDPSE exam scorer Chris Fraker shares his tips for success and how the certification benefits privacy professionals and their organizations.

17 May 2023
Blog Post

Understanding the Risk of Robotic Process Automation

Reviewing vendor-provided scripts and testing systems in contained environments are important measures in dealing with risk stemming from robotic process automation.

17 May 2023
ISACA Journal Article

A Framework for SIEM Implementation

An SIEM solution consumes information in the format of event logs from many different source systems and provides a consolidated view of security activities within an enterprise.

Author: Grant Hughes
Blog Post

Maintaining Sovereignty in the Cloud: Controlling Your Digital Future

Cloud users' desire for for control over their data calls for digital sovereignty measures in collaboration with cloud providers.

16 May 2023
Podcast

2023 IT Compliance and Risk Benchmark Report

Are you wondering about the ever-changing landscape of IT compliance and risk management? Look no further. Hyperproof, a leading SaaS compliance operations provider, conducts an annual survey of over 1,000 IT risk, compliance, and security professionals to uncover their top challenges.

16 May 2023
Blog Post

Using Tabletops and Simulations to Build Better Incident Responders

Incident simulations can be highly effective at pinpointing gaps in monitoring and detection processes, and better understanding how to go about catching bad actors.

15 May 2023
Podcast

What Is Your IP Address Cybersecurity IQ? The Role of IP Address Data in a Digital World

There are literally thousands of VPN services on the market. Some are undeniably benign, but others offer a slate of features that are friendly to cyber criminals.

15 May 2023
Blog Post

Credential Hacking: The Dark Side of Artificial Intelligence

Artificial intelligence is capable of helping cybercriminals crack passwords, but the good news is cybersecurity professionals can leverage AI to fight fire with fire.

11 May 2023
Podcast

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

In this episode, we’ll assess risk management myths and discuss how to establish scalable, quantifiable, and always-on risk management for the future.

11 May 2023
@ISACA Article

ISACA Board Approves 2023-24 Board Slate; De Santis to be Board Chair

The upcoming slate for the 2023-24 ISACA Board of Directors was recently approved by the board, with John De Santis to become ISACA's next board chair.

10 May 2023
@ISACA Article

ISACA’s New Report Reveals Value, Benefits of Digital Trust

ISACA's State of Digital Trust 2023 research explores how organizations view digital trust, its top benefits, major obstacles, how it is measured and more

10 May 2023
Blog Post

Digital Trust: Focus on the Forest Rather Than the Trees

Digital trust does not come about through any one product or technology but increased transparency in how technology is being developed and deployed would be a good starting point to strengthening trust in the digital ecosystem.

10 May 2023
ISACA Journal Article

BCP and Corporate Social Responsibility in the Event of Union Strikes

In the event of a union strike, it is essential to not only have a business continuity plan, but to have one that balances with corporate social responsibility .

Author: Jason Jiao
Blog Post

Taking Digital Trust from a Lofty Goal to a Measurable Reality

Organizations can turn digital trust into an important competitive advantage, as reinforced by the major takeaways from ISACA's State of Digital Trust 2023 report.

9 May 2023
Audit Article

What the Post-Pandemic Future Holds for IT Auditors

COVID-19 acted as a catalyst that accelerated digital transformation, modified how brands interact with their customers and disrupted IT audit practices.

9 May 2023
Blog Post

ISACA Virtual Conference Keynoter: Never Lose the Spark of a Startup

Marc Randolph, a national bestselling author, executive mentor, angel investor, and the co-founder and first CEO of Netflix, will be the opening keynote speaker at the ISACA Virtual Conference: Digital Trust World.

8 May 2023
Podcast

How Organizations Can Consistently Reduce Cyberrisk

Cyber threats are now a “clear and present danger” to most organizations, companies and governments of the world. A good cyber defense involves many, intricate layers. You can never have enough layers, just like you can never remove all the risk.

8 May 2023
Blog Post

The Evolution of Cloud Computing and Distributed Ledger Technology

Enterprises need to have significant trust before they can move forward with delegating data control, storage and application execution to cloud providers.

5 May 2023
Blog Post

Embarking on the Journey Toward Digital Trust

Dealing with adversity in a trustworthy and transparent way can turn a problem into a big opportunity for a company to strengthen its relationship with customers.

4 May 2023
Emerging Technology Article

Generative AI: The Future Is Now, and It’s Risky

Far too many users are starstruck by AI capabilities and are putting enterprises at substantial risk.

4 May 2023
@ISACA Article

Annual Report Dives into ISACA’s Growth, Digital Trust Impact

ISACA's newly released 2022 annual report spotlights the organization's growing focus on digital trust as well as other highlights from the year, plus a recap of ISACA's finances.

3 May 2023
@ISACA Article

Cyber Versus IT Security in a Permanently Connected World

Before there was cybersecurity, there was IT security: contrasting the two terms reinforces the importance of going back to the security basics.

3 May 2023
@ISACA Article

It’s Personal: You Define What Success and Work-Life Balance Mean for You

Finding work-life balance can be challenging, especially in demanding digital trust fields, but there are several tactics that can help professionals find the right blend of personal and professional.

3 May 2023
Blog Post

Privacy-Preserving Security Analytics

Preserving privacy while outsourcing is a challenge, especially when factoring in considerations such as how to preserve the security and privacy of data at rest.

3 May 2023
Podcast

Key Considerations for Conducting Remote IT Audits

Conducting adequate preparation including risk assessments, assessing resource requirements and ensuring ongoing communication to harness both the benefits and to address the potential challenges faced when conducting hybrid or fully virtual audits.

3 May 2023
Blog Post

Developing Collective Risk Leadership Through CRISC

The interconnected nature of risks in today's environment calls for a holistic approach to risk management, which can be reinforced through the principles of the CRISC credential.

2 May 2023
Blog Post

ISACA’s Digital Trust Vision Highlighted in 2022 Annual Report

ISACA's newly released 2022 annual report highlights the digital trust resources that the organization put forward along with other key organizational progress from the year.

1 May 2023
ISACA Journal Article

Information Security Matters: CISOs at Risk

Many of the readers of this Journal are or may someday be IT directors or chief information security officers. Sadly, your jobs may be on the line, should there ever be a cyberattack on your watch.

Author: Steven Ross
ISACA Journal Article

IS Audit in Practice: Advantages of Technology in Achieving Diversity

The CIO was convinced not only that technology could drive diversity in positive ways, but that the process itself could foster better collaboration from the team.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Advancing Sustainability Goals With DevOps

There are multiple things that we can do to support, either directly or indirectly, sustainability goals in and through the controls, procedures, processes and countermeasures that we work with every day.

Author: Ed Moyle
ISACA Journal Article

The Digital Trust Imperative: Cybersecurity Is Still Critical

Cybersecurity is not all there is to digital trust, but it is a key component that should not be ignored or undervalued.

Author: K. Brian Kelley
ISACA Journal Article

Navigating the New Distributed Enterprise

Now that a hybrid or distributed workforce has become the new normal, it is imperative to ensure the digital trust, security and integrity of users, devices and assets, no matter where they physically reside.

Author: Timothy Liu
ISACA Journal Article

Redefining Enterprise Cloud Technology Governance

Cloud computing is a key enabler of digital transformation and is an important consideration in digital governance; therefore, it is important that greater emphasis is placed on cloud governance to ensure that it is aligned with future business requirements.

Authors: David Mazula and Casper Lamprecht
ISACA Journal Article

Building Cyberresilience From Collaborative Culture

Overall, collaboration allows enterprises to better understand the threat landscape, effectively deploy resources to deter threats, respond to attacks more effectively and recover more quickly.

Author: Joseph Cheng
ISACA Journal Article

The Illusion of Control and the Challenge of an Adaptable Digital Enterprise

Enterprise risk management should be positioned to address uncertainties by shifting attention from avoiding failure to understanding control as a dynamic balance between decreasing uncertainties and amplifying novel emerging behaviors.

Author: Jeimy Cano
ISACA Journal Article

Reducing Human and AI Risk in Autonomous Systems

To mitigate risk attributed to semiautonomous and fully autonomous systems, it is necessary to ensure that autonomous systems are designed and built to allay such fears by considering biases, ethics, fairness and trustworthiness as they apply to AI systems.

Author: C. Warren Axelrod
ISACA Journal Article

Case Study: Pivoting to Ecommerce During COVID-19 With SAP Commerce Cloud

For an organization to be successful in its business and become a leader in the market, it needs to be willing to use technology to initiate an effective digital transformation.

Author: Dhruv Aggarwal
ISACA Journal Article

Data Are the Lifeblood of Business: To Thrive Governance Must Drive Insight

This new reality of data as the lifeblood that flows through all aspects of an organization presents an unprecedented opportunity to create new business benefits, innovate and work more effectively.

Authors: Nina Bryant and Susana Esteban
Podcast

Seven Things to Know Before Automating IT General Control Audits

This podcast is a practical discussion with two IT Internal Auditors, Frans Geldenhuys and Gustav Silvo, that have automated IT General Controls across their highly diversified and decentralized group.

2 May 2023
Blog Post

The Science of Cybersecurity and its Future Challenges

Cybersecurity is a sub-discipline of computer science and a rigorous scientific approach should underpin the work of cybersecurity leaders and practitioners.

28 April 2023
Emerging Technology Article

Can AI Be Used for Risk Assessments?

To produce risk assessments with more accuracy, artificial intelligence (AI) can be used because one of its core competencies is data aggregation and interpretation.

28 April 2023
Blog Post

How the Relationship Between CISOs and Legal Teams is Changing

A closer relationship between CISOs and enterprise legal teams can help CISOs deal with increasing regulatory burdens, how to approach cybersecurity insurance and addressing liability in the event of data breaches.

27 April 2023
@ISACA Article

How Security Leaders Should Approach a Challenging Budgeting Environment

Tim Wallen, Regional Director, UKI & BeNeLux, for Logpoint, shares his perspective on current budgeting priorities and challenges for security leaders, AI security tools and more in this Q&A interview.

26 April 2023
Blog Post

Risk Assessment for Technical Vulnerabilities

Regardless of local regulations, risk assessment for technical vulnerability should supplement an organization’s existing comprehensive security risk assessment, not serve as a substitute.

26 April 2023
ISACA Journal Article

The Future of Cybersecurity Assessments Is Here

Data-driven security assessments are the next generation of cybersecurity assessments that organizations need to adapt to augment existing, traditional security assessments.

Authors: Karthik Sridharan, Jyothsna Chalasani and Pradeep Sekar
Blog Post

Pentagon Leak Case Shows that Insider Threats Remain a Prominent Risk

The recent high-profile Pentagon leak in the United States underscores the importance of defending against insider threats.

25 April 2023
Risk Article

Data Recovery Pitfalls to Avoid

There are 4 common false beliefs that should be dispelled to better protect organizations and their data.

25 April 2023
Blog Post

United Nations Meeting on the Status of Women Reveals True Gender Parity is Centuries Away

Women across the globe are finding ways to fast-track change and counteract concerning projections for how long it will take to truly erase gender disparities in the tech workforce and society as a whole.

24 April 2023
Blog Post

Gaining More Than I’ve Given Through ISACA Volunteering

Sunil Bakshi, of India, has relished sharing his expertise and exchanging ideas with members of ISACA's global community through his ISACA volunteer activities.

21 April 2023
Blog Post

ISACA Volunteer Starts Slow, Seizes Opportunities to Grow

A self-described introvert, Joyce Chua, of Singapore, says her volunteer activities with ISACA helped her build her speaking and collaborating skill set.

20 April 2023
Emerging Technology Article

Breaking Through the Barriers of Leadership

Although traditional gender dynamics and systemic inequality create substantial obstacles that are preventing women from achieving parity in leadership roles within the metaverse, there are also ways for women to break through barriers.

20 April 2023
@ISACA Article

Celebrating ISACA Volunteer Appreciation Week 2023

Combining micro and macro perspectives and developing an architect's mindset are among the keys to becoming proficient at framework modeling.

19 April 2023
@ISACA Article

Seven Tips for Achieving Dynamic Professional Transformation with Framework Modeling

Combining micro and macro perspectives and developing an architect's mindset are among the keys to becoming proficient at framework modeling.

19 April 2023
Blog Post

Volunteer Finds Resources He Needs ‘All Under One Roof’

Chetan Anand says ISACA has provided many of the knowledge resources he is looking for "all under one roof," and he gives back through extensive volunteering.

19 April 2023
ISACA Journal Article

ENISA’s Threat Landscape and the Effect of Ransomware

The blurred lines between cyberespionage and cybercrime, especially if state-sponsored actors carry out the attack, confirm that ransomware is a national security issue.

Author: Antonio Villamor
Blog Post

Volunteer Work Provides Fresh Perspectives for InfoSec Professional

Germany-based ISACA volunteer Julia Hermann says her volunteer work with ISACA has exposed her to new perspectives that have furthered her professional growth.

18 April 2023
Blog Post

Volunteering Pays Quick Dividends for Recent University Graduate

Han Jumashov has become an active ISACA volunteer after relocating to the United States from Turkmenistan to pursue his university degree and the beginning of his professional career.

17 April 2023
Blog Post

Award-Winner Creates a Culture of Innovation, Adaptability and Inclusion

ISACA Chicago Chapter President Ramona Ratiu reflects on her recent ISACA Inspirational Leadership Award and shares her leadership goals going forward.

14 April 2023
Podcast

Eight Cybersecurity Trends to Watch for in 2023

With the start of a new year, it is a key time for all organizations, small through enterprise, to examine their IT infrastructure and review cybersecurity policies.

14 April 2023
Blog Post

Why Team Training Leads to Big Business Benefits

Enterprise training can ensure team members are aligned in their decision-making and approaches for more effective team performance and communication with stakeholders.

13 April 2023
@ISACA Article

Five Key Considerations When Developing a Collaboration Strategy for Information Risk and Security

The key to success for CISOS, their organizations, and their information risk and security programs is collaborating with leaders, stakeholders, and individuals on common goals.

12 April 2023
Blog Post

How Automation Can Streamline Your Compliance Journey

Usage of compliance automation technology is rising as organizations that implement it experience a range of benefits.

12 April 2023
ISACA Journal Article

The Impact of Blockchain Technology on Accounting and Auditing

If the adoption of new technologies such as blockchain changes the process of conducting transactions, accountants and auditors should understand the changes to correctly reflect them in their work.

Author: Mohammad K. Elshqirat
Podcast

Industry Spotlight - Julia Kanouse

Get to know Chief Membership and Marketing Officer Julia Kanouse as she sits down with childhood best friend and ISACA VP Amanda Raible. The duo discuss everything from leadership to motherhood while competing in Mario Kart! Tune in!

12 April 2023
Blog Post

Interactive Tabletop Scenarios: A Comprehensive Approach to Strengthen and Assess Your Incident Response Strategy

Interactive tabletop scenarios, incorporating gamification, can make a big difference in sharpening organizations' incident response preparedness.

11 April 2023
Security Article

How Organizations Can Consistently Reduce Cyberrisk

Cyberrisk is an ever-changing parameter that requires constant analysis and is difficult to quantify.

11 April 2023
Blog Post

CMMI Updates Take Performance Improvements to the Next Level

The latest iteration of the CMMI model includes security, safety, data management, people management, and managing virtual workforce best practices.

10 April 2023
ISACA Journal Article

Auditing and Digital Transformation Are at a Crossroads

To help organizations sustain this fast-paced growth, the performance and resilience of enterprises‘ IT systems and controls must be assured through internal and external audit and assurance partners.

Author: Vimal Mani
Blog Post

Introduction to ICS/OT Systems and their Role in Critical Infrastructure

Industrial Control Systems/Operational Technology must be understood and secured effectively to avoid potentially disastrous impacts on critical infrastructure.

6 April 2023
@ISACA Article

How to Help a University Student Excel on the Internship Front

University students interested in internships need to be proactive to position themselves for the experiences they need to effectively jump-start their careers.

5 April 2023
@ISACA Article

What Detrimental Outcomes Might ChatGPT and AI-Powered Bing Unleash?

While ChatGPT and Bing AI have both been prominent examples of promising technology based on OpenAI, the related risks will require vigilance from digital trust professionals.

5 April 2023
Blog Post

How CMMI Cybermaturity Platform (CCP) can help your organization implement Zero Trust

ISACA's new eBook is a free resource to guide you on how to simplify the implementation of a Zero Trust strategy in your organization with the CMMI Cybermaturity Platform (CCP).

5 April 2023
ISACA Journal Article

Combatting Social Engineering

Although ransomware, data breaches and other large-scale cyberattacks are frequently in the headlines, it is too easy to overlook the common thread that runs through many of these incidents: social engineering.

Author: Chun Li
Blog Post

The Exciting Benefits of ISACA’s MDDAP VIP Portal

ISACA's Medical Device Discovery Appraisal Program (MDDAP) Voluntary Improvement Program (VIP) Portal launched to collaborators and stakeholders with exciting features and updates.

4 April 2023
Blog Post

Security Awareness Training: A Critical Success Factor for Organizations

Reducing chances of a data breach, supporting existing systems and increasing customer confidence are among the leading benefits of effective security awareness training programs.

31 March 2023
Blog Post

‘There is Hope’: Facebook Whistleblower Takes On Misinformation, Addresses Digital Trust

Facebook whistleblower Frances Haugen, who will be a keynote speaker at ISACA's upcoming Digital Trust World Boston conference, addresses misinformation and digital trust.

30 March 2023
Podcast

Conference Chats with Chelsey & Robyn

Tune in to listen to ISACA’s very own Chelsey Byrd and Robyn Franko as they discuss the upcoming fun at ISACA Conference North America 2023: Digital Trust World. 

30 March 2023
@ISACA Article

Tracking the Evolving Cybersecurity Jobs Landscape for 2023

Given a challenging economic environment, hiring in the cybersecurity field might focus more on strategic and critical roles in the coming months.

29 March 2023
Blog Post

Crypto Collapse and Democratizing Auditing

The proliferation of emerging technologies across domains and throughout all layers of an organization is leading to a democratization movement that is not yet well-understood, with IT audit playing a significant part.

29 March 2023
ISACA Journal Article

User Susceptibility to Social Engineering in AR Environments

The cutting-edge technology augmented reality has seen increasing use but the potential cybersecurity risk facing users of this technology remains a point of concern.

Author: Sarah Katz
Blog Post

Insights from a Privacy Jedi

Privacy expert Michelle Dennedy recently shared her insights on emerging privacy trends and key industry challenges in an Ask Me Anything session through ISACA's Engage platform.

28 March 2023
Risk Article

Social Media as a Growing Threat to the Workplace

Failing to prioritize the security and privacy of a social media account can result in negative consequences spanning both the personal and professional worlds.

28 March 2023
Emerging Technology Article

Understanding and Mitigating the Risk of AI vs. Traditional Software

It is crucial to understand what makes AI so different from traditional rule-based systems and how to address these differences.

27 March 2023
Blog Post

The Biggest AI Moment Ever for Cybercrime Just Happened

Cybersecurity professionals, beware: the theft and repurposing of powerful AI models is within cybercriminals' reach, and it could be a game-changer.

24 March 2023
Podcast

Advertising Information Security

In this episode, executive principal at Risk Masters International’s Steven Ross discusses why vendors of IT products and services are advertising information security...

24 March 2023
Blog Post

Compliance Automation Journey: Five Steps to Streamline Efforts, Identify Risks, and Improve Team Workflows

When implemented effectively, compliance automation can make a big difference in allowing teams to dedicate their time toward more impactful priorities.

23 March 2023
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 2

The updated versions of the ISO/IEC 27001 and ISO/IEC 27002 standards mean organizations have work to do to align their methods, protocols and workflows with the latest guidelines.

22 March 2023
@ISACA Article

The Urgent Need for AI in GRC and Security Operations: Are You Ready to Face the Future?

The growing prominence of artificial intelligence is surfacing new opportunities for GRC and security professionals but also calls for specialized technical expertise.

22 March 2023
Blog Post

Solutions for Digital Identification

While a universal solution for digital identification of internet users might not be realistic, finding solutions that are suitable in various situations is realistic and a worthwhile goal.

22 March 2023
ISACA Journal Article

Agile Manifesto for Internal Audit

The internal audit process must be responsive to internal enterprise changes to easily align with the evolution of the business and guarantee the effectiveness of audit operations.

Author: Luigi Sbriz
Blog Post

A Collaborative Approach to Cybersecurity

Since attackers often benefit from cooperative measures, it only makes sense for organizations to collaborate in their efforts to thwart cyberthreats, even if that has historically proven to be challenging.

21 March 2023
Podcast

The Future of Technology Risk: 4 Ways to Build Stakeholder Trust in the Technology Risk Imperative

Today, the pace of change across industries is quicker than ever before. Economic, political, and social unrest and a global climate crisis have placed unprecedented disruption and pressures on organizations looking to navigate a rapidly changing environment.

21 March 2023
Blog Post

Five Habits to Make Compliance Smoother for Lean Teams

Smaller organizations might find keeping on top of compliance activities to be challenging but there are several key habits that can help lean teams meet compliance responsibilities without feeling overburdened.

20 March 2023
Blog Post

As in Life, Digital Trust Is a Two-Way Street

It is not only organizations that have eroded trust – people have played a role, also, and both people and organizations need to be a part of fixing what is broken.

17 March 2023
Blog Post

Software-Defined Networking: The Future of Networking

Software-defined networking provides a modern solution to evolving access challenges that can be problematic for network administrators.

16 March 2023
Podcast

Measuring Security Resilience from the Lens of the Adversary Community

In a world where adversaries are constantly adapting to improve tactics, techniques, and procedures (TTPs), it is crucial to understand the unique traits and goals of various types of adversaries that actively seek to cause harm to an organization.

16 March 2023
@ISACA Article

Yes, Business Process Maps Are Boring

Documenting business processes and how money flows through the organization might not be glamorous but it is well worth the effort for security teams.

15 March 2023
@ISACA Article

IT Audit Buzzwords That Have Become Buzzkills to Clients and Process Owners

IT auditors can manage their engagements more effectively by ditching common buzzwords in favor of less combative language.

15 March 2023
ISACA Journal Article

Application of the Nudge Theory for Improving Information Security Awareness Campaigns

Study findings provide strong evidence for the applicability of the nudge theory in improving the effectiveness of information security awareness posters.

Author: Sudeep Subramanian
Blog Post

Top Risks and Rewards of Moving to the Cloud

Enterprises increasingly are moving to the cloud and seeing major benefits along the way, but it is important to weigh those gains against numerous cloud risks that need to be managed.

14 March 2023
Risk Article

A Road Map to Breaking Down Zero Trust Barriers

Zero trust provides an enterprise the opportunity to create a more robust and resilient security posture, simplify security management, improve the end user experience and enable modern IT practices.

14 March 2023
Emerging Technology Article

Standardization and Audit in the Blockchain Space

Standardization and audits play a crucial role in in mitigating the risk that organizations potentially face when implementing blockchain emerging technology.

14 March 2023
Blog Post

Influencing Security Decisions with Effective Communication

Effective communication makes a big difference in bolstering leadership buy-in for security programs.

13 March 2023
Privacy Article

Separating Privacy Awareness From Security Awareness Training

Having a privacy and security awareness training program is better than not having one at all, but having two focused programs addressing high-risk topics is beneficial to not only organizations, but employees as well.

13 March 2023
Blog Post

Assessing Culture With Help From the US Surgeon General

The importance of organizational culture is now understood to be a major factor in an organization’s overall success.

9 March 2023
Podcast

Risky Business – Jon Brandt

For the average person, life moves quickly. But for business leaders and anyone involved in any aspect of IT, the pace at which technology is changing is overwhelming.

9 March 2023
@ISACA Article

‘Dream Big and Dare to Try’

ISACA Auckland Chapter board member Abby Zhang shares her perspectives on her role as a SheLeadsTech ambassador, needed progress for women in the digital trust fields and her areas of interest as a security researcher.

8 March 2023
@ISACA Article

Key Security Features for SAP Analytics Cloud

SAP Analytics Cloud offers a wide range of security features and best practices to ensure the protection of data and functionality from unauthorized access.

8 March 2023
Blog Post

ISACA Foundation Takes Equity Message to White House Office of National Cyber Director

ISACA Foundation recently took its message of equity and inclusion to the White House.

8 March 2023
ISACA Journal Article

RPA Is Evolving but Risk Still Exists

There are many benefits and uses of robotic process automation, and the newest addition of command-and-control centers; however, implementing these tools can also lead to risk.

Author: Larry Wlosinski
Blog Post

Data Privacy: A Public Policy Challenge

Data privacy is not just about information security, governance or customer trust - it also is a public policy challenge.

7 March 2023
Governance Article

Why Are Regulations Demanding SBOM Adoption?

With the rise of software-based products, regulators have quickly implemented new standards to help manage the complexities of the software supply chain.

6 March 2023
Blog Post

Improved IT Frameworks

Frameworks and IT general control guidance should be reviewed periodically to keep up with industry best practices.

3 March 2023
Blog Post

LastPass Hack Highlights Importance of Applicable Acceptable Use Policies.

The recent LastPass breach reinforces that Acceptable Use Policies should not be overlooked or underestimated.

2 March 2023
@ISACA Article

Artificial Intelligence: The Future of Information Security Awareness | ISACA

Artificial intelligence will be the wave of the future when it comes to effective information security awareness training.

1 March 2023
@ISACA Article

Interviews. Pitch. Audition. Marathon! (Part 2)

A thoughtful, strategic approach to interviews will dramatically improve a candidate's chances to land job offers.

1 March 2023
Blog Post

Five Factors That Turn CISOs into Firefighters

Chief information security officers often find themselves doubling as firefighters - can it be avoided?

1 March 2023
ISACA Journal Article

Considerations for Developing Cybersecurity Awareness Training

it is important to implement effective cybersecurity awareness training to help employees understand proper cyberhygiene, recognize the security risk factors associated with their actions and identify cybersecurity incidents they may encounter in their work.

Author: Tan Soon Chew
ISACA Journal Article

Information Security Matters: Who Leads Cyberresilience?

Resilience is an enterprisewide undertaking and all functions must work together to achieve it.

Author: Steven Ross
ISACA Journal Article

IS Audit in Practice: Data Integrity On Demand

As a risk manager or audit professional, how does one assess data integrity for new and innovative business when time is of the essence?

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: API Sprawl and Emergence

Unforeseen outcomes represent a blind spot in our ability to plan and can undermine security or privacy, make it harder to provide validation, or decrease the effectiveness of governance.

Author: Ed Moyle
ISACA Journal Article

The Digital Trust Imperative: The Impact of Relationships on Trustworthiness

An organization's relationships, and the quality of those relationships, may be the keys to surviving an unexpected disruption.

Author: K. Brian Kelley
ISACA Journal Article

Is Detrimental Unexpected IT Emergence Inevitable?

Given the increasing pace of global IT development, it is important to understand if detrimental, unexpected IT emergence is in organizations’ control.

Author: Guy Pearce
ISACA Journal Article

The Potential Impact of the European Commission’s Proposed AI Act on SMEs

The use of artificial intelligence (AI) technology has been consistently growing in popularity; therefore, many countries are designing and implementing policy frameworks to address the use of AI with regard to its ethical and security-related impacts.

Authors: Jakob Gassauer and Gerald Burch
ISACA Journal Article

Identifying and Preparing for Interruptions, Disruptions and Emergence

It is important for information systems auditors to understand the nature of these interruptions, disruptions and emergence events to help their organizations to mitigate the adverse impact.

Author: Anantha Sayana
ISACA Journal Article

Cloud Computing Evolution and Regulation in the Financial Services Industry

It is crucial for financial institutions to understand the role played by cloud computing in the increasingly digitized banking world, how to mitigate the risk of depending on cloud services and the further development that may materialize through the rise of distributed ledger technology.

Author: Kilian Trautmann
ISACA Journal Article

Case Study: Taming Unruly Data to Improve Compliance

Through a very modest investment and reliance on the ingenuity of its problem-solving team, the on the ingenuity of its problem-solving team, the bank prevented its fictitious records problem from morphing into a big data disaster.

Author: Mick Brady
ISACA Journal Article

Digital Trust and the Audit Function

With the ever-increasing use of and reliance on the Internet, big data and disruptive technologies, digital trust has become a necessity due to its ability to measure confidence in an organization's ability to protect, store and secure data and personal information.

Author: Gopikrishna Butaka
ISACA Journal Article

Protecting Industrial Control System Software With Secure Coding Practices

The best way to ensure secure ICS software is to apply a security perspective throughout the software development life cycle—from design to code development through verification and operation.

Author: Matthew Scott
Blog Post

The Future of Technology Risk

Consider four ways to build stakeholder trust in the technology risk imperative.

28 February 2023
Privacy Article

The Difference Between Data Privacy and Data Security

When it comes to data privacy, most people think about recent events such as TikTok’s data harvesting activities, Cambridge Analytica’s use of Facebook data without consent and new privacy regulations being introduced globally.

28 February 2023
Security Article

Prepare for Success by Planning for Threat Actor Eviction

Before returning to business as usual after a breach, enterprises must ensure that all threat actors have been evicted from the network and are not able to enter again

28 February 2023
Blog Post

Five Powerful Quotes on the Black Experience in IT

Despite historically being underrepresented in many IT fields, Black professionals have made a huge impact on digital trust disciplines.

27 February 2023
Blog Post

The Competitive Advantages of Privacy and Trust

Sound practices in managing privacy and emerging technology implementations pays off for enterprises in creating trust with customers.

24 February 2023
Blog Post

Mindfulness Amid the Chaos

Anastasiia of the ISACA Kiev Chapter reflects on the difficult last year and the support the chapter has received from ISACA's global community.

23 February 2023
@ISACA Article

One Year Later: ISACA Ukraine Community Standing Strong

One year after their country went under attack, members of the ISACA Kyiv (Ukraine) Chapter continue to show great resiliency and garner support from ISACA chapters around the world.

22 February 2023
@ISACA Article

Seven Habits of Highly Skilled Digital Trust Professionals

The same habits that are associated with highly successful people can be applied to successful digital trust professionals, with a few additional twists to consider.

22 February 2023
ISACA Journal Article

The True Cost of a Data Breach

For chief information security officers looking to convey how serious data breaches could be to their organizations, translating them into economic impact is critical.

Authors: Natalie Jorion and Jack Freund
Podcast

Rethinking Identity Governance

SaaS is eating the world even more than we think. Companies are dealing with SaaS sprawl: hundreds of apps distributed across different owners that store sensitive data and which are used to orchestrate critical business workflows.

21 February 2023
Blog Post

Examining Information Privacy Realities Contradiction Theory

Allowing our information privacy violation tendency to outweigh our protection tendency because of our self-interests can prove problematic to ourselves and others.

21 February 2023
Blog Post

Making Risk Management for Agile Projects Effective

ISACA’s Incorporating Risk Management into Agile Projects white paper provides guidance for conducting risk assessment in an agile project context.

20 February 2023
Blog Post

Five Overlooked Benefits of Having an IT Certification

Some benefits to attaining certifications are obvious but there are many other benefits beneath the surface.

17 February 2023
Blog Post

Smoothing the Path for an Even Brighter Future for ISACA

ISACA continues to deliver on its digital trust vision while finding new ways to serve its global community.

16 February 2023
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 1

IT auditors and security practitioners should familiarize themselves with the updated ISO/IEC 27002:2022 Standard.

15 February 2023
@ISACA Article

Agile Methodologies Require Adjustments to Risk Management

A new ISACA white paper explores how Agile methodologies can benefit and help shape enterprise risk management.

15 February 2023
@ISACA Article

Beyond the Buzzwords: Specific Controls You Can Use

Industry buzzwords are commonplace, but what are the actual controls that audit professionals need to be familiar with to excel in their roles?

15 February 2023
Blog Post

Building Resilience with ISACA

Resilience has become top-of-mind throughout the digital trust fields since the pandemic. The ISACA community can be a great place to sharpen resilience on a number of fronts.

15 February 2023
ISACA Journal Article

NIST’s Privacy Framework for Proposed US Federal Privacy Law

Governments around the world are enacting data security and data privacy rules and regulations at an increasing pace that is forcing enterprises to react, respond and realign their businesses to meet these challenges.

Author: Valdez Ladd
Podcast

2023: The Year of Risk

A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation-state APTs.

15 February 2023
Blog Post

Data Protection and Its Impact on the Older Population

Impacts of GDPR and other data protection policies on the elderly population should not be overlooked.

14 February 2023
Risk Article

Integrated Risk Management in an Interconnected World

In this integrated world, it is no longer enough for an enterprise to manage risk strictly within its own borders.

14 February 2023
Blog Post

FedRAMP for ISVs: How Out-of-Scope Organizations Can Demonstrate Federal Compliance

Some software vendors don’t fall within the scope of FedRAMP and must identify alternate paths to compliance.

13 February 2023
Podcast

Career Coach Advice: How to Launch Your IT Audit Career

Career coach Caitlin McGaw will share her top tips for young professionals and career changes on how to launch a successful career in IT audit—from acing your first interview and landing your first job to career resources to help your career continue to grow and thrive.

10 February 2023
Podcast

How to Mature Your Privacy Compliance Program: A Conversation With OneTrust DPO Linda Thielova

Compliance with the world’s ever-increasing list of privacy laws can be a tricky undertaking for any organization, but by taking a few simple steps...

10 February 2023
Podcast

Improving Cyber Resilience in an Age of Continuous Attacks

We live in the age of continuous compromise. This podcast dives into why so many organizations continue to be breached even after spending money on cybersecurity point solutions.

10 February 2023
Blog Post

Governance, Processes and Planning: Three Significant Countermeasures to Being Hacked

Governance, processes and planning are three components of cybersecurity management that can address the people vulnerability.

9 February 2023
Blog Post

Three Key Predictions for 2023: The Year of Risk

The rise in importance of internal risk assessments is among the key trends that could shape the risk landscape in 2023.

9 December 2022
@ISACA Article

Implementing an Emerging Risk Analysis Process

Emerging risk analysis is an area more enterprises should prioritize, and it might be less difficult to implement than many realize.

8 February 2023
ISACA Journal

The Future of Cryptography: Performing Computations on Encrypted Data

Fully homomorphic encryption allows organizations to ensure their customers' privacy without undermining their ability to gain insights from their data.

Author: Devharsh Trivedi
Risk Article

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

By calculating vulnerability risk, enterprises can prioritize vulnerabilities based on risk level to help determine the order in which vulnerabilities are addressed.

7 February 2023
Blog Post

Major Challenges Ahead for GRC Professionals in 2023

GRC professionals will need to remain attuned to changes impacting the technology, regulatory and security landscapes to be effective in the year to come.

2 February 2023
@ISACA Article

Interviews. Pitch. Audition. Marathon!

Digital trust professionals typically remain in-demand even at times when economic conditions are not ideal.

1 February 2023
@ISACA Article

IT Certifications That Are Best for Beginners

Credentials aimed at boosting early-career professionals can equip digital trust professionals to successfully break into IT fields.

1 February 2023
@ISACA Article

Projecting Cybersecurity in 2023

2023 shapes up as another challenging - and interesting - year for security professionals

1 February 2023
Blog Post

Data Protection in Enterprises

Data protection is maturing toward a more holistic approach, with emphasis on meaningful datasets to enterprises and regulations.

1 February 2023
ISACA Journal Article

Help Source Q&A

How can the effectiveness of security awareness programs be measured?

Author: Sunil Bakshi
Risk Article

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

The beginning of a new year is the perfect time to reflect on the past year and assess any industry trends or upcoming events that could impact organizations.

31 January 2023
Blog Post

Third Party Audit Reports as the New Trust Currency

The compliance audit process can give third parties confidence in an organization’s ability to manage and govern information security and privacy.

30 January 2023
Blog Post

Assessing the Risk of Emerging Technology: Will Early Assessments Match Reality?

Implementation of emerging technologies requires organizations to rethink their approaches to risk assessment.

26 January 2023
@ISACA Article

Entering a New World of Digital Trust

A new conference series from ISACA will bring digital trust professionals together in 2023 in the US, Europe and virtually.

25 January 2023
@ISACA Article

The Career-Changing Impact of Mentorship

ISACA's Mentorship Program was highlighted in a recent ISACA Live conversation spotlighting the benefits of connection and professional growth.

25 January 2023
@ISACA Article

The Intersection of Trust and Employee Productivity

New research from Cerby suggests that by adopting zero trust principles and trust-positive initiatives, organizations can build digital trust with employees and consumers.

25 January 2023
Blog Post

CMMI Performance Continues to Impress, Improve

The CMMI Performance Report captures encouraging insights in business capability and performance objectives.

25 January 2023
ISACA Journal Article

Blockchain Smart Contracts, Part 3: Deployment and Integration With Existing Information Technology Systems

It can be challenging to integrate blockchain smart contracts with existing (legacy) IT systems.

Authors: Samuel Smith and Andy Garcia
Blog Post

Categorizing and Handling Sensitive Data

Organizations need to be intentional and diligent about how they classify and handle both regulated and unregulated sensitive data.

24 January 2023
Security Article

Common Misconceptions About Modern Ransomware

There are many misconceptions about ransomware attacks, often due to enterprises’ failure to adapt to changes in threat group tactics, techniques and procedures (TTPs).

24 January 2023
Blog Post

Recognizing the Hidden Risk and Quantifying Ethical Analysis When Governing Data

An ethics-based algorithm could be useful in moving data governance forward and accounting for overlooked risks.

23 January 2023
Blog Post

Modern Complexities of Cybersecurity

An ethics-based algorithm could be useful in moving data governance forward and accounting for overlooked risks.

20 January 2023
Podcast

ISACA Live: Advancing Digital Trust Through IT

On National IT Professionals Day, ISACA's Kevin Keh explains how IT professionals can advance digital trust in their organizations and in their industries.

19 January 2023
@ISACA Article

New ISACA Report Spotlights Privacy Benefits, Challenges

A new ISACA privacy report highlights key challenges and opportunities for practitioners in 2023.

18 January 2023
Blog Post

ChatGPT and Leveraging Artificial Intelligence in Auditing

ChatGPT is the latest example of how artificial intelligence can make a substantial impact for IT audit professionals.

18 January 2023
ISACA Journal Article

Why Enterprises Need Trust Assurance

To ensure that quality services and products are being delivered and to identify any partners who may be behaving unethically, enterprises need trust assurance.

Author: Vimal Mani
Podcast

Information Privacy Contradiction: Interest-Based Posture of Compliance and Violation?

Why do individuals, organizations, institutions, nations, or responsible agents work hard to preserve their personal and enterprise data, personnel information, trade secrets, intellectual properties...

18 January 2023
Blog Post

ISACA Mentorship Program Galvanizing Connections

The ISACA Mentorship Program is leading to new connections and professional growth around the globe.

17 January 2023
Blog Post

Sizing Up the Global State of Privacy

ISACA's Privacy in Practice 2023 report showcases areas for improvement when it comes to executive support, skills and staffing in the privacy field.

17 January 2023
Blog Post

Where Privacy Stands Five Years After GDPR

Five years after the GDPR regulation came onto the privacy scene, there is still much progress to make on the people, process and technology fronts for enterprises to be on sturdier ground.

17 January 2023
Audit Article

Key Considerations for Conducting Remote IT Audits

While remote auditing is nothing new, the COVID-19 pandemic and resulting need for social distancing fast-tracked the adoption of remote and hybrid audits.

17 January 2023
Blog Post

How to Ensure Your IT Objectives Align with Organizational Goals

Aligning IT initiatives to overarching enterprise business goals is important and measurable.

12 January 2023
@ISACA Article

How to Resource the CISO

The CISO position is challenging enough. It must be resourced properly to set up the CISO for success.

11 January 2023
@ISACA Article

Learning From Other People’s Mistakes

Sharing information about what is working and what is not working can be an overlooked ingredient for success for risk management professionals.

11 January 2023
Blog Post

Five Reasons to Make 2023 the Year to Pursue a Certification

Validation of knowledge and keeping pace with the fast-moving technology landscape are among the leading motivations to pursue an IT certification in 2023.

11 January 2023
ISACA Journal Article

Mitigating Technical Vulnerabilities With Risk Assessment

A risk assessment can prioritize which technical vulnerabilities are most critical, allowing an enterprise to allocate the appropriate resources to fix or patch these vulnerabilities in a timely manner.

Author: Tan Soon Chew
Blog Post

Ransomware Looms Large on Third-Party Risk Landscape

Due diligence and sound risk management are essential to help enterprises prepare for ransomware and other threats involving third-party relationships.

10 January 2023
Security Article

Eight Cybersecurity Trends to Watch for in 2023

As 2023 approaches, it is an opportune time for organizations of all sizes to examine their IT infrastructure and review their cybersecurity policies.

10 January 2023
Blog Post

The Importance of Embedding a Culture of Privacy by Design

Organizations can gain a competitive advantage by taking deliberate measures to implement privacy by design.

9 January 2023
Blog Post

How I Survive Imposter Syndrome

Dealing with imposter syndrome can be even more challenging for those living and working in countries in which they are not native speakers.

6 January 2023
Blog Post

In Search of Great Data Candidates

Identifying the best candidates for data-focused roles can go a long way toward improving an organization's risk profile.

5 January 2023
@ISACA Article

Candidates Beware: Red Flags to Avoid when Preparing for and Taking an ISACA Exam

Creating trust in the exam process and results is crucial for certification candidates to demonstrate their accomplishments.

4 January 2023
@ISACA Article

ISACA Puts Forward Ransomware Audit Program | ISACA

ISACA’s ransomware audit program provides foundational information, practical guidance and approaches to preparing for and recovering from a ransomware-related incident.

4 January 2023
@ISACA Article

The Perennial New Year’s Question: Should I Stay or Should I Go?

The start of a new year for some professionals means time to think about whether they intend to stick with their current job or pursue a new opportunity.

4 January 2023
Blog Post

How Cyber Pathways Can Help Your Career

The Cyber Pathways Framework could have a significant impact in resolving the ongoing skills crisis in the cybersecurity field.

4 January 2022
ISACA Journal Article

Understanding, Assessing, Aligning and Transforming Organizational Culture

Culture is crucial for nearly every enterprise; a strong culture can lead to a successful organization and a lack of culture can cause an organization to be unsuccessful.

Author: Mark Tarallo
Security Article

What Is Your IP Address Cybersecurity IQ?

Now more than ever, security professionals need a thorough understanding of the IP addresses that seek to access their networks.

3 January 2023
Podcast

Beware the Traps of Data Governance and Data Management Practice

Guy Pearce joins ISACA’s Lisa Villanueva for a conversation about the traps of Data Governance and management.

3 January 2023
Podcast

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Numerous laws and regulations have been passed to protect sensitive information, both at the federal and state level, creating a patchwork of requirements for companies to comply with.

3 January 2023
ISACA Journal Article

Guest Editorial: Dear Readers

As a long-time member, I am excited to see ISACA commit to digital trust to help organizations and individuals build and benefit from a safer and more secure digital world.

Author: Rinki Sethi
ISACA Journal Article

Information Security Matters: Advertising Information Security

I am concerned that people at large will come to believe that information security can be achieved simply by buying it. Yes, tools are important, but the program that chooses and uses those tools is paramount.

Author: Steven Ross
ISACA Journal Article

IS Audit in Practice: Building Digital Trust Through Advocacy

Growing skills through formal programs in hopes of increasing the talent pool of qualified professionals would institutionalize consistent learning for the profession and assist in standard and repeatable digital trust attributes.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Infrastructure as Code—Digital Trust Enabler?

In situations where there is new technology in the offing, it is incumbent upon the practitioner to both objectively analyze that risk and also evaluate that technology for its potential in reduction of risk and to help enable trust.

Author: Ed Moyle
ISACA Journal Article

The Digital Trust Imperative: Defining, Establishing and Measuring Digital Trust

Given that digital trust is an abstract concept, we do need to define it as clearly as possible. We also need some means of determining how trustworthy an organization is in the digital ecosystem.

Author: K. Brian Kelley
ISACA Journal Article

Reality Check: The Use of Big Data and Predictive Data Models

The power, precision and affordability of predictive models are increasing based on the increasing volume and availability of data in general and the computing power of the cloud.

Author: Kevin Alvero
ISACA Journal Article

Toward Rebuilding Data Trust

Poor data management in general, and poor data quality in particular, can have negative impacts on data trust and, thus, on digital trust.

Author: Guy Pearce
ISACA Journal Article

How to Digitally Verify Human Identity: The Case of Voting

The excess of information used for identification is contrasted with the need to respect the fundamental rights and freedoms of people’s privacy and in particular their right to protect their personal data.

Author: Luigi Sbriz
ISACA Journal Article

Extending Zero Trust to the End User Ecosystem

There are significant gaps in current approaches to achieving digital trust, and to address these gaps, organizations need to expand security perimeters to fit into a digital trust framework.

Author: Gideon Hazam
ISACA Journal Article

Looking Inside the Magical Black Box: A Systems Theory Guide to Managing AI

With the widespread use of AI, this technology affects most of humanity; therefore, it may be time to take a systemwide view to ensure that this technology can be used to make ethical, unbiased decisions.

Authors: Simona Aich and Gerald Burch
ISACA Journal Article

Case Study: Performing a Cybersecurity Audit of an Electric Power Transmission Systems Operator

Most countries in the world consider electricity transmission and distribution infrastructure and services fundamental parts of their critical infrastructures. 

Authors: Bostjan Delak and Miroslav Kranjc
ISACA Journal Article

Business and Technology Drivers for Decentralized Cloud Systems

Decentralized cloud systems offer a remedy for lack of data ownership and control, data breaches and security risk, increasing storage costs and low transmission speed.

Author: Robert Putrus
Blog Post

The New, Emergent CISO

The CISOs of the future will have to combine a wide range of technical and business skills to rise to the many challenges they will face.

30 December 2022
Blog Post

The Main Challenges of Effective Risk Management

Risk management can be a tremendous asset for organizations when the right processes and methodologies are applied to overcome key challenges.

28 December 2022
ISACA Journal Article

Are IT General Controls Outdated?

When testing IT general controls, additional controls related to security assessments, data asset protection, secure data transit, endpoint protection, vulnerability monitoring, security monitoring and secure disposal should be considered for the relevant application, database, operating system and network components in the IT environment.

Author: Jouke Albeda
Blog Post

Addressing Selective Compatibility

Today's methods of authentication are likely to become less reliable going forward, making selective compatibility all the more relevant.

22 December 2022
Podcast

Do Data Go To Waste

The Impact of SOX on the Industry 20 Years Ago and Today. Opponents of Sarbanes Oxley, (SOX) contend the law is too costly for companies to operationalize given the small benefit that SOX regulation provide.

22 December 2022
@ISACA Article

Cybersecurity: What is Changing and What Isn’t

ISACA member Sourya Biswas shares his perspective on how the cybersecurity and risk professions are evolving, the role security can play in advancing digital trust and what challenges the future will present.

21 December 2022
@ISACA Article

Facial Recognition Technology and Privacy Concerns

Privacy and security risks need to be addressed as facial recognition technology becomes more prevalent and usages for the technology expand.

21 December 2022
Blog Post

Top Cyberattacks of 2022: Lessons Learned

Major 2022 data breaches involving Optus, Uber and Neopets led to many lessons learned for security practitioners and business leaders.

21 December 2022
ISACA Journal Article

When Data Protection Is a Hindrance Rather Than a Facilitator

Data protection has become a catch-all excuse for poor service—a problem that can only be solved with a mixture of transparency (both governmental and organizational) and regulatory initiatives.

Author: Rupert Brown
Audit Article

Seven Things to Know Before Automating IT General Control Audits

There are 7 major takeaways from an audit automation process.

20 December 2022
Blog Post

The Future of Skills: Preparing for Industry 4.0 and Beyond

Industry 4.0 brings great potential to transform the IT professional landscape.

16 December 2022
Blog Post

Quantifying the Qualitative Risk Assessment: Using Data to Inform Judgment

The technology field is ripe for quantification support for qualitative judgments.

15 December 2022
@ISACA Article

50 Years and an Impactful Future for the ISACA Journal

The ISACA Journal is wrapping up its 50th anniversary year while remaining committed to providing key guidance for the ISACA community in the future.

14 December 2022
@ISACA Article

Addressing Professional Ethical Dilemmas

Stakeholders prefer to do business with reputable enterprises that conduct themselves ethically, meaning digital trust professionals must keep ethical considerations top-of-mind as they conduct their work.

14 December 2022
@ISACA Article

How Digital Trust Professionals Can Thrive in a Challenging 2023

2023 shapes up as a challenging year for digital trust professionals, who can face a dynamic and fast-changing set of circumstances in fields such as IT audit, risk management, privacy and cybersecurity.

14 December 2022
Blog Post

All systems are GO!

Enterprises need to shift their mindset from 'cyber incident' to 'crisis management,' especially in an era when ransomware and other threats are present dangers.

14 December 2022
ISACA Journal Article

The Information Privacy Contradiction

Information privacy policies, regulations and enforcement mechanisms would better serve society if information privacy realities contradiction considerations were integral to policy formulation and legislative enactment from the onset.

Author: Patrick I. Offor
Security Article

Improving Cyberresilience in an Age of Continuous Attacks

It is now more important than ever to constantly develop and mature cybersecurity readiness. A holistic and integrated approach with the right tools can provide a better chance of surviving a cyberattack.

13 December 2022
Podcast

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation, and a looming recession, it is clear that the world has entered a new era of risk.

13 December 2022
Blog Post

Talent Transformation Strategies for Security Leaders to Address the Cybersecurity Workforce Challenges

Investing in a strong security culture and adopting a growth mindset are among the approaches that can help organizations transform their strategy for dealing with cybersecurity talent shortages.

12 December 2022
Blog Post

Five Actionable Success Tips for Risk Professionals in 2023

What organizational risks should risk management professionals be sure to keep in mind as we head toward 2023? Kerris Lee provides tips for the new year for risk practitioners.

8 December 2022
@ISACA Article

ISACA Fielding 2023-24 ISACA Board of Directors Nominations

ISACA is seeking new directors for upcoming board term.

7 December 2022
@ISACA Article

The Unheard Story of Lost Anonymity

If there are so many benefits of removing anonymity from the internet, then why not do so? The answer to this question is directly related to the meaning of the internet itself.

7 December 2022
Blog Post

Five Actionable Success Tips for Privacy Professionals in 2023

More and more organizations are realizing that privacy programs must be appropriately prioritized and resourced, a reality that will only become more striking in 2023.

7 December 2022
ISACA Journal Article

Using FLOSS to Implement COBIT for I&T Governance

Free/libre open source software (FLOSS) can be used to achieve greater freedom along with vendor independence and financial benefits in enterprise software portfolios.

Authors: Laura Jaime and João Barata
Blog Post

Five Actionable Success Tips for Security Professionals in 2023

Creating a personal incident response plan is a good place to start when security professionals consider how they can thrive in 2023.

6 December 2022
Audit Article

AI Ethics and the Role of IT Auditors

It is critical that ethics be given careful consideration when designing, operating and auditing AI systems.

6 December 2022
Blog Post

Five Actionable Success Tips for Audit Professionals in 2023

Looking toward 2023, IT audit professionals will need to increasingly focus on cloud environments and privacy engineering to keep pace with the changing technology and regulatory environment.

5 December 2022
Blog Post

Dialing in the Data

Building cyber resilience can be an uphill battle for many organizations given the proliferation of data and the fast-evolving threat landscape.

2 December 2022
Podcast

Meeting Attackers Where They Are

The world's largest software companies leverage modern-day Red Teams to protect against real-world attacks. Many companies focus on vulnerability management, compliance, and patching to secure themselves, but this is only a tiny part of the big picture.

2 December 2022
Blog Post

Achieving Resilience at ASEAN-Japan’s Cybersecurity Capacity Building Centre

Much can be learned from the way the ASEAN-Japan’s Cybersecurity Capacity Building Centre deployed several procedures to reduce the COVID-19 pandemic’s effects on operations.

1 December 2022
@ISACA Article

Preventing Privacy by Design from Becoming a Privilege

Privacy risks are on the rise due to the proliferation of data, putting greater emphasis on privacy by design.

30 November 2022
Blog Post

Identity and Access Management: The Nonhuman View

As digital transformation sweeps across organizations, the technologies that are the foundation of that transformation need access.

30 November 2022
ISACA Journal Article

Establishing Enterprise Roles for Data Protection

There are clear challenges associated with how specific types of data need to be safeguarded, stored and shared on a need-to-know basis, and data governance mechanisms provide guidelines for these practices.

Authors: Sai Krishnan Mohan and Ranganath Iyengar
Blog Post

Which Cybersecurity Roles Pay the Best?

Cybersecurity talent remains highly in-demand, leading to several roles that command high salaries.

29 November 2022
Security Article

How Cyberprofessionals and Threat Actors Have Changed Over the Decades

As threat actors get bolder and more creative, cybersecurity professionals must attempt to stay 1 step ahead.

29 November 2022
Podcast

Taking Security Strategy to the Next Level: The Cyber Kill Chain vs. MITRE ATT&CK

In an era of rampant ransomware and other malicious cyberattacks, it’s mandatory to double down on cybersecurity analysis and strategy to ensure an optimal security posture and the protection of critical assets and data.

29 November 2022
Blog Post

Five Mistakes to Avoid When Preparing for a Certification Exam

Avoiding some common mistakes can make for a more successful certification exam experience.

28 November 2022
@ISACA Article

Five Key Components of an Application Security Program

An effective application security program can significantly reduce the presence of new vulnerabilities, which, in turn, enhances application security.

23 November 2022
@ISACA Article

The Board’s Role in Advancing Digital Trust

Board role in digital trust article: Digital trust is a topic that requires ongoing tone-setting, backing and direction from the board of directors.

23 November 2022
Blog Post

What Do the ISO 27001 Updates Mean for Your Business?

"After nine years of certifications, ISO has released an updated version for one of the most popular frameworks in the cybersecurity environment."

23 November 2022
ISACA Journal Article

Adding a New KPI to Determine Whether Directors and Officers Have Met Their Legal Duties

Information security and privacy teams need an easy-to-adopt, readily deployed, inexpensive and fully scripted compliance audit process to arrive at a new key performance indicator.

Author: Charles Cresson Wood
Blog Post

Digital Native Organizations Are Energizing Organizational Design

Digital native organizations are ahead of the curve when it comes to enabling digital transformation and modernization.

22 November 2022
Risk Article

How to Use Cyberthreat Intelligence to Proactively Reduce Cyberrisk

The ability to proactively learn about the tactics and capabilities of an attacker provides an excellent opportunity to prevent the attacker from entering the fort or doing any damage to the fort’s walls.

22 November 2022
Podcast

Auditee Buy-In—A Key Component of Effective Audits

As you plan and execute your audit, do you take time to invest in the stakeholder relationship? This can be an often-overlooked element but essential in an effective audit.

23 November 2022
Blog Post

5G Privacy Implications

Enterprises must consider the risk of 5G adoption on the front end and be proactive about working through potential privacy and security implications.

21 November 2022
Blog Post

How Knowledge Workers Can Convince Employers to Sponsor IT Certifications and Professional Growth

Employers can support their employees' professional development by sponsoring their professional certifications and providing ongoing training resources.

18 November 2022
@ISACA Article

ISACA Certification Referral Program Underway

ISACA's certification referral program allows certified professionals to earn rewards while also helping to strengthen digital trust professions.

16 November 2022
@ISACA Article

ISACA White Paper Highlights 5G Privacy Landscape

Privacy threats related to 5G must be addressed to ensure the technology's transformative potential is not counterbalanced by unintended problems.

16 November 2022
Blog Post

Applying Enterprise Risk Management to Cyberrisk

The rise of ransomware has increased the stakes for enterprise risk management and cyber risk.

16 November 2022
ISACA Journal Article

Benefits and Challenges of Implementing Cross-System SoD Monitoring Using SAP GRC

Cross-system user-level segregation of duties risk analysis between SAP and non-SAP systems provides insight into the access risk that prevails in the user base and helps remediate it through appropriate mitigation controls or the removal of conflicting access.

Author: Snedhal D. Pandya
Blog Post

‘Putting Out Fires’ and Maturing Your Privacy Compliance Program

As privacy regulations continue to take effect, enterprises must mature their privacy compliance programs.

15 November 2022
Security Article

What Makes a Good Cybersecurity Professional?

A shift into a cyber career can be part of an impactful journey into helping protect the world around us.

15 November 2022
Blog Post

Audit Essentials for Driving Efficiency and Value

Each audit has a lifecycle, from planning to execution to conclusion, and each phase in the audit lifecycle requires multiple steps to be executed effectively.

14 November 2022
@ISACA Article

What is the Connection Between IT Certifications and Salaries?

IT certifications can help digital trust professionals qualify for a job with a higher salary across IT audit, cybersecurity, risk management, data privacy and related fields.

9 November 2022
Blog Post

The Impact of a Hybrid Workplace on Security

Although the shift to the hybrid workplace has been a sea change for IT and security teams, new advances in security concepts and solutions hold the potential to smooth out the transition.

9 November 2022
ISACA Journal Article

Optimum Security Cognizance Through People, Process and Behavior Transformation

The importance of cybersecurity in enterprise ecosystems is constantly being communicated to the workforce to create awareness, which helps enterprises reduce their attack surfaces.

Author: Vimal Mani
Podcast

Breaking Down the ESET T2 2022 Threat Report

In this ISACA Podcast episode, ESET’s Chief Security Evangelist, Tony Anscombe, joins ISACA’s Principal, Emerging Technology Professional Practices, Collin Beder to discuss ESET’s recently released T2 2022 Threat Report.

9 November 2022
@ISACA Article

Generosity: Good as Gold, in Your Life and Career

Being generous with your time and talent can lay the foundation for a successful and rewarding career.

7 December 2022
Blog Post

Solving Security and Privacy Concerns in Emerging Technology

Personal data are more exposed than ever in the evolving emerging technology landscape but are often insufficiently protected from being stolen.

7 November 2022
Blog Post

Seven Key Steps to Build Digital Trust

The path to stronger digital trust includes key steps such as understanding customer expectations and going beyond checking boxes.

4 November 2022
Podcast

Enabling Digital Trust through Canada's Digital Charter

Data are the lifelines of a digital economy. They drive innovation, enabling cutting-edge research and next-generation technologies, including artificial intelligence (AI)...

4 November 2022
Blog Post

Five Quick Tips for Taking ISACA Certification Exams

ISACA certification-holders share their tips and guidance for success on ISACA certification exams.

3 November 2022
@ISACA Article

Building (or Improving) a Risk Assessment Program

There are essential considerations with which a risk assessment program must be designed to help an enterprise achieve its security posture goals.

2 November 2022
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

A new white paper from ISACA provides guidance on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

2 November 2022
@ISACA Article

Plan to Make 2023 Your Best Career Year Yet

Now is the time to begin planning in earnest for career success in 2023.

2 November 2022
Blog Post

A Pilot’s Lofty Goal of Building Trust Through Audit

ISACA member Osama Abbas is a champion for digital trust in his role as head of audit while finding time for his aviation passion in his free time.

2 November 2022
Security Article

Cybersecurity Strategies to Enable Digital Trust

Cybersecurity is an enabler of digital trust and a key success factor of the digital transformation journey.

2 November 2022
ISACA Journal Article

Trustworthy Tactics for Unlocking the Value of Genetic Data

An enterprise that manages a large amount of sensitive information is subject to a complex patchwork of laws and regulations, including privacy regulations, laboratory regulations, human subject protection requirements and ethical considerations.

Author: Mick Brady
Podcast

It's About (Down) Time

In this ISACA Podcast episode, Risk Masters International's Steven Ross tells ISACA's Collin Beder that organizations should start focusing on hours of unavailable systems and data when measuring the cost of a cyber-attack.

2 November 2022
Blog Post

Keep Your Dream of Becoming a CISA Alive

Candidates who struggle on their first try to pass the CISA certification exam can still reach their goal with perseverance and some tweaks to their preparation.

1 November 2022
Privacy Article

Preparing Organizations for Saudi Arabia’s New Data Protection Law

Technologies are constantly evolving, more devices are being connected to the worldwide network, data are becoming more important than ever, and countries are taking data privacy more seriously, putting data into consideration in jurisdiction strategies.

1 November 2022
ISACA Journal Article

Letter From the CEO

As the ISACA Journal concludes its 50th anniversary year, it is a great time to both reflect on the past and get excited about the future...

Author: David Samuelson
ISACA Journal Article

Information Security Matters: Convergence—Where Next?

Does this convergence of specialties enhance or vitiate the effectiveness of each of them individually? The answer depends on whether IT control is a zero-sum...

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Do Data Go to Waste?

Data management is built on accuracy and relevance, and both characteristics are the mainstay of an IS auditor’s inspection criteria.

Author: Cindy Baxter
ISACA Journal Article

Innovation Governance: Balancing Innovation With Data Protection

Innovation does not give license to bypass the usual questions that are asked when we have more time. It requires us to answer or evaluate them more quickly.

Author: K. Brian Kelley
ISACA Journal Article

Essential Assumptions for Effective Data Security

For data security efforts to be effective, it is critical that people in all areas and levels of the enterprise operate under five key data security-related assumptions.

Authors: Kevin Alvero and Brian Alvero
ISACA Journal Article

Scaling the Future of Collecting Internal Audit Interview Evidence

New technology offers the potential to cost effectively collect large interview data sets using an automated auditing interview process with virtual interviewers.

Authors: Matthew D. Pickard and David A. Wood
ISACA Journal Article

Beware the Traps of Data Governance and Data Management Practice

Data-driven decision-making can never entirely be about making decisions based on hard data as opposed to intuition, observation or guesswork because most data are never in a perfect state...

Author: Guy Pearce
ISACA Journal Article

The Future of Privacy: Insights From the EU Digital COVID Certificate

The development of the EU Digital COVID Certificate (EUDCC) offers some insights into what the future may hold for managing individual privacy while supporting the effective use of information.

Authors: Till Mueller and Gerald F. Burch
ISACA Journal Article

Sponsored: To Stay Relevant, InfoSec Must Strengthen Its Business Partnerships

To effectively manage digital risk, InfoSec professionals and business leaders must work in tandem to increase their mutual risk understanding and mitigation efforts.

Author: John Wheeler
ISACA Journal Article

An Ethics-Based Algorithm for Governing Data Ethics

Data quality is a crucial issue to data protection, and data bias is a hidden nuance to protecting that quality—data governance is needed.

Author: Wanbil W. Lee
ISACA Journal Article

Case Study: Driving Digital Transformation Through COBIT

Based on a foundation of COBIT, CBN has achieved synergy across the organization as it relates to IT projects and their place in enterprise risk and strategy as a direct result of improvements and...

Author: Katie Teitler
ISACA Journal Article

Performing Risk Assessments of Emerging Technologies

Emerging technologies represent a major source of risk, and their complexities make those risk areas especially difficult to assess.

Authors: Michael Kelly and Adeline Chan
Blog Post

How to Safely Share Your Business’s Online Videos

Finding the right balance between security and convenience is key for businesses when it comes to sharing their videos online.

28 October 2022
Blog Post

Finding or Building the Right Framework for Your Organization

Organizations face a challenge in understanding which framework will deliver the most value in an era of increased regulatory and business challenges.

27 October 2022
Podcast

How Social Engineering Bypasses Technical Controls

We are subjected to phishing scams almost daily, and even the most seasoned professional must examine an email to ensure the links included are safe.

27 October 2022
Podcast

ISACA CyberPros – Naomi Buckwalter

Executive Director of Cybersecurity Gatebreakers Foundation, Naomi Buckwalter, joins ISACA’s Jon Brandt to discuss burnout.

27 October 2022
Podcast

What Makes Risk Assessments So Unpleasant and How to Change That

Ryan Cloutier's child came home from school one day and told him that he had figured out the staff Wi-Fi password. Frustrated that the security wasn't better for a school network, Ryan decided to do something about it.

27 October 2022
@ISACA Article

Top Three Mistakes IT Security Teams Still Make

Common mistakes that limit security teams' effectiveness include piecemeal patch management, a lack of incident response plans and insufficient monitoring.

26 October 2022
Blog Post

Cyber Ratings as Measures of Digital Trust

As the profession of cybersecurity continues to mature, it inevitably will borrow from other disciplines that have developed mature practices. The credit rating profession has much to offer cybersecurity as it attempts to support the overarching need for the creation of digital trust.

26 October 2022
Governance Article

How Responsible for IT Governance Is the BoD?

With a fresh look at the importance of the role of the BoD and other stakeholders in IT governance, it is time for boards to take advantage of the opportunity offered by IT governance to create value in their organizations.

26 October 2022
ISACA Journal Article

The Changing Information Systems Landscape Creates New IT Risk

Audit needs to evolve to address the technological advances and changes in the information systems landscape.

Author: Sriram Balalsubramanian
Blog Post

Smarter Testing Equals Safer Digital Experiences

Tighter alignment of testing with the software development lifecycle and better modeling of real-world adversary threats has allowed Adobe to become more DevSecOps-minded in its application security testing.

25 October 2022
Blog Post

Risk Appetite vs. Risk Tolerance: What is the Difference?

By demystifying the risk appetite and risk tolerance terms, it is easier to explain and integrate these concepts within enterprise risk management frameworks.

4 October 2022
Risk Article

Taking a Risk-Based Approach to Pen Testing

The results of penetration (pen) tests are also worth examining using a risk-based approach.

24 October 2022
Blog Post

How Risk Transformation Enables Enterprise Success

Risk expert Luma Badran recently led an ISACA Engage community discussion of topics including risk transformation, best practices for the three lines of defense, internal audit, operational risk management and cybersecurity insurance.

21 October 2022
Blog Post

‘Privacy Is Not Dead, But It Is Dying’

Menny Barzilay will be a keynote speaker for ISACA Conference Asia 2022, to take place virtually 16-17 November, presenting on “The Dark Future of Privacy.” Barzilay, an internationally recognized cybersecurity expert and CTO of the Interdisciplinary Cyber Research Center at Tel-Aviv University, recently visited with ISACA Now to discuss privacy mining, deep fakes, digital trust and more.

20 October 2022
Security Article

How to Create an Enterprise OT Cybersecurity Program

As the importance of cybersecurity grows in the public eye, many organizations are considering leveling up their security postures with operational technology (OT) cybersecurity programs.

20 October 2022
@ISACA Article

A Proactive Plan to Shore Up the IS Audit Talent and Skills Gap Early

Effectively addressing the skills gap among IT auditors will require new approaches on the part of HR teams, hiring managers and across the organization.

19 October 2022
@ISACA Article

How Important Is Source Code Escrow?

When escrow is required, organizations should ensure that system documentation and source code are comprehensively covered.

19 October 2022
@ISACA Article

Top Five Reasons to Upskill Your Team Together

Across the digital trust professions, organizations can upskill their teams, improve retention and demonstrate to employees that they value their professional development by participating in enterprise training programs.

19 October 2022
Blog Post

Exploring the Relationship Between IT Certifications and Salaries

Certifications can have a big impact on IT professionals' salaries and career advancement opportunities.

19 October 2022
ISACA Journal Article

5G Innovations and Cybersecurity Risk

It is critical for practitioners to understand 5G’s risk factors such as unique identifiers, software-defined networking (SDN) vulnerabilities, and interoperability’s impact on strong access control.

Author: Blake Curtis
Blog Post

Cloud Governance and Security Imperatives

Organizations that can strike a balance between their strategic objectives and security needs will be well equipped for success in their cloud implementations.

18 October 2022
Podcast

Quantifying the Qualitative Risk Assessment

In this ISACA podcast episode, IT Risk Director and Senior Vice President Mike Powers and IT Segment Risk Manager Julie Ebersbach discuss using the qualitative risk assessment as part of an organization's enterprise risk framework, focusing on using data to inform subjective judgments.

18 October 2022
Blog Post

The Cybersecurity Skills Gap: Dispelling Misconceptions

The workforce challenge organizations often perceive as a cybersecurity skills gap is more accurately a failure to take advantage of the people and resources that should be better utilized.

17 October 2022
Blog Post

What is the ROI from Enterprise Training?

The return on investment from enterprise training extends well beyond the financial to areas such as mitigating risk and helping organizations become more agile and resilient.

14 October 2022
Risk Article

Higher Education, the Pandemic and the Need to Strengthen the Risk Framework

There is a need for oversight and controls to be revisited in certain higher education institutions.

13 October 2022
Podcast

Gaining More Actionable Intelligence Using a Smarter Security Data Lake

In today’s dynamic world of distributed computing and cloud-scale systems, traditional security data platforms and tools such as SIEM typically fall short of actually delivering the intelligence needed to better adapt to the rapidly changing threat landscape.

13 October 2022
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

New guidance from ISACA provides context on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

12 October 2022
@ISACA Article

Mentor Magic: How To Make Mentorship Work for Your Career

Mentorship can play a valuable role in advancing digital trust professionals' careers, but being mentored effectively is not as simple as just showing up to have coffee.

12 October 2022
@ISACA Article

Shifting the Paradigm for Women in Tech

ISACA member Esanju Maseka recently attended a Women in STEM conference organized by the Zambia National STEM Foundation. Maseka visited with the @ISACA newsletter to recap what she learned and provide her perspective on efforts to address the gender disparity in the tech workforce.

12 October 2022
Blog Post

A COBIT 2019 Use Case: Financial Institutions in Georgia

The COBIT framework has some key applications in the financial sector as demonstrated by a recent use case in Georgia.

12 October 2022
Privacy Article

Detecting Insider Threat Behaviors Using Social Media Platforms

It is important for IT professionals to understand the availability of social media data and methods that can be used to identify possible insider threats using machine learning and the privacy and policy implications pertaining to it.

12 October 2022
ISACA Journal Article

A Step-by-Step SoD Implementation Guide

Segregation of duties is central to achieving compliance with laws and regulations and assuring shareholders that proper governance is applied, and it is included as an activity in COBIT.

Author: Stefano Ferroni
Blog Post

How to Transition from General IT to Cybersecurity

For IT professionals looking to transition to a cybersecurity career, there are several promising pathways to position themselves for success in cybersecurity.

11 October 2022
Security Article

Cybersecurity Is a Top Priority for Pharmaceutical Organizations

The pharmaceutical industry is taking critical measures to enhance its cybersecurity posture.

11 October 2022
Podcast

Industry Spotlight with Ali Pabrai

There is no denying the passion that ecfirst's CEO, Ali Pabrai has for cybersecurity. In this ISACA Podcast, Ali tells ISACA's Hollee Mangrum-Willis that after all his years in the industry, he is still more excited than a two-year-old at the entrance to Disneyland.

11 October 2022
Blog Post

Securing Patient Data Is Paramount in the Post-Pandemic Era

Securing patient data and complying with HIPAA laws may seem like a challenge, but there are several steps your organization can take to combat a cyber incident.

10 October 2022
Governance Article

How to Conclude Governance System Design

The dynamics of the external and internal effects on organizations demand a flexible and customized governance system adapted to the specific needs of the organization.

10 October 2022
Blog Post

The Social and Psychological Consequences of Ransomware Attacks

Organizations focus on the financial loss and disruption to services caused by ransomware attacks, but there are significant social and psychological effects that are often overlooked.

7 October 2022
Audit Article

Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat

As a purposeful partnership with internal or external resources, co-sourcing simultaneously meets enterprise objectives and facilitates upskilling.

7 October 2022
Blog Post

How To Apply Process Mapping Synergy Gains for Business Continuity and Disaster Recovery

Process mapping from disaster recovery and business continuity planning can help improve enterprises' overall business resiliency.

6 October 2022
Podcast

Audit in Practice - Auditing Culture

What’s The Risk LLC’s Cindy Baxter sits down with ISACA’s Robin Lyons to discuss auditing culture, which can be one of the most interesting areas to audit.

6 October 2022
Podcast

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity incidents like ransomware can potentially bring operations to a standstill. Recent regulatory changes by the FTC and proposed changes by the SEC show that both agencies are drafting cybersecurity rules similar to ERM concepts.

6 October 2022
@ISACA Article

ISACA Provides Guidance for More Sustainable Workforce

A volatile workforce, accelerated by the COVID-19 pandemic, has made operational resilience a rising priority for enterprise leaders.

5 October 2022
@ISACA Article

Top ISACA Cybersecurity Content from 2022

October is Cybersecurity Month and a great time to catch up on some of the top cybersecurity content ISACA has produced so far in 2022.

5 October 2022
Blog Post

Navigating Privacy and Compliance Post-Dobbs Ruling

A variety of healthcare, data privacy and security issues have emerged since the recent Dobbs ruling that have impacted and will continue to impact both businesses and individuals in the United States.

5 October 2022
ISACA Journal Article

Addressing the Complexities of Cybersecurity at Fintech Enterprises

Fintech organizations can become significant players impacting the entire financial system, and regulators cannot afford to let them fail.

Author: Komitas Stepanyan
Podcast

Implementing Artificial Intelligence: Capabilities and Risk

University of Florida's Ivy Munoko is passionate about AI and has plenty to share regarding implementation and usage, but ISACA's Collin Beder asks, "is it ethical"?

4 October 2022
Podcast

Incident Report & Continuous Control Monitoring

This episode of the ISACA Podcast is all about incident reporting. Lesotho Postbank's Relebohile Kobeli talks to ISACA's Collin Beder about mitigating risk, minimizing losses from events, and good communication.

4 October 2022
Blog Post

The Impact of Cybersecurity on Consumer Behavior

New ISACA data on consumer attitudes about cybersecurity reveal there is much work to be done for enterprises to earn the trust of customers and stakeholders.

3 October 2022
Blog Post

Five Major Auditing Challenges in Cloud Computing and How to Overcome Them

Top challenges for auditing the cloud start with identifying cloud usage and controlling and monitoring user access.

30 September 2022
Blog Post

Advancing Digital Trust on Capitol Hill, in Parliament and Beyond

ISACA leaders recently have taken their digital trust message to government officials from the UK, Ireland and the United States.

29 September 2022
Podcast

Industry Spotlight with Lisa Young

Netflix's Lisa Young started as a bank teller that learned tech by fixing and servicing ATMs, which transitioned to her joining the network ops field and leading her to...

29 September 2022
@ISACA Article

Internet-Exposed Protocols Remain Easy Entry Point for Attackers

To help IT leaders assess their risk posture and attack surface visibility, new research has been conducted about network protocols that are exposed to the public internet.

28 September 2022
Blog Post

A CISA Top Scorer’s Tips to Feel Prepared for the CISA Certification Exam

Angelina Kahn-Dubois, the top Certified Information Systems Auditor (CISA) certification exam scorer for 2021, offers tips for success on the CISA exam.

28 September 2022
ISACA Journal Article

Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design

Organizations should take the lead to follow the privacy by design approach by proactively embedding privacy into the design and operation of technology systems, infrastructure and business practices.

Author: Saravanan Gurumurthy
Blog Post

‘Piecemeal Approach’ Insufficient to Create Digital Trust

Matt Chiodi, chief trust officer at Cerby and a member of ISACA's Digital Trust Advisory Council, and Karen Heslop, ISACA's vice president of content development, provide their perspectives on ISACA's State of Digital Trust 2022 report.

27 September 2022
Podcast

Defending Data Smartly

Some industry watchers estimate that by 2025 the collective data of humanity will reach 175 Zettabytes. ISACA's Jon Brandt invites Dr. Chase Cunningham (aka Dr. Zero Trust) to discuss how to defend the ever-growing amount data...

27 September 2022
Blog Post

The Importance of Organizational Resilience in an Age of Immense Change

Organizational resilience has become increasingly top-of-mind for enterprises in the era of The Great Resignation.

26 September 2022
Blog Post

Audit Approaches for Enterprise Databases

Ensuring enterprises can achieve their business objectives without concerns about sensitive data security is a value-add proposition for internal audit departments looking to perpetuate their role as trusted advisors to executive management.

23 September 2022
Security Article

Addressing SAP Security Gaps

SAP requires high-level consideration, or critical elements of the business will be vulnerable to malicious cyberactors—with no apparent response.

22 September 2022
Privacy Article

Privacy Considerations During Mergers and Acquisitions

When news was announced that Amazon acquired iRobot, the enterprise that makes Roomba robot vacuums, many privacy advocates expressed concern.

22 September 2022
Podcast

Ethical AI Shifting the Conversation Left

Many organizations prioritize goals such as gains and profits, which often require rich data sets, but fail to consider the eventual impact of their data handling methodologies on foundational social justice issues.

22 September 2022
@ISACA Article

The Three Lines of Defense as a Means to Foster, not Inhibit, Collaboration

To the extent that digital trust practitioners draw upon the three lines of defense as a support or discussion point, we need to be ready to explain it in a way that doesn’t make others feel like their role in the risk management equation is diminished.

21 September 2022
ISACA Journal Article

Addressing Intentional Threats Using Risk Assessment

Cyberspace must be considered a hostile environment. Although it has enormous potential, threats are always present, even in the most protected virtual worlds or within home networks.

Author: Luigi Sbriz
Blog Post

Five Key Takeaways from ISACA’s State of Digital Trust 2022 Report

Key takeaways from ISACA's State of Digital Trust report show how organizations must prioritize, measure and collaborate to make strengthening digital trust a reality.

20 September 2022
Podcast

Why (And How to) Dispose of Digital Data

Bassel takes us on a deep dive into digital data with ISACA's Safia Kazi on the five stages of data disposal in this ISACA podcast episode.

20 September 2022
Blog Post

Giving Data Integrity Its Place on the Podium

Data integrity, one of the key technology risk factors identified in recent IT audit research conducted jointly by ISACA and Protiviti, is crucial to the decisions that enterprises make in the course of routine business.

19 September 2022
Blog Post

How MDDAP Improves Product Quality

By helping medical device manufacturers better understand and sharpen their capabilities, ISACA’s Medical Device Discovery Appraisal Program (MDDAP) is advancing device quality and patient outcomes by driving toward a culture of continuous improvement.

16 September 2022
Blog Post

Digital Trust: The Key to Successful Transformation

Today’s digital economy is driven by innovation. The companies that are able to find new ways to serve their customers, often enabled by implementation of emerging technologies, are the ones best positioned to thrive.

15 September 2022
Security Article

The Circle of Failure: Why the Cybersecurity Industry Does Not Work

The cybersecurity industry has failed. The evidence is everywhere and overwhelming. Anyone who understands that the industry was founded on the fundamental objective of preventing IT systems from breaches and data theft can surely agree that it has failed. Those who do not agree are not paying attention.

15 September 2022
Podcast

Industry Spotlight with Johann Dettweiler, Part II

In this ISACA podcast episode, we connect with TalaTek Director of Operations Johann Dettweiler to discuss his almost two decades of experience across multiple industry fields, his involvement in FEDRAMP compliance, and why the next generation should focus on adding certifications to their resumes.

15 September 2022
@ISACA Article

Digital Trust: The Convergence of Privacy and Security

ISACA's recent State of Digital Trust survey reinforces that privacy and security should complement each other to help organizations advance digital trust.

14 September 2022
@ISACA Article

ISACA Foundation Scholarship Program to Help Bridge Talent Gap

ISACA Foundation is helping support underrepresented professionals in digital trust fields through its scholarship program.

14 September 2022
Audit Article

Auditee Buy-In—A Key Component of Effective Audits

In business, auditors are often portrayed as the bad guys. From an external audit perspective, auditors enter an organization with no true relationship with, or connection to, the auditee. The

14 September 2022
ISACA Journal Article

Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts

The rapid development of blockchain technology and cryptocurrency has influenced the financial industry by creating a new crypto economy, which has been compounded by next-generation decentralized applications that do not involve a trusted third party.

Author: Pinkal Shah
Blog Post

How To Communicate Risk in a Way Leadership Can Understand

The key to effectively communicating risk is aligning risks to the company's business objectives.

13 September 2022
Blog Post

How Secure is Your Data? A New Way of Looking at Data Privacy Compliance

Recent data privacy compliance regulations, along with existing ones, present a whole new dimension in the world of regulatory compliance requirements for banks/financial services across the globe.

12 September 2022
Blog Post

The Customer’s Responsibility in the Cloud Shared Responsibility Model

The cloud shared responsibility model model can help relieve customers’ operational burdens as the cloud service provider operates, manages and controls the host operating system, infrastructure components and actual physical security of the facilities.

9 September 2022
@ISACA Article

Rookie Success Factors: Career Advice from the ISACA community

Career Corner columnist Caitlin McGaw compiles a treasure trove of early-career tips and guidance for rising digital trust professionals.

7 September 2022
@ISACA Article

Strategies to Customize and Implement COBIT Best Practices

The COBIT framework is often most valuable for organizations when it is customized to address the specific business challenges the user is addressing.

7 September 2022
Blog Post

Privacy: A Key Component of Building Digital Trust

The key relationship between privacy and advancing digital trust was explored in a recent ISACA Live episode with Safia Kazi and Betsie Estes.

7 September 2022
Risk Article

Enabling Digital Trust With Canada’s Digital Charter

Data are the lifelines of a digital economy. They are driving forces for innovation, enabling cutting edge research and next generation technologies including artificial intelligence (AI), robotics and the Internet of things (IoT).

7 September 2022
ISACA Journal Article

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity risk is a critical enterprise concern. Cybersecurity incidents such as ransomware have the potential to bring an organization’s operations to a standstill.

Author: Tom Schneider
Blog Post

AI Ethics and eXplainable AI (XAI): Much Easier Said Than Done

More artificial intelligence (AI) proponents are proposing that integrating ethics with AI will result in better customer engagement with the technology

6 September 2022
Podcast

Achieving Effective Cloud Risk Management

Cloud is ubiquitous now. From small enterprises to large companies, all are moving a part of their technology operations to cloud. Initial reluctance is now nowhere to be seen.

6 September 2022
Blog Post

A Fan of Diverse Experiences

ISACA member Varun Prasad works with tech companies of varying sizes to help build digital trust by addressing the security and privacy compliance requirements of customers and other stakeholders.

2 September 2022
Security Article

Taking Security Strategy to the Next Level

In an era of rampant ransomware and other malicious cyberattacks, it has never been more important to double down on cybersecurity analysis and strategy.

2 September 2022
ISACA Journal Article

Letter From the SVP of Publishing

The ISACA Journal is consistently cited by ISACA members as one of the most valued benefits of their membership package.

Author: Shannon Donahue
ISACA Journal Article

Information Security Matters: It’s About (Down) Time

It is important that we stop measuring the cost of cyberattacks only in the number of records breached and start focusing on hours of unavailable systems and data.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Auditing Culture

Is there a way that the risk management and audit professions can get through the soft, unquantifiable information to produce actionable recommendations?

Author: Cindy Baxter
ISACA Journal Article

Help Source Q&A

What are the essential personal skills IS auditors should possess to effectively carry out audit work?

Author: Sunil Bakshi
ISACA Journal Article

It Is Time to Stop Haunting the Ghost in the Machine!

Digitally native enterprises have found that there are better ways to organize their people than the haunted and dated organizational design paradigms that were first practiced long before the rise of the modern...

Author: Guy Pearce
ISACA Journal Article

Auditing Your Organizational Culture

How does an internal audit team conduct a culture audit, especially when the subjectivity of culture can take auditors out of their comfort zones?

Author: Kevin M. Alvero
ISACA Journal Article

How Social Engineering Bypasses Technical Controls

When the widespread availability of information is enhanced by the excessive compulsion by some people to engage in excessive sharing on social media, social engineers can have a field day.

Author: Allen Ari Dziwa
ISACA Journal Article

Case Study: Adopting RiskOps to Streamline Governance and Risk Management

This case study provides insight into Highmark Health’s transition to RiskOps and highlights some of its immediate process improvements, including capacity creation to address emerging risk...

Authors: Chuck Donina and Kathleen S. Hartzel
ISACA Journal Article

Against the Quantum Threat: Selective Compatibility

Selective compatibility is achieved through a set of technical tools, processes and protocols that allow a conditional connection between several information systems...

Authors: Jean Jacques Raphael, Jean Claude Célestin, and Eric Romuald Djiethieu
ISACA Journal Article

Quantifying the Qualitative Technology Risk Assessment

Some risk assessments may be entirely quantitative, but most enterprises find an exclusively mathematical approach flawed and subject to manipulation and bias.

Authors: Julie Ebersbach and Michael Powers
ISACA Journal Article

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Could cybersecurity implementation benefit from a US Sarbanes-Oxley Act of 2002 (SOX)-type approach?

Author: Mike Tomaselli
ISACA Journal Article

Building Resilient Security in the Age of the Great Reshuffle

Enterprises should revisit their strategies for managing the cybersecurity workforce and build resilient environments with a focus on learning and development, job rotation, security culture and investment in people.

Authors: Prakash Renduchintala, Rohitha Chowdhary and Pradeep Sekar
Podcast

Industry Spotlight with Dr. Blake Curtis, Part II

Author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

1 September 2022
@ISACA Article

Better Approaches for Protecting Data

A new ISACA white paper provides guidance on how organizations can evolve their approach to data protection to keep up with the threat landscape.

31 August 2022
Blog Post

Cloud Computing — What IT Auditors Should Really Know

Given the growing reliance on cloud computing, internal audit should adopt a proactive approach to cloud initiatives and position the department as a trusted advisor.

31 August 2022
Blog Post

ISACA Kenya Chapter to Support Vulnerable Children in CommunITy Day 2022

ISACA's annual CommunITy Day of global volunteering is coming up on 1 October, with chapters around the world preparing to make their impact at the local level.

30 August 2022
Podcast

Industry Spotlight with Dr. Blake Curtis, Part I

Author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

30 August 2022
Blog Post

IT Audit Field Provides ‘So Many Options’ for Early-Career Professionals

Jeff Burke shares his experience as a new IT auditor and describes why IT audit is a promising career path for rising professionals.

29 August 2022
Governance Article

GRC Programming: The Third-Party Security Web

Governance, risk management and compliance (GRC) are growing disciplines with continuously changing identities.

29 August 2022
ISACA Journal Article

Bias and Ethical Concerns in Machine Learning

Artificial intelligence (AI) has evolved rapidly over the past few years. A decade ago, AI was just a concept with few real-world applications, but today it is one of the fastest-growing technologies, attracting widespread adoption.

Author: Niral Sutaria, CISA, ACA
Blog Post

Mapping a Serial Rug Pull Scammer on Binance Smart Chain

Rug pull events can be detected and analyzed using publicly accessible blockchain explorers, online analytical tools and data repositories.

26 August 2022
Risk Article

The Key(s) to Writing Good Risk Statements

To effectively manage risk at an organization, risk must be identified and analyzed by an information systems professional.

26 August 2022
Blog Post

Shifting the Paradigm to Protect Your Data

ISACA's new white paper, "Defending Data Smartly," goes beyond solutions for protecting your organization’s data, also exploring challenges across information technology, compliance, privacy and governance.

25 August 2022
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part II

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry. Having realized the value of information at an early age, Arnulfo has forged his path within the IT community.

25 August 2022
@ISACA Article

The Quantum Computing Threat: Risks and Responses

An ISACA expert panel shares their views on quantum computing threats and the related implications for cybersecurity practitioners.

24 August 2022
Blog Post

International Standards: ISACA Update on ISO Governance and Management Standards Initiatives

ISACA recently participated in meetings to review and update several ISO governance and management standards.

24 August 2022
ISACA Journal Article

ASEAN’s Resilience in Capacity Building

In 2018, the Government of Japan and the Association of Southeast Asian Nations (ASEAN), agreed to establish the ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC)1 to train at least 700 cybersecurity personnel to counter cyberthreats and close the cybersecurity skills gap.

Authors: Thongchai Sangsiri, Araya Sawasdichai, Issara Amornkraisee and Kamonchanok Chaiyakun
Blog Post

Breaking Into the IT Industry: IT Degree and Certification

Earning IT certifications can make a big difference in both salary and job opportunities for early-career professionals, and can also serve as a strong complement to IT degree programs.

23 August 2022
Blog Post

Ethical Artificial Intelligence and Machine Learning By Design: A New Standard to Doing Business

Several foundational steps can be taken for organizations by adopting an ethical artificial intelligence and machine learning lifecycle to move toward standardizing ethical technology implementations.

22 August 2022
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part I

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry.

22 August 2022
Blog Post

Approach to Auditing a Core Banking System

Auditing core banking systems successfully requires due diligence on a wide range of control tests.

19 August 2022
Risk Article

Does Your Organization Need a Security Risk Assessment?

The enterprise risk assessment and enterprise risk management processes comprise the heart of the information security framework.

19 August 2022
Blog Post

A Five-Step Process to Help Organizations Achieve Operational Resilience

Operational resilience is far more than having business continuity planning in place and conducting disaster recovery drills; it requires strategic decision-making when planning, identifying, defining, working, testing, monitoring and re-defining multiple parameters.

18 August 2022
@ISACA Article

Digital Trust Takes a Village

Digital trust is a team sport, requiring engagement throughout the organization at all levels. Digital trust also extends outside of the organization to business partners and vendors.

17 August 2022
@ISACA Article

Mentorship Program Making Valuable Connections

The ISACA Mentor Program facilitates one-to-one mentorship connections and brings together ISACA members at all stages of their careers who want to give or receive professional development support.

17 August 2022
@ISACA Article

The Evolution of Bots and How to Defend Against Them

Bots have become more sophisticated over time, upping the degree of difficulty for practitioners to ensure they do not undermine digital trust.

17 August 2022
Blog Post

Title Bias – The New Form of Bigotry in The Workplace

Title bias occurs when someone treats another person differently because they don’t hold a specific title or position in an organization, and it can badly damage workplace culture.

17 August 2022
Security Article

Improved Visibility Means More Effective Security Tools

When it comes to evaluating the efficacy of security tools, the first question many people ask is “How do I know if my enterprise’s security tools are protecting sensitive data?”

17 August 2022
ISACA Journal Article

Matching Microsoft Security Tools With the Cyber Kill Chain

Among the many security tools and products Microsoft provides, there are a number of mechanisms that are built into the operating systems and enterprise software.

Author: Aleksandr Kuznetcov
Podcast

Current State of Cybersecurity in K12

ISACA's Director of Professional Practices and Innovation Jon Brand hosts Doug Levin, co-founder and National Director of K12 Security Information eXchange (K121 SIX), a national non-profit dedicated solely to helping schools protect themselves from emerging cybersecurity threats.

16 August 2022
Blog Post

Burned Out: InfoSec Professionals Sound the Alarm

According to a recent survey, almost a third of infosec professionals want to quit the cybersecurity profession due to burnout within the next 12 months. Can we save our industry from a mass resignation before it’s too late?

15 August 2022
Blog Post

Creating, Not Predicting, the Future

ISACA Europe Conference keynote speaker Stefan Hyttfors visited with ISACA Now to discuss some of his favorite themes—the future, emerging technology and trends in globalization and sustainability.

12 August 2022
Podcast

Industry Spotlight with Todd Fitzgerald

Cybersecurity leader, author, and host of the CISO Stories podcast, Todd Fitzgerald sits down with ISACA’s Chelsey Byrd to discuss his extensive career journey in security...

12 August 2022
Blog Post

My CISM Exam Journey

Laura Tate Zannucci shares her experience preparing for the CISM certification exam, including tips and guidance on what proved to be successful tactics.

11 August 2022
Podcast

ISACA Live: Advancing Digital Trust Through Audit and Assurance

A strong audit and assurance function is critical to achieving digital trust in an organization. This conversation spotlights audit's role in digital trust and outlines key priorities. It also shares new ISACA resources for auditors.

11 August 2022
@ISACA Article

Cyberinsurance Is Still Expensive

There are certain immutable laws of economics, though not all of them are well received. One such law is the mechanism by which organizations price their products and services.

10 August 2022
@ISACA Article

New Credential Prepares Early-career IT Audit Professionals

A new credential from ISACA gives those seeking a strong foundation in IT audit knowledge the chance to accelerate their early-career prospects.

10 August 2022
Blog Post

Advancing Technology as a Human Right

Code Your Dreams was recognized with the ISACA Technology for Humanity Award for leadership in empowering the next generation of civic-minded technologists.

10 August 2022
ISACA Journal Article

Blockchain Smart Contracts, Part 2: Applications and Recommendations

Media attention on blockchain exploded in 2021, with major news outlets reporting on governments’ adoption of blockchain and associated smart contract systems such as central bank digital currencies (CBDCs) and egovernment

Authors: Samuel Zaruba Smith and Andy Garcia
Blog Post

My Path to a Career in Cybersecurity

Dr. Joseph J. Burt-Miller Jr. says experience, certifications and degrees form the "cyber triangle" to spark career growth in the cybersecurity field.

9 August 2022
Risk Article

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation and a looming recession, it is clear that the world has entered a new era of risk.

9 August 2022
Podcast

Managing Security Across Disparate Database Technologies

We usually think about the most efficient way to do things while working in production environments. Still, often employees forget about an insecure environment once the work has been completed and they have moved on to another project.

9 August 2022
Blog Post

Auditors in a ‘Perfect Position’ to Further Digital Trust

IT auditors are an important part of the digital trust equation since they are able to give organizations confidence in the processes and business relationships that they have in place.

8 August 2022
Blog Post

Eight Steps to Manage the Third-Party Lifecycle

Managing third parties is a relationship that must be managed throughout the third-party management lifecycle, from identification and screening to offboarding.

5 August 2022
Blog Post

Advancing Digital Trust Through Collaboration

To address the biggest challenges in the technology field, Priya Mouli, Director at PwC’s Cybersecurity Consulting practice yhinks there needs to be more collaboration and cooperation among the public and private sectors and groups globally.

4 August 2022
Podcast

Implementing Emerging Technologies: Agile SDLC Still Works

AI is a part of our everyday life. What's The Risk LLC's Cindy Baxter gives ISACA's Kevin Keh examples of modern media like the movies Free Guy, Ron’s Gone Wrong and The Matrix...

4 August 2022
@ISACA Article

Rocket Fuel for Your Career: Stories that Inspire, Influence and Build Your Brand

“My boss tells amazing stories. I could listen to her for hours.” I was talking with an IT audit manager at a global pharma company when she made that comment.

3 August 2022
@ISACA Article

Do Your Policy Documents Represent Current Practices?

Process owners are subject matter experts who understand processes, procedures and controls in place, whether documented or not. However, auditors usually go by the maxim that “If it’s not documented, it does not exist.”

3 August 2022
@ISACA Article

New Member Benefit: Risk Scenarios Starter Pack

Well-developed risk scenarios providing a realistic and practical view of risk that may prevent an enterprise from achieving its business objectives are especially valuable in today’s fast-moving and often volatile business landscape.

3 August 2022
Blog Post

Sharpen Your Machine Identity Management

New technologies are regularly implemented into IT infrastructure in this era of digital transformation, placing increased importance on sound machine identity management (MIM).

3 August 2022
ISACA Journal Article

Blockchain Smart Contracts, Part 1: Introduction for Accounting and Auditing Professionals

Blockchain smart contract technology is having and will continue to have a significant impact on accounting and auditing.

Authors: Samuel Zaruba Smith and Andy Garcia
Blog Post

How Much Trust Should You Give Digital Identity Identification?

Digital identity is a necessity. It should be simple and accurate as well as easily eliminable. Users should be able to expect control over the dissemination of their personal data.

2 August 2022
Blog Post

How to Build a Data Science Team Within the Internal Audit Function

Data science is a growing and evolving force in different functional areas of business, and the internal audit function is no exception.

1 August 2022
Blog Post

Building Our Security Coordination Center (SCC) Hunting Program

When many companies think about network security, they usually think in terms of firewalls, anti-virus software, intrusion detection systems, and multi-factor authentication (MFA).

29 July 2022
Podcast

ISACA Live: Managing Supply Chain Risk with Richard Hollis

ISACA's risk expert Paul Phillips and Richard Hollis, CEO of Risk Factory and an ISACA Conference Europe speaker, examine top cyber risks impacting the supply chain, steps organizations...

29 July 2022
Blog Post

Supply Chain Security: Where Do We Go from Here?

ISACA risk expert Paul Phillips and CEO of Risk Factor Richard Hollis discussed key challenges influencing supply chain security in an episode of ISACA Live last week. Their conversation was supported by insights from ISACA’s recent survey, Supply Chain Security Gaps: A 2022 Global Research Report.

28 July 2022
Security Article

The Power of Provenance

While next-generation firewalls, extended detection and response (XDR) and other security solutions do a great job of detecting and thwarting cyberattacks, it is all too common for a sneaky or camouflaged threat to slip through into the network.

28 July 2022
@ISACA Article

Insider Threats: What Needs to Be Done?

In the information and cybersecurity domain, it is well-documented and much discussed that the most significant threat to an organization often stems from its own employees.

27 July 2022
@ISACA Article

The Midgame Could Be Beginning of End for Ransomware Perpetrators

The growing impact of ransomware attacks on organizations has been staggering in recent years.

27 July 2022
Blog Post

Data Resilience Is the Cornerstone of Digital Resilience

Digital resilience is the outcome of organizational action taken to rapidly deploy or modify digital technologies to address the negative impact of shocks—such as the pandemic—in the interests of maintaining organizational sustainability.

27 July 2022
ISACA Journal Article

Governance of Key Aspects of System Patch Management

When a pop-up notification prompts a user to update their system with the latest patch, the response is often to click on the Remind Me Later option.

Author: V. J. Srinivas
Blog Post

Changes Needed to US Federal Privacy Proposal for Effective Implementation

My Privacy & Security Brainiacs team has been tracking US federal bills proposed by Congress that mention privacy in some way.

26 July 2022
Security Article

SaaS Security Risk and Challenges

The hybrid work model imposed by organizations during the height of the COVID-19 pandemic triggered many enterprises to accelerate moves to cloud-based services for better resilience and efficiency.

26 July 2022
Podcast

Industry Spotlight with Pam Nigro

On this episode of Industry Spotlight, ISACA's outgoing Board Chair, Greg Touhill, introduces the 2022-23 Board Chair, Pam Nigro.

26 July 2022
Blog Post

Addressing Security Risks to Medical IoT Devices

The Internet of Things (IoT) enables millions of smart devices worldwide that are connected to the internet to collect, process and share data.

25 July 2022
Blog Post

Mea Clift: ‘A Force of Nature’

ISACA member Mea Clift advances digital trust in her work but also makes time for some old-fashioned personal pursuits.

22 July 2022
Risk Article

What Makes Risk Assessments So Unpleasant and How to Change That

“I would love to complete a security risk assessment,” said no one, ever. Many people would agree that performing and reviewing security risk assessments are not particularly enjoyable, especially for IT and security teams that are already overworked, understaffed and burned out.

22 July 2022
Podcast

The Impact of People on Information Technology Landscape

In this episode, ISACA’s Jon Brandt chats with Thomas Lenzenhofer, Business Development Manager at Cisco, about his new ISACA article titled, “The Impact of People on Today’s Information Security Landscape.”

22 July 2022
Blog Post

Know Your Risks – and Your Friends’ Risks, Too

In today’s globally connected world, organizations are finding themselves at a greater risk than ever of a supply chain compromise.

21 July 2022
Blog Post

Purple Teaming: The Next Gen Pen Test

It’s pen test time again. Time to get updated quotes from vendors and put something on the schedule ahead of the compliance deadline, but will this year’s results be any different than last time?

20 July 2022
@ISACA Article

Stop Losing Cyber Talent and Start Leading with Why

At a time when 60 percent of cybersecurity firms report difficulty retaining cyber talent, I would like to introduce a new method for increasing employee engagement and retention. In this article, you’ll learn to apply techniques from agile to guide your organization in connecting their work to the company’s overall purpose.

20 July 2022
ISACA Journal Article

The Top-Five Audit Essentials for Driving Efficiency and Value

Audit teams often struggle to determine why projects get delayed, and they fail to understand resulting client concerns

Author: Sushma Uniyal
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

20 July 2022
Blog Post

Persevering Through a Seismic Industry Shift

Eventcombo was recognized this year with the ISACA Innovative Solutions Award “for enabling community connections and continuing education virtually during a global pandemic through innovative EventTech solutions.”

18 July 2022
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

18 July 2022
Blog Post

What Can Internal Auditors Do to Increase Cybersecurity Audit Effectiveness?

Cybersecurity has topped the list of critical risk for organizations for the fifth time in both the European Confederation of Institutes of Internal Auditing’s (ECIIA’s) 2022 Risk in Focus report and the Institute of Internal Auditor’s (IIA’s) OnRisk 2022 report.

15 July 2022
Emerging Technology Article

Mitigating Cryptocurrency’s Carbon Footprint

In today’s rapidly evolving finance industry, organizations can either change and thrive or fall behind the market competition. One of the most discussed evolving trends in finance is cryptocurrency.

15 July 2022
Blog Post

Why You Can’t Afford to be Reactive About Cybersecurity and Compliance

There has been a very clear change in awareness and overall attitude toward cybersecurity and compliance in recent years.

14 July 2022
Podcast

Smarter Testing = Safer Digital Experiences

Application testing is a critical component of a software development lifecycle. A complete testing battery for any application includes not only functionality and usability testing but security and reliability testing as well.

13 July 2022
@ISACA Article

Five Key Considerations When Developing a Security Strategy for IoT and OT

The Internet of Things (IoT) and operational technologies (OT) significantly expand the threat and vulnerability landscape for organizations that choose to adopt them. The notion of “You are only as strong as your weakest link” took on a new meaning when IoT and OT devices and capabilities were introduced.

13 July 2022
@ISACA Article

ISACA Sponsors the First International Cybersecurity Challenge

The European Union Agency for Cybersecurity (ENISA), together with sponsors including ISACA, created and hosted the first International Cybersecurity Challenge (ICC) in Athens, Greece from 14-17 June this year. This challenge was designed to attract young talent in the cybersecurity community and to bring global attention to the education and skills needed in cybersecurity professions.

13 July 2022
@ISACA Article

Stop Passing the Privacy Hot Potato

The privacy function remains relatively new at most organizations. While the implementation of major regulations such as GDPR and CCPA in recent years helped elevate privacy’s stature, many organizations are still in the mode of, “I have to do this thing, but I don’t really know what this thing is, or how it will impact my organization.”

13 July 2022
Blog Post

Characterizing System Security Engineering Using a Business Impact Analysis

As adversaries continuously seek to disrupt, cause harm and wreak havoc on complex digital assets, enterprises must strategically plan, design and build secure, trusted systems.

13 July 2022
Audit Article

The Evolution of Internal Audit in a Digital-First Environment

When leaders at a new digital bank were putting together a job description for their first chief audit executive (CAE), they knew they were looking for more than a candidate who could perform conventional internal audit functions.

13 July 2022
ISACA Journal Article

A Standardized Approach for Peer Review of Internal Audit

The quality of enterprise governance and the questionable judgment and roles of internal auditors have resulted in some financial reporting irregularities, fraud and various forms of malpractice such as insider trading.

Authors: Gaurav Priyadarshi, Abhishek Anand and Ishika Shukla
Blog Post

Cyber Incident Reporting: From Guidance to Enforcement

Imagine a day when the stock markets suddenly begin to crash, contrary to market movements, and your equity holding nosedives from a healthy green to an alarm bells-blaring red.

12 July 2022
Blog Post

Digital IT Forensics Evolution Through Digital Transformation

According to the National Institute of Standards and Technology, “Digital forensics is the field of forensic science that is concerned with retrieving, storing, and analyzing electronic data that can be useful in criminal investigations. This includes information from computers, hard drives, mobile phones, and other data storage devices.”

11 July 2022
Risk Article

How Enterprises Can Leverage Incident Reporting

Incident reporting plays a vital role in strengthening the internal controls necessary for an organization to operate properly. An incident is defined as “[A] nonstandard operation which causes interruption or reduction in quality of service.”

11 July 2022
Blog Post

Cybersecurity Workforce Advancement

Cybersecurity education and training is important in the cybersecurity workforce and provides students and recent graduates with information on how to find what path to take. Paths include formal education from universities and institutions that provide programs to better equip the student who desires to be a cybersecurity professional (e.g., bachelor’s, master’s and doctoral degrees) and cybersecurity training such as boot camps, certifications preps and certificate programs.

8 July 2022
Podcast

Cyber Decisions Only Executives Can Make

One of ISACA’s most popular Journal columnists joins us to discuss his most recent release, “Cyber Decisions Only Executives Can Make.” Steven Ross chats with ISACA’s Safia Kazi about cyber recovery plans...

8 July 2022
Blog Post

AI and Digital Ethics: ‘There Could Not Be More Overlap’

Véliz recently visited with ISACA Now to share her perspectives on AI, digital ethics and more.

7 July 2022
Audit Article

Preparing Your First Supplier Audit Plan

Organizations outsource processes and services for a variety of reasons: to cut costs, preserve resources, make room for growth and remain competitive in their industries.

7 July 2022
Blog Post

Quantum Computing and the Role of Internal Audit

Quantum computing is a very exciting discipline formed by the combination of computer science, physics and mathematics, which uses some of the mysterious aspects of quantum mechanics to enable unprecedented computational performances.

6 July 2022
@ISACA Article

Digital Trust: Atop the Technology Pyramid

I recently attended an IDC analyst presentation analyzing emerging trends in the cybersecurity realm, and one slide in particular caught my attention.

6 July 2022
@ISACA Article

Job Descriptions Falling Down on the Job: What Hiring Managers Can Do to Fix This Calamity

Most hiring managers never thought they would have to master the art of copywriting. Documentation – yes. Report writing – yes. Ad copy – not so much.

6 July 2022
@ISACA Article

Top Takeaways from New IT Audit Technology Risks Survey

Cybersecurity is the leading risk area for IT audit departments, with related risks such as privacy and data also ranking among the top concerns, according to a new study from ISACA and Protiviti.

6 July 2022
ISACA Journal Article

Quantum Disruption for Defensive and Offensive Cybersecurity

Since the idea of applying the principles of quantum physics to classical computing originated in the early 1980s, many prototypes, simulations and research efforts have been carried out in attempts to put the idea into practice.

Author: Balaji Swaminathan M.
Blog Post

Ensuring You Have the Right Governance in Place for Physical and Environmental Controls

Physical and environmental controls are more than gates, guards, generators and HVAC monitoring. Getting physical and environmental controls right is a big step forward in reducing your enterprise’s risk and protecting critical assets in an unpredictable world. So how do you determine that you have the proper controls and governance oversight in place?

5 July 2022
Audit Article

Now Is the Time for IT Auditors to Perform Advisory Pre-Implementation Reviews

Demand for digital transformation is increasing as enterprises endeavor to offer more innovative products or services and modernize legacy IT environments.

5 July 2022
Podcast

Real-World Data Resilience

Join ISACA's Lisa Villanueva as she talks with Guy Pearce about his recently released ISACA Journal article "Real-World Data Resilience". Guy has a deep knowledge of the movement of data and says "it’s about change and nothing is stable."

5 July 2022
Emerging Technology Article

The Case for Outcome-Based Cybersecurity: A Data-Focused Shift in Cybersecurity Management

The challenges faced by today’s cybersecurity practitioners are well documented, however, the situation may be worse than described.

1 July 2022
ISACA Journal Article

Letter From the Incoming Board Chair: Dear Readers

As a technology professional, I have borne witness to a technology evolution from sneakernet to ethernet to Internet.

Author: Pam Nigro
ISACA Journal Article

Information Security Matters: Cyber Decisions Only Executives Can Make

Cybersecurity is not simply a technical problem.” I have heard and read this many times (and have said it a few times, as well).

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Implementing Emerging Technologies—Agile SDLC Still Works

It was a big deal scheduling network operation center (NOC) tours for customers when I was a client account director in network services...

Author: Cindy Baxter
ISACA Journal Article

Innovation Governance: Charting the Course for Quantum Computing

Once upon a time, I was an undergraduate physics major studying a subject called quantum mechanics.

Author: K. Brian Kelley
ISACA Journal Article

Focal Points for Auditable and Explainable AI

Artificial intelligence (AI) is a branch of computer science that originated, at least academically, almost 75 years ago.

Author: Guy Pearce
ISACA Journal Article

Making and Breaking Data Security With Quantum Machines

The characteristics of the quantum universe are not very intuitive when based on observations of everyday physics, which may explain why even theoretical physicist Albert Einstein found the phenomena “spooky."

Author: Dalia Khader
ISACA Journal Article

Evaluating Ethical Challenges in AI and ML

In general, privacy, bias and discrimination are currently receiving a lot of attention. However, it is common for them to be underprioritized in technology implementations and treated as isolated issues...

Author: Joshua Scarpino
ISACA Journal Article

Managing Security Across Disparate Database Technologies

Enterprise databases present several unique challenges for security and audit professionals. They are paradoxical, as they must securely store vast amounts of sensitive data...

Author: Adam Kohnke
ISACA Journal Article

Case Study: Eliminating the Embedded Malware Threat at the Binary Level

Attack methods that evade enterprise security controls are understandably favored among cybercriminals, and the growing trend toward embedding malware in documents is evidence of the difficulty of...

Author: Mick Brady
ISACA Journal Article

Rethinking the Effectiveness of Controls in the Digital Age

In the midst of international geopolitical turbulence, organizations must mobilize to keep their businesses dynamic and establish long-term strategic postures that define ways forward amid instabilities.

Author: Jeimy J. Cano M.
ISACA Journal Article

Privacy, Security and Bias in Emerging Technologies

Emerging technology is an obvious and oft-repeated term, usually referring to digital technology recently developed. The first use of social messaging tools to make calls or send messages was approximately...

Author: Shini Menon
ISACA Journal Article

Implementing Artificial Intelligence: Capabilities and Risk

During the last decade, there has been exponential growth in artificial intelligence (AI) adoption. Total global enterprise AI investments grew from US$12.75 billion to US$67.85 billion between 2015 and 2020.

Author: Ivy Munoko
Blog Post

Arts vs. Sciences in IT: How UX Design Can Bridge the Gap

As professionals in IT-related fields, our jobs can seem very explicit: Binary 1s and 0s and Boolean true or false is baked into much of what we do. There are exceptions of course, but often there is a right answer or a wrong answer, and little space in between.

30 June 2022
Security Article

Writing a Charter for an Enterprise Security Operations Center

The security operations center (SOC) is the heart of information security for medium- to large-sized organizations. It ensures organizational cyber well-being by monitoring the infrastructure and managing its cyberhealth.

30 June 2022
Podcast

Breaking Down the ESET T1 Threat Report

ESET, a global leader in cybersecurity, has released its T1 2022 Threat Report, which summarizes the most notable trends that shaped the threat landscape from January to April 2022.

30 June 2022
Blog Post

MDDAP Helps Achieve Fast, Sustainable Solutions for Medical Device Quality

MDDAP’s successful development is due in part to the Case for Quality (CfQ) being launched from FDA’s own research with a wide variety of stakeholders, which revealed a problem in the industry: compliant manufacturers were still having similar types and frequency of issues as non-compliant manufacturers. While compliance was important, it alone wasn’t going to drive the desired quality outcomes.

29 June 2022
@ISACA Article

How the Rise of the Chief Trust Officer Role Can Shape Digital Trust in Organizations

It’s often said that trust is hard to earn and easy to lose. It undergirds most everything we do, yet is so fragile that, without it, nothing works.

29 June 2022
@ISACA Article

The Need for Job Rotation

On the surface, job rotation may seem straightforward or even outright boring. But this business process can be interesting when you peel back the layers.

29 June 2022
ISACA Journal Article

Help Source Q&A

Privacy by design is a methodology originally developed in 1995. It takes a broad view of a system and its data relative to seven principles.

Author: Sunil Bakshi
ISACA Journal Article

Reducing Security Vulnerabilities in a Hybrid Workplace

The lockdowns and other precautions instituted based on the COVID-19 pandemic have fundamentally changed the way society lives, works and plays.

Author: Timothy Liu
Blog Post

ISACA Member’s Impact in Nigeria Recognized on the Global Stage

Kashifu Inuwa Abdullahi, Chief Information Technology Officer, National Information Technology Development Agency in Nigeria, was recognized this year with the ISACA Inspirational Leadership Award “for leadership in bridging the digital divide by providing computers and other IT infrastructure to rural areas and schools and for providing virtual libraries.”

28 June 2022
Podcast

Where Privacy Meets Security

Jo Stewart-Rattray, the Director of Technology & Security Assurance for BRM Advisory, believes privacy is a team sport. Every organization needs to be responsible for asking, “what data is being collected,” “where is the information held,” “what purpose is the information being collected for,” and “how is the information being protected.”

28 June 2022
Blog Post

How the Right Help Desk Processes Can Strengthen Security

The IT help desk might seem like a simple portal for helping end users manage their issues. But in reality, it represents one of the first (and best) filters for identifying potential cybersecurity problems that may arise.

27 June 2022
Blog Post

Next-Generation CISO: Business, Technical or Mix of Both?

Before we get to the answer to the question posed in the title, let’s look at the typical job responsibilities of a CISO.

23 June 2022
@ISACA Article

Post-breach Lessons Learned from SolarWinds CISO Tim Brown

SolarWinds CISO Tim Brown spoke with ISACA Board Director Rob Clyde at the ISACA Conference North America last month about lessons learned from the high-profile software supply chain incident in 2020.

22 June 2022
Blog Post

Lessons in Change and Leadership from ‘The UnLearning Lady’

Zanele Njapha recently visited with ISACA Now to discuss her quirky nickname, her views on entrepreneurship and organizational change, and more.

22 June 2022
Security Article

Why (and How to) Dispose of Digital Data

The stakes are too high for organizations not to comply with data privacy regulations. For example, noncompliance with the EU General Data Protection Regulation (GDPR) can result in a fine of up to €10 million or up to 2% of the organization’s worldwide annual revenue from the preceding financial year, whichever is higher.

22 June 2022
ISACA Journal Article

The Human Consequences of Ransomware Attacks

The Internet’s impact on daily life is unquestionable. It provides a platform for communication, ecommerce and interactions between individuals and enterprises around the world.

Author: Joseph Cheng | CISA, CRISC, CPA
Blog Post

Reach and Teach: An Effective Way to Market and Advertise Cybersecurity Services

Now is the time for cybersecurity professionals to get in front with their message.

21 June 2022
Blog Post

Introducing the Principle of Need to Have Available

The principle of need to have available can be summarized as having only the permissions you need for your next set of tasks.

21 June 2022
Podcast

How To Build A Following Around Your Ideas

In this talk based on her book Stand Out: How to Find Your Breakthrough Idea and Build a Following Around It, Dorie Clark explains how to build a following around your ideas.

21 June 2022
Blog Post

The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce

While much has been said and written about the difficult cybersecurity skills and hiring landscape, one key characteristic that is typically overlooked in cybersecurity professionals is empathy.

17 June 2022
Podcast

Industry Spotlight with Jan Anisimowicz

Jan Anisimowicz is an experienced senior IT manager with over 23 years of experience in GRC, data analysis, broad business, and technical perspective in telco, banking, pharma, and insurance.

17 June 2022
Blog Post

Foundational Understanding of Databases Boosts Auditors’ Value

With all the areas under an IT auditor’s purview, it is challenging, perhaps impossible, to be as proficient as we would like to be in all areas.

16 June 2022
Podcast

Climate Resiliency and Regulation

Climate resiliency and green innovations are of worldwide interest today, but what is the best way to use skills and expertise that will make a difference?

16 June 2022
@ISACA Article

The Business Impacts of COVID-19: A Post-Pandemic Approach to IT Security and Data Privacy Risks

The business impacts of COVID-19 went far beyond a workforce used to sweatpants and slippers in lieu of their former business casual clothing, said speaker Ralph Villanueva at ISACA Conference North America 2022.

15 June 2022
@ISACA Article

Authentic Allyship and Intentional Leadership

Hollee Mangrum-Willis, Senior Program Manager of ISACA’s One In Tech foundation, sat down with Belinda Enoma, data privacy and cybersecurity leader, to discuss authentic allyship and intentional leadership.

15 June 2022
@ISACA Article

Improving Security Across the Software Supply Chain

Today’s software development needs to take a comprehensive approach to be secure. Security needs to be considered at every step of the software supply chain.

15 June 2022
@ISACA Article

Privacy Paradox: Digital Transformation and Governance

A few months ago, my young son wanted to watch videos on YouTube. I let him use my phone, and he started watching one video after another.

15 June 2022
Blog Post

Perimeter-less Security

“Never trust, always verify” have been the buzzwords ever since the term “zero trust” was coined. According to Pulse, 87% of decision-makers believe that zero trust security strategy will simplify their organization’s security architecture.

15 June 2022
Audit Article

The Repetitive History of IT Audit Outcomes

While the term “IT audit” may be defined differently across organizations based on industry requirements and their applicable frameworks, the outcomes of such audits are often fairly predictable.

15 June 2022
ISACA Journal

Reducing Cybersecurity Security Risk From and to Third Parties

A major lesson from the COVID-19 pandemic is that protecting oneself is only part of the solution that will put a stop to the virus.

Author: C. Warren Axelrod
Blog Post

Reaching Objectives and Enabling Success: How CMMI Creates Habit Persistence

During ISACA Conference North America 2022, ISACA launched a new initiative focusing on the pursuit of digital trust, which means that this topic was present in several discussions throughout the conference.

14 June 2022
Podcast

Gaining Digital Trust by Eliminating Privacy Dark Patterns

With the growing emphasis on consent for collecting and processing data, some enterprises have turned to tricking data subjects into giving their consent by using privacy dark patterns.

14 June 2022
Blog Post

Making Continuous Controls Monitoring Work for Everyone

As a security assurance professional, you know the importance of controls testing. After all, only organizations that thoroughly test and prove their controls’ effectiveness can be confident that they’ve sufficiently mitigated their security and data privacy risks.

13 June 2022
Blog Post

Customs Goes Digital: Exploring the Latest Trends

It’s been amazing to watch how almost every aspect of global life has been digitized in some shape or form over the past several years – and customs is no different. The question is, which aspects are changing? And is it for the better?

10 June 2022
Podcast

Industry Spotlight with Mark Thomas

Mark and Jessica dive deep into his career journey and their shared history of developing ISACA training content.

9 June 2022
@ISACA Article

China’s Personal Information Protection Law Highlighted in New ISACA Resource

Enterprises around the world could feel the consequences of China’s Personal Information Protection Law (PIPL), which recently went into effect.

8 June 2022
@ISACA Article

ISACA Supply Chain Security Report Spotlights Major Vulnerabilities

Less than half of respondents to a new ISACA survey have high confidence in the security of their organization’s supply chain as supply chain risks have become increasingly top-of-mind for enterprises and consumers alike throughout the pandemic.

8 June 2022
@ISACA Article

The Future of Quantitative Cyberrisk Reporting

An increasing number of boards of directors (BoDs) are paying greater attention to their cyberrisk exposure, which has placed pressure on security teams to provide BoDs with what they need.

8 June 2022
Blog Post

The Great Resignation & Employee Retention in Digital Trust Professions: Closing Critical Workforce Gaps

ISACA Conference North America 2022 last month featured the launch of ISACA’s new initiative focusing on the pursuit of digital trust, which was a recurring theme throughout many of the event’s presentations.

8 June 2022
ISACA Journal Article

Process Mapping Synergy Gains From BCP and DR

Understanding how processes work and where controls are needed is crucial for organizations to improve their efficiency. Process mapping is a common place to start.

Author: Alonzo Longshore
Blog Post

Give Your IT Risk Program a Jump-start

I’m constantly fielding questions about how to start building a modern-day IT risk management program, and a quick Google search reveals that there are many differing opinions on the best approach.

7 June 2022
Podcast

Cybersecurity in a COVID-19 World: Insights on How Decisions Are Made

In the early days of the Covid-19 pandemic, all organizations pivoted to remote work.

7 June 2022
Blog Post

Supply Chain Risk Management: Where Do We Start?

Mea Clift examines how to climb the mountain of evaluating vendors to ensure they're meeting security standards.

6 June 2022
Blog Post

Demystifying China’s Personal Information Protection Law: PIPL vs. GDPR

On 20 August 2021, the National People’s Congress (NPC) passed the final version of the Personal Information Protection Law of the People’s Republic of China (PIPL), a comprehensive privacy law that covers multiple facets of personal information protection.

3 June 2022
Security Article

The Digital Gold Rush: Football, Ransomware and the Bottom Line

The San Francisco 49ers team, one of the NFL’s 32 professional football teams, was hit by a Ransomware-as-a-Service (RaaS) faction called BlackByte.

3 June 2022
Risk Article

The New Global Risk Profile

The Russia–Ukraine War has plunged the entire world into a new risk landscape, especially organizations that already faced high levels of risk.

2 June 2022
Podcast

Industry Spotlight with Caitlin McGaw

Caitlin McGaw answered an ad in the newspaper in 1997 for a position with an Executive Search Firm and she was instantly hooked.

2 June 2022
@ISACA Article

New Resource Helps Tailor Risk Management Programs

ISACA has released a Risk Starter Kit to aid enterprises in creating their own tailored risk management program.

1 June 2022
@ISACA Article

Ready to Crush Interviews? Add This Superpower to Your Career

Is there a secret sauce to interviewing? In a word, yes.

1 June 2022
@ISACA Article

The CISO Evolution

Let’s travel back in time a bit to 1995. Michael Jordan returned to the NBA, DVDs were invented, and—most importantly, for the purposes of this article—the first CISO was hired.

1 June 2022
Blog Post

How Best to Protect Your Assets

How do you typically protect a special or expensive piece of jewelry? You may keep it in a bank locker or in an electronic safe in your home.

1 June 2022
Blog Post

In a World of Technology, ISACA Makes the Difference

At the beginning of this year, ISACA took on a bold new vision for the future: Be the standard-maker for digital trust everywhere.

1 June 2022
ISACA Journal Article

How Effective Is Your Cybersecurity Audit?

Cybersecurity is becoming an increasingly important focus for organizations, and the COVID-19 pandemic has only accentuated cyberrisk for every type of enterprise.

Authors: Matej Drašček, Sergeja Slapničar, Tina Vuko and Marko Čular
Blog Post

The Governance, Assurance and Automation that Financial Services Organizations Need

In response to the recent Russian invasion of Ukraine, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a set of expansive economic measures designed to incapacitate the Russian financial system.

31 May 2022
Blog Post

The Future of Audit in the World of Interconnected Business

The COVID-19 pandemic had changed many things; one among them is the perception of the audit process as business processes have become more interconnected and interdependent.

27 May 2022
Blog Post

Five Cybersecurity Memes and What They Say About Cybersecurity Today

Cybersecurity memes on social media are often good for a laugh, but several of the more popular ones have gained resonance with security professionals for a reason...

26 May 2022
@ISACA Article

Cultivating a Cyber Culture at Your Organization

Simon Sinek has said, “Corporate culture matters. How management chooses to treat its people impacts everything – for better or for worse.”

25 May 2022
@ISACA Article

How CISOs Can Uplevel the Security Conversation

Chief information security officers (CISOs) are becoming the most senior executive leader responsible for trust inside an enterprise.

25 May 2022
@ISACA Article

How Much Enough Is Enough?

Recently, due to the nature of my work, I was made aware of a cyberincident that was not widely publicized, wherein an attacker used social engineering techniques to manipulate a person into revealing their banking credentials, namely user ID and password.

25 May 2022
Blog Post

Separating Fact from Fiction: Debunking Myths Around CMMC 2.0

With more than 220,000 companies supporting the US Department of Defense, the defense industrial base presents an enticing target for hackers, nation-states, and cybercriminals.

25 May 2022
ISACA Journal Article

Real-World Data Resilience Demands an Integrated Approach to AI, Data Governance and the Cloud

The real-world rate of change affecting almost everything to do with data is what separates the theory of enterprise data resilience from its practice.

Author: Guy Pearce
Blog Post

Cybersecurity and Consumers

As a cybersecurity leader and scientist, I find it interesting that as I observe events all around me that all are seemingly unconnected, they are in fact connected, at times with exciting and favorable outcomes.

24 May 2022
Blog Post

Combining the Risk Register and the Maturity Model to Increase Total Value

Communicating the results of business controls to top management is never an easy process, especially if we want to ensure concrete information based on risk and effectiveness of controls is communicated. Generally, risk and controls rely on different methodologies; this is not ideal. Instead, we need flexible methodologies, collaboration between business processes and adequate tools.

23 May 2022
Blog Post

Digital Trust Requires All Hands on Deck – But the Payoff Is Big

The fields in which ISACA’s professional community works – such as audit, risk, security, privacy and governance – feed into the more encompassing realm of digital trust.

20 May 2022
Security Article

Performing User Access Reviews to Improve Enterprise Security

Security leaders can enhance security at their enterprises by conducting frequent and thorough user access reviews.

20 May 2022
Podcast

Cyber (Business) Recovery

Steven talks to ISACA's Safia Kazi about how to prepare for a cybersecurity Event and how to recover. Steven discusses the types of attacks to watch out for, Business Continuity Planning and how to recover from a cybersecurity event.

20 May 2022
Privacy Article

Fostering Trust by Eliminating Dark Patterns

With the growing number of privacy laws and regulations that require consumer consent before collecting or processing data, some enterprises have turned to tricking consumers into giving their consent through the use of dark patterns, which are practices that deceive users into acting in a way in which they did not intend.

18 May 2022
Blog Post

COVID-19: An Ignitor in Information Risk Management

This makes one think about risk subconsciously as we are uncertain about when pandemics will happen as well as how we should be prepared to contain and reduce their impact.

18 May 2022
Risk Article

Performing an Information Security and Privacy Risk Assessment

Enterprise information security and privacy professionals are responsible for identifying information security and privacy gaps in information management systems and processes.

18 May 2022
ISACA Journal Article

Better Cybersecurity Awareness Through Research

In the last few years, information security professionals have faced tremendous challenges. Just in 2021, there were more than two billion malware attacks and trillions of intrusion attempts.

Author: Ranjit Bhaskar
Blog Post

Three Reasons Your Third-Party Management Program is Struggling

Building trust throughout an organization requires working collaboratively across lines of the business and gaining interdepartmental, cross-functional visibility.

16 May 2022
Blog Post

Understanding the Full Digital Trust Ecosystem

A Google search of “digital trust” turns up 5.73 billion results, and hundreds of recent trade press articles have covered the topic.

13 May 2022
@ISACA Article

A PDCA Approach to Conducting a DPIA

Since their inception, much has been written and discussed about Data Privacy Impact Assessments (DPIAs), a term introduced by the EU General Data Protection Regulation (GDPR).

11 May 2022
@ISACA Article

Survival Toolkit for Information Systems Auditors

Nobody starts out as an expert in their field, and work can become even scarier when switching from one career to another.

11 May 2022
Blog Post

The Needed Societal Response to Cybersecurity Risk in the COVID Era

COVID-19 has transformed how business is conducted with the acceleration of cloud adoption and remote working. Organizations’ data is no longer kept within the perimeter of the office’s or data center’s boundary.

11 May 2022
Governance Article

Maximizing the Benefits of DevOps Using COBIT

If adopted properly, Agile and DevOps practices can result in improvements in objective software development metrics such as deployment frequency, lead time for changes, change failure rate and mean time to recover (MTTR).

11 May 2022
Podcast

Industry Spotlight with Niki Gomes

Everyone starts somewhere and for Niki Gomes, it was at the front desk of a hotel where she worked her way up to hospitality management, before pivoting to accounting and finally to the American Red Cross...

11 May 2022
Blog Post

Award Winner Weaves ISACA Into Academic Curriculum

Andre Pitkowski recently visited with ISACA Now for a Q&A interview, reflecting on his award. The following is a transcript of the interview.

10 May 2022
ISACA Journal Article

Zero Trust in Data Privacy Operations

Following the onset of the COVID-19 pandemic, the rapid expansion of remote work created new opportunities for cybercriminals.

Author: Valdez Ladd
Blog Post

Zero Trust Does Not Imply Zero Perimeter

Typically, when we hear “zero trust” these days, folks generally hear the common example of remote employees not having to VPN (Virtual Private Network) back to their enterprise network to access the cloud resource.

9 May 2022
Podcast

Industry Spotlight with Ed McCabe

One of Ed McCabe's first childhood memories was taking apart his grandparent's heirloom grandfather clock to find out why it wasn't working.

27 May 2022
Blog Post

Should Information Systems Audit Evolve to Information Systems Continuous Monitoring?

Nothing in this world is static. Everything evolves, and improvements often happen when things evolve.

6 May 2022
Blog Post

2021 Annual Report Spotlights ‘Inspiring Work’ of ISACA Community

Through new learning and credentialing opportunities, enterprise resources and its ever-growing global community, ISACA was in pursuit of digital trust throughout 2021 on multiple fronts.

5 May 2022
@ISACA Article

Importance of Digital Trust Highlighted in Latest ISACA Report

Building digital trust is more important than ever before, according to ISACA’s latest free report, “Digital Trust: A Modern-Day Imperative.”

4 May 2022
@ISACA Article

ISACA 2021 Annual Report Released

ISACA’s 2021 Annual Report, with a theme of how ISACA is working to advance digital trust, is now available on the ISACA website.

4 May 2022
@ISACA Article

ISACA Announces 2022-23 Board Slate

Pamela Nigro will be the next chair of the ISACA board of directors when the 2022-23 ISACA board is installed on 1 June.

4 May 2022
@ISACA Article

Job Change and Buyer’s Remorse: Minimize Risk and Maximize Opportunity

It seemed like the perfect thing. The amazing gadget, the miracle face cream, the cool designer shoes – finally on sale.

4 May 2022
Security Article

Basics for Improving the Safety of Your Organization's Data

The world is currently experiencing the Fourth Industrial Revolution (4IR), a result of which has been the innovation of big data.

4 May 2022
Blog Post

Building a More Trustworthy Digital World

Technology is truly driving global innovation and the world economy.

3 May 2022
Blog Post

In 50 Years, the ISACA Journal Has Had and Seen it All

Congratulations to the ISACA® Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA® members, their organizations, the IT governance community and society at large.

3 May 2022
ISACA Journal Article

Integrating MITRE With COBIT

Protecting enterprises from malicious code and software requires that governance and cybersecurity practitioners take a comprehensive approach.

Author: Blake Curtis
Blog Post

Practical Advice for Agile Audit

Agile audit is in right now, and it looks like even the people who were doing everything agile opposes are now ardent supporters and push for going agile.

2 May 2022
ISACA Journal Article

The Pitfalls of Supply Chain Risk Management

Many organizations have progressively increased their reliance on a growing number of global suppliers.

Author: David Podeswik
ISACA Journal Article

Operational Resilience: Preparing for the Next Global Crisis

Although resilience in business operations has been a priority for organizations since before the onset of the COVID-19 pandemic, the ongoing global pandemic has made resilience more critical than ever.

Author: Sumedha Adavade
ISACA Journal Article

Is Business Continuity Management Still Relevant?

Business continuity refers to the ability of organizations to minimize losses and keep functioning and fulfilling their missions, even under extremely adverse circumstances. But this is costly and, in current times, where cost cutting is a key concern, there is...

Author: Spiros Alexiou
ISACA Journal Article

Case Study: Cloud-Native Security Using Zero Trust

For most organizations, cloud usage is now the norm. Much like the adoption path of many technologies, the road to cloud normalization started with an initial reluctance and has only recently begun to gain wider acceptance.

Author: Ed Moyle
ISACA Journal Article

Incident Response During the Global COVID-19 Crisis

Since March 2020, the global COVID-19 pandemic has affected the characteristics of incident response (IR) in the cybersphere. These unprecedented times have forced some enterprises to deal with their most severe business crises to date and to cope with the pandemic’s impact on the threat landscape.

Author: Ofir Eitan
ISACA Journal Article

Understanding the Shared Responsibilities Model in Cloud Services

The world of on-premises technology was practical when cloud services were not available.

Authors: Jai Sisodia and Mohammed Khan
ISACA Journal Article

Meeting the Demand for Zero Trust Talent

Implementing a zero trust architecture creates a more adaptable security platform that is not designed around a static, perimeter-based network defense strategy, which can help further protect critical systems and data from attacks based on confidentiality, integrity and availability.

Authors: Fortune Onwuzuruike and Kenneth Myers
ISACA Journal Article

Book Review: Creating a Virtual-First Line of Defense for Secure Software Development

Creating functioning software is a challenge at the best of times, but ensuring that it is also secure is time consuming, requires fairly scarce skills and, frequently, is not effective.

Author: Robert Findlay
ISACA Journal Article

Letter From a Past Editor: Dear Reader

Congratulations to the ISACA Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA...

Author: Michael P. Cangemi
ISACA Journal Article

Information Security Matters: Cyber (Business) Recovery

The last of the five core functions of the US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is Recover. It comes last because this function only comes into play if the previous four—Identify, Protect, Detect and Respond...

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Resilience and Regulation

My evenings are usually quiet three weeks out of the month, but at least one week is packed with community meetings and city public hearings. The pandemic may have impacted in-person gatherings, but government and community action continue online.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: The Impact of Cryptocurrency and Its Carbon Footprint

In recent years, cryptocurrency has played an increasingly important role in the financial market. From July 2020 to June 2021, the popularity of global cryptocurrency increased by more than 880 percent.

Author: Jiewen Wang
ISACA Journal Article

Innovation Governance: Planning for Failure to Ensure Resilience

Even prior to the COVID-19 pandemic, the technology world was in the midst of a fundamental shift in how we operate. DevOps and cloud computing adoption growth was the vanguard of this change.

Author: K. Brian Kelley
ISACA Journal Article

Help Source Q&A

What is resilience and how it is related to business continuity? Simply put, “resilience” means the ability to withstand an adverse situation and return to normal.

Author: Sunil Bakshi
Blog Post

Failure to Patch and the Rare Case of the Java Crypto Hack

One of the often-accepted truisms in cybersecurity is to ensure that all systems supporting and protecting business operations are up-to-date and current.

29 April 2022
Blog Post

Living off the Land (LotL) Classifier Open-Source Project

In security, “Living off the Land” (LotL or LOTL)-type attacks are not new. Bad actors have been using legitimate software and functions to target systems and carry out malicious attacks for many years.

28 April 2022
Emerging Technology Article

Benefits of Adopting Secure Access Service Edge for Operational Technology Security

Traditional operational technology (OT) networks are built based on the rigid 6-level (level 0 to level 5) hierarchical Purdue model, which has worked well for the last few decades.

28 April 2022
@ISACA Article

The Makings of a Cybersecurity Leader

Phil Zongo, recently visited with @ISACA to discuss cybersecurity leadership, cyber strategy and his new memoir.

27 April 2022
@ISACA Article

Understanding the Distinction Between Cyberwar and Espionage

“May you live in interesting times” is an apocryphal curse that is purported to be of Chinese origin. On the surface, it sounds like a good thing: one would think everyone would want to live in interesting times.

27 April 2022
Blog Post

Twenty Ways Information Security Has Become More Challenging in the Past 20 Years

To mark the anniversary of ISACA’s Certified Information Security Manager (CISM) we spoke with 20 CISM-holders to collect their commentary on the biggest challenges that have emerged in infosec since CISM came on the scene in 2002.

27 April 2022
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2: Identity Trust Service Implementation

Identifying a physical person on a network using their digital name (username) is a task made possible by the authentication system.

Author: Luigi Sbriz
Podcast

ISACA Live: Risk Scenarios

Paul Philips and Lisa Young will discuss how risk scenarios help decision-makers understand how certain events can impact organizational strategy and objectives

27 April 2022
Blog Post

Twenty Ways Information Security Has Changed for the Better in the Past 20 Years

ISACA’s Certified Information Security Manager (CISM) certification is now in its 20th year and to mark the anniversary, we spoke with 20 CISM-holders to collect their commentary on what has changed for the better.

26 April 2022
Blog Post

How CISOs Can Score Some Quick Wins

Brian Fletcher, recently visited with ISACA Now to discuss how chief information security officers (CISOs) can start off by achieving some quick wins for their organizations and how organizational cyber maturity enters the equation.

25 April 2022
Security Article

Decoding CUI—a Highly Valued Data Type at Risk

Governments often create or own information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and governmentwide policies. In the United States, this type of information is referred to as Controlled Unclassified Information (CUI).

25 April 2022
Blog Post

Malicious Trends: What You Need to Know

According to the recent Cybersecurity Ventures 2022 “Cybersecurity Almanac,” organizations will spend approximately US$1.75 trillion on cybersecurity between 2021 and 2025.

22 April 2022
Podcast

Managing Data Privacy Risks and Compliance with a Distributed Workforce

Data now includes, consumer's social media, news, view and even browser searches. From 2010-2020, the amount of data created, captured, and copied in the world increased from 1.2 trillion GB to 59 trillion GB and the amount created in the next 5 years is projected to double

22 April 2022
Blog Post

Supply Chain Security: Analysis of the Georgian Ecosystem

According to the European Union Agency for Cyber Security (ENISA): “In cybersecurity, the supply chain involves a wide range of resources (hardware and software), storage (cloud or local), distribution mechanisms (web applications, online stores), and management software.

21 April 2022
@ISACA Article

The Layer Cake Paradigm Part II: Great Interview Questions that Make You Memorable

Recapping quickly, our focus in this article is how to ask questions during job interviews that “get the job done.”

20 April 2022
@ISACA Article

Tracking Two Decades of Changes in Information Security

For the past 20 years, the Certified Information Security Manager® (CISM®) has served as the global credential that ensures alignment between an organization’s information security program and its broader strategic goals.

20 April 2022
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1: Identity Trust Abstract Model

The identity of an Internet citizen, or netizen, is generally determined by asking the digital citizen to share personal data with the authentication system to obtain credentials to access data.

Author: Luigi Sbriz
Blog Post

Proven Methodologies to Fight Ransomware

Though the topic of ransom and ransomware is extremely popular, a lot of discussions center around a few topics: prevention, insurance and recovery.

19 April 2022
Blog Post

Saluting Our Global Volunteers

When ISACA certification candidates take an exam, the content of that exam was created and reviewed by ISACA volunteers.

18 April 2022
Risk Article

How to Develop and Execute a Rigorous Data Backup and Recovery Strategy

When approximately 22 terabytes (TB) of Dallas Police Department (DPD) (Texas, USA) data were accidentally deleted during a cloud migration in March 2021, ultimately only 14 TB could be recovered, affecting myriad case files and prosecutorial actions.

18 April 2022
Podcast

CMMC and CUI: Rocket Fuel

Join ISACA's Senior Manager, CMMI Professional Practice, Kileen Harrison as she talks with ecfirst's Chief Executive Officer, Ali Pabrai about his recently released articles, “What Cyberprofessionals Should Know About CUI”, and “US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework”.

18 April 2022
Blog Post

Celebrating Women in Cybersecurity

Joanna Karczewska, a longtime ISACA member from Poland, recently visited with ISACA Now to discuss the book and her views on progress made by women in the cybersecurity field. The following is a transcript of the interview:

15 April 2022
Blog Post

The Evolution of GRC

Back in the day, manual processes were dominant, with telex and fax being the most common mode of communication. As a result, risk governance was also focused on these ways of business processing.

14 April 2022
@ISACA Article

Continuous Learning Commitment: The Path Forward in a Volatile Labor Market

It’s no secret that companies currently face an acute talent crunch. Between the pandemic, The Great Resignation and economic inflation – not to mention turbulent world events – we’re in a highly volatile labor market.

13 April 2022
@ISACA Article

Five Key Considerations for Improving IT Supply Chain Security

Most organizations have historically focused their information risk and security efforts on what they can control and often ignore their IT supply chains, which they can only influence.

13 April 2022
Blog Post

The Trans-Atlantic Data Privacy Framework: A Significant Step Toward Reinforcing Transatlantic Cooperation, Setting a New Standard for Personal Data Protection

Global trade has been growing for decades, as most economies accelerated their globalization since the 1990s, using digital technology as a key catalyst that helped industries interconnect further and innovate.

13 April 2022
Risk Article

Achieving Effective Cloud Risk Management

Cloud technology has leaped to the forefront of the technological world in the last 2 decades. One would be hard pressed to find an enterprise that has not implemented cloud technology in some form or another.

13 April 2022
Blog Post

Level Up Your Governance to Drive Business Growth

When you search for the term “cybersecurity” online, you get approximately 17 billion images of padlocks and shields – but what is this trying to communicate?

12 April 2022
ISACA Journal Article

Cybersecurity in a COVID-19 World

The COVID-19 crisis has created a cyberpandemic that is due, in large part, to decisions made by organizational leaders and stakeholders.

Authors: Maik Fichtenkamm, Gerald F. Burch, Ph. D and Jordan Burch
Security Article

Where Privacy Meets Security

In a world where data are pervasive and increasingly connected, for security professionals, protecting the privacy of individuals and organizations could be compared to trying to put an octopus into a string bag: a constantly changing, wriggly challenge.

11 April 2022
Blog Post

What Business Leaders Need to Know About Cybersecurity Preparedness

Many cybersecurity incidents occur when organizations think they’re doing the right thing.

8 April 2022
Audit Article

Essentials for an Effective Cybersecurity Audit

Cybersecurity has become a pressing issue worldwide, thereby necessitating robust auditing procedures to provide assurance to senior management and boards of directors (BoDs).

8 April 2022
Blog Post

The Future of Complex Legacy Enterprise Transformation

The process of manual programming has never been a perfect or exact science, and the resulting defects that occur along the way have long plagued the software development lifecycle and are therefore perpetuated in legacy systems.

7 April 2022
@ISACA Article

Explainable Artificial Intelligence (XAI): Useful But Not Uncontested

Artificial intelligence (AI) has been referred to as a “black box” technology given the difficulty organizational management, and even specialists, have in explaining what the technology does with its data input.

6 April 2022
Blog Post

Using SWIFT as a Lesson for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the Society for Worldwide Interbank Financial Telecommunication’s (SWIFT) communication system, were compromised.

6 April 2022
Risk Article

Concepts to Consider When Acquiring “The Little Guy”

Throughout the last decade, there has been an increase in cyberattacks targeting small- and medium-size enterprises with a myriad of techniques and payloads, and more than 80% of enterprise owners know they are at risk.

6 April 2022
ISACA Journal Article

Help Source Q&A

Before the pandemic, most organizations worldwide believed that offices were essential to their business and productivity deteriorates when employees work from home. 

Author: Sunil Bakshi
Blog Post

Addressing the Biggest Challenges in Cloud Security

Gartner has predicted that by 2026 the public cloud expenditure will exceed 45 percent of all enterprise IT.

5 April 2022
@ISACA Article

The Layer Cake Paradigm: Strategies for Asking Great Questions at Each Interview Stage

This is the first of a two-part article on how to ask questions during interviews that “get the job done,” meaning they help you stand out from the competition, and they get you the valuable information you need to do excellent due diligence in the job search process.

6 April 2022
Blog Post

ISACA Seeks Input to Digital Trust Ecosystem Framework

If you do a Google search for digital trust, you’ll receive over 5.5 billion results; indeed, digital trust is a popular topic these days! Definitions of digital trust, however, vary widely.

4 April 2022
Privacy Article

Data Privacy: From Compliance to Trust

Organizations are looking to prioritize their users’ privacy notices and policies not just to protect their value and to be compliant with existing laws, but also to provide something that is the holy grail for a product: trust.

4 April 2022
Blog Post

Technology and the Democratization of Opportunity

Silvina Moschini visited with ISACA Now to discuss digital transformation, cloud adoption, corporate social responsibility and more.

1 April 2022
Risk Article

Cybersecurity and Third-Party Supplier Risk

Enterprises today are being driven to adopt technology at an unprecedented pace as society witnesses what could be referred to as the Fourth Industrial Revolution (4IR). This technological adoption has been driven by factors such as the quest for efficiency, technology...

1 April 2022
Blog Post

Embracing the Possibilities of the Modern Business Landscape

Isabel Aguilera recently visited with ISACA Now to provide her perspective on technology’s role in shaping today’s business environment.

31 March 2022
Podcast

CyberPros: Evolution of Interconnectivity of Cyber and Warfare with Fred Carr

In this episode, ISACA’s CyberPro, Jon Brandt chats with Founder and CEO of Anchor Systems, Fred Carr about the current threat landscape, challenges, and misalignment between public and private sectors, and impacts on national and global security.

31 March 2022
@ISACA Article

Zero Trust as Security Strategy to Prevent Data Exfiltration in the Cloud

Before diving into how zero trust security can factor into cloud security, it is worth clarifying that zero trust is not a new concept, nor is it a new technology that you can simply implement in your infrastructure to enhance the security of your data.

30 March 2022
Blog Post

The Pandemic Era: A Period of Business Resilience

COVID-19 has markedly impacted the mitigation measures for business continuity and IT disaster recovery adopted by businesses over the last two decades.

30 March 2022
Security Article

The NATO Cyberresponse Dilemma

It should come as no surprise that the North-Atlantic Treaty Organization (NATO) finds itself in a bit of a legal and procedural dilemma regarding response efforts and capabilities to the Russian invasion of Ukraine.

30 March 2022
ISACA Journal Article

Understanding the Importance of the Turkish Information and Communication Security Guide on Cybersecurity

Countries around the world are looking to invest in infrastructure that will allow for the use and dissemination of innovative technologies.

Author: Tolga Mataracioglu
Blog Post

What to Consider When Making the Step to the Cloud

Organizations that decide to take their entire IT landscape, or parts of it, to the cloud need to consider the different factors that need to be prioritized according to their needs.

29 March 2022
Podcast

A Security Awareness Program for PCI-DSS Compliance

People are considered the weakest link in any organization’s cybersecurity defenses.

29 March 2022
Blog Post

Edwards: From a Compliance Mindset to a Performance Mindset

Edwards was an early adopter of the MDDAP program. The company’s Draper, Utah facility completed its first MDDAP appraisal in 2017 as part of the program pilot.

25 March 2022
Blog Post

Using InfoSec Compliance Programs for Proactive IT Risk Management

Proactive IT risk management is crucial to maintain a successful business. This means implementing measures to identify and mitigate potential risks, continuously and reliably, before those risks can cause material (or worse, permanent) damage.

24 March 2022
Podcast

Industry Spotlight with Jo Stewart-Rattray

In this episode of Industry Spotlight, Robyn Franko, Manager of Event Operations and Services at ISACA, chats with Jo about her background and career path, hobbies, and some interesting challenges the industry faces.

24 March 2022
@ISACA Article

Hiring Challenges Linger and Loom Large on Cybersecurity Landscape

Longstanding talent gaps on the cybersecurity landscape have been compounded in the era of The Great Resignation. ISACA’s free State of Cybersecurity 2022 report shows most companies have significant work to do to find and retain the cybersecurity talent they need.

23 March 2022
@ISACA Article

New ISACA Zero Trust Resource Shows How to Beat Adversaries at Their Own Game

With the acceleration of remote working and employee use of personal devices for business purposes, enterprises need to develop a Zero Trust strategy to defend against threats.

23 March 2022
Blog Post

Aligning Business Objectives and Human Outcomes in Digital Transformation

Kate O’Neill, recently visited with ISACA Now to provide her view of human-centric digital transformation, how data should be integrated into companies’ business models and more.

23 March 2022
Blog Post

Cyber Workforce: Out of the Ashes and Into the Fire

ISACA’s State of Cybersecurity 2022 report was published earlier this week, and it’s not looking too good for us good guys. For the third year in a row, the cybersecurity labor shortage looms large as the main focal point, casting its long, grim shadow across most of the report’s 40-plus pages.

23 March 2022
Audit Article

An Integrated Approach to Security Audits

A cyberattack can be devastating to any organization because it compromises sensitive data and, as a result, the financial position, strategic vision, and more important, the trust and credibility that the enterprise has built over the years.

23 March 2022
ISACA Journal Article

The Future of Govtech

The average Internet user spends almost seven hours online every day, which equates to two days a week. Meanwhile, the Internet is used by approximately 4.9 billion people, which is more than 60 percent of the global population.

Author: Chetan Choudhury
Emerging Technology Article

Digital Realities: Future Potentials and Use Cases

Humans are a curious species, and it is part of our nature to ponder the future. We are hardwired to find patterns, so we often use the past to predict what will emerge in the future.

22 March 2022
Blog Post

Essential Tips for Staying Current on Cybersecurity Terminology

Navigating the language of cybersecurity is like trying to win an argument with someone you love. You must be open-minded, kind-hearted and committed.

21 March 2022
Blog Post

Don’t Let Collaboration Tools Become a Red Carpet for Black-Hat Hackers

2020 was a unique year and most of us couldn’t wait to call an end to it for so many reasons, including the increased trends in cyberattacks – some of which targeted collaboration tools such as in the example I noted above.

18 March 2022
Podcast

The Transformative Power of Mobility

Join ISACA’s Performance Based Training Engineer, Collin Beder as he speaks with Tom Schneider, Senior Associate of Proactive Advisory for Cyber Defense Labs as they discuss Tom’s recently released article “Ensuring that Cybersecurity is Everyone’s Job”.

18 March 2022
Blog Post

How Auditors Fit into the Zero Trust Journey

"Zero Trust” is one of those security buzzwords making the rounds on the inter-webs recently, but what does it mean and why should security or IT audits teams start caring about this term? Traditionally, enterprises concern themselves with forming a layered defensive...

17 March 2022
@ISACA Article

Strong Cyber Accountability at Board Level a Must

Accountability and oversight are the two key reasons why a company’s board exists. Everything that the board does can be subsumed into these two buckets.

16 March 2022
Blog Post

Evaluating Governance Over DevOps Practices

Auditors and related practitioners are always learning and prepared to pivot as new technologies and modes of software delivery are introduced.

16 March 2022
ISACA Journal Article

A Unified Response to Cyberattacks, Fraud and Financial Crime

These days, virtually all aspects of public life are visible online. With this trend comes abundant risk. Organizations are negatively affected more frequently by cyber-related issues, including cybersecurity intrusions, fraud and financial crimes (e.g., money laundering, bribery, tax evasion).

Author: Vishal Chawla
Podcast

Industry Spotlight with Raven David

Listen as Raven recaps the success of his cybersecurity awareness program, gives thoughtful advice to the next generation of young professionals, and discusses his current self-educating project, 3D printed chess set with Arduino-powered actuators and a Python chess engine.

16 March 2022
Blog Post

Improving Cybersecurity Incident Response

Incident response handling procedures could use some improvement. By utilizing and practicing incident response exercises, organizations can put in place a strong and integrated response to incidents of varying types.

15 March 2022
Podcast

Privacy for Sale

Is Privacy a commodity? This episode explores the future direction of privacy and the demise of privacy in the digital age. Could privacy become something that people cannot afford, creating a two-tier system of internet users — those who can afford privacy and those who cannot?

14 March 2022
Blog Post

Embedding Digital Trust in Fintech: Seven Practical Steps

There has long been debate about whether innovation and risk management can coexist. For some digital pioneers, risk and compliance are synonymous with being a roadblock to innovation.

11 March 2022
Blog Post

Vulnerability Management: Addressing Your Weaknesses Before They Can Be Exploited

As businesses continue to extend their digital footprints to support remote workers and deliver the products and services customers demand, the risk of a breach grows exponentially.

10 March 2022
@ISACA Article

The Business Risk Posed by Artificial Intelligence

Artificial intelligence (AI) is no longer a new concept. Much has been written about this emerging technology and new articles and research are published online every day. Organizations have started to learn and understand its full potential.

9 March 2022
Blog Post

Exploring HackTown: A College for Cybercriminals

It’s becoming simpler for wannabe cybercriminals to catch a portion of the billions of dollars lost through fraud happening every year. All you really need is some Bitcoin knowledge, some free tools and no moral qualms taking from others.

9 March 2022
Privacy Article

Educated and Empowered Data Subjects: A Privacy Prerequisite

US lawmakers recently introduced a bill seeking to improve transparency of terms of service agreements.

9 March 2022
ISACA Journal Article

A Strategic Risk-Based Approach to Systems Security Engineering

In the 21st century, the backbones of business, trade, economy and critical infrastructure for public- and private-sector enterprises are information systems and the data they store, process and transmit.

Author: Hunter Sekara
Podcast

Ensuring that Cybersecurity is Everyone’s Job

Join ISACA’s Performance Based Training Engineer, Collin Beder as he speaks with Tom Schneider, Senior Associate of Proactive Advisory for Cyber Defense Labs as they discuss Tom’s recently released article “Ensuring that Cybersecurity is Everyone’s Job”.

9 March 2022
Blog Post

Taking a Clear-Eyed View of the Road Ahead for Women in Security

ISACA member Reshma Devi recently visited with the ISACA Now blog to discuss her mindset about volunteering, her views on progress for women in the security industry and more.

8 March 2022
Blog Post

My New Career Connection Through ISACA Mentorship Program

I have been a member of ISACA for over 10 years, and it has touched my life in many ways. When I first acquired the CISA certification in 2012, an avalanche of job offers followed!

7 March 2022
Podcast

Zero Trust: How to Beat Adversaries at Their Own Game featuring Dr. Zero Trust

ISACA’s Jon Brandt welcomes Dr. Chase Cunningham aka Dr. Zero Trust to the ISACA CyberPros podcast. You may know Chase from his own podcast, Dr. Zero Trust, or book series, Cynja.

4 March 2022
Blog Post

Good Enterprise Governance Needs CGEIT: My Journey to Pass the Exam

I earned ISACA’s CRISC and CISM certifications in 2019 and 2020, respectively. I always feel a professional obligation to give back to ISACA global community through sharing my lessons learned after passing each exam – hopefully providing practical guidelines will be beneficial to professionals who are preparing to obtain these industry-recognized credentials worldwide.

3 March 2022
@ISACA Article

Avoiding the Chaotic 5G Rollout at Airports

5G rapid rollout is a high priority around the world because its adoption can generate high revenue in both the public and private sectors thanks to its greater speed, capacity, and quicker response, which can positively increase businesses’ productivity and efficiency.

2 March 2022
@ISACA Article

The Great Resource Roundup

A fact of modern life: We love curated lists and recommendations. Yelp, Wirecutter, Rotten Tomatoes, Amazon, and so many more … we all have our go-tos. Recommendations make life easier and more interesting.

2 March 2022
Blog Post

Tensions Shine Spotlight on Protecting Critical Infrastructure

Given the tense security environment caused by Russia’s current attacks on Ukraine, threats to critical infrastructure are top-of-mind throughout the cybersecurity community.

2 March 2022
ISACA Journal Article

A Five-Layer View of Data Center Systems Security

The data center is the central nervous system for any organization. As the hub of servers that host business-critical data, the data center needs special attention. There are some basic checks required for keeping IT systems safe in the data center. It is imperative for IT...

Author: Ravi Shankar Vemuri
ISACA Journal Article

Letter From the Board Chair: Dear Reader

The volume you are reading is the ISACA Journal’s second in its 50th anniversary year. The topic of the workforce is one that has evolved significantly over time—and one that continues to change rapidly.

Author: Gregory J. Touhill
ISACA Journal Article

Information Security Matters: Privacy for Sale

On 16 September 2021, I was perusing my morning newspaper (well, actually, my morning news website) and was struck by this headline: “The Battle for Digital Privacy Is Reshaping the Internet.”

Author: Steven J. Ross
ISACA Journal Article

IT Audit in Practice: The Transformative Power of Mobility

It is hard to believe the quarter century mark is just a few years away. The pace of technology has been frenetic since the turn of the century, and the upcoming milestone that 2025 represents is an opportunity to reflect upon what it means for a workforce that has gone from dotcoms to Zoom.

Author: Cindy Baxter
ISACA Journal Article

HelpSource Q&A

Our organization is contemplating hiring a virtual CISO. How does the role work and how do we ensure that it will be effective and meet business objectives?

Author: Sunil Bakshi
ISACA Journal Article

Mindset Matters

On 11 March 2020, just two months after the initial cases were uncovered in Wuhan, China, the World Health Organization officially declared COVID-19 a pandemic. Eight days later, the US State of California became the first state to issue a stay-at-home order, requiring...

Author: Kevin M. Alvero
ISACA Journal Article

Bringing Enterprise Security Home

The May 2021 Colonial Pipeline ransomware attack that crippled fuel delivery for several days in the southeast region of the United States was not the first time US enterprises have been held hostage by criminal hackers—and it will not be the last.

Author: Pranav Kumar
ISACA Journal Article

The Cyberrisk Quantification Journey

Many organizations suffer from being unaware of their levels of cyberrisk and lack business engagement in cybertechnology in general.

Author: David Vohradsky
ISACA Journal Article

The Crucial Principle of Need to Have Available

When confidentiality, integrity and availability (CIA) were established as the main information security attributes in the 1990s, employees around the world were not working from home due to a global pandemic.

Author: Yiannis Pavlosoglou
ISACA Journal Article

Case Study: Growing a Technology Company Using a Secure-by-Design Approach

In 2018, Trigo Vision was founded by brothers Michael and Daniel Gabay to help grocery stores embrace digital transformation and innovate toward a checkout-free experience for customers. The start-up, based out of Herzliya, Israel, built a technology predicated...

Author: Katie Teitler
ISACA Journal Article

Ensuring That Cybersecurity Is Everyone’s Job

Employees focus on the responsibilities that are listed in their job descriptions. If cybersecurity and privacy responsibilities are not documented in job descriptions, then it is likely that staff members will assume that cybersecurity is not a primary responsibility for them...

Author: Tom Schneider
ISACA Journal Article

Taking IT Operations From Phoenix to Hydra Dragon

If there is a choice between being a phoenix or a hydra dragon, which option would be better? Both are ancient mythical creatures with supernatural powers.

Author: Abdelelah Alzaghloul
ISACA Journal Article

Facts and Fallacies of IoT-Driven Workplace Transformation

Due to the fast-paced, IT-enabled industrial revolution, new and innovative technologies have become more deeply ingrained in business operations and society in general.

Author: Vimal Mani
Podcast

Breaking Down the ESET T3 2021 Threat Report

Tune in as ISACA’s Kevin Keh talks with the Chief Security Evangelist of ESET, Tony Anscombe about the latest released report from ESET.

1 March 2022
Blog Post

Volatile Times Call for Heightened Cybersecurity Preparedness

The recent attacks on Ukraine are a daunting reminder that today’s battles occur on two fronts: the physical world and the digital one.

28 February 2022
Blog Post

A Lesson for the Cybersecurity Community

With the numerous cyberattacks being reported in the news almost daily, I find it helpful to think of some words of wisdom from my grandfather.

25 February 2022
Blog Post

Getting Creative with Maturity Models and COBIT 2019

Maturity models have become an area of personal interest in my professional practice. Maturity models can act as a common language that serves as a bridge between the business and the IT function.

24 February 2022
ISACA Journal Article

Capability Maturity Model and Risk Register Integration: The Right Approach to Enterprise Governance

The total number of active controls in an enterprise is always extremely high. Part of the normal functioning of any process or activity is to define an objective, map the rules to achieve it, put them into practice and then constantly check their alignment with the defined objective.

Author: Luigi Sbriz
Security Article

Improving Cybersecurity Training to Protect Your Enterprise and Yourself

Security is everyone’s responsibility. Whether it is viewed as a burden, an obstruction to business goals or part of doing a good job, achieving effective security requires each and every individual to participate.

23 February 2022
@ISACA Article

What Cyberprofessionals Should Know About CUI

It has been said that data are the new oil, and personally identifiable information (PII), personal data (PD) and protected health information (PHI) are being drilled for in the new data-based economy.

23 February 2022
Blog Post

Why Collecting the Right Metadata is Crucial for Scaling a Security Program

At Adobe, security is a critical priority for us, and we believe in defense-in-depth, which begins with monitoring — from collecting event logs and configuration data made available by public cloud providers, to logs from EDR systems and vulnerability scanning pipelines.

23 February 2022
Security Article

Courage Under Fire

Most people recognize that humans are fallible, but this fact can have dire consequences for those whose jobs entail protecting life or assets. Within the cyber realm, insiders are often responsible for cybersecurity incidents, resulting in a US billion-dollar security awareness computer-based training market.

23 February 2022
Blog Post

Auditing in a Virtual Universe

The Industrial Revolution in the 18th and 19th centuries came with a lot of transformations and innovations that gave rise to the use of machines and fundamentally changed the ways humans live.

22 February 2022
ISACA Journal Article

Data and AI Management in Smart Agriculture Using Soil and Crop Data

With smart agriculture using soil and crop data gaining traction around the world, the importance of data management is also being increasingly recognized. As in any other business, the products produced (in this case, crops in agriculture) need to be safe and environmentally and socially friendly.

Authors: Mitsuhiko Maruyama, Taiji Ayabe, Yotaro Sato and Alexander Vinson
Podcast

Building Digital Trust in a FinTech Start Up

Today's Page to Podcast features ISACA's Kevin Keh and Donald Tse, the Head of Cyber & Technology Risk at Mox Bank and author of "Cybersecurity and the Technology Risk in Virtual Banking", as they dive into the virtual banking scene in fintech.

22 February 2022
Blog Post

Celebrating Five Decades of the ISACA Journal

The ISACA Journal is more than just a print and digital publication – for 50 years, it has served as a reflection of ISACA’s membership, in the view of Steven Ross.

18 February 2022
Podcast

Lessons Learned from a Year of Remote Work

Working from alternate work sites using unsecure networks may be here to stay, but there is much to learn from 2020 that can help improve cybersecurity capabilities for remote staff.

18 February 2022
Blog Post

Drilling Down on Data Protection and DPO Reporting

Cat Coode, founder of Binary Tattoo and an expert in global privacy regulation compliance, recently participated in a privacy-themed Ask Me Anything thread on ISACA’s Engage platform.

17 February 2022
ISACA Journal Article

The Role of Technology in SOX and ICFR Compliance Programs

After several major accounting scandals, the US Sarbanes-Oxley (SOX) Act of 2002 was enacted in the United States to protect investors from fraud, improve reliability of financial reporting and restore investor confidence.

Author: Nneoma Okorie
@ISACA Article

Who Is Ultimately Responsible for Your Organization’s Security?

Being a telecom engineer by profession, most of my time is spent in technical areas where most of the people are usually of the opinion that network security is the responsibility of the security team (Security Operations Center) and the security auditors only.

16 February 2022
Blog Post

How to Navigate the Perfect Storm: Cyberthreats and Skills Shortages

Over the past two years in particular, the importance of cybersecurity has been globally recognized, and sophisticated cyberattacks have made international headlines.

15 February 2022
Emerging Technology Article

Ethical Emerging Technologists

Cybersecurity professionals aim to help organizations protect their information and IT infrastructures. Their main purpose is to avoid negative impacts, not only to their clients’ enterprises, but also to their clients’ and users’ lives.

15 February 2022
ISACA Journal Article

The Evolution of Audit in the Wake of the Pandemic

The practice of audit is age-old, though the many models and methods have evolved over time. The audit community has faced significant challenges, ranging from misalignment with auditees to ignorance about changing risk areas with technology advances.

Author: Gopikrishna Butaka
Podcast

Unpacking Pakistan's Cybersecurity Policy 2021

ISACA’s Director of Professional Practices & Innovation, Jon Brandt, is joined by Muneeb Imran Shaikh, author of "Pakistan’s Cybersecurity Policy in 2021: A Review".

15 February 2022
Blog Post

Individual Behavior, Corporate Action and Sarbanes-Oxley

In recapping the history of the Sarbanes-Oxley Act (SOX) of 2002, discussions often include lists of the corporations whose actions led to enactment of this United States legislation. The terms “corporate scandal” and “corporate fraud” are used.

14 February 2022
Blog Post

A Workplace Sea Change: Sizing Up The Next Normal

The workplace in February 2022 looks drastically different than it did even a year ago and is likely to be reshaped even further in the year to come.

11 February 2022
Blog Post

Many Shades of a Common Problem: Privacy Rights Requests

DSARs, IRRs, Consumer Rights’ Requests, Derechos ARCO – if you broke out into a cold sweat reading any one of those, then this blog post is for you. Privacy requests are complex and burdensome in daily operations today, and only getting more prolific.

10 February 2022
ISACA Journal Article

Redefining Risk Toward Its Management

One analysis of the word “risk” and its impact on risk management processes uses RISK as an acronym for reasoning, intelligence, strategy and knowledge.

Author: Tapas Bhattacharya
Podcast

Using XDR and Zero Trust to Combat Ransomware

Listen in as ISACA's Research Advisor, Brian Fletcher and Trend Micro's Bill Malik look into the realities behind ZDR and Zero Trust, how ransomware works, and how the both XDR and Zero Trust can help organizations minimize their vulnerabilities.

10 February 2022
@ISACA Article

Environmental, Social and Governance Gains Traction

A new ISACA publication discusses the importance of establishing an environmental, social and governance (ESG) framework and applying it to an enterprise’s daily operations.

9 February 2022
@ISACA Article

ISACA Conference Session to Spotlight Lessons from SolarWinds Breach

An upcoming ISACA Conference session will shed new light on one of the most consequential cybersecurity events of all time.

9 February 2022
@ISACA Article

Tips for Effective Control Design

While someone may be familiar with a concept because they have been putting it into practice for some time, when they try to articulate it to others, they might find it difficult to explain.

9 February 2022
Security Article

Using a Team Approach in the New Year to Face the Future

Anticipating how the world of technology will evolve and change is not only a goal for economists, investors and power players in the stock market, but for cyberentrepreneurs, risk managers, IT professionals, chief information security officers (CISOs) and chief security officers (CSOs).

9 February 2022
Blog Post

Insights into Environmental, Social and Governance (ESG)

Are we prepared for the Environmental, Social and Governance (ESG) challenge? Organizations are facing heightened expectations from interested parties such as regulators, customers, consumers, investors, community activists and others when it comes to ESG.

8 February 2022
Blog Post

Leveraging Cybermaturity to Right-Size Cybersecurity

We hear the word “cybermaturity” tossed around quite often these days, but what does it mean? Cybermaturity is a state describing the sophistication, or rigor, of one’s cybersecurity capabilities and processes.

8 February 2022
ISACA Journal Article

A Three-Way Approach for Breaking Down the Great Wall of IT

Sometimes known as the Stone Dragon, the Great Wall of China is one of the world’s greatest engineering wonders. This masterpiece can be seen from space and was built as a series of fortifications over several hundred years and across the historical northern borders of Imperial China.

Author: Abdelelah Alzaghloul
Blog Post

Aggravating Circumstances for an RCE Vulnerability: A Log4j Retrospective and Risk Landscape Evaluation

Information security teams were forced to respond over the holiday as an Apache Log4j zero-day vulnerability was discovered and socialized across the infosec community.

7 February 2022
Blog Post

Understanding the Importance of Effective Board Communication

For any cybersecurity framework to be successful, it is essential that the chief information security officer (CISO) or equivalent figure be able to simply communicate with top management the state of security in the organization, present an improvement plan, justify it with the risk assessed and request the necessary resources.

4 February 2022
Podcast

What is Environment, Social, and Governance (ESG)?

Mark Thomas (Founder, Escoute) and Caren Shiozaki (EVP & CIO, TMST, Inc.) join ISACA's Lisa Villanueva for a conversation about Environment, Social, Governance or ESG.

4 February 2022
ISACA Journal Article

The Importance of a National Digital Identity System

The leaders and policymakers of nations around the world are working on building national digital identity systems and frameworks.

Author: Biji Scaria
@ISACA Article

Report Provides Insights on Evolving Privacy Landscape

New research from ISACA explores the latest trends in enterprise privacy—from privacy workforce and privacy by design to privacy challenges and the future of privacy—in its new Privacy in Practice 2022 survey report, sponsored by OneTrust.

2 Feburary 2022
@ISACA Article

The Job Search Timing Conundrum

Hiring for IT audit, IT GRC and information security roles appears to be in full-tilt boogie mode. Posts from hiring leaders promoting their openings are appearing frequently on LinkedIn.

2 February 2022
Blog Post

Simplify and Contextualize Your Data Classification Efforts

In the CISO Desk Reference Guide, I noted how critical the concept of “context” is to security programs. The same holds true for our organizations and their respective privacy programs.

2 February 2022
Blog Post

Achieving Workforce Diversity in Cybersecurity

In the current global landscape of near daily announcements of cyberattacks, organizations can no longer just sit back and wait for employees to find them; they must be proactive.

1 February 2022
Governance Article

Using COBIT for Value-Based Direction Setting

Every organization goes through a phase in its life cycle that leaves it with 2 options: transform or decline.

1 February 2022
ISACA Journal Article

The Evolution of Information Systems Audit

From the early days of electronic data processing (EDP) to modern cybersecurity, IS audits have come a long way. The landscape around information systems has been changing, but as in any journey, an eye on the rearview mirror enables better decision-making and safer travel forward.

Author: Anantha Sayana
Podcast

The Impact of SOX on the Industry 20 Years Ago and Today

The Sarbanes-Oxley (SOX) Act was passed by the United States Congress in 2002. 20 years later, ISACA's Robin Lyons asks Cindy Baxter, Director at What’s the Risk, LLC all about SOX.

1 February 2022
Blog Post

The Weakest Link in the Cybersecurity Chain: Are You Aware of It?

Recently, there was a debate on our audit team regarding the increased amount of cybercrime during the pandemic and the best ways to handle it.

31 January 2022
Blog Post

My Guide to Passing the CISA Exam

Becoming CISA-certified in the first attempt is not an easy task, but it can be passed simply by following a dedicated and structured study plan.

28 January 2022
ISACA Journal Article

Humans and Cybersecurity— The Weakest Link or the Best Defense?

Cyberwar and conventional war have certain similarities, but cyberwar involves obscure and often anonymous enemies. Cybersecurity is one of the most significant challenges facing both enterprises and individuals today. It is vital to be prepared to defend against the war waged by sophisticated cyberadversaries.

Author: Julien Legrand
Podcast

Privacy in the Dark (Data)

Listen in as Safia Kazi, ISACA's Privacy Professional Practice Advisor, as she speaks with Steve Ross, Executive Principal of Risk Masters International, about his article "Privacy in the Dark (Data)".

27 January 2022
@ISACA Article

Proximate Cyberrisk Management Starts With Culture

Everybody wants to get to the root cause of a problem, but few actively try to manage the risk around its edges.

26 January 2022
@ISACA Article

Seeking Sustainable Results in Addressing Cyber Talent Gap

One the most discussed topics of the past decade has been the growing talent gap in cybersecurity.

26 January 2022
@ISACA Article

Taking the Lead to Build the Cyber Workforce of the Future

2021 was a thrilling roller coaster of peaks, dips, twists and turns for cyber professionals across the United States in both the public sector and private industries.

26 January 2022
Blog Post

Plenty of Progress Still Needed on the Privacy Landscape

2021 was an eventful year for privacy with the emergence of new legislation such as the California Consumer Privacy Act, Brazilian General Data Protection Law and China Personal Information Protection Law.

26 January 2022
Blog Post

What Is a Risk Heat Map & How Can It Help Your Risk Management Strategy

In the early 2000s, pharmaceutical company GlaxoSmithKline (GSK) was facing a serious risk: One of its manufacturing plants did not meet the requirements of current good manufacturing practices (CGMP).

25 January 2022
Security Article

US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework

Cybersecurity is only as good as an organization’s weakest link. Increasingly, the weakest link is the cyber supply chain.

25 January 2022
ISACA Journal Article

Working Toward a White Box Approach

It has long been the assumption that, once built, all computer systems are Turing machines—that is, devices that perform one small, deterministic step at a time—and are, therefore, deterministic in nature

Authors: Sandipan Gangopadhyay, Stuart Mcguigan, Vijay Chakravarthy, Dheeraj Misra and Sumit Tyagi
Podcast

Industry News Wrap

ISACA's CyberPro Jon Brant breaks down industry news stories so far in the new year: Log4j, Cyber Insurance, Augmented Reality/Virtual Reality, Metaverse, Deep Fakes, and even the legal discussion around vehicle car data.

26 January 2022
Blog Post

Charting a Course for Digital Trust

As we begin this new year, we’re also in the early stages of executing on a new strategic plan that will shape ISACA’s focus in 2022 and the coming years.

24 January 2022
Blog Post

Enablers That Propelled Our Careers to a Higher Level

Undoubtedly, ISACA is cultivating the next generation of digital trust professionals as it is a one-stop-shop for top-notch industry-recognized credentials, pieces of training that bridge the gaps between what people learn in university and the practical skills required to perform tasks at work.

21 January 2022
ISACA Journal Article

SWIFT’s Customer Security Program: Lessons for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the communication system of the Society for Worldwide Interbank Financial Telecommunication (SWIFT), were compromised through spear phishing emails.

Author: Ninad Dhavase
@ISACA Article

Boosting Cyberresilience for Critical Enterprise IT Systems With COBIT and NIST Cybersecurity Frameworks

The term cyberresilience is defined as “[T]he ability of a system to continue to operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities and recover to an effective operational posture in a time frame consistent with mission needs.”

19 January 2022
@ISACA Article

Foundation in Place for a Promising Year Ahead

Happy New Year, ISACA community! The year ahead holds great promise, but before we turn our attention to all there is to look forward to in 2022, let’s briefly reflect on how we’ve reached this point.

19 January 2022
@ISACA Article

Reaching DevSecOps Maturity

Development teams may be using the latest and greatest technology to build amazing products, but security does not always keep the same pace.

19 January 2022
@ISACA Article

Stay on Top of Privacy Challenges with These ‘Must-Dos’

Organizations seeking to build and strengthen their privacy programs in 2022 face a range of challenges – the proliferation of data, an evolving regulatory landscape, ongoing challenges related to the COVID-19 pandemic, and many more.

19 January 2022
Blog Post

Technology Control Automation: Improving Efficiency, Reducing Risk and Strengthening Effectiveness

A principal component of a sound risk management framework, particularly in highly regulated institutions, is an effective control testing program.

19 January 2022
Blog Post

Code of Conduct: An Effective Tool for GDPR Compliance

We are three+ years out from the EU General Data Protection Regulation (GDPR) taking effect. While many organizations are still new to or struggle with GDPR, a more recent milestone could shed light on this development for privacy practitioners and implementors.

18 January 2022
Security Article

Cybersecurity Lies and the Lying Liars Who Tell Them

I freely admit I borrowed my title from former US Senator Al Franken’s 2003 book Lies and the Lying Liars Who Tell Them. But I think it is time we as security professionals take a good hard look at ourselves and admit all the ways that we are lying…to OURSELVES!

18 January 2022
ISACA Journal Article

Cybersecurity Incident Response Exercise Guidance

Organizations must review cybersecurity threats and attack vectors, understand the importance of the incident response plan (IRP), review response activities, conduct tabletop exercises, analyze the exercises to determine areas for improvement, manage reporting and conduct IRP maintenance.

Author: Larry G. Wlosinski
Blog Post

Is Agile Auditing a Sure Thing for Internal Audit?

Operational innovation. Business resilience. Operational disruption, possibly resulting from third-party management issues like suppliers’ solvency, compliance, service/product quality and even suppliers’ behavior (if your enterprise happens to be subject to the UK Bribery Act or similar legislation).

14 January 2022
ISACA Journal Article

Strengthening Cybersecurity With Red Team Engagements

These days, cyberadversaries are coming up with different kinds of capabilities and objectives behind each of their new cyberattacks, which has forced organizations to do a deeper, more introspective evaluation of their existing cyberdefense mechanisms.

Author: Vimal Mani
@ISACA Article

A Look Ahead at New Data Privacy Regulations

“Data are the new oil” is no longer a new sentiment. This has become the reality for individuals, organizations and entire countries since the adoption of digital transformation throughout the last 15 years.

12 January 2022
@ISACA Article

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

The idea of a risk register used in a practical and effective way is an expectation of the ISACA’s Certified in Risk and Information Systems Control® (CRISC®) certification.

12 January 2022
@ISACA Article

Finding Calm Amid Chaos: Improving Work-Life Balance

Many write about the need for work-life balance, but nothing affirms its criticality more than a negative health report. Recently, a friend required significant medical treatment, which provided some additional inspiration for this column.

12 January 2022
Blog Post

Maintaining Your Compliance Strategy During (and After) CISO Turnover

Amidst the “Great Resignation,” employees across industries — and experience levels — are reconsidering their relationship with work.

12 January 2022
Blog Post

Foundation in Place for a Promising Year Ahead

Happy New Year, ISACA community! The year ahead holds great promise, but before we turn our attention to all there is to look forward to in 2022, let’s briefly reflect on how we’ve reached this point.

11 January 2022
Security Article

A Brief History of the Cybersecurity Profession

Cybersecurity careers are in high demand, but a closer look at the timeline of network technology and the Internet reveals that this has virtually always been the case.

11 January 2022
ISACA Journal Article

A Security Awareness Program for PCI DSS Compliance

Fintech organizations that provide payment solutions to merchants, banks and financial institutions have a strict requirement to maintain security and regulatory compliance.

Authors: Yasmin Razack and Timothy Sorbin
Podcast

How Do Organizations Control Their Use of Social Media

What are the main risks that most enterprises need to consider when it comes to social media? If you don’t know, you and your organization are in danger of serious reputational risk!

11 January 2022
Blog Post

A Bird’s Eye View of Cyberinsurance Plans

Most cyberattacks launched by hackers result in financial repercussions for the organization and cause disruption of its critical assets and services.

10 January 2021
Blog Post

Online Education From a Security Risk and Controls Perspective

The internet and the subsequent online revolution have led to the digitization of almost every aspect of human life; education is no different.

6 January 2022
ISACA Journal Article

Going Agile in Audit: What to Do and What Not to Do

Agile is on trend these days. Even the people who opposed agile in the past have now jumped on the bandwagon and actively campaign for going Agile while not always understanding what that means—and often inserting the same nonagile obstacles they have been practicing into their version of Agile audit.

Author: Spiros Alexiou
Podcast

From the Board Level to the Code Level

Blake Curtis is a global business risk and security engineer for Deloitte Global and a research scientist with a Ph.D. in cybersecurity and risk management. Today he breaks down frameworks, governance and governmental controls from the board level to the code level.

6 January 2022
@ISACA Article

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away.

5 January 2022
@ISACA Article

Develop This Essential Career Skill in 2022: Getting to the Next Question

The head of IT audit at a major global organization once told me that an absolutely critical thing to success on the job was “getting to the next question.”

5 January 2022
@ISACA Article

More Governance Than Ever

Few would doubt the need for proper enterprise governance, which, ultimately, ensures that direction is set, benefits are realized, risk is managed and resources are reasonably used. These four conditions summarize what governance is all about.

5 January 2022
@ISACA Article

New Resources Address Evolving Challenges on the Audit Landscape

In 2022, many audit professionals will shift their focus to developing dynamic new strategies such as agile auditing, revisiting established technologies from a remote or hybrid working environment perspective, and closing any gaps between compliance expectations and current practices—and how they can enhance their skills to meet the needs of the evolving audit landscape.

5 January 2022
Blog Post

Recognizing the Customer’s Responsibility in a Shared Responsibility Model

Every industry, regardless of size, is eager to realize the benefits of the cloud. The cloud providers’ ability to move from a Capital Expenditures (CAPEX) model to Operating Expenses (OPEX) is not all about upfront cost savings, which the cloud platforms offer.

5 January 2022
Podcast

ISACA Cyber Pro Chats with Naomi Buckwalter

ISACA’s Cyber Pro, Jon Brandt, invites information security guru, Naomi Buckwalter, Director of Information Security and IT to the podcast to discuss hot and heavy topics within Cybersecurity and the IT industry.

5 January 2022
Blog Post

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

The idea of a risk register used in a practical and effective way is an expectation of the ISACA’s Certified in Risk and Information Systems Control® (CRISC®) certification.

4 January 2022
ISACA Journal Article

Cybersecurity and Technology Risk in Virtual Banking

Managing cybersecurity and technology risk is a major challenge for virtual banks. Although cyberattacks and a lack of system resilience can be detrimental for both traditional and virtual banks, they arguably have a greater impact on the latter.

Author: Donald Tse
Podcast

What Will it Take to Reach DevSecOps Maturity?

While our development teams have been busy running full speed ahead using the latest and greatest technology to build amazing products, security teams haven’t always been known to keep the same pace – and we have reached a point of “developer revolt.”

4 January 2022
ISACA Journal Article

Letter from the CEO

The ISACA Journal you hold in your hand—or read on your screen—marks an important milestone. The year 2022 is the 50th year of this publication.

Author: David Samuelson
ISACA Journal Article

Information Security Matters: Privacy in the Dark (Data)

According to informed sources, 55 percent of all enterprise data are dark, so there is a lot of information just sitting there waiting to be (mis)used.

Author: Steven Ross
ISACA Journal Article

Innovation Governance: Innovation Against Cyberattacks

With the challenges of securing cyberspace, there has been a great deal of innovation throughout the past decade, especially in the last couple of years. However, the multitude of attacks and their increasing sophistication is going to require even more innovation...

Author: K. Brian Kelley
ISACA Journal Article

Migrating to the Cloud: How the COVID-19 Pandemic Has Affected the IT Landscape

The question of whether to move on-premises software to the cloud has been relevant for several years. In the past, every year a few more enterprises migrated to the cloud, but that changed significantly in 2020 when organizations faced the effects of the COVID-19 pandemic.

Authors: Lukas Werner and Gerald Burch, PH.D.
ISACA Journal Article

On the Need for Combined Assurance

Over the last 50 years there have been vast changes in IT. Opinions vary, but one of the most disruptive was the invention of the Internet, which, in turn, led to the creation of cloud computing.

Author: Ian Cooke
ISACA Journal Article

IT Audit: A Look Ahead

Traditionally, the term “IT audit” suggests certain familiar procedures such as ensuring the functionality and integrity of an entity’s tools, systems and networks; testing and monitoring the security of IT systems against intrusion or misappropriation...

Author: Kevin M. Alvero
ISACA Journal Article

The GRC Journey Never Ends

Information security has existed since humans started sharing information. For example, Julius Caesar developed a cipher to protect information from unauthorized disclosure.

Author: Muhammad Asif Qureshi
ISACA Journal Article

Case Study: Minority Students Dive Into the Tech Talent Pool

From the most senior level to the rank-and-file, the workforce running the US technology industry has long failed to mirror the ethnic diversity of the tech user base or society at large.

Author: Mick Brady
ISACA Journal Article

Overcoming a False Sense of Security: How to Deeducate Current Security and Control Practices

The current international dynamic characterized by tension between nations in the midst of gray zone conflicts highlights the challenges in cyberspace and how cyberoperations affect the relationships of enterprises and countries.

Author: Jeimy Cano
ISACA Journal Article

Embedded Finance Brings Banks to New Frontiers of Risk

Embedded finance has been hailed as a paradigm shift in financial services, moving from being product-centric to customer-centric.

Author: Terrence Cai
Blog Post

How to Enable DICE and TPM for Optimal Security

By 2030, more than 24 billion Internet of Things (IoT) devices will have entered our cities, workplaces and homes, according to Transforma Insights. For years, I have been working to make sure that these devices have a healthy immune system so that they can defend against malicious attacks.

30 December 2021
ISACA Journal Article

Help Source Q&A

How can organizations define risk appetite? Is there any standard method or technique?

Author: Sunil Bakshi
Blog Post

Cybersecurity in Arbitration

Arbitration is a process of resolving a dispute between two or more parties through one or more arbitrators to obtain a legally binding decision outside of court. The proceedings and awards remain confidential.

29 December 2021
Blog Post

Assessing and Improving Information Governance Maturity Across Emerging Data and Cloud Systems

Organizations are concerned about the impact of rapid digital transformation on their data privacy, security, compliance and legal risk.

28 December 2021
ISACA Journal Article

Building a Maturity Model for COBIT 2019 Based on CMMI

Years ago, the COBIT 5 Process Assessment Model (PAM) was commonly used to assess the maturity level of a COBIT implementation.

Author: Luis Gorgona
Podcast

Emerging Tech Session #5 - Ultra-Emerging Tech

Join Kevin Keh, IT Professional Practices Lead - Research Development for ISACA, and guest, Ramses Gallego, International Chief Technology Officer for CyberRes in the latest session of our LinkedIn Live series on Emerging Technology.

27 December 2021
Blog Post

Log4Shell Update and Resources

In the past week, you’ve likely seen multiple headlines about a new major security vulnerability. Log4j is an open-source logging framework built on Java coding language that is used by approximately one-third of all webservers. On 9 December, a flaw in the code was discovered and rated a 10 out of 10 on the Common Vulnerability Scoring System (CVSS) due to its possible impact. 

23 December 2021
Blog Post

The Importance of VPN Technology Assurance

Virtual Private Networks (VPNs) for many years have already been in place in almost every organization. Their use has been mostly limited to functioning as site-to-site tunnels between offices and third-party organizations, providing remote access of IT specialists for incident/change...

23 December 2021
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 2

The ability to answer top management's questions is the first step to being successful in presenting information security risk effectively. In enterprise risk management, the difficulty is to combine different data...

Author: Luigi Sbriz
@ISACA Article

Drawing Connections Between Security and Employee Personalities

An enterprise’s employees are often regarded as its biggest weakness in terms of cybersecurity. Though some threats are posed inadvertently by employees with certain personality traits, an organization can also be targeted intentionally by an employee acting as an insider threat.

22 December 20212
@ISACA Article

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

22 December 20212
Blog Post

Central Bank Digital Currency and Governments’ Quests for Control

According to National Geographic, “An adaptation is any heritable trait that helps an organism, such as a plant or animal, survive and reproduce in its environment.” Eucalyptus trees survive the wildfires of the Australian forest because of their thick, multilayered barks that act as insulation against heat.

22 December 2021
Blog Post

Qualities of a Trusted Information Systems Auditor

The information systems auditor’s journey is one of exploration because each time we encounter new risks, processes and controls, they become a part of our work.

21 December 2021
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 1

In organizations, the topic of enterprise risk management presents a twofold problem: the calculation of the level of risk and effective communication to top management. An accurate risk assessment loses all its effectiveness if it is not properly understood by managerial executives with decision-making power.

Author: Luigi Sbriz
Blog Post

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase data is the new oil. But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

20 December 2021
Security Article

We Can Neither Regulate Nor Sanction Away Cryptocurrency’s Facilitation of Ransomware

While 2020 will be remembered for the beginning of the COVID-19 pandemic, 2021 may be remembered as the year when ransomware entered the collective public consciousness, courtesy of the Colonial Pipeline and JBS ransomware attacks.

20 December 2021
Blog Post

Compliance Versus Risk: Why Choosing the Right Approach is So Important

Most organizations have now realized the critical importance of cybersecurity risk management.

17 December 2021
Blog Post

A Holistic Training Approach That Helps Enterprise Governance Thrive

If you have been on your professional or social networking sites in the past several months, you might have noticed that many of your colleagues are posting about their newly acquired certifications.

15 December 2021
ISACA Journal Article

Adopting International Standards in Africa to Protect Critical Infrastructure

The digitally interconnected world has immense potential. Internet-based technologies are becoming an integral part of every critical infrastructure.

Author: Patrick Katuruza
@ISACA Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan.

15 December 2021
@ISACA Article

Nominations Open for ISACA Board of Directors

Nominations for the 2022-2023 ISACA Board of Directors are open now through 31 January 2022.

15 December 2021
@ISACA Article

Shining a Stronger Spotlight on the Information Systems Audit Profession

Way back while I was in university, despite the fact that I was pursuing a bachelor’s degree in computer science, I never heard any faculty mention a profession in IS/IT audit. To date, when I mention my profession to some, they ask what in the world it is that I do.

15 December 2021
Blog Post

The Challenging Task of Auditing Social Media

A request to audit social media is rarely confused with a pleasant sunny day at a picnic. It is fundamentally an audit of the organization’s marketing department, which comes with challenges as marketers are not always following best practices of internal controls.

15 December 2021
Security Article

Diversity in the Cybersecurity Workforce

The cybersecurity professional labor shortage is no secret and has only been exacerbated by the COVID-19 pandemic. For many enterprises, hiring processes slowed or stopped altogether; even those which were able to resume normal recruitment efforts were met with a cyberskills gap.

15 December 2021
Blog Post

Log4shell Vulnerability Highlights Critical Need for Improved Detection and Response Policies and Procedures

A zero-day vulnerability of Log4j (CVE-2021-44228), an open-source, Java-based logging utility widely used by enterprise applications and cloud services, recently came to light.

14 December 2021
ISACA Journal Article

Trusted AI Platforms for the Connected Car Ecosystem

It is common knowledge that sensitive or personal data from connected cars are at risk of being hacked or breached. More important though, is that it is critical to realize that connected cars pose serious threats to human lives, including fatalities.

Authors: Khyati Mehta, Chinmoy Rajpal and Gaurav Verma
Blog Post

Three Key Priorities for Emerging Tech Practitioners in 2022

Regardless of where somebody specializes in the IT field – whether an audit, risk, privacy, governance or security practitioner – the impact of emerging technology is becoming increasingly relevant.

13 December 2021
Blog Post

Wanted: Experienced, Passionate Leaders for ISACA Board of Directors

There’s a saying when it comes to what makes an effective board of directors: Noses in, fingers out. That’s the approach the ISACA Board of Directors takes, meaning the Board is responsible for governance and oversight for the organization, but we steer clear of the operational execution.

13 December 2021
Privacy Article

Preparing for Upcoming Data Privacy Regulations

The global privacy landscape has changed drastically since the EU General Data Protection Regulation (GDPR) became law in 2018.

13 December 2021
Blog Post

Three Key Priorities for Governance Practitioners in 2022

The accelerating technological advancements and digital transformation did not reduce its pace in 2021 and it does not figure to in 2022, nor for the foreseeable future.

10 December 2021
Blog Post

Three Key Priorities for Cyberrisk Practitioners in 2022

It’s that time of the year again where people are making prognostications about what will happen in the new year.

9 December 2021
ISACA Journal Article

Evidence-Based Prioritization of Cybersecurity Threats

The landscape of cybersecurity threats is evolving at a tremendous pace. New adversaries with increasingly sophisticated tactics and tradecraft seem to emerge on a continuous basis

Authors: Richard Kerkdijk, Sebastiaan Tesink, Frank Fransen and Federico Falconieri

Security Operations Challenges in 2021

ISACA’s Director, Channel Business Development, Chris DeMale is joined by ServiceNow’s Director of Product Marketing, Karl Klaessig in this follow up interview that takes a deeper look into his presentation during ISACA’s Virtual Summit session, Security Operations Challenges in 2021.

10 December 2021
@ISACA Article

Artificial Intelligence Uses in Blue Team Security: What’s Working and What Isn’t?

Artificial intelligence (AI), machine learning (ML), and deep learning (DL) are often applied in cybersecurity, but their applications may not always work as intended.

8 December 2021
@ISACA Article

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase, “Data is the new oil.” But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

8 December 2021
@ISACA Article

More Bad News About Cyber

If you clicked on this column because its title conveyed a negative tone, you are not alone. It is well known that negativity drives user interaction in online environments.

8 December 2021
Blog Post

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away. They simply lurk beneath the new issues that claim the attention of privacy pros until the time is prime to exploit those old vulnerabilities.

8 December 2021
Blog Post

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

7 December 2021
ISACA Journal Article

Reduced Appetite: How COVID-19 Will Impact Future Business Continuity Planning

No one could have predicted the far-reaching effects of the COVID-19 outbreak. However, many organizations had invested in business continuity and disaster recovery (BC/DR) to prepare for such unexpected disruptions.

Authors: Pascal A. Bizarro and Aaron Wheeler
Podcast

Information Security Programs Need to be Ubiquitous, Proactive, and Vigilant

This ISACA TV interview is a discussing about information security concerns (and challenges), evolution, and the future. Topics covered include mobile computing devices, the Internet of Things (IoT), artificial intelligence (AI), cyber threat intelligence (CTI), software tools...

7 December 2021
Blog Post

Three Key Priorities for Audit Practitioners in 2022

These past two years have been a stretch for everyone. Most are still learning how to work differently and re-evaluating their strategies to get the best out of the worst season.

6 December 2021
Governance Article

COBIT Focus Area: Information and Technology Risk—A Model for Internal Audit Analysis

Risk management is an important function in any organization. Financial services organizations often employ the three lines of defense approach to manage risk within the organization.

6 December 2021
Privacy Article

Finding Common Ground: Security, Privacy and Marketing

It is a common perception that marketing is generally at odds with security and privacy. Although these are broad generalizations with plenty of excluded nuances and exceptions, marketing is seen as thriving on data—the more, the better.

6 December 2021
Blog Post

Cyber Defense Strategies 4.0 Incorporating AI Technology

In the age of Industrial Revolution 4.0, cybersecurity has become a more pressing and disturbing concern for both boards and senior management globally.

3 December 2021
Blog Post

Data-Driven vs. Data-Informed: How Auditors Find the Right Balance

Data is a powerful thing. Consequently, the role that data analytics play in today’s audit profession cannot be emphasized enough, especially in light of digital transformation across different industries.

2 December 2021
@ISACA Article

Artificial Intelligence Adoption in Internal Audit Processes

As artificial intelligence and automation technologies advance, they are being used in a variety of fields to automate operations that were previously done manually.

1 December 2021
@ISACA Article

How to Ace Your Performance Review

So, do you prepare for your performance review? Like, really prepare – meaning that you have a list of your accomplishments.

1 December 2021
@ISACA Article

Tech Debt, Explained

I recently heard the term tech debt for the first time and wondered what it meant. A brief search engine query provided the shocking information that this term was first coined in 1992 by Ward Cunningham, a developer who developed Wiki software.

1 December 2021
Blog Post

Cybermaturity: A Path to Right-Sizing Cyber Practices

The concept of cybermaturity has gained increased attention in recent years, while still not being well-understood in many circles across the industry.

1 December 2021
Podcast

How Innovative Enterprises Win With Secure Machine Learning

Enterprises use machine learning to validate who they are doing business with and to find new opportunities. ISACA's IT Professional Practices Lead Kevin Keh discusses secure machine learning with Protegrity's Chief Security Strategist Ulf Mattsson.

1 December 2021
Blog Post

Case Study: How ASELSAN MGEO Improved Design and Management Processes with CMMI V2.0

Defense contractors and general manufacturers across the globe that are looking to improve overall design and management processes or upgrade their cybersecurity maturity level can do so with ease and efficiency – even during a pandemic.

30 November 2021
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 1

The transfer of personal data out of the European Union (EU) to nations around the world takes place tens of thousands of times every day, and it has been occurring for so long that it has largely become routine business.

Author: Scott M. Giordano
Blog Post

Six Steps to a Mature Policy Management Program

When the reality of the pandemic sank in, and people shifted to remote working nearly overnight, companies had to rethink the data and technology policies written for a typical office working space. Some organizations were scrambling to make updates, while others already had a policy management program to guide them through this event.

29 November 2021
@ISACA Article

Cybersecurity: A Shared Responsibility

Let me begin by asking everyone a question – what does “shared responsibility” mean? What are the responses that come to your mind when you ask the question?

24 November 2021
@ISACA Article

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

24 November 2021
@ISACA Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception. With its increasing number of start-ups, young professionals and digital transformation programs that have been implemented by established organizations, it was incumbent upon Pakistan to enact a cybersecurity policy supported by an overarching framework that also addressed data protection and privacy.

24 November 2021
Blog Post

Privacy in Greater Peril

There is a saying that states “May you live in interesting times,” but it is considered to be a curse. Unfortunately, we are living through a particularly interesting period that is turbulent, high risk and oftentimes devastating.

23 November 2021
ISACA Journal Article

Algorithms and the Auditor

Recent advances in machine learning (ML) and artificial intelligence (AI) have raised new awareness and concerns of algorithms, including their uses and misuses and their potential and limitations.

Author: Spiros Alexiou
Blog Post

Imagining Audit Tech With AI

As an experienced professional who has worked with pharmaceutical, medical device, financial service, government, retail and hedge fund organizations, it did not take me many years to realize that audits and assessments were largely manual, tedious and intensive activities.

22 November 2021
Security Article

Using Zero Trust and XDR to Stop Ransomware

The rise of ransomware has inspired the creation of myriad techniques attackers can use to achieve their goals. At its core, ransomware encrypts an enterprise’s data and then sells the key needed to decrypt them.

22 November 2021
Podcast

HCL State of Cybersecurity 2021

Jon Brandt (Information Security Professional Practices Lead at ISACA) and Renju Varghese (Fellow and Chief Architect at HCL Technologies) break down the State Of Cybersecurity 2021 —Part II report.

22 November 2021
Blog Post

Changing the World on ISACA CommunITy Day

The first Saturday in October has become my favorite day of the year at ISACA. Every year, thousands of ISACA members and their families join together to perform local community service, and we track those efforts to measure the collective impact we have when we work together – even while apart.

19 November 2021
Podcast

ISACA’s New CyberPro – Jon Brandt

Listen in as ISACA’s Information Security Professional Practices Lead, Jon Brandt grabs the podcast microphone and takes over November’s Cyber Pros to discuss CISA’s Directive Breakdown.

19 November 2021
Blog Post

Acronyms Only Scratch the Surface of What ISACA Stands For

ISACA itself is an acronym, formerly standing for the Information Systems Audit and Control Association. And of course, we’re well known for our global portfolio of IT certifications – CISA, CISM, CRISC, CGEIT, CDPSE, CET, ITCA – not to mention the COBIT framework.

18 November 2021
ISACA Journal Article

Benefits Management for Digital Transformation Programs

The global economy is becoming more challenging due to greater international competition, the pace of digital transformation and increased customer experience expectations.

Authors: Sam Opdenakker, Kim Maes, Ph.D. and Steven De Haes, Ph.D.
Security Article

Human Error in Cyberspace

Human error is inevitable, even in fields as thorough and technically efficient as cybersecurity. While there are mechanisms in place to prevent and detect such occurrences, on occasion, even an enterprise that is usually a well-oiled machine can fall victim to vulnerabilities that may arise due to the human factor.

17 November 2021
@ISACA Article

Member Spotlight: Janelle Vasquez

Janelle Vasquez, recently visited with @ISACA to discuss her journey with ISACA, why entrepreneurship appeals to her and how she became enamored with Latin dancing, among other topics.

17 November 2021
@ISACA Article

Tailored Governance for Small and Medium Enterprises

When it comes to small and medium sized enterprises (SMEs), there is no one-size-fits-all approach to governance for enterprise information and technology.

17 November 2021
@ISACA Article

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

17 November 2021
Blog Post

COBIT’s Value for Small and Medium Enterprises

If one or more of the statements below reflects your thoughts on COBIT®, you should investigate the latest ISACA publication, COBIT for Small and Medium Enterprises (SMEs).

17 November 2021
Blog Post

Why the Cloud Market is Booming

Cloud computing and the extended cloud service industry have become mainstream in today’s IT industry

16 November 2021
ISACA Journal Article

A Text-Mining Approach to Cyberrisk Management

Cyberrisk is one of the most pervasive threats facing the global community. The World Economic Forum (WEF) has listed cybersecurity failure as one of the top-five global risk factors since 2018.

Authors: Arunabha Mukhopadhyay and Kalpit Sharma
Podcast

ISACA Live: Emerging Tech - Cloud

Why is the cloud still considered an emerging technology in 2021? Why is the cloud both an enabler and catalyst for all other technologies? How has the cloud changed our organizational eco-systems?

16 November 2021
Blog Post

Cybermaturity and Protecting Against Ransomware

Ransomware continues to dominate the headlines in both cybersecurity journals and mainstream media.

15 November 2021
Podcast

LinkedIn Live: State of Cybersecurity, Part 2

In honor of Cybersecurity month, ISACA’s Director of Communications, Kristen Kessinger, and Information Security Practices Lead, Jon Brandt, discuss the findings of this year’s ISACA State of Cybersecurity...

15 November 2021
Blog Post

The Latest Trends for Master’s Students In IT and How To Leverage Them

There are many reasons people in the IT industry choose to pursue further education. It could be because of the pursuit of knowledge wanting to get ahead of the trends. Or it could be because of the financial aspect – the promise of a promotion or a higher pay that comes with the master’s degree. 

12 November 2021
Blog Post

Challenge Underlying Security Assumptions

Ted Harrington runs Independent Security Evaluators (ISE), the elite security researchers who pioneered car hacking, were first to exploit the iPhone, first to exploit Android OS, pioneered medical device hacking, and run hacking event IoT Village.

11 November 2021
ISACA Journal Article

Does Trust Still Matter in the Era of Zero Trust?

The most common theme of recurring security incidents in recent memory has been associated with the breaches of seemingly trustworthy service providers or technologies.

Author: Ar Kar Oo
Podcast

ISACA's Global Strategy

Join ISACA’s CEO David Samuelson as he discusses ISACA’s Global Strategy with ISACA’s Chief Global Strategy officer Chris Dimitriadis. Chris shares his career path to ISACA, industry trends, advice to the next generation and how ISACA will continue to innovate in the future!

11 November 2021
@ISACA Article

Diagnosing the Epic Fails in Cybersecurity

The cybersecurity industry has long been failing, and to reverse course, a better understanding of the root causes of that failure is needed.

10 November 2021
@ISACA Article

Anyone Can Be an Ally: Grow your Learning and Make Positive Change

“Allies are people who bring change to life in a given setting,” said Sarah Benczik, principal at Deloitte, during her presentation at One In Tech’s seminar during last month’s ISACA Conference Europe.

10 November 2021
@ISACA Article

State of the Threat Landscape Expert Panel

ISACA Conference Oceania welcomed a panel of security experts from the region and beyond to dive into the current threats facing enterprises: cyberrisk, emerging tech adoption, educating stakeholders about risk, and more.

10 November 2021
@ISACA Article

The Magic Trick to Gaining Influence

Vinh Giang, keynote speaker at last month’s ISACA Conference Europe, was able to convince his parents that not only should he quit university, but that they should invest in his dream: teaching magic online.

10 November 2021
Blog Post

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

10 November 2021
Podcast

Cyber Risk and Communicating to a Board of Directors

Digital transformation has heightened due to the pandemic. We went from, “we can’t work from home” to “we can only work from home moving forward”.

10 November 2021
Podcast

Digital Body Language

What is digital body language and why does it matter? Join ISACA's Director of Global Volunteer Engagement Megan Moritz as she speaks with Erica Dhawan, author of Digital Body Language: How to Build Trust and Connection, No Matter the Distance. Mega and Erica discuss...

10 November 2021
Podcast

Getting Started with Risk Quantification

One of the cornerstones of managing the unknown is defining it and measuring it. Anything that could cause harm to an organization needs to be tracked and managed. As more and more transactions occur entirely on digital platforms or are at least facilitated digitally, the ability of cybersecurity issues to trigger a breakdown in the delivery of products and services is a top concern of executives and boards.

10 November 2021
Podcast

IT Audit in Practice: Survival When You are Small-business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan. Was your small-business or corporation prepared for the shift to remote work in early 2020? If not, you probably realized that business continuity is more than having the right systems and applications in place.

10 November 2021
Podcast

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external cloud environments, and information sharing.

10 November 2021
Podcast

Security as a Service

What is security as a service and when is it needed? Tune in as ISACA’s Cyber Pros explain how the increase in hacks and attacks are forcing companies to take cyber security more seriously.

10 November 2021
Podcast

The Cybersecurity Workforce

Join ISACA’s Director of Communications, Kristen Kessinger as she interviews ISACA’s Information Security Professional Practices Lead, Jon Brandt about what is currently happening in the cybersecurity workforce.

10 November 2021
Podcast

US DoD’s CMMC Guidelines — What You Need to Know

Cybersecurity Maturity Model Certification or CMMC is a new security program being released by the US DoD. If you are a DoD contractor, your livelihood could be at stake as contract requirements and contractors will need to be certified or a contract won’t be awarded.

10 November 2021
ISACA Journal Article

How to Construct a Governance System From the Board Level to the Code Level

The concepts involved in promoting a mature structure for software platforms and applications can be quite intricate.

Author: Blake Curtis
Blog Post

New Opportunities Await ISACA Members in 2022

With Membership and Certification renewals right around the corner, I wanted to take a moment and preview some of what you have to look forward to in 2022!

8 November 2021
Blog Post

Planning for Multiple Futures at Once

Nikolas Badminton, a keynote speaker at ISACA’s EVOLVE emerging tech virtual conference, taking place 16-17 November, recently visited with ISACA Now to share his perspective on the business technology landscape.

8 November 2021
Security Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception.

8 November 2021

Talking to Alan Turing About Artificial Intelligence
Blog Post

Talking to Alan Turing About Artificial Intelligence

Is it enough that a computer can be called intelligent if it can deceive a human into believing that the computer is human? Maybe not.

5 November 2021
Blog Post

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a new and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

4 November 2021
ISACA Journal Article

Adopting Technical Controls for Data Privacy in the Digital Age

These days, people tend to share seemingly related or unrelated personal information online, such as birthdays, addresses, contact details, relationships and holiday plans.

Author: Muhammad Tariq Ahmed Khan
@ISACA Article

Counteroffers on the Rise: Job Seekers, Be Prepared for a Wild Ride

The counteroffer strategy typically lies dormant until talent shortages mount. Then, they start popping up like mushrooms after a rain. Like mushrooms, some are tasty, while many are detrimental to your career; some are deadly damaging.

3 November 2021
@ISACA Article

Exploring Blockchain Forensics

In technical terms, blockchain forensics is the use of science and technology to investigate and establish facts in criminal or civil courts of law.

3 November 2021
@ISACA Article

Five Key Considerations When Applying a Trust, but Verify Approach to Information Security and Risk Management

Doveryai, no proveryai or ”trust, but verify,” the Russian proverb made famous by former US President Ronald Reagan, means that a responsible person always verifies everything before committing themselves to a common business with anyone, even if the other party seems completely trustworthy.

3 November 2021
Blog Post

Exploring Blockchain Forensics

In technical terms, blockchain forensics is the use of science and technology to investigate and establish facts in criminal or civil courts of law.

3 November 2021
Blog Post

Building a Strong Risk Culture in the New Normal

The current times are challenging for many organizations in terms of adjusting their frame of mind to working in a hybrid manner (i.e., from home and in the office), keeping abreast of new guidelines from local regulatory and government authorities and managing operational risk.

2 November 2021
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 2

As discussed in “What the Schrems II Ruling Means for Modern Multinational Information Security Practice, Part I,” on 16 July 2020, the Court of Justice of the European Union (CJEU) rendered what is likely to be its most disruptive decision to international commerce to date, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (“Schrems II”).

Author: Scott M. Giordano
ISACA Journal Article

Cyberthreat Intelligence as a Proactive Extension to Incident Response

Cyberthreat intelligence (CTI) is one of the latest buzzwords in the information security industry.

Author: Larry G. Wlosinski
Security Article

Operational Security: A Business Imperative

The US military developed the operational security (OPSEC) methodology during the Vietnam War. Military service afforded me unique opportunities and insights obtained throughout assignments that spanned across the intelligence community and multiple areas of warfare.

1 November 2021
ISACA Journal Article

Information Security Matters: Afraid of the Dark (Data)

I have a cabinet at home that is stuffed full of…well, I am not quite sure what. I am pretty sure there are chargers, although I am not as certain that the devices they once charged still exist. There are cables, connectors and whatnot—a lot of whatnot. If I were a betting man, I would wager that most readers have a cabinet, closet, box or drawer just like mine.

Author: Steven J. Ross
ISACA Journal Article

IT Audit in Practice: Interconnections and Vendors

Business success is inextricably defined by relationships. No matter what technology is used or what brilliant application has been launched, the connections between business owners, suppliers and clients reflect the strategy and how the business owner defines...

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: A Fairy Tale of Innovation

Greetings traveler! Since you have been navigating the wonderful and informative world of the ISACA® Journal for some time, you have likely been inspired to explore and question the world around you. I invite you to take a break from staring at screens for I have a tale to tell.

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Interconnectivity Innovation

In today’s business world, few organizations larger than a small enterprise can survive without interconnectivity limited to just email or a website. Even smaller not-for-profit organizations are using tools that provide greater interconnectivity.

Author: K. Brian Kelley
ISACA Journal Article

How Innovative Enterprises Win With Secure Machine Learning

New solutions help innovative enterprises succeed in an ever-changing, increasingly competitive digital economy. These solutions can empower enterprises to activate and extract value from sensitive data and engender trust by preserving the privacy of customers and employees.

Author: Ulf Mattsson
ISACA Journal Article

Differentiating Internal Audit in Supply Chain Risk Management

Bracing consumers for looming supply chain disruptions has become a repetitive task for the news media in the wake of the COVID-19 pandemic. In early 2021 alone, consumers were told to prepare for shortages of everything from gasoline to chlorine and chicken to computer chips.

Author: Kevin M. Alvero
ISACA Journal Article

The Anatomy of ICT and Services Supply Chain Risk Management

Innovative cyberattacks are emerging across the world in the wake of the COVID-19 pandemic. Attackers are using more sophisticated tools, techniques and processes (TTPs), including information and communications technology (ICT) and services supply chains...

Author: Vimal Mani
ISACA Journal Article

The Pandemic Exposed a Lack of Business Continuity. How Business Must Change

Business continuity planning (BCP) has received considerable attention recently due to the COVID-19 pandemic. Many organizations found that they either did not have a plan to address the many changes that occurred due to the pandemic or that their plan...

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid and Tyler Fezzey
ISACA Journal Article

Case Study: Building an Enterprise SOC and Risk Management Function

Starting in the early 2000s and until the mid-2010s, compliance was a primary driver for many cybersecurity programs; as instilled by business executives, the fear of failing an audit was more worrisome than the threat of a breach.

Author: Katie Teitler
ISACA Journal Article

Cyberruse at the Cybergates: Technology, People and Processes

In 1587, Spain was at war with England. Under King Philip of Spain, the Spanish Empire built an armada of 130 large battleships, all waiting in the bay of Cadiz, Spain, ready to invade England.

Author: Pratim Datta
ISACA Journal Article

Help Source Q&A

We are hearing the term “disinformation” more often. Is it the same as misinformation? If not, what is the difference?

Author: Sunil Bakshi
Blog Post

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

29 October 2021
ISACA Journal Article

Security Adjustments to Strengthen the Bond Between Risk Registers and Information

A valuable component of corporate governance is the risk register. Although it is not mandatory, using a risk register to build a sound risk governance process for an organization is strongly recommended.

Author: Luigi Sbriz
@ISACA Article

Surge in Ransomware Attack and 10 Biggest Attacks in 2021

Ransomware attacks have increased alarmingly in 2021. No industry is safe from this malicious act, and every computer file is at risk of being encrypted.

27 October 2021
@ISACA Article

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, law or information technology.

27 October 2021
@ISACA Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

There is undoubtedly a substantial gap in available cybersecurity personnel to fill the existing open positions, and most researchers believe this gap is only going to grow without a significant change in how personnel are recruited into and retained within the field.

27 October 2021
Blog Post

A Strategy for Tackling ISACA Certification Examinations

ISACA offers several certifications in technology areas related to IT governance, information security, information system audits, privacy, risk management and emerging technologies.

27 October 2021
Blog Post

Delivering Company-wide Security through Cross-collaboration

You’ve just been directed by your CISO to create a set of operational security standards. Where do you even begin?

26 October 2021
ISACA Journal Article

The Evolution of Security Operations and Strategies for Building an Effective SOC

Cybersecurity threats are becoming increasingly complex, sophisticated, malicious, well organized and well funded. The widespread adoption of artificial intelligence (AI)-powered tools and technologies will lead to customized, high-impact cyberattacks.

Author: Lakshmi Narayanan Kaliyaperumal
Blog Post

Taking Fakeness to New Depths with AI Alterations: The Dangers of Deepfake Videos

Even if you haven’t heard the term before, chances are you’ve come across dozens of deepfake videos online and maybe didn’t know it.

25 October 2021
Blog Post

Head In The Clouds: Seeing Cloud Security Risks Clearly

Businesses have transitioned huge swaths of their operations to the cloud in recent years, and the messaging around the shift has included at least one key pitch: the cloud is more reliable and more secure than legacy technology.

22 October 2021
Blog Post

Fascinating Numbers: How COBIT 2019 Helps Set Targets and Measure IT Performance

Since I was a child, I have been good at mathematics and my sister, who is one year older than me, has often taken advantage of this by explaining theories to me in order to do her homework. I did not mind because numbers always fascinated me.

21 October 2021
ISACA Journal Article

The Invisible Enemy Within: Insider Threats

When most organizations think of an insider threat, their focus is on a technically skilled, disgruntled and unethical employee or contractor with privileged access.

Author: Allen Ari Dziwa
@ISACA Article

Can IT Governance Be Dispensed With?

In the present context of digital transformation no longer being optional for any enterprise in the current digitization-driven economy, whether wholly or partially in the case of retention of some legacy systems, a commitment to strong IT governance is absolutely mandatory for survival.

20 October 2021
@ISACA Article

‘How Much Does It Pay?’

As a recruiter who specializes in recruiting audit and GRC professionals, I spend significant amounts of time each week reaching out to prospective candidates, via email, InMail, or phone, about the opportunities for which we are recruiting.

20 October 2021
@ISACA Article

ISACA Provides Guidance on Operational Resilience in EU Financial Sector

The European Union’s recently released Digital Operational Resilience Act (DORA) draft is designed to provide digital operational resilience rules for EU financial institutions, and ISACA provides guidance on this proposal in its new white paper, Digital Operational Resilience in the EU Financial Sector: A Risk-Based Approach.

20 October 2021
Blog Post

Addressing New Operational Resilience Requirements of the EU-DORA Proposal

In 2020, the European Union (EU) published a proposal on digital operational resilience known as EU-DORA. EU-DORA, albeit a proposal only, marks a turning point in EU banking regulation as it introduces wide-ranging new requirements in several areas and combines earlier singular regulatory provisions.

20 October 2021
Blog Post

Qualitative vs. Quantitative Risk Assessment

With the ongoing impact of the COVID-19 pandemic in today’s business ecosystem, the value of decision making by using risk-oriented thinking has emerged more clearly and precisely.

19 October 2021
Security Article

Novel Ideas From NIST for Fighting APTs

2021 brought many surprises, not the least of which was an uptick in the scale and severity of cyberattacks. One might be tempted to call 2021 the year of ransomware, yet ransomware is not merely automated worms anymore.

19 October 2021
ISACA Journal Article

Rise of Ransomware Attacks on the Education Sector During the COVID-19 Pandemic

Malware has existed for decades. Ransomware has become one of the most financially devastating types of malware attacks and poses a serious threat to agencies, school districts and other organizations

Author: James G. Koomson
Blog Post

Key Pointers For a ‘People-First’ Transformation

So much has changed in the past decade of technology. Remember early iPhones, or the first generation of social media platforms just hitting the mainstream?

18 October 2021
Podcast

ISACA Conference Europe – Keynote speaker: Vinh Giang

Listen in as ISACA Conference Europe Keynote speaker, Vinh Giang's discusses how he became the successful entrepreneur, magician and keynote speaker that he is today.

18 October 2021
Blog Post

Patching Security Awareness: Human Traits as Vulnerabilities

October is Cybersecurity Awareness Month, a time of year when security awareness improvement actions become especially prominent.

15 October 2021
Blog Post

How to Prepare for and Pass the CISA Exam on Your First Try

In life, it is very easy to spot a certain model and brand of car if that is what you are yearning to have.

14 October 2021
ISACA Journal Article

Establishing a Foundation and Building an Insider Threat Program

Establishing a brand new process, function or program can be daunting. Some of the challenges include determining where to start, researching whether it has been done successfully in the past and, if it has, discovering the best practices and frameworks that can be used as a starting point.

Author: Kara Nagel
@ISACA Article

Latest Collaboration Brings Emerging Technology Focus to Puerto Rico

One of the best parts about my role at ISACA is the chance to build new relationships that can truly lead to transformative progress in people’s learning paths and, ultimately, their careers.

13 October 2021
@ISACA Article

Navigating Changes in Internal Audit

Shuaib Shakoor, CISA, executive director for internal audit at professional services firm JLL, visited with @ISACA to discuss how internal audit is changing, how audit teams should approach cyberrisk and the challenges that accompany implementing emerging technology.

13 October 2021
@ISACA Article

Unraveling the Dark Web

When discussing the dark web, some might say that one will never find a more wretched hive of scum and villainy. But if that is true, why does it continue to exist?

13 October 2021
Blog Post

Business Continuity Planning: Finding a Better Way

Although the details change on a case-by-case basis, a large number of organizations in some parts of the world have begun to reinstate pre-pandemic business operations in some form or another.

13 October 2021
Blog Post

Pass the IT Risk Fundamentals Certificate Exam on the First Attempt

To any exam-taker, it is always magnificent after completion of your test to view the screen displaying “You Passed.”

12 October 2021
Security Article

Lessons Learned From a Year of Remote Work

Over the last year, organizations have had to address many new challenges. When the COVID-19 pandemic first hit, many enterprises had to send staff home with workstations, printers and other resources they needed to continue working.

12 October 2021
ISACA Journal Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

There is undoubtedly a substantial gap in available cybersecurity personnel to fill the existing open positions, and most researchers believe this gap is only going to grow without a significant change in how personnel are recruited into and retained within the field.

Author: Christopher Henry
Blog Post

The Power of Goal-Setting and Re-Imagined Communication

Vinh Giang, a keynote speaker at ISACA Conference Europe 2021, recently discussed themes of perspective, empowerment, goal-setting, and positive mindset to encourage others to believe in the possibility of positive change with ISACA Now.

8 October 2021
Blog Post

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, lawor information technology.

8 October 2021
Blog Post

The Ethics of Artificial Intelligence

Artificial intelligence (AI) is intelligence demonstrated by machines as opposed to the natural intelligence displayed by humans or animals.

7 October 2021
ISACA Journal Article

The Influence of Employee Personality on Information Security

Employees are often considered the weakest link in the information security chain, creating both unintentional and intentional security threats for their employers and their employers’ partners and customers.

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid, Tyler Fezzey and Christine Kelley
@ISACA Article

Challenges of AI and Data Privacy—And How to Solve Them

Artificial intelligence (AI) has developed rapidly in recent years. Today, AI and its applications are a part of everyday life, from social media newsfeeds to mediating traffic flow in cities to autonomous cars to connected consumer devices such as smart assistants, spam filters, voice recognition systems and search engines.

6 October 2021
@ISACA Article

The Profile: The Most Underrated Section in the Modern CV

The Profile or Summary section at the very beginning of many résumés is the most underrated and abused section of all. Underrated because most professionals don’t fully understand how powerful this opening section of the CV can be, which is to say, extremely powerful.

6 October 2021
@ISACA Article

Time to Push Back Against Emboldened Cybercriminals

There are no questions about the growing profitability of cybercrime, which will reach an estimated US$10.5 trillion by 2025.

6 October 2021
Blog Post

Seven Tips for Protecting Your HIPAA Database

Protecting confidential data is a top priority for every industry, but when it comes to the healthcare industry, the regulations and compliance requirements that are in place require stringent data protection measures.

6 October 2021
ISACA Journal Article

US Policy on the Use of Force in Cyberspace

The United States’ ability to defend and protect itself in cyberspace has evolved at an incredible pace. This evolution has been accomplished largely due to various frameworks such as the US National Cybersecurity Strategy (NCS), Joint Publication 3-12 and Presidential Policy Directive 21.

Authors: Roncs Etame-Ese, Daniel Odei, Sean Manning, Eric Mavakala and Andrew Hall, Ph.D
Blog Post

How Can the Relationship Between Risk, Control and Maturity Create Value?

Sometimes the world of internal control is associated with the color gray—an environment of repetitive, boring and ineffective activities.

4 October 2021
Security Article

Protecting Your Organization From Ransomware

It seems as though ransomware is constantly being discussed on the news. It also seems there have been more news stories about ransomware in the past few months than in the past few years.

4 October 2021
Blog Post

When Are Virtual Chief Information Security Officers the Right Choice?

Cybersecurity executive management and leadership are a key component to securing an organization’s infrastructure and assets properly.

1 October 2021
@ISACA Article

Cultivating the Next Generation of Digital Trust Professionals

Attracting the next generation of professionals is not just critical for ISACA’s future – it is critical for the future of our professions.

29 September 2021
Blog Post

Five Easy Technical Tips for an Optimized SAP GRC ARA Report

An effective and mature governance, risk and compliance (GRC) program has proper business requirements and the right blend of automation and technology support.

29 September 2021
Blog Post

How to Write Strong Risk Scenarios and Statements

Risk management is both art and science. There is no better example of risk as an art form than risk scenario building and statement writing.

29 September 2021
ISACA Journal Article

Decentralized Cloud Computing

Computing has penetrated all aspects of everyday life from smartphones, cars, televisions and cameras to home appliances.

Author: Daniel D. Wu, Ph.D., CISA, CISM
Blog Post

Building the Sustainable Innovations of the Future

Shivvy Jervis, Futurist & Founder of the FutureScape 248 laba, recently visited with the ISACA Now blog to discuss the job landscape of the future, what makes innovations sustainable, her past work with the United Nations and more.

27 September 2021
@ISACA Article

Assessing the State of Cybersecurity in 2021 and Preparing for 2022

Nearly three-quarters of the way through 2021, it is a good time to take stock on the state of cybersecurity and lessons learned this year.

22 September 2021
@ISACA Article

Collective Curriculum Development in Information Security

We have all heard about or experienced the cybersecurity workforce and skills shortage. In an attempt to address the skills shortage from an educational institution point of view, I used crowdsourcing to develop a new graduate level cybersecurity course.

22 September 2021
@ISACA Article

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a trending and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

22 September 2021
ISACA Journal Article

Is Cyberspace Secure From Humans?

A stable mechanism is one that operates consistently and sensibly. Cybersecurity is fundamentally a dynamic sociotechnical mechanism and, due to the human factor, it is vulnerable because human behavior and decisionmaking are complex and often unreliable.

Author: Gopikrishna Butaka
Blog Post

Five Considerations for Leveraging the Unified Compliance Framework

The compliance landscape is constantly shifting, and companies are often challenged to meet the requirements of multiple regulations and frameworks.

20 September 2021
@ISACA Article

2021 ISACA CommunITy Day Fast-Approaching

Come give back with ISACA® for our third annual CommunITy Day as fellow ISACA members, staff and their families take action in their local communities to help make a difference across the globe.

15 September 2021
@ISACA Article

Five Reasons to Add Privacy Knowledge to Your Professional Repertoire

When we think of privacy professionals, we usually think of someone with the Data Protection Officer (DPO) designation, but that is a narrow view. A privacy professional does not need to have a DPO title in order to perform privacy responsibilities.

15 September 2021
@ISACA Article

Insurance as a Risk Response

A July 2021 post on ISACA’s Engage platform considered how insurance coverage can be proposed as a risk response when presenting the risk to senior management and the board of directors (BOD). Although there were quite a few replies to the post, I would like to answer from an operations perspective.

15 September 2021
Blog Post

CRISC and My Career Path Dedicated to Risk and Controls

Throughout my years working in risk and controls, the two constants that helped propel my career have been demonstrating professional knowledge and enabling opportunities.

15 September 2021
ISACA Journal Article

A Technology Control Testing Automation Case Study

Many organizations, particularly those highly regulated by government entities, such as banking and insurance, employ a Three Lines of Defense model for risk management.

Author: Michael Powers
Blog Post

Cloud Auditing 101: How Do I Get Started?

We’re entering what feels like a new era in re-inventing how we once worked. Pre-2020 seems like a lifetime ago, and not only are organizations accelerating their cloud adoption, we as practitioners are re-examining our own careers and skills.

3 September 2021
@ISACA Article

Are Video CVs Back? Hiring Leaders Weigh In

This past July, TikTok launched a trial video résumé program to connect job-seekers with more than 30 major companies, including Target, Chipotle and Shopify. The job listings were a mix--for example, a “restaurant team member” for Chipotle and a senior data engineer for Shopify.

1 September 2021
@ISACA Article

Future-Proofing Our Tech Stack

ISACA operates with a digital-first mindset. Soon, we will have the technological infrastructure in place to fully execute on that mentality.

1 September 2021
@ISACA Article

ISACA Conference Oceania Keynoters to Share Solutions, Optimism for Future of Tech

Energize yourself, your career and your life with powerful messages from outstanding keynote addresses at ISACA Conference Oceania 2021, an event taking place virtually 28-30 September.

1 September 2021
ISACA Journal Article

Accessing Data and Maintaining Privacy Before, During and After Catastrophic Events

The basic precepts of privacy do not change in the face of catastrophes, but the type and amount of personally identifiable information (PII) used and generated and the need for legitimate access to those data increase substantially.

Author: C. Warren Axelrod
Security Article

Cyberrisk Quantification for Improved Cybersecurity

Cyberthreats and cyberattacks are inevitable. Cyberrisk, which formerly was considered relevant only to cybersecurity professionals, is now recognized as having the potential to threaten an entire organization.

31 August 2021
Blog Post

An IT General Controls-Based Audit Approach for Blockchain

From an audit standpoint, there are many different focal points for blockchain. Fortunately, looking at blockchain from the perspective of IT general controls (ITGCs) makes auditing blockchain more manageable and simpler.

30 August 2021
Privacy Article

Doing Privacy Right, Not Privacy Rights

The current privacy discourse is shaped around the question: “Is your organization compliant with privacy regulations such as the EU General Data Protection Regulation (GDPR), the US State of California Consumer Privacy Act (CCPA) or the US Health Insurance Portability...

30 August 2021
ISACA Journal Article

Information Security Matters: Privacy Data Management

Several issues ago, I wrote an article in this space titled, “Why Do We Need Data Privacy Laws?”1 In that piece, I expressed my skepticism about many new privacy laws while the old ones were still not being observed.

Author: Steven J. Ross
ISACA Journal Article

IT Audit in Practice: The Human Side of Cybersecurity—Careers

Cyber cops? In the 1990s, who would have thought that technology would offer an endless number of job opportunities fighting the bad guys? The technical nature of cybercrime offers information systems specialists unique career options in a world where cybercrime...

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Is Anybody Home? The Return

While the world waited for the scientific breakthrough of a vaccine for COVID-19, we created second lives for ourselves in an effort to battle boredom, continue to work and learn, and stave off the mental side effects of living in quarantine for as long as possible.

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Innovating the Human Factor

In information security, one of the standard axioms is that people are the weakest link. Trust forms the foundation of society. Though in the last few years, we have seen the consequences of specific breakdowns in that trust. However, trust still drives things. Humans still trust.

Author: K. Brian Kelley
ISACA Journal Article

Exploitable Traits as Vulnerabilities: The Human Element in Security

As the saying goes, every chain is only as strong as its weakest link and, in the case of information security, that weakest link is the human factor. Employees are high-level risk factors at all enterprises.

Author: Eszter Diána Oroszi
ISACA Journal Article

What Role do Humans Play in Ensuring Cybersecurity?

Human behavior is a significant variable in any organization’s cybersecurity program. People have the potential to create serious issues through negligence or harmful intent, but they can also play a vital role in keeping an organization’s information assets secure.

Author: Kevin M. Alvero
ISACA Journal Article

Virtual CISOs: Security Leader or Security Risk?

Every organization needs a leader dedicated to establishing, executing and preserving its information security mission. For many mature organizations, this leader is the chief information security officer (CISO).

Author: Brian K. Ngac
ISACA Journal Article

Rethinking the Weakest Link in the Cybersecurity Chain

The cybersecurity chain consists of IT systems, software, networks and the people who interact with this technology. Most cyber researchers consider humans to be the weakest link in the cybersecurity chain. Nine out of 10 (88 percent) data breach incidents are caused...

Author: Glorin Sebastian
ISACA Journal Article

Case Study: Technology Modernization, Digital Transformation Readiness and IT Cost Savings

“Digital Distinction” is a major trend for growing, medium-sized organizations, with growth requiring a well-executed digital platform enabled by foresight, leadership and accountability that helps ensure that societal needs are addressed with limited input resources.

Author: Guy Pearce and Richard Fullerton
ISACA Journal Article

Best Practices for Setting Up a Cybersecurity Operations Center

The cybersecurity operations center (CSOC) is a vital entity within any enterprise structure. Its responsibilities are dictated by the size of the enterprise, whether the enterprise is multinational, the enterprise’s preference for centralized or decentralized cybersecurity...

Author: Robert Putrus
@ISACA Article

It Is Time to Focus on Cyberresilience

The events of 2020 have brought to the forefront of everyone’s mind the need for organizational resilience.

25 August 2021
@ISACA Article

New Resource Sizes Up Insider Threats

Insider threats can be especially unpredictable for security teams to deal with, as perpetrators might already have access to organizational resources that are not available to the general public.

25 August 2021
@ISACA Article

Understanding Cyber Risk Metrics and Reporting

Cyber risk is top of mind for organizations around the world, but effectively addressing that risk and reporting on it to enterprise leaders require a nuanced approach based on organizations’ risk appetite and strategic aims.

25 August 2021
Blog Post

Modernizing IT Operations for the Digital Age

The IT discipline has evolved in an unanticipated pace during the last decade, and it is still evolving, forcing both development and operations teams to adapt to this new digital age that is centered around delivering value faster, cheaper and better.

25 August 2021
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 2

Imagine this scenario: A client asks an auditor to review their enterprise’s usage of social media, likely because their chief operating officer (COO) has asked them to do so.

Author: Robert Findlay
Blog Post

Embracing the Next Step in My ISACA Journey

My introduction to ISACA was simple enough – a friend of mine recommended I pursue the Certified Information Systems Auditor (CISA) certification back in 2003.

23 August 2021
Security Article

Achieving the CMMC’s Highest Levels

The achievement of higher levels of the US Department of Defense (DoD)’s Cybersecurity Maturity Model Certification (CMMC), specifically Maturity Levels 4 and 5, enhances an organization’s ability to protect Controlled Unclassified Information (CUI) and reduces the risk of advanced persistent threats (APTs).

23 August 2021
@ISACA Article

ISACA Acts as Expert Adviser to UK Cyber Policymakers

Concerns related to cyberattacks are wide-ranging, with impact on organizations’ reputations, the possibility of physical/financial harm and supply chain disruptions causing the most unease, according to ISACA’s recently released State of Cybersecurity 2021 report.

18 August 2021
@ISACA Article

The FinTech Effect: Redefining the Financial Ecosystem

As the saying goes, “Nothing lasts forever.” This is the case with traditional banks and financial houses with their big and massive structures, from Wall Street in the United States to Bangalore in India. Banking as we have come to know it is changing.

18 August 2021
@ISACA Article

‘The Great Resignation’: The First Thing You MUST Do If Considering a Job Change

Of late, I have had both hiring managers and IT audit, GRC and security practitioners calling to ask about the “Great Resignation.” Team leaders are worried about retention and back-filling roles.

18 August 2021
Blog Post

The Non-Human Path to an Effective Insider Threat Program

An insider threat program may seem like something from the Philip K. Dick story “The Minority Report,” where three precognitive individuals (precogs) identify criminals before they commit the crime and the precrime police force arrests the identified criminals to prevent the crime from occurring.

18 August 2021
ISACA Journal

What Government Contractors Should Know About the US DoD’s CMMC Guidelines

By now, defense contractors of all sizes and service types should know about the Cybersecurity Maturity Model Certification (CMMC). If they do not, it is important to learn about it sooner rather than later: Their livelihoods will depend on it.

Author: Johann Dettweiler
Blog Post

Making the Security Conversation More ‘Feature-Driven’

A constantly changing security landscape driven by increasingly persistent threats, growing attack sophistication and tighter compliance requirements keeps both the security and product teams at Adobe busy.

16 August 2021
Governance Article

Establishing Artificial Intelligence Governance

Artificial intelligence (AI) is seemingly everywhere, with events such as the COVID-19 pandemic spurring increased investment in AI as organizations accelerate plans to power an increasingly digitally connected workforce.

16 August 2021
@ISACA Article

How and Why Publicly Available Information Is Used

There are thousands of servers on the Internet ready to satisfy any data request that one might have. Although the Internet is commonly divided between the open web, the deep web and the dark web, only the open and deep webs coexist on the same infrastructure. The dark web, which will be explored in a forthcoming article, exists on an entirely separate network.

11 August 2021
@ISACA Article

ISACA CommunITy Day Set for 2 October

Join ISACA for the third annual CommunITy Day as ISACA members, staff and their families take action in their local communities and make a difference worldwide. This year’s CommunITy Day event is scheduled to take place on 2 October 2021.

11 August 2021
@ISACA Article

ISACA Website Outage Planned for Mid-September as New Association Management System Is Implemented

ISACA is preparing to transition to a new association management system that will deliver more valuable, relevant and personalized information to ISACA members.

11 August 2021
@ISACA Article

New Resource Evaluates Blockchain Controls

Blockchain technology has become one of the most promising technological advancements of the past decade with the potential to transform a variety of key industries.

11 August 2021
Blog Post

The Complexity Conundrum: Simplifying Data Security

As technology continues to evolve at an accelerating pace, unprecedented situations like the COVID-19 pandemic have further cemented our digital way of living and doing business. With digitization, there has been massive data proliferation and growth of data repositories.

11 August 2021
ISACA Journal

Decoding the Secrets of Cyberinsurance Contracts

Cyberattacks are emerging faster than ever in the wake of the COVID-19 pandemic. As new dimensions are incorporated into these disruptive cyberattacks, enterprises around the world must be more vigilant about protecting their critical information assets.

Author: Vimal Mani
Blog Post

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

9 August 2021
Podcast

ISACA’s Digital Transformation Part III — The Digital Member Experience

David Samuelson and ISACA’s Chief Membership Officer, Julia Kanouse discuss the positive impact of technology on our members and the ways in which our global community has grown even closer despite the pandemic.

6 August 2021
@ISACA Article

Enhancing Digital Transformation Through New COBIT Focus Area for DevOps

Advancing digital transformation is a top priority for today’s enterprises. Providing business and technology leaders with new tools to support this effort, ISACA’s new publication, COBIT Focus Area: DevOps, offers guidance based on COBIT 2019 to optimize governance and management practices for enterprises implementing DevOps.

4 August 2021
@ISACA Article

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

4 August 2021
@ISACA Article

Influencing and Engaging Gen Z: Let’s Fill the Workforce Gap!

Back in March, I wrote a blog post for ISACA Now titled “IT Audit is ‘Boring’? Time to Fix the Perception Problem.” The post seemed to strike a chord; it stirred up a lot of conversation globally and generated more than 9,000 views on LinkedIn.

4 August 2021
Security Article

Final Thoughts on the State of Cybersecurity in 2021

ISACA® recently published State of Cybersecurity 2021, Part 2: Threat Landscape, Security and Cybersecurity Maturity, the second part of its annual cybersecurity report. Now in its seventh year, the report enables ISACA to poll its target audience and report the survey findings.

4 August 2021
ISACA Journal

Direct From the Practitioner: Crowdsourcing for Cybersecurity Curriculum

Cybersecurity threats and the technology to deal with them are constantly evolving. Because of this, both aspiring and current cybersecurity practitioners must be educated about relevant issues and should keep up to date on new developments so they can adapt and excel in defending their enterprises’ assets.

Author: Brian K. Ngac
Podcast

Why should I listen to you?

Dustin Brewer and Frank Downs will take you through their journey, from their start in cybersecurity to how they expanded their knowledge and skills to become the recognized cyber professionals that they are today.

3 August 2021
Blog Post

Leading a Business and Raising a Family: 5 Ways to Maintain the Balance as a Boss Mom

If you’re a woman—especially if you’re both a working boss and a mom—I bet you can relate to Beyoncé’s hit “Run the World (Girls),” a proud shout-out to female strength and empowerment.

2 August 2021
Blog Post

Key Considerations in an Era of Remote and Hybrid Workforces

COVID-19 has changed the way we live, think, work and operate in a way that was never envisioned. Many organizations have now embraced the hybrid model, with employees splitting time between in-office and remote work.

30 July 2021
Privacy Article

The Automation of a Data Protection Officer’s Tasks

Data protection officers (DPOs) are facing increasing difficulties when performing tasks manually to comply with data privacy regulations. Gathering information about personal data processing activities in a large enterprise can take several months.

30 July 2021
Blog Post

Does Your Organization Have a Risk-Aware or Risk-Blame Culture?

In this blog post, I would like to share with you some of the scenarios to recognize if we are instead in blame culture organizations when it comes to risk management.

29 July 2021
@ISACA Article

Caught In Between: Evolving Security Challenges for the Hybrid Workplace

After a year and a half of pandemic, most audit, security and governance professionals have grown comfortable with the “remote work” risk landscape.

28 July 2021
@ISACA Article

State of Cybersecurity: Reputational Damage from Attacks Tops List of Concerns

With high-profile cyberattacks such as the SolarWinds incident and the Colonial Pipeline ransomware attack on the rise, global government and business leaders are challenged to keep pace with the barrage of threats.

28 July 2021
@ISACA Article

The Final Decision: Which Cybersecurity Job Offer Should I Accept?

As a recruiter, it isn’t uncommon for my cybersecurity candidates to end up with three or four job offers. I recently worked with a candidate who was trying to decide between seven! In this in-demand field, how do you work out which job offer to accept?

28 July 2021
Blog Post

Seeing the Impact of Change in Real Time

Shawn Rhodes, TEDx Speaker and a nationally syndicated columnist, recently visited with ISACA Now to discuss the evolving risk landscape, managing change and more.

28 July 2021
ISACA Journal Article

Partly Cloudy or Clear Skies Ahead?

In a recent survey of general counsel at large enterprises, titled The General Counsel Report 2021: Rising to Today’s Challenges and Building Resilience for the Future, the majority of respondents indicated that the risk they feel their organizations are most notably ill prepared to navigate is the impact of “emerging” data sources on ediscovery—the process of collecting, analyzing and reviewing electronic evidence—for legal matters, investigations and regulatory compliance.

Authors: Tim Anderson, Ted Barassi and Ted Barassi
Podcast

The Lowdown on IoT

Join ISACA's Dustin Brewer as he tells you what you need to know about IoT now – why is it still considered an emerging tech? What are the biggest cybersecurity threats, and what opportunities will the Internet of Things bring in the next five years?

28 July 2021
Blog Post

AI Looms as Major Variable on Cyberthreat Landscape

Artificial intelligence is one of those big, scary topics that can incite fear, excitement, or a bit of both. Security professionals such as myself wonder how increased usage of AI and machine learning will help to shape the future state of our work.

27 July 2021
Blog Post

Privacy By Design: How Far Have We Come?

One can hardly consider any part of the data value chain today – from data acquisition to data archiving or disposal – without considering privacy.

26 July 2021
Blog Post

Is Blockchain the Ultimate Cybersecurity Solution for My Applications?

Blockchain technology can offer important cybersecurity benefits, such as reducing cyberattacks, and it has recently created a lot of hype as a panacea for all the current challenges related to information security.

23 July 2021
Blog Post

New Points of Connection for ISACA's Global Community

Whether it is our chapters collaborating in new ways, the rise of virtual and hybrid conferences, or growing traction on the Engage platform, ISACA’s global community has come even closer together despite the challenges brought on by the pandemic.

22 July 2021
Podcast

Breaking Down the ESET Threat Report

ESET has released its T1 2021 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research.

22 July 2021
@ISACA Article

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up.

21 July 2021
@ISACA Article

New Paper Explores Combination of Risk Responses for Enterprises to Weigh

Risk response is a part of daily life – every time drivers get in a car, they actively implement strategies to respond to driving-related risks through wearing a seatbelt, being a defensive driver, and having a car with enhanced safety features. However, everyone is willing to take on a different level of risk, which makes matters complicated.

21 July 2021
@ISACA Article

Preventing the Next Cybersecurity Attack with Effective Cloud Security Audits

The use of cloud services to support business needs has exponentially increased over the past years. Most companies have now moved from traditional IT environments to private or public cloud deployments to support IT, security and business needs.

21 July 2021
@ISACA Article

What Do You Want Your Career to Be? Now’s the Time to Ideate

The second half of 2021 is the ideal time to dream, plan, revise and set new goals. This second half of the year is like none other before. Many are reclaiming a sense of normalcy after a health crisis that shut down the world. It is tempting to dive into that with trips...

21 July 2021
Blog Post

A Nuanced View of Risk Response

Managing risk is not easy despite it often being considered “common sense” since we do risk assessments all the time in our day-to-day life.

21 July 2021
ISACA Journal Article

Prevention of Vulnerabilities in Software Development Using Design Thinking

In today’s software delivery, the Agile methodology is one of the most widely adopted approaches. Agile has several variants such as Scrum, XP, Kanban and Scrum Bann.

Authors Thejasvi Nagaraju and Shubhamangala Aithal
Blog Post

How IoT Has Changed, and Why It’s Still Considered ‘Emerging Tech’

Even though the IoT originated 15 years ago, organizations in 2021 continue to define IoT as an emerging piece of technology.

20 July 2021
Blog Post

Wanted: A Cybersecurity Upton Sinclair

The drumroll of ransomware attacks featured on the evening news, such as the recent Kaseya incident or the Colonial Pipeline incident in the US, has brought the issue further into the public’s awareness.

19 July 2021
Privacy Article

How to Promote Privacy Best Practices at Work

Data privacy is increasingly top-of-mind for today’s executives. The 24th Annual Global CEO Survey—US Findings found that chief information security officers (CEOs) ranked cybersecurity and data privacy second among 11 areas of impact and value, which is why many organizations are putting financial resources behind privacy initiatives.

19 July 2021
Governance Article

The Elephant in the Risk Governance Room

Effective risk governance means organizations are making data-driven decisions with the best information available at the moment.

19 July 2021

Rethinking Cyberresilience

The National Institute of Standards and Technology (NIST) Special Publication 800-160 has caused organizations to do some rethinking when it comes to cyberresilience and disaster recovery, and what this standard means to existing plans.

15 July 2021
Podcast

Cybersecurity Isn’t Real, Right? Wrong!

Every day, the risk of cyber and ransomware attacks regularly increases in frequency and danger. But despite the proof in numbers, many organizations still don’t recognize the need to fortify their fortress and improve the strength of their Cybersecurity practices.

15 July 2021
@ISACA Article

Encryption and Extended Monitoring to Protect Secret Information

All companies —no matter how small— need some form of a security program to protect their secret information. However, the security that is currently in place to protect those secrets are oftentimes insufficient.

14 July 2021
@ISACA Article

Five Ways Frameworks Can Drive Your Organization’s Digital Transformation

The top executives and CEOs of organizations across the globe are overwhelmed trying to cope with changing technological developments and customer expectations.

14 July 2021
@ISACA Article

ISACA Community Finds New Connection Points

The power of community is ISACA’s secret sauce. It’s what binds our global community together, and never has that been more evident than during the pandemic.

14 July 2021
Blog Post

Bridging the Gap Between Security and the Business: A New Approach to Business Risk Quantification

In the security arena, today’s teams have to navigate significant layers of complexity, contending with too many different standards and too many disparate technologies. When we talk about security, we have a lot of buzzwords, catchphrases, and, of course, acronyms, which too often serve to compound the confusion.

14 July 2021
ISACA Journal Article

The Changing Face of Education: Risk, Security and Process Around Distance Learning

The digital revolution has changed many industries, including education. Although digitized learning platforms have made education and information more easily accessible, they have also brought on a rise in cybersecurity and other process risk that must be addressed.

Author: Glorin Sebastian
Blog Post

What Do CIOs Want from IT Newcomers? Adaptability

How can recent graduates and other newcomers to IT fields make an impression on CIOs and other enterprise technology leaders who are looking to hire? Josh Hamit, vice president and CIO with Altra Federal Credit Union, recently visited with ISACA Now to describe what characteristics he finds most promising in early-career candidates.

13 July 2021
Security Article

How to Determine the Cybersecurity Level of Your Value Chain

Assuring that third parties with access to systems and/or information do not pose a risk to business is a major pain for most organizations, but there are ways to assess the level of cybersecurity that a vendor provides.

13 July 2021
Blog Post

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up. Plus, the person I was speaking with is also a privacy fanatic like me...

12 July 2021
Blog Post

How AI Can Make Your Office More Safe and Secure

It’s hardly news that artificial intelligence has amazing potential to boost organizations’ productivity and workflows

9 July 2021
Security Article

Security Inventors Need Not Apply

Part of what makes a cyberjob appealing is that you get to invent, build the “killer application (app)” or make a new breakthrough. That is the appeal for many brilliant creative types, but the reality is that the cybersecurity realm does not allow much leeway for creativity.

9 July 2021
Blog Post

A (Kind of) Quantitative Approach to Organizational Risk Tolerance

At times it seems risk tolerance relates to the famous quote on congressional accomplishments, “When all is said and done, there is a lot more said than done.” This is likely because the term is often used qualitatively. That is, we describe one organization as more or less risk tolerant than another without addressing how much more or less.

8 July 2021
Podcast

Building a Zero-Trust Network Platform

Finding a balance between a pleasant user experience and stringent security requirements can be a challenge.

8 July 2021
@ISACA Article

Five Key Considerations When Adopting a Seed Vault Approach for Ransomware Protection

A “seed vault” approach to ransomware protection can be a last-resort method for organizations to access their data in the event of a catastrophic availability event such as a ransomware attack.

7 July 2021
@ISACA Article

Have a Question for ISACA Leaders? Join Our ‘Ask Me Anything’

ISACA members can join ISACA Director Veronica Rose, ISACA Board Chair Gregory J. Touhill and ISACA CEO David Samuelson as part of a new “Ask Me Anything” Leadership Series.

7 July 2021
@ISACA Article

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

7 July 2021
@ISACA Article

The Best Interview Hack? Start With Rethinking Your Résumé

Most people face job interviews with a degree of trepidation about the unknown-ness of it all. There is the sense of the interview being sort of a black box. The biggest bogey is trying to suss out what the hiring team is really looking for.

7 July 2021
Blog Post

Architecting COBIT for Governance Success

While I was in the process of implementing the ISO 27001 standard for a mission-critical healthcare system for one of the major health care organizations in India, I became COBIT-certified, and I took the opportunity to use COBIT to ensure compliance not only in an ISO 27001 audit but also in the privacy assessment that the organization was undergoing at the same time, which was conducted by a government agency.

7 July 2021
ISACA Journal Article

A Trusted Secure Ecosystem Begins With Self-Protection

As the connected digital ecosystem expands, cyberthreats and vulnerabilities are gaining momentum at an unprecedented scale. Creating a healthy immune system on every device is critical to build cyberresilience and protect organizations, end users and networks from malicious attacks.

Author: Thorsten Stremlau
Privacy Article

Cross-Border Data Transfer and Data Localization Requirements in China

In 2020, China launched a global data security initiative focused on strengthening international coordination for cross-border data flow and outlining the principle of personal information protection.

6 July 2021
Blog Post

Three Ways the IT Department Can Boost Customer Retention

When a business’s decision-makers develop a customer retention strategy, they typically involve certain critical team members such as the marketing director, in these discussions.

2 July 2021
Blog Post

Did the FBI Hack Bitcoin? Deconstructing the Colonial Pipeline Ransom

On 7 May, 2021, Colonial Pipeline, a US oil pipeline system, that mainly carries gasoline and jet fuel to the southeastern United States suffered a ransomware cyberattack that impacted the computerized equipment that managed the pipeline.

1 July 2021
@ISACA Article

2022 ISACA Awards Call for Nominations

Each year, ISACA recognizes outstanding contributions that advance our professional community and exemplify our leadership and purpose.

30 June 2021
@ISACA Article

3 Things COBIT Is & 3 Things It Isn’t

For over 25 years, COBIT 2019 has built on and integrated best practice frameworks that are used to develop and promote the process of understanding, designing and implementing enterprise governance of IT (EGIT).

30 June 2021
@ISACA Article

Achieving Application Rationalization Using COBIT 2019

How many applications does the average organization use? Research shows that, typically, an organization with 200 to 501 employees uses 123 applications.

30 June 2021
@ISACA Article

Connecting Community to Build the Future of Cybersecurity

ISACA’s annual State of Cybersecurity report provides an environmental scan of the cyber workforce and real-world implications of enterprise budgets, the length of time required to fill positions, and what skills cyber professionals need to ensure success in their roles.

30 June 2021
@ISACA Article

Evolving Your Cybersecurity Through Cyber Maturity

In a recent ISACA survey that asked participants what their top cybersecurity program goals were, more than 73 percent cited that achieving continuous improvement of cyber security was their number-one need.

30 June 2021
Blog Post

Transformation Goes Beyond Hardware, Software

Technology drives everything that we do at ISACA – whether that is powering members’ pursuit of a career-changing certification, providing an array of flexible virtual learning opportunities, offering support and resources for our global chapters – the list goes on.

30 June 2021
ISACA Journal Article

Information Security Matters: RBAC, BCM & SoD

What a perfect information technology headline! Three acronyms and not a single word. But they are three important concepts in information security, and I would like to take a few pages to explore their intersection.

Author: Steven J. Ross
ISACA Journal Article

The Network: Driving Digital Transformation

Information technology is changing the world. It is transforming how we interact, learn and communicate. Around the world, IT fuels national prosperity and security, and ISACA members are at the forefront of optimizing and securing the digital ecosystem.

Author: Gregory Touhill
ISACA Journal Article

IT Audit in Practice: Algorithms and Audit Basics

I must admit, when I saw the theme of this volume of the ISACA Journal, algorithms, or as we call them at work “algos,” I thought, “There’s a topic I don’t understand.” Of course, that is not really the case because every industry I have worked in uses algorithms...

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: The Student Becomes the Teacher

If you have been following this column, you have probably recognized some recurring themes, one of those themes being that for everyone, especially IT personnel, continuing education is never finished.

Author: Dustin Brewer
ISACA Journal Article

Algorithms and the Enterprise Governance of AI

Alan Turing (1912-1954), a founding father of artificial intelligence (AI) and the inventor of the Turing Test that determines whether a computer can think, defined algorithms as sets of precise instructions for solving problems.

Author: Guy Pearce and Maureen Kotopski
ISACA Journal Article

To Bot or Not to Bot? That Is the Question for Digital Banking

There is a legendary proverb that emphasizes that a journey of a thousand miles begins with a single step. In this case, the first step is highlighting the concept of digital banking by introducing the idea of chatbots or bots.

Author: Luis Emilio Alvarez-Dionisi
ISACA Journal Article

How Can AI Drive Audits?

Auditing is viewed as a manual, subject-matterdriven, tedious and sometimes highly subjective practice. With the digital disruption that surrounds IT professionals, it is time to explore how the next generation of artificial intelligence (AI), natural language processing...

Author: Shini Menon
ISACA Journal Article

How Effective Is Blockchain in Cybersecurity?

Recently, blockchain technology has created a lot of hype as a panacea for all issues related to information security. Blockchain technology provides stronger transactional security than traditional, centralized computing services for secured networked transaction ledger.

Author: Neeraj Benjamin
ISACA Journal Article

Case Study: Retooling Carbon Accounting—Better Business, Healthier Planet

Salesforce, a San Francisco, California, USA-based enterprise with a global workforce exceeding 54,000, offers a broad range of cloud software and services, including customer relationship, customer service, marketing automation, analytics and application development.

Author: Mick Brady
ISACA Journal Article

Modern IT Operations: Ninja, Samurai or Ronin?

For decades, the IT discipline has suffered from a division between its two main entities: the development team and the operations team. This segregation of duties (SoD) has resulted in different mindsets, models and tools, and competing and conflicting objectives.

Author: Abdelelah Alzaghloul
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 1

A few years back, there was an Irish enterprise that based its whole business model on its social media presence. This was a vital part of the enterprise’s business strategy, and it prided itself on its use of social media channels. So, it was no surprise when the chair...

Author: Robert Findlay
ISACA Journal Article

HelpSource Q&A

How much cybersecurity budget or investment does an organization need to effectively plan to reduce the number of security incidents and data breaches? How can security practitioners convince the board of directors (BoD) to approve this budget?

Author: Sunil Bakshi
ISACA Journal Article

Cyberresilience in an Evolving Threat Landscape

It is important to know if one’s organization is robust enough to survive in the event of a security event, let alone expand and improve. Many reputable cybersecurity organizations are publishing guidance on how to respond in the event of a theft or data breach.

Author: Larry Marks
Blog Post

Mountain Climbing and the CGEIT Exam: Relishing the Journey

Studying for a certification is not so different from any other endeavor, whether it be professional or personal. One of my hobbies for over a decade has been hiking mountains of all shapes and sizes.

29 June 2021
Blog Post

Accounting for Cyber Fraud Risks During Audit Planning

With a changing global economic outlook, there has been a correlated shift in the fraud landscape, and how audit leaders should manage it. An assessment of fraud possibility is a requirement when carrying out an audit engagement, after all.

28 June 2021
Privacy Article

Advertising Technology: The Invisible Tracker Cheating Privacy

There are many privacy concerns impacting humanity across the globe—one of which is advertising technology (ad tech).

28 June 2021
Podcast

Advance Security for Secret Information

Listen in as ISACA Journal columnist, Steven Ross, CISA, CDPSE, AFBCI, CISSP, MBCP, delves deeper into his latest article, “Advanced Security for Secret Information.” As a follow up to his two previously published journals, “Keeping Secrets,” and “Secrets and Privacy,” Ross continues to make the case that the protection of secret information is becoming a significant issue in cybersecurity.

28 June 2021
Blog Post

Is Traditional Detection and Response Reliable?

I have been in the security industry and helped customers with their cybersecurity business challenges for the last 15 years; therefore, I have had the opportunity to witness and experience the evolution and modernization of attack vectors, the evolution of advanced tactics and techniques and the expansion of the attack surface.

25 June 2021
Blog Post

How IOT Opportunities and Risks Will Evolve in a Post-Pandemic Environment

According to the World Economic Forum, the number of connected devices exceeded 50 billion last year.

24 June 2021
@ISACA Article

Cybersecurity Merry-Go-Round

There are many US citizens outside the cyber industry who only pay attention to cybersecurity incidents when they are affected by them. It can be argued that every data breach directly affects those whose personally identifiable information (PII) was accessed by...

23 June 2021
@ISACA Article

QR Code Security Challenges

Quick Response (QR) codes are rising in popularity. According to a survey conducted by MobileIron, more than 66% of respondents stated that a QR code makes life easier in a touchless world–despite a majority of people lacking security on their mobile devices.

23 June 2021
@ISACA Article

Three Ways to Limit Burnout and Improve Work-Life Balance in Cybersecurity

As a recruiter, it’s my job to speak with professionals who are actively or passively considering looking for a new job. One of the most common discussions I have now (even more so since the pandemic) is around work-life balance and burnout.

23 June 2021
Blog Post

Redefining Effective Project Management

As we undergo a digital transformation at ISACA, one key element has been strategic project management.

23 June 2021
ISACA Journal Article

A Novel Approach for Government Acquisition and Procurement

In 2015, the commissioner of US Customs and Border Protection (CBP) engaged the Defense Acquisition University (DAU) (Fort Belvoir, Virginia, USA) to review CBP’s acquisition and procurement performance.

Authors: Steven Moyer, Gunter Brunhart, Richard Dubs, Thomas Erickson, Robert Skalamera, Rob Kepner
Podcast

ISACA’s Digital Transformation Part II — People, Process, and Technology

David Samuelson is back and continuing his discussion of ISACA’s Digital transformation. This time David interviews members of ISACA’s IT team — CTO, Simona Rollinson; Sr. Director, Application Development, Sean Ways; and Sr. Director of Enterprise Project Management, Amy Witkowski.

23 June 2021
Podcast

ISACA’s Digital Transformation Part I — Positive Potential of Technology

Join ISACA’s CEO David Samuelson as he discusses the positive potential of technology with ISACA’s Chief Product Officer, Nader Qaimari.

23 June 2021
Blog Post

How Mid-Sized Businesses Can Overcome Cybersecurity Challenges

Growing cybersecurity concerns, combined with regulation and compliance challenges, are a problem for enterprises of all sizes including mid-sized companies.

22 June 2021
Blog Post

ISACA Talks Digital Transformation

ISACA hosted a LinkedIn Live discussion last week regarding new strategies that are being developed and implemented as part of ISACA’s ongoing digital transformation, and how those efforts will benefit members.

22 June 2021
Blog Post

How Cloud-Based Mobile Device Management Supports Remote Working

Years ago, companies managed their devices manually and often using solutions allowing capabilities for device management activities.

21 June 2021
Blog Post

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

18 June 2021
Blog Post

Metrics that Matter: Measuring Organizational Performance in a Post-Pandemic World

There’s no question that environmental, social and corporate governance (ESG) is on the minds of almost every board member and C-suite leader, but it has expanded beyond the boardroom and is now also top of mind for investors and consumers. This all happened—or at least was accelerated—as a result of the COVID-19 pandemic.

17 June 2021
@ISACA Article

Five Ways for New IT Pros to Accelerate Career Growth

Gaining a foothold in IT careers can be intimidating for industry newcomers, given the rising complexity of the technology landscape and the evolving privacy and security threats professionals must learn to mitigate.

16 June 2021
@ISACA Article

What the Heck is ‘Auditor Instinct’? IT Audit and Security Leaders Provide the Low-down

For years, I have had IT audit directors ask me, as a recruiter, to look for experienced IT audit professionals with “auditor instinct” – that ability to “just know” when something isn’t quite right and when more questions and more digging are is needed to surface the big issues, the root causes, the major findings.

16 June 2021
@ISACA Article

Virtual and In-person Options Available for 2021 GRC Conference

A high degree of flexibility for learners will mark the hybrid 2021 GRC Conference, taking place 9–11 August. The conference, put on jointly by The IIA and ISACA, will take place in Denver, Colorado, USA, as well as virtually.

16 June 2021
@ISACA Article

New Resource Illustrates Synergies Between ITIL 4 and COBIT 2019

Organizations looking to create value for their stakeholders can implement frameworks as effective tools for building structures, organizing thoughts, planning events and architecting businesses. A new free white paper from Axelos and ISACA discusses...

16 June 2021
ISACA Journal Article

Organizational Culture for Information Security: A Systemic Perspective on the Articulation of Human, Cultural and Social Systems

Many international reports and research centers repeatedly insist that the individual is the most important element concerning information security and one of the most relevant when determining an information protection practice for organizations.

Author: Jeimy Cano
Podcast

Just the Fax on Cybersecurity

Is your home printer or fax machine an IOT device? You bet it is! Dubbed ‘Faxploit’, research has shown how cyber criminals can infiltrate any home or corporate network by exploiting wireless printers and fax machines. A fax numbers is all it takes to launch this type of attack.

16 June 2021
Blog Post

Leverage COBIT and ITIL for Customer-Centric, Connected and Collaborative Organizations

The information and technology (I&T) industry has operated in a changing environment for decades, but it wasn’t until the recent convergence of many disruptive events that forced us to rethink our governance models.

15 June 2021
Blog Post

Practice Healthy Career Hygiene

Just like the way hygiene is comprised of conditions or practices conducive to maintaining health and preventing disease, especially through cleanliness, the practice of career hygiene is no different when it comes to preventing career risk, building career capital and maintaining a healthy career.

14 June 2021
Blog Post

Understanding Blockchain Risks and the Coming Wave of Enterprise Adoption

In collaboration with AICPA & CIMA, ISACA published a joint white paper in April entitled “Blockchain Risk: Considerations for Professionals,” an important work that describes and provides background about specific risks related to blockchain implementation and operation.

11 June 2021
Blog Post

The Case for Stackables in Addressing the Skills Gap

I have written before about how there are fractures in our current education system, globally, and how the skills gap continues to widen as there is misalignment between what students are taught in universities and what companies need and expect.

10 June 2021
@ISACA Article

ISACA Installs 2021-2022 Board of Directors

ISACA welcomed its 2021-2022 Board of Directors last week during its virtual Annual General Meeting. The new board includes members with diverse backgrounds and a range of expertise from across the globe, including new Board Chair Gregory J. Touhill.

9 June 2021
@ISACA Article

Key Questions to Address for Effective Cloud Governance

The migration to the cloud is occurring faster than ever in an era of widespread remote work and increased need for speed and agility in conducting business. As enterprises move away from on-premise servers and embrace cloud computing and SaaS applications...

9 June 2021
@ISACA Article

The Peltzman Effect and Cybersecurity

The COVID-19 vaccination program designed to contain the pandemic is progressing rapidly across the globe. As the number of people who are vaccinated increases, experts have raised concerns about the Peltzman effect, wondering if people will feel more secure...

9 June 2021
Blog Post

Preserving Privacy With New Technologies

New technologies for data protection can arm innovative enterprises to win in an ever-changing, increasingly competitive digital economy.

9 June 2021
Governance Article

The Better the Board Management, the Better the I&T Governance

Today, information and technology (I&T) can have tremendous influence on whether an organization succeeds or fails.

9 June 2021
ISACA Journal Article

Sea Change in Risk Culture

Until a few months ago, no one would have believed that large swaths of the workforce would be doing nearly everything from within the four walls of their homes, including, for example, the most complex banking transactions and other financial activities that normally involve walking into a bank branch office.

Author: Sumedha Adavade
Blog Post

Serving ISACA is Baked into My Professional DNA

Many in IT fields fixate on the new technology and tools that are regularly trumpeted to help us keep pace with new challenges. While the allure of technological innovation draws our attention, we often forget that technology must complement the people and processes...

8 June 2021
Blog Post

Building a Successful Strategy for the CDPSE Exam

Evolving privacy regulations and technology require companies to implement privacy by design and by default into products.

7 June 2021
Security Article

What Role Does Data Destruction Play in Cybersecurity?

There are many concerns associated with the modern cybersecurity community. Robust firewalls, reliable cloud storage solutions, in-house IT support and antivirus bundles are all examples. Still, the role of data destruction should never be taken for granted.

7 June 2021
Blog Post

Cyberresilience: A Critical Cybersecurity Capability

The rapid evolution of cyberthreats leaves the gamut of risk assessment efforts undertaken by organizations inadequate in addressing cybersecurity concerns.

4 June 2021
Blog Post

The Importance of Risk Assessments and Risk-Informed Decision Making

Recently, I wrote about the concept of “just enough security” and mentioned how “striking the balance between too much, not enough, and just enough security is no cakewalk.”

3 June 2021
@ISACA Article

The Privacy-Research Connection

Medical research and clinical trials have long been relied on as means of obtaining useful, accurate data to learn more about diseases and their potential treatments.

2 June 2021
@ISACA Article

The Risk of Remote Work

When it comes to how people work, 2020 was a fantastic experiment, demonstrating that millions of professionals in myriad roles, across a plethora of company sectors and sizes, around the world, can successfully work remotely.

2 June 2021
@ISACA Article

ISACA Pulse Poll: Ransomware Insights in the Aftermath of Colonial Pipeline

The Colonial Pipeline attack caused massive disruptions to gasoline distribution in parts of the United States in May, resurfacing preparedness for ransomware attacks as a front-burner topic for enterprises around the world.

2 June 2021
Blog Post

Four Things I’ve Learned as an Early-Career Professional To Help Create Trust

As an early-career professional, I have learned – through experience and an amazing set of mentors – that two of the most crucial qualities that can impact your career opportunities are: Integrity and Credibility.

2 June 2021
Blog Post

Beware the Privacy Violations in Artificial Intelligence Applications

It has been proposed that, “Privacy matters to the electorate, and smart business looks at how to use data to find out information while remaining in compliance with regulatory rules.” Since “smart business” also consists of “the electorate” as employees, at least one...

27 May 2021
@ISACA Article

Developing Your Career in Cybersecurity

In my previous article “Becoming a CISO,” one of the core pieces of advice was to stay curious and always learn. In the cybersecurity space, learning and development is crucial to progression.

26 May 2021
@ISACA Article

Announcing CMMI V2.2 Release – Security and Safety

ISACA’s new CMMI Model content describes best practices for holistically defining security and safety strategies, approaches, activities, and functions necessary to protect an organization’s entire ecosystem, including personnel, resources and information.

26 May 2021
@ISACA Article

The Role of the Supply Chain in Security

One of the many unexpected consequences of the COVID-19 pandemic has been the global computer chip shortage—or reallocation, as described by security expert Frank Downs in the “Supply Chain Security Considerations” episode of the ISACA Podcast.

26 May 2021
@ISACA Article

Explore Cyberrisk Quantification With Free ISACA Resource

Cyberrisk quantification (CRQ) expresses cybersecurity risk in terms of monetary value to the enterprise. A new white paper from ISACA, Cyberrisk Quantification, addresses the importance of acquiring useful data and amplifying it as part of a CRQ analysis.

26 May 2021
@ISACA Article

Cyberrisk Quantification Purity Tests

Measurement can be a tricky thing. Many practitioners want more ways to measure the effectiveness of cybersecurity programs to determine whether they are doing the right things to protect their organizations.

26 May 2021
Blog Post

Converting Technology Language to Business Language with Cyberrisk Quantification

Cyber risk is continuously evolving. Companies are dealing with different threat actors and events every day, which is why cyber is the fastest-growing risk for many enterprises, and why cybersecurity ranks among the top priorities for global organizations.

26 May 2021
Governance Article

A Systematic Approach to Implementing a Governance System Using COBIT 2019

Effectively addressing the challenges posed by the COVID-19 crisis requires not just a management system but a governance system that is designed with a primary focus on stakeholder needs and continually serving customers.

26 May 2021
ISACA Journal Article

Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard

George is an inexperienced hiker. He is lost in the woods and it is dark. He wants to go back to civilization. He has a global positioning system (GPS) navigator, but he does not know how to use it correctly.

Author Ioannis Routsis
Blog Post

Proud to Be Part of ISACA’s Growth and Resilience

First and foremost, it has been my great honor and privilege to serve as Chair of the ISACA Board of Directors. It has been my true pleasure to be surrounded by the sincere dedication of the staff, the board and ISACA members around the world.

25 May 2021
Blog Post

Ransomware Defense Calls for Solid Fundamentals, Rigorous Enforcement

Every 11 seconds, an employee will click on a link or open an attachment in a seemingly innocent email and his or her organization will be rapidly infected with ransomware.

24 May 2021
Security Article

APTs Require Enhanced Cyberdefense

Advanced persistent threats (APTs) are introduced by adversaries that possess sophisticated levels of expertise and significant resources, which allow them to achieve their objectives by using multiple attack vectors (e.g., cyberattacks, physical attacks, deception).

24 May 2021
Blog Post

Sizing up the New US Executive Order on Cybersecurity

For years we have seen standards, regulations and legislation arise in the aftermath of a cyber incident or shifts on the technology landscape.

21 May 2021
@ISACA Article

A Modern Perspective on IT Risk

With cybercrime and related threats on the rise, and increased global spending on cybersecurity with not much impact on risk reduction, there is a need for change. “Let’s switch our mindset from the old management style that uses outdated thinking and slows remediation, and instead look to a forward, modern perspective,”...

19 May 2021
@ISACA Article

ISACA Conference Keynoters Deliver Calls to Action

ISACA Conference North America 2021 united business IT professionals in many roles and disciplines. One commonality in attendees’ careers is the desire to bring more passion, leadership and bravery to both their work and personal lives. The conference’s three keynote presenters...

19 May 2021
@ISACA Article

Remote Engagements, Audit Fatigue Among Challenges for Auditors

“As auditors, we abide by clear rules that are repeatable,” Doug Landoll said this month in his ISACA Conference North America presentation, “Remote Assessments: Retooling Security Risk Assessments in a Pandemic Environment.” He shared some of the work-around solutions...

19 May 2021
@ISACA Article

Revisiting Third-Party Risk in the Pandemic Era

Pandemic-driven disruption has drastically changed the way most organizations conduct business, and that includes third-party vendors upon which many companies heavily rely.

19 May 2021
@ISACA Article

Why We’re Losing the Cybersecurity War

It’s time to admit we’re losing the cybersecurity war and become more accountable about the real reasons why.

19 May 2021
ISACA Journal Article

Demystifying the Implementation of Cyberresilience Programs

Cyberattacks are emerging faster than ever across the world in the wake of the COVID-19 pandemic. With newer dimensions incorporated into emerging disruptive cyberattacks, organizations globally are more vigilant about protecting their critical information assets.

Author: Vimal Mani
Blog Post

Best Practices to Implement Secured Cloud Collaboration Tools

According to a recent study published by Gartner Inc., end-user spending on public cloud services could grow 23.1% in 2021, reaching US$332.3 billion compared to $270 billion in 2020.

18 May 2021
Blog Post

Hidden Insights from The Pulse: Emerging Technology 2021

In The Pulse: Emerging Technology 2021 report, ISACA sought feedback on specific emerging technology trends, training, and implementations, to identify and establish a baseline of what constitutes an emerging technology, as these definitions can vary from person-to-person or between organizations.

18 May 2021
Podcast

The Relationship Between Privacy and Research

Volunteering to participate in medical research is a commendable act of service, but to do so can understandably raise questions about subject privacy. In this episode of the ISACA Podcast, ISACA Journal columnist Cindy Baxter discusses...

18 May 2021
Blog Post

Achieving Continuous Compliance and IT Control Automation

Every organization has to comply with regulations and control frameworks. As assurance professionals, we are often tasked with understanding the compliance requirements, validating the compliance controls’ design, and then testing the control effectiveness.

17 May 2021
Privacy Article

Building a Solid Foundation for Privacy: What Data Exist?

As more privacy regulations are released, organizations must evaluate their privacy capabilities. However, it is difficult to know where to start. The first thing organizations need to do to make sure they are being responsible is to determine what data they possess.

17 May 2021
Blog Post

Understand the Cyber Skills Shortage to Get Ahead

Cybersecurity remains a seller’s market. Threats and exploits continue to be more sophisticated and increase in frequency

14 May 2021
Blog Post

Building the Foundation for ISACA’s New Learning Pathways

Nader Qaimari, Chief Product Officer at ISACA, was interviewed by ISACA CEO David Samuelson on 7 May in a LinkedIn Live discussion on ISACA’s digital transformation and how it is supporting the evolving learning resources for ISACA’s professional community. The following is an excerpt from the conversation.

13 May 2021
@ISACA Article

Congratulations to the 2021 ISACA Hall of Fame Inductees

ISACA is pleased to honor the 2021 Hall of Fame inductees for their thought leadership, volunteer service and/or engagement activities. Earlier this year ISACA announced the legacy inductees to initiate this new honor, and to complete the first class of this member-to-member recognition...

12 May 2021
@ISACA Article

Fighting Risk to Find Resilience

Digital transformation can add value to an organization and position it to become—and stay—resilient. But to accomplish this, “you have to have some way of measuring both your maturity today and where you are in the digital transformation journey,” ServiceNow’s ...

12 May 2021
@ISACA Article

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword. GRC systems target a fusion of three elements that should harmoniously exist in business...

12 May 2021
@ISACA Article

Is Outsourcing Truly Considered Risk Sharing?

Risk management practices specify that every risk be identified and assessed. Based on the risk assessment, one or more of the following four risk management options can be chosen as the preferred method of addressing the risk...

12 May 2021
@ISACA Article

Welcoming Thomas Kyei-Boateng: ISACA’s new CFO

Thomas Kyei-Boateng joined ISACA in May as Chief Financial Officer (CFO). Thomas is a strategic finance professional with 15 years of progressive experience in financial leadership roles at some of the world's biggest organizations, including Capital One Financial Corporation...

12 May 2021
Blog Post

Performance and Compliance – Stop the Level Chase!

Take a maturity level-based compliance framework as a compliance example. The intention and design of these frameworks is that compliance can be boiled down to a single number, e.g. maturity level 3, which theoretically then equates to certain demonstrable performance expectations.

12 May 2021
Blog Post

Bridging the Digital Divide

Niel Harper is an ISACA Global Achievement Award-winner for “contributions to capacity building across the world towards the development of affordable, open and user-centric Internet infrastructure.” Find out more about Niel’s background and achievements in the Q&A below.

11 May 2021
Security Article

The US FFIEC’s Cybersecurity Assessment Tool in Numbers

In an era of hyperconnectivity, cybercriminals are constantly innovating their tactics to exploit human error and technological vulnerabilities. Adapting to the changing threat landscape is essential for any organization to remain secure in the digital age.

11 May 2021
Podcast

Supply Chain Security Considerations

The computer chip shortage resulting from the COVID-19 pandemic may sound like a mere supply chain issue, but the ramifications of it have also been felt in the cybersecurity sector.

11 May 2021
Blog Post

Data Resilience: A Hero’s Journey for Data Professionals

In the archetypal hero journey, once ordinary characters, such as Luke Skywalker, Frodo Baggins, Arya Stark, Katniss Everdeen or even the android, Data, leave what they know to pursue a quest, facing many extraordinary, fantastic and sometimes supernatural predicaments or dilemmas in an unknown world.

10 May 2021
Blog Post

Fill in Gaps from University Studies for Early Career Success in InfoSec

The world of InfoSec is full of opportunities and challenges, but not everyone is ready to tackle them right out of school.

7 May 2021
Blog Post

Practical Tips to Get the Right Cybersecurity Insurance for Your Company

Falling victim to a cyberattack isn’t an experience anyone wants to deal with. However, cyberattacks are always a potential threat and cause devastating consequences. Just in the first half of 2020, 36 billion records were exposed in data breaches. The effects of those breaches will be felt for quite some time.

6 May 2021
@ISACA Article

Complimentary Guide Explores Blockchain Risk

Blockchain can bring transformational benefits to businesses, but also comes with risks that need to be identified and mitigated, as detailed in a new joint white paper from ISACA and AICPA, Blockchain Risk: Considerations for Practitioners.

5 May 2021
@ISACA Article

How to Stay on Top of Data Privacy Changes and Ensure Ongoing Compliance

After a flurry of activity and changes to privacy settings and disclosure, many felt they could move on once they had checked that compliance box. But things have not remained static from a regulatory standpoint

5 May 2021
@ISACA Article

Improving the Odds of Your Résumé Reaching the Hands of a Human

Talent acquisition and HR teams like ATSs because they reduce the hours spent by humans (often too few in HR functions) reading résumés. Presumably, the AI in the ATS system can parse for key words and match those to a job description and any other custom parameters that a company builds into their résumé screening.

5 May 2021
@ISACA Article

State of Cybersecurity 2021: Cyber Field Thriving Despite Pandemic

Despite the widespread economic damage resulting from the COVID-19 pandemic, the cybersecurity industry has remained relatively unscathed, according to ISACA’s State of Cybersecurity 2021 study.

5 May 2021
@ISACA Article

The Power of Technology in a Pandemic

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available...

5 May 2021
Blog Post

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword.

May 5 2021
ISACA Journal Article

Cyberresilience in a Societal Context

In this century, especially in the previous few years, several factors have placed enormous stress on the resilience of businesses—and by extension, of their suppliers, customers and employees—around the world. The first among these was the global financial crisis...

Author: Steven J. Ross
Blog Post

The More Things Change in Cybersecurity, the More They Stay the Same

Amidst a global pandemic that prompted a wide range of governmental response actions and mandates, the cybersecurity industry was largely untouched, as shown by respondent data to ISACA’s State of Cybersecurity 2021: Global Update on Workforce Efforts, Resources and Budgets.

4 May 2021
Blog Post

The Pace of Technology Change Doesn’t Have to Be Overwhelming

When I started my career in technology, I began by working on SNA networks. Mainframes, Virtual Telecommunications Access Method (VTAM), Synchronous Data Link Control (SDLC), and Token Rings were all things I learned about right away, and just when I got good at them, I was thrown into a land of Transmissions Control Protocol / Internet Protocol (TCP/IP) and multiprotocol networks.

3 May 2021
Blog Post

Pandemic Calls for Flexibility, New Approaches

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available for certification exams and transitioning in-person conferences to virtual events, among many major safety-minded “pivots” brought on by the pandemic.

30 April 2021
ISACA Journal Article

Information Security Matters: Advanced Security for Secret Information

No matter how small, every enterprise beyond a lemonade stand has some form of a security program. Even someone with a one-person business probably has a personal computer with Internet connectivity, and that PC undoubtedly has a firewall, antivirus software...

Author: Steven J. Ross
ISACA Journal Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

We have all been through a lot. The pandemic has built a new working model, changing leadership perceptions on how and where work can be performed. The intricate plans that many enterprises tested on an annual basis in line with business continuity turned into...

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Cryptocurrency—A Microcosm of Emerging Technology

Emerging technologies can be a tough subject for discussion. Experts, practitioners and just about anyone in the IT field can be very opinionated and passionate when it comes to a particular technology, especially if they are currently working on an implementation...

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Innovating Resilience

Innovation is not just about new products, new ways to compete and developing new features. Innovation is also examining what is in place today, seeing where the gaps are and building solutions to address those gaps. When it comes to resilience, innovation has a strong role to play.

Author: K. Brian Kelley
ISACA Journal Article

The Global Pandemic’s Affect on Business Continuity

Though the events of 2020 are sometimes characterized as unimaginable, many organizations have been preparing for a global pandemic for years. However, many others have found themselves scrambling to maintain operations in the wake of mass shutdowns...

Author: Kevin M. Alvero
ISACA Journal Article

Data Resilience Is Data Risk Management

Data resilience has several vendor definitions, for example: maintenance of the availability of hosted production data, the ability of data infrastructure to avoid unexpected disruptions, and a combination of the governance, operational and technical considerations...

Author: Guy Pearce
ISACA Journal Article

Working Toward a Managed, Mature Business Continuity Plan

Business continuity is defined as having the right tools in place to make sure that an organization can continue to function during an interruption of one or more of its critical mission functions.

Author: Sven De Preter
ISACA Journal Article

Succession Planning for Business Continuity

In this digital age, when discussing business continuity, the first things that come to mind are technology and related processes. However, it is important to note that the critical elements of human resources (HR) and processes have equal weight. The challenge of ...

Author: Muhammad Asif Qureshi
ISACA Journal Article

Case Study: A Journey Toward CMMC Compliance

Peerless Tech Solutions is a managed service provider that specializes in support for government contractor clients. As a federal contractor in its own right, Peerless, in late 2019, began an internal project to prepare itself for compliance with Cybersecurity Maturity Model Certification...

Author: Mick Brady
ISACA Journal Article

Information System Contingency Planning Guidance

When planning information security for a system, it is essential to remember to include contingency planning because it provides the resilience needed to respond to technical disruptions and ensure the system is available. The critical planning component is an information...

Author: Larry G. Wlosinski
ISACA Journal Article

Help Source Q&A

Recently I heard the term “purple team.” What are the objectives and roles of this team?

Author: Sunil Bakshi
@ISACA Article

A Futurist’s Take on Cryptocurrency

Cryptocurrency is a useful tool for solving process issues and conducting transactions within enterprises. Its record-keeping and self-auditing capabilities make it highly valuable to many industries—and individuals. Some authorities believe cryptocurrency is used primarily...

28 April 2021
@ISACA Article

Becoming a CISO

Almost every candidate recruiters speak to in cybersecurity wants to know one thing: How do I reach the top and get to that CISO level? Speaking with individuals who specialize in the space is one of the best places to start.

28 April 2021
@ISACA Article

Breaking Through Into Cybersecurity

Our specialty at Tiro Security is cybersecurity and GRC, and here is one of the reasons I highly recommend it: the great thing about cybersecurity is that there is an element of it in every single role inside IT (and even outside of IT).

28 April 2021
@ISACA Article

Can There Ever Be Normalcy in Cyberspace?

Challenges face the US government amid an increasingly turbulent threat landscape foreshadowed by the December 2020 SolarWinds supply chain attack. But to categorize SolarWinds as merely a hack is a disservice, as it is now understood to be a major cybercampaign involving an estimated 1,000 nation-state actors.

28 April 2021
Blog Post

Governance and Ethics of Emerging Technology

As organizations explore and adopt emerging technologies, governance is rarely if ever at the forefront of their agendas.

28 April 2021
ISACA Journal Article

Risk Assessment and Analysis Methods: Qualitative and Quantitative

A risk assessment determines the likelihood, consequences and tolerances of possible incidents. “Risk assessment is an inherent part of a broader risk management strategy to introduce control measures to eliminate or reduce any potential risk-related consequences.”

Author:Volkan Evrin
Blog Post

In the Technology Age, You Can’t Always Trust What You Hear and See

It seems like any mention of technological advancement also can unearth a case of misuse.

27 April 2021
Blog Post

Cybersecurity’s Allure for Rising Professionals

Kyla Guru, a Stanford University student and CEO of Bits ’N Bytes Cybersecurity Education, visited with ISACA Now to discuss her passion for cybersecurity and why she considers the field to be a great fit for young professionals.

26 April 2021
Blog Post

Key Considerations for Business Continuity and Disaster Recovery

Business success is often couched in terms of growing and maintaining the customer base and launching innovative products.

23 April 2021
Blog Post

Reasonable Professional Care for The Next Generation of Women Leaders

As we celebrated International Women’s Day last month under the tagline “Choose to Challenge,” I took time to reflect on my own journey.

22 April 2021
@ISACA Article

Composing Thank You Notes That Support Your Job Search and Your Life

Want to stand out from the competition when interviewing for jobs? Send a thank you note. But don’t just send any old thank note copied from a template because a boring thank you note will do more harm than good.

21 April 2021
@ISACA Article

Developing an Enterprise Innovation Practice

Today, the survival of enterprises depends on the ability to innovate. Since the world is becoming more global and the development of new technologies is rapidly increasing, the ability to effectively innovate is likely to become even more important in the future.

21 April 2021
@ISACA Article

New Certified in Emerging Technology (CET) Credential Features Stackable Certificates

Not only do today’s practitioner in audit, governance, privacy, risk and security need to be knowledgeable about their disciplines, but increasingly, they have to understand how their fields are being impacted by emerging technologies...

21 April 2021
@ISACA Article

The Hidden Benefits of Nontraditional Backgrounds in Security Roles

It is widely known that a skills gap has plagued the cybersecurity workforce for years, leaving security professionals in high demand. But according to Adobe’s Director of Application Security, David Lenoe, now is a good time for organizations to source from a generally untapped...

21 April 2021
Blog Post

Secure Implementation of Emerging Technology Critical in Evolving Business Landscape

The COVID-19 pandemic changed how we utilize technology on both a personal and business level. Although some of these changes will fade away as we approach the end of the pandemic, there will be permanent effects that will linger indefinitely.

21 April 2021
ISACA Journal Article

Innovating in Times of Change: The Place for Artificial Intelligence in Auditing

With the growth of computing power and big data over the last two decades, the direction of artificial intelligence (AI) adoption has been forward, and it is moving fast. AI is technology that aims to boost the capability of machines to mimic human cognitive skills...

Author: Ivy Munoko
Blog Post

Creating Community and Connections with ISACA Volunteers

It is my honor to write this blog each April as we celebrate the contributions and connections we have made through the ISACA Volunteer Program.

20 April 2021
Blog Post

How to Prepare for the CISM Exam

Governments around the world are in the midst of the challenging task of pushing out COVID-19 vaccines in a safe, but urgent and calculated manner. Unprecedented leadership is needed to overcome logistical hurdles.

19 April 2021
Security Article

Advanced Cyberdefense US DoD’s CMMC Maturity Level 5

Advanced persistent threats (APTs) require that organizations respond with active and credible cyberdefenses. This is the focus of Maturity Level 5 of the US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC). Maturity Level 5 focuses on the protection of Controlled Unclassified Information (CUI) and is the highest level of cybersecurity defined in the CMMC standard.

19 April 2021
Blog Post

Varying Standards of Censorship and Privacy in the Age of Parler

On 6 January 2021, the US Capitol was stormed. It was subsequently determined that some of the perpetrators of this act, which resulted in loss of life, used the social media platform Parler to coordinate the attack.

16 April 2021
Podcast

Pursuing Risk Resilience

To survive—and thrive—after a digital transformation, organizations must establish a robust resilience program. In this episode of the ISACA Podcast, sponsored by ServiceNow, Risk Solutions Specialist Brandon Reese...

16 April 2021
Blog Post

A New Framework to Drive Digital Transformation

Yoshimasa Masuda recently visited with ISACA Now to discuss his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation and innovation and its connections in areas including pandemic response, healthcare and academia.

15 April 2021
@ISACA Article

Your Attention, Please: Introducing the New @ISACA

No matter where we live, or what our professional roles may be, there are many shared experiences to which we all can attest. One of those universal truths in today’s world: there is so much content out there, it can be overwhelming.

14 April 2021
@ISACA Article

Tune Up Your Career Now for High Performance All Year

Maintenance, hygiene, good habits, best practices. Whatever we call looking after our careers, the ongoing work of building our career success is our business as professionals.

14 April 2021
@ISACA Article

ISACA Launches New CCAK Certificate in Partnership with Cloud Security Alliance

In partnership with the Cloud Security Alliance (CSA), ISACA has launched the new Certificate in Cloud Auditing Knowledge™ (CCAK™)—the first-ever credential of its kind that fills a need for vendor neutral, technical training and credentials in cloud auditing.

14 April 2021
@ISACA Article

How to Embrace Agile Principles in Risk Management

Risk management professionals must embrace a new way of working by applying the principles of Agile. Applying Agile principles in assurance generates high-quality, focused value faster, using short sprints over the course of the year to alleviate the burden of a stringent audit plan.

14 April 2021
Blog Post

Fingerprinting a Security Team

The central security team in a product development organization plays a vital role in implementing a secure product lifecycle process.

14 April 2021
ISACA Journal Article

Third-Party Assurance: Why and How?

Outsourcing IT services to the cloud offers many benefits for organizations. The concerns regarding maintaining and securing IT services become the responsibility of the supplier. The organization is supported and risk is transferred with a contract.

Author: Jouke Albeda
Blog Post

5G Implementation: Healthcare Costs and Benefits

Normal, day-to-day life has been reshaped by the COVID-19 pandemic for more than a year, greatly impacting the lives of virtually everyone. People were and still are being advised to stay home, isolating themselves from the rest of world to reduce the spread of the virus.

13 April 2021
Privacy Article

A Primer to Defensible Data Disposition

Transforming business frontiers have created an expanding digital universe and explosive data growth, requiring organizations to act as reservoirs and graveyards of data. With the amount of data that exists doubling every 2 years...

12 April 2021
Governance Article

Using Risk Assessment to Support Decision Making

An effective and mature risk governance program drives better decision making in all directions of an organization: up to leadership and the board, down to individual contributors and laterally to all lines of business.

12 April 2021
Blog Post

Genuine Parts Builds Improved Cyber Maturity with ISACA’s CMMI® Cybermaturity Platform

Genuine Parts Company determined that its initial cyber maturity assessment needed to create a baseline against a common framework that aligns with NIST CSF and the ISO 27001 controls.

9 April 2021
Blog Post

Incoming ISACA Board Features Experienced Leaders, Diverse Backgrounds

Diversity is one of ISACA’s great strengths, and it comes in so many forms. Because of our global scope – ISACA has a presence in 188 countries and more than 220 chapters worldwide – our geographic diversity may be most obvious, enabling ISACA members to network and learn from colleagues from many cultures and backgrounds.

7 April 2021
Blog Post

Managing a Remote Team Securely and Effectively

More than a year after the start of the COVID-19 pandemic, organizations across the world are still adjusting to this unprecedented event.

7 April 2021
Blog Post

Shorting Third-Party Security

Last night, I watched a movie named “The Big Short.” While it was a complete dramatization of events that led to the financial market collapse of 2008, it seemed too good to be fiction.

7 April 2021
ISACA Journal Article

Ethics and Morality in the Fourth Industrial Revolution: Rethinking Ethics, Values and Innovation in the Digital Age

The Fourth Industrial Revolution (4IR) is fundamentally changing the world, and technological advances such as artificial intelligence (AI), machine learning (ML) and digitization are increasingly affecting how people live, work, communicate, learn and play.

Author: Oupa Mokgoantle
Podcast

The State of Cryptocurrency

Cryptocurrency has helped make blockchain technology mainstream, lauded by the general public for its decentralizing capabilities and in the cybersecurity space due to its integrity and self auditing.

6 April 2021
Blog Post

Driving Sustainable Improvement for Medical Device Quality

Medical device manufacturers seeking to better understand, measure and improve their capabilities have a new avenue to do so.

5 April 2021
Security Article

A Tiny Link in an Endless Chain

We are all part of a giant and interwoven supply chain. Cybersecurity failure within the supply chain is a collective problem that has always existed, but its severity has been brought to light once more due to recent events.

5 April 2021
Governance Article

The Sweet Spot of Risk Governance

In baseball, the “sweet spot” refers to the precise location on a bat where the maximum amount of energy from a batter’s swing is shifted into the ball.

5 April 2021
Blog Post

So, You Read Cybersecurity Predictions For 2021: What’s Next?

By now, it’s not the cybersecurity predictions for 2021 that matter – it’s what you do with them.

2 April 2021
Blog Post

A Four-Step Approach to Adopting a Privacy Framework

Organizations with mature privacy programs are reaping more benefits than average and are finding it easier to comply with new privacy regulations, according to Cisco’s 2021 Privacy Benchmark Study.

1 April 2021
ISACA Journal Article

Giving IT Governance Its Real Value

One of the most misused words in IT is “governance.” Unfortunately, the constant misuse of the terms “IT governance” and “governance” often leads to either a lack of context or a blurred meaning that is subject to personal interpretation.

Author: Ramón Serres
@ISACA Article

ISACA Launches New CCAK Certificate in Partnership With Cloud Security Alliance

In partnership with the Cloud Security Alliance (CSA), ISACA has launched the Certificate in Cloud Auditing Knowledge (CCAK)—the first-ever credential of its kind that fills a need for vendor-neutral technical training and credentials in cloud auditing.

29 March 2021
@ISACA Article

Navigating Change: The 5 Stages of Security Control Acceptance

Change, even when embraced, requires adjustments within organizations and their workforces. The changing and evolving threat landscape and frequency of attacks has highlighted the need for organizations to continue implementing new security controls—and mature existing ones.

29 March 2021
@ISACA Article

Privacy Professionals Can Now Test Their Expertise With ISACA’s CDPSE Exam

The demand for technical privacy professionals is high, but these roles are harder and more time-consuming to fill than legal/compliance positions, according to ISACA’s Privacy in Practice 2021 survey report.

29 March 2021
@ISACA Article

Encourage Cyber Accountability by Embracing Security Culture

An organization’s first line of defense against cyberthreats is its employees and the culture in which they work, but without a proper security posture, they can quickly become an enterprise’s weakest link.

29 March 2021
@ISACA Article

The Hidden Vulnerabilities of Remote Access Tools

The sudden shift to remote work caused by the COVID-19 pandemic left organizations and IT departments scrambling to provide in-home office solutions that would allow employees to continue working safely.

29 March 2021
@ISACA Article

Accomplish Your Career Goals With CRISC

Jose Vazquez has spent most of his career working in compliance, audit and business controls roles and has familiarized himself with many industry- and company-specific IT risk management frameworks.

29 March 2021
Blog Post

How to Overcome Obstacles on Your Path to Certification

“It ain’t about how hard you can hit, it’s about how hard you can get hit and keep moving forward; how much you can take and keep moving forward. That’s how winning is done.”

29 March 2021
Governance Article

Auditing IT Governance in the Navigation Sector

Auditing IT governance in the navigation sector is a challenge. The number of interdependencies and stakeholders in new navigation systems makes the process truly complex, and the increasing trend in subcontracting large parts of a system hides some of those interdependencies and other details in a huge number of contracts and other legal documentation.

29 March 2021
Privacy Article

Data Minimization—A Practical Approach

The amount of data collected across enterprises has exponentially increased over the years—and it continues to grow.

29 March 2021
Podcast

Diversifying the Security Hiring Pool

It is no secret that there has long been a gap in the cybersecurity workforce. But enterprises can take a step toward filling it by looking to nontraditional candidates, according to Adobe’s Director of Application Security, David Lenoe.

29 March 2021
Blog Post

Capability is King and Performance is Paramount

Being a musician myself (jazz and classical bass trombonist), I was thinking about how playing music well during a concert is VERY similar to developing new software or system or service.

26 March 2021
Blog Post

Selecting, Building, Landing and Growing Your Cybersecurity Career

I’ve been fortunate to work in a wide diversity of cybersecurity roles over my two decades in the field – from operations, services, consulting, vendors, managed service providers (MSPs) and more. I’ve hired hundreds of professionals from senior, experienced leaders to green new recruits.

24 March 2021
ISACA Journal Article

Healthcare Revolution in the 5G Age: Health Risk and Opportunity

In 2017, more than 180 scientists and doctors across the European Union (EU) co-signed an appeal calling on the EU to halt the rollout of fifth generation (5G) technology for telecommunications until potential hazards for human health and the environment...

Author: Ronke Oyemade
Blog Post

Creating a Values-Driven, Balanced Life and Career

Sebastian Terry, an author, TV host and founder of the 100 Things philanthropic movement, recently visited with ISACA Now to discuss his approach to goal-setting and life balance.

23 March 2021
Blog Post

Overcoming Cloud Hurdles Through Effective Audits

Remote access, increased collaboration capabilities, automatic software updates, potential for cost savings – organizations increasingly are drawn to these and other major benefits of leveraging cloud services

22 March 2021
Security Article

Entrepreneurship Gone Bad

Just when you thought 2020 was bad enough, 2021 ushered in its own chaos. The events that transpired in the United States during the first weeks of the new year were highly emotional, wrought with anxiety and, in many ways, an embarrassment to every US citizen who wakes up each day just trying to do and be better than the day before.

22 March 2021
Blog Post

Best Practices for Data Hygiene

Data hygiene consists of actions that organizations can, and should, take as a matter of following not only compliance requirements, but also as part of basic risk management program practices. Consistent, risk-specific data hygiene practices supports not only...

19 March 2021
Blog Post

Why Executive-Focused Security Awareness Training is Important

Willie Sutton was a bank robber in the early 1900s, and a quite successful one at that. Over a long and less-than-illustrious-but-more-than-successful career, he amassed over US$2 million. Even without considering inflation, that’s a serious chunk of change.

18 March 2021
Blog Post

Four Steps to Achieve SOC 2 Compliance

SOC 2 compliance is stressful for many organizations, but achieving continuous compliance while lowering the annual frustration is within your reach.

17 March 2021
ISACA Journal Article

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external environments, such as the cloud...

Author: Ulf Mattsson
Blog Post

What Next? Near- and Long-Term Actions Following Microsoft Exchange Hack

By now, you’ve almost certainly heard about the serious and ongoing attacks being conducted against on-premise Microsoft Exchange Server implementations.

16 March 2021
@ISACA Article

Discover the Future of Privacy and Risk at ISACA’s Virtual Summit

As emerging technologies including artificial intelligence (AI), the Internet of Things (IoT) and robotic process automation (RPA) continue to dominate innovation in IT, enterprises have been granted more access to personal data than ever. This has made the need for...

15 March 2021
@ISACA Article

How Workforce Risk Was Impacted by COVID-19

The workforce as we know it has undergone significant changes since the onset of the COVID-19 pandemic, some of which are likely to become permanent. Shifting to remote work has allowed employees around the world to keep their jobs...

15 March 2021
@ISACA Article

New Stackable ISACA Certification Designed for Students, New Professionals and Career Changers

ISACA is dedicated to helping individuals at every skill level obtain the IT knowledge foundation they need to succeed in the industry. To aid in this effort, ISACA has created the Information Technology Certified Associate (ITCA) certification...

15 March 2021
@ISACA Article

Not All Risk Treatment Options Are the Same

Risk management frameworks can teach risk professionals valuable lessons about what a risk management program should look like. We are encouraged to begin by making a list of the threats to, and vulnerabilities of, our organizational assets...

15 March 2021
@ISACA Article

Showcase Your IT Thought Leadership by Writing for ISACA

ISACA is committed to expanding the IT knowledge base by publishing original thought leadership that explores trending topics in the fields of governance, privacy and cybersecurity. To source this valuable content, ISACA invites industry experts to serve as volunteer...

15 March 2021
Blog Post

New ITCA Credential Aims to Fill Urgent Skills Gap for IT Candidates, Employers

We consistently hear about the shortage of cybersecurity professionals, often mentioned in the same sentence discussing the growing threat of data breaches and malware attacks.

15 March 2021
Blog Post

How the CISO Can Build Support from Senior Management

Trust is the cornerstone of any relationship, and it is built and nurtured progressively based on many factors.

12 March 2021
Blog Post

How to Thrive as a CISO: Award-Winner Brennan P. Baybeck Shares His Perspective

Brennan P. Baybeck, CISA, CISM, CRISC, CISSP, recently was named 2021 CISO of the Year in the APEX Awards, hosted by the Colorado Technology Association. Baybeck, VP & CISO for Customer Services at Oracle Corporation, was ISACA’s 2019-2020 board chair and remains an ISACA board director.

11 March 2021
Blog Post

Understanding the Link Between the Need Signal and Information Privacy Equipoise

One thing that became clear when writing an article on need signal is that we are just scratching the surface in our understanding of information privacy, both practically and from a scholarly standpoint.

11 March 2021
Blog Post

Contemplating the Dark Web and Secure Human Behaviors

Technological advances have made the job of information system auditors, risk managers and governance and security professionals difficult.

10 March 2021
ISACA Journal Article

I&T Governance Framework for Artificial Intelligence in Marketing

Information and technology (I&T) governance is a critical component of corporate governance, and it becomes even more crucial when organizations implement emerging technologies. Of the various emerging technologies that are currently transforming...

Authors: Benjamin A. Witt, Sarah J. Wolanske and Jeffrey W. Merhout
Blog Post

CISA-Certified Professionals Are More Needed Than Ever: How I Prepared to Join the Club

The COVID-19 pandemic is revealing just how important it is for all businesses to have a robust and efficient information technology infrastructure.

9 March 2021
Podcast

Remote Access Tools From a Hacker Perspective

Remote access tools can be an IT blessing, allowing tech support to quickly and remotely troubleshoot computer problems while reducing the need for lengthy conversations with confused employees.

9 March 2021
Blog Post

Celebrating the Women in our Global Network of Engaged Members

In honor of International Women’s Day, the ISACA Now Blog asked women who are helping elevate the profession about their volunteer roles with ISACA and their advice about getting involved.

8 March 2021
Blog Post

IT Audit is ‘Boring’? Time to Fix the Perception Problem

I was recently on a social media site where professionals join a career topic discussion group and ask questions. Someone asked: What job is boring? The very first answer: “IT audit.”

4 March 2021
Blog Post

Avoiding the Post-Quantum Cyber Apocalypse

Today, the comfort of our modern living is driven by advances in information technology: think of the mobile banking apps on your phones, the proliferation of blockchain technologies, and the various electronic sensors and components that are powering your home appliances, cars and the electricity grid, hospitals, and the list goes on.

3 March 2021
ISACA Journal Article

Benefits of Using a SOAR Solution

Security orchestration, automation and response (SOAR) is a widespread discussion among academicians, technologists, and executives linked to the cyber and digital spaces.

Author: Farhan Imitaz
Blog Post

HR and Cybersecurity: Supporting Each Other in Challenging Times

Cybersecurity was not on the top of the agenda for many Human Resources professionals in early 2020.

2 March 2021
@ISACA Article

Auditing for Success

Thorough compliance audits are critical to the success of every IT organization—and every auditor. But to achieve the desired results, sufficient time and resources must be allotted to prepare for the audit.

1 March 2021
@ISACA Article

Be Wary of Security Product Marketing

I recently read an article about cybersecurity and concluded that vendor influence on the discipline has reached a point of concern. Vendors and their marketing campaigns strive to introduce different terms into cyberprofessionals’ occupational jargon...

1 March 2021
@ISACA Article

Certify Your Privacy Experience With CDPSE Early Adoption

As data collection and management regulations increase in number and complexity, enterprises must enlist IT privacy professionals to successfully implement data privacy programs from a technical perspective.

1 March 2021
@ISACA Article

SheLeadsTech: From Inspiration and Awareness to Action

ISACA is committed to improving gender diversity in the technology field. To support this initiative, ISACA has continued to evolve its SheLeadsTech program since its inception in 2017.

1 March 2021
@ISACA Article

The Power and Potential of 5G

Cellular network technology has evolved at an exceptional, nearly unpredictable pace, growing from the voice-only system it once was to the impressive voice, text and data 5G technology of today.

1 March 2021
Blog Post

Become Inspired, Not Intimidated, by Technology

Michelle Poler, a creative and passionate social entrepreneur, fear-facer, and branding strategist, will be the closing keynote speaker at the ISACA Conference North America 2021, a virtual event to take place 4-6 May.

1 March 2021
Security Article

The Assault on Truth

Truth. Fact—a statement in accordance with reality. For years, there has been an assault on truth, whether through the promotion of “alternative facts,” the normalization of seemingly insignificant lies, the sharing of half-truths that mischaracterize reality or the confounding of fact and opinion.

1 March 2021
Privacy Article

Understanding the Importance of US Privacy and Identity Theft Laws

It is essential for IT experts and practitioners to be aware of and understand privacy laws as there are increasing global cybersecurity incidents.

1 March 2021
Blog Post

Reviewing Digital Transformation Practices

Competitive pressures, new markets and new digital technologies are the main drivers of digital transformation.

26 February 2021
Security Article

Resilience in the Cybersecurity Supply Chain

The US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC), establishes 5 maturity levels.

26 February 2021
ISACA Journal Article

IS Audit in Practice: Relinquishing Privacy to Research

I have always loved medicine. The science is intriguing and you can get involved if you want, which I did as a teenager, volunteering at the local hospital and giving blood every time a blood drive came through my community.

Author: Cindy Baxter
ISACA Journal Article

Information Security Matters: Keeping Secrets

In my last column, I made the case that the protection of secret information—as opposed to personally identifiable information (PII)—is becoming a significant issue in cybersecurity. This article picks up where that one left off.

Author: Steven J. Ross
ISACA Journal Article

The Bleeding Edge: The Boxes of Pandora and Schrodinger

If you have not heard it already, the Schrodinger’s Cat thought experiment1 is meant to help people understand just how strange things are on the quantum level of existence. From superposition to entanglement, when it comes to quantum mechanics...

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Privacy Innovations

At the time of the writing of this article, the SolarWinds supply chain hack is the big news within information security. Due to the sophistication of the attack and the follow-up, information security researchers believe a nation-state actor...

Author: K. Brian Kelley
ISACA Journal Article

A Guide to Selecting and Adopting a Privacy Framework

COVID-19 imposed change on every aspect of life and business in 2020, but 2020 was also a significant year in the world of privacy protection for reasons beyond the pandemic.

Author: Minaz Khan
ISACA Journal Article

What Is Your Privacy and Data Protection Strategy?

The global data privacy and protection landscape has been radically transformed within the last five years, notably with the enactment of the EU General Data Protection Regulation (GDPR) in 2018.

Author: Corlane Barclay
ISACA Journal Article

Varying Standards of Censorship and Privacy in an Interconnected World

On 5 August 2020, the US State Department announced the expansion of the Clean Network,1 which includes a number of programs intended to safeguard US assets and protect US IT from interference by malicious actors.

Author: William Emmanuel Yu
ISACA Journal Article

Need Signal: Information Privacy Equipoise

It has become apparent that need signal, more than information privacy concern or information privacy calculus, is the primary driver for individuals’ online participation or online transactions, whether it is participating or transacting in egovernment...

Author: Patrick Offor
ISACA Journal Article

Case Study: Building a Zero Trust Architecture to Support an Enterprise

Cimpress is a US$2 billion global company specializing in “mass customization,” meaning customizable business-to-business (B2B) and business-to-consumer (B2C) hard copy and digital print products. Cimpress was founded in 1994 with a focus on helping...

Author: Katie Teitler
ISACA Journal Article

The Gentle Art of Password Management

System and security administrators and information system auditors are often faced with the task of providing an adequate level of IT assurance for their own enterprises or those of their clients. This daunting challenge has become a high-profile endeavor...

Authors: David Trepp and Joshua Schmidt
ISACA Journal Article

The Dark Web and the Role of Secure Human Behaviors

Dark web concepts are helpful for preserving the privacy and security of its users. These hidden corners of the Internet provide anonymity for people who are oppressed by their governments, free speech to journalists, and secure communication channels...

Authors: Babur Kohy, Warren D. Holston and Ibrahim Waziri Jr.
Blog Post

How the Pandemic Has Boosted Some Tech Skills and Certifications

With the annus horribilus of 2020 now behind us, have tech certifications been affected by all the sturm und drang brought on by the double whammy of a pandemic and economic recession? The answer may surprise you.

24 February 2021
ISACA Journal Article

Deepfake: The Lay of the Land

Deepfake is the modern equivalent of Photoshop. It uses an artificial intelligence (AI) method called deep learning to create fake images and videos.

Authors: Pavankumar Mulgund and Samina Lohawala
Blog Post

Being a Reasonable IT Auditor During the Pandemic

Recently I have had a number of people asking me, “How are you conducting your audits with the onset of the COVID pandemic?”

23 February 2021
Blog Post

Best Practices to Manage Risks in the Cloud

The growth in cloud computing has been exponential. Forrester predicted that the global public cloud infrastructure will grow 35% to US$120 billion in 2021. COVID-19 has served to accelerate this trend further

22 February 2021
Privacy Article

China’s Personal Financial Information Protection

On 8 December 2020, the chairman of the China Banking and Insurance Regulatory Commission (CBIRC) laid out areas that the authorities will be looking at closely in the fintech industry.

22 February 2021
Security Article

Cybersecurity in the Digital Onboarding Process

Acquiring new clients using a digital channel such as a mobile application rather than requiring a physical presence is a process referred to as digital onboarding.

22 February 2021
Podcast

Risk After COVID-19: A New Workforce

The COVID-19 pandemic has prompted massive changes within the modern workforce, providing risk assurance and audit professionals a unique opportunity to assess how they approach the risk framework.

22 February 2021
Blog Post

Creatively Scaling Application Security Coverage and Depth

One of the biggest challenges and opportunities for an Application Security (AppSec) team is to scale effectively.

18 February 2021
Blog Post

Baselining Cybersecurity Skills for All IT Professionals

In the era of modern IT, it is becoming increasingly important for IT professionals to have a base-line contemporary cybersecurity skillset.

17 February 2021
Blog Post

Rethinking Information Security Awareness Strategies

In 2000, it was predicted that semantic attacks that target humans and use the vulnerability in information processing capabilities of humans would be the primary attack vector of cybercriminals.

17 February 2021
Blog Post

Congratulations to the Exceptional 2021 ISACA Award Recipients

ISACA values the contributions of our members and professionals across our industry and recognizes outstanding achievements annually through the ISACA Awards Program. Join us in celebrating the 2021 ISACA Award Recipients!

16 February 2021
Governance Article

Using COBIT 2019 to Proactively Mitigate the Impact of COVID-19

Enterprises are established with set objectives of meeting stakeholders’ needs and serving customers with desired products or services that add value. To be able to continually meet these objectives, an appropriate risk management strategy with a...

16 February 2021
ISACA Journal Article

Book Review: Corporate Governance—A Pragmatic Guide for Auditors, Directors, Investors, and Accountants

Vasant Raval’s Corporate Governance: A Pragmatic Guide for Auditors, Directors, Investors, and Accountants clearly sets the tone for the reader in the preface by stating that the “primary purpose of this book is to provide as complete a picture of the current state of corporate governance in the USA.”

Author: Ken Doughty
@ISACA Article

How to Improve Your Cybersecurity Audit

Cybersecurity audits ensure that organizations are well prepared to defend themselves against internal and external cyberthreats.

15 February 2021
@ISACA Article

Why Auditors Should Adopt Social Engineering

Social engineering is considered a type of security attack that targets the weakest link; that is, humans. However, rather than discuss how to audit social engineering preparedness or eliminate social engineering attacks, I pose—and answer—the question, do auditors need to acquire social engineering skills?

15 February 2021
@ISACA Article

Risk in 2021, as Identified by IT Auditors

The onset of the COVID-19 pandemic at the end of 2019 led to a tumultuous year that followed for organizations worldwide. Usual business operations came to a halt, with a resulting shift to remote work for many that presented new challenges—and increased risk.

15 February 2021
@ISACA Article

Creating a Culture of Cybersecurity at Princeton University

Building a culture of cybersecurity through user awareness training reduces risk to the enterprise and can enhance employee productivity.

15 February 2021
@ISACA Article

The Dangers of Neglecting Physical Security

In the age of cloud-hosted services, the Internet of Things (IoT) and remote work, cybersecurity conversations typically revolve around securing your network and devices, rather than your office building.

15 February 2021
Blog Post

Freedom to Fail – and Innovate

Leroy Chiao recently visited with ISACA Now to discuss lessons he took from his time as an astronaut, his observations on the latest technology trends and more.

12 February 2021
Blog Post

The COVID-19 Pandemic, Digital Security and 5G Security Architecture

Normal day-to-day life was brought to a halt by the COVID-19 pandemic, which greatly impacted the lives of virtually all people worldwide in unprecedented fashion.

10 February 2021
ISACA Journal Article

Nudging Our Way to Successful Information Security Awareness

Ensuring the security of information flowing in an organization requires the attention of all stakeholders including top management, employees and customers. Compliance with information security policies should be taken seriously with small or large...

Authors: Sudeep Subramanian and Udita Agrawal
Blog Post

Essential Cybersecurity Components: Continuous Monitoring, Human Intelligence and Commitment

Continuous monitoring is essential in the cybersecurity ecosystem of an organization. Proper design, implementation and continuous monitoring provide just-in-time reflection of users, devices, networks, data, workloads activities and status in the organization’s infrastructure.

9 February 2021
Privacy Article

CCPA in a Multilayered B2B Environment

Organizations that collect business-to-business (B2B) data from residents of the US State of California got a reprieve in 2019. The California Consumer Privacy Act (CCPA) went into effect in January 2020, applying to the collection of business-to-consumer (B2C) data.

5 February 2021
Blog Post

When the Mundane Becomes the Target

Cloud security in 2020 was upended from previous years – to say the least. The COVID-19 pandemic fundamentally altered human behavior, and those changes directly impacted the tech industry.

4 February 2021
Podcast

The Perils of Overlooking Physical Security

With today’s advanced cloud capabilities, cybersecurity is an obvious priority at many organizations. But that can leave physical security diminished or outright neglected.

4 February 2021
Blog Post

Disciplined IT Hygiene During Organizational Change

Everyone knows that IT and its evolution is an undisputable partner in any organization. IT teams no longer play a supporting role.

3 February 2021
ISACA Journal Article

Identifying the Practices of Digital Transformation: Based on a Systematic Literature Review

Initiatives using digital technologies as an enabler have been studied and implemented by many enterprises in recent years, mainly due to the increasing demand from customers for value-added products and services delivered faster and more conveniently.

Authors: Tomás Aguiar, Silvia Bogea Gomes, Paulo Rupino da Cunha and Miguel Mira da Silva
Blog Post

When to Assess Security and Privacy During the Procurement Process

Many organizations are concerned about security, privacy and vendor management for information technology (IT) services and applications, and rightly so.

2 February 2021
@ISACA Article

Improve Your Active Directory Security

Malicious cyberactors can leverage an organization’s Active Directory settings to gain network privileges by moving laterally. However, by taking proactive security measures, it is possible to reduce the attack surface of the enterprise’s network.

1 February 2021
@ISACA Article

The State of Privacy in the New Year

Though some organizations consider privacy to be a static, one-size-fits-all objective to be accomplished merely to comply with regulations, it should instead be viewed as an essential part of gaining customer trust and, therefore, critical to business success.

1 February 2021
@ISACA Article

Building Cloud Governance From the Basics

Cloud computing and cloud services have become a reality, and they are here to stay. Organizations of all sizes are adopting cloud computing and cloud services. According to Cisco, cloud data centers will process 94% of workloads in 2021.

1 February 2021
@ISACA Article

Information Technology From an Ethical Perspective

The power of an organization’s ethics, culture and individual behaviors to contribute to successful governance and management practices is often underestimated. Effective IT auditors must understand the ethical implications of the information systems...

1 February 2021
@ISACA Article

Top ISACA Resources of 2020

In today’s rapidly changing technology landscape, continuing education and skills development are essential tools for professionals who wish to keep up. To contribute to the IT knowledge base, ISACA is dedicated to creating relevant educational content...

1 February 2021
@ISACA Article

Congratulations, 2021 ISACA Award Recipients and Hall of Fame Inductees

ISACA is pleased to recognize the 2021 ISACA Award recipients and honor the first-ever Hall of Fame inductees for their thought leadership and volunteer service. It is only through peer nominations that ISACA can recognize these achievements.

1 February 2021
Security Article

Supply Chain Threats and the Cybersecurity Solution

On 6 December 2020, the Craft Industry Alliance reported that the McCall printing facility in Manhattan, Kansas, USA, had been shut down since October 2020 due to what appeared to be a malware attack.

1 February 2021
Blog Post

Security in the Cloud: Not Somebody Else’s Problem

Unless you’ve been living under the proverbial rock, you likely are aware of the Capital One breach in 2019 that leaked confidential information from more than 100 million credit applications stored in the Amazon Web Services (AWS) cloud.

29 January 2021
Blog Post

How to Identify Vulnerable Third-Party Software

The year 2020 will be reflected in history as a year of many surprises. In hindsight, one trend that, though not a surprise, rattled unexpecting companies, was the explosive occurrence of cybersecurity breaches via third-party software.

28 January 2021
Security Article

Cost-Effective Steps to Managing Cyberrisk

Today’s complex cyberthreat landscape is a risk to all enterprises. Combating these threats requires an enhanced, coordinated and sustained national effort across industry and government. A determined, well-resourced adversary can penetrate any network.

27 January 2021
ISACA Journal Article

What Type of Management Is Required to Stop Serious Cyberattacks?

The actual level of cyberrisk that many organizations face is now far out of alignment with what top management would consider an acceptable level of cyberrisk. In 2017, Warren Buffett, the chairman and chief executive officer (CEO) of Berkshire Hathaway...

Authors: Charles Cresson Wood and Jody R. Westby
Blog Post

Cyber Insurance for a Changing Landscape

In 2020, we adjusted to a global pandemic. Many businesses were not prepared to face this new reality but were forced to respond quickly to ensure their operations continued.

26 January 2021
Blog Post

Privacy in Practice 2021: Data Privacy Trends, Forecasts and Challenges

Data privacy, privacy management, digital privacy, data protection – the list goes on when it comes to data privacy and protection imperatives. The phrase “Data is the new oil” was coined considering the growing importance of personal and organizational data.

26 January 2021
Blog Post

Solving your Most Frequently Asked Questions

In late 2020 and early 2021, ISACA received more inquiries from members and customers than ever before, with unprecedented demand for certifications, including the CDPSE early adoption program.

25 January 2021
Blog Post

When IT is Your Profession, Life-long Learning Beyond Academia is Your Devotion

When you begin a new role or join a new employer, specific existing skills and experience secured the opportunity for you.

25 January 2021
Blog Post

Setting the Record Straight on 5 Cloud Security Myths

When it comes to cybersecurity in today’s digital landscape, the cloud is one of the most misunderstood elements.

22 January 2021
Privacy Article

Smart Objects and Their Privacy Implications

In the cybersecurity realm, it has long been discussed and understood that people are considered the weakest link in cybersecurity. And, like security, everyone has a crucial role to play to ensure a reasonable degree of privacy, to keep personal data safe.

22 January 2021
Blog Post

Azure DevOps: Access, Roles and Permissions

As IT auditors, we are well aware that the change management process is a critical component of IT controls testing in risk-based and compliance audits.

21 January 2021
Blog Post

Cybersecurity and the Board of Directors

A key initiative that enterprises should not overlook is the need for IT teams to bridge the gap between the chief information security officers (CISOs) and their organization’s board of directors (BoD).

20 January 2021
ISACA Journal Article

Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls

Cyberrisk is not just an IT issue; it is much broader. The magnitude or impact of a cyberattack can determine the survival of an enterprise. Business risk continues to exist.

Author: Robert Putrus
@ISACA Article

Surveying the State of Privacy in 2021

Consumers are becoming increasingly aware of how, when and by whom their data are being used. Organizations that fail to protect the privacy of their customers are at risk of financial and reputational damage. Results from ISACA’s 2020 State of Privacy survey...

18 January 2021
@ISACA Article

Zero Trust Should Not Equal Zero Business

The IT community made some incorrect assumptions about risk in 2020. That is to be expected, as all risk assessments rely upon assumptions. However, it is important to ensure that such assumptions are communicated to others and clearly articulated...

18 January 2021
@ISACA Article

Communicating Cyberrisk to Organizational Leadership

Cybersecurity professionals are often tasked with presenting technical risk assessments and the subsequent implications to their organization’s board of directors (BoD). To do so effectively, one must adopt the language that the board members use...

18 January 2021
@ISACA Article

Refine Your Cloud Expertise With ISACA’s Cloud Auditing Certificate

Cloud auditing is a critical step in successfully migrating to the cloud. Organizations can develop a better understanding of what cloud services and deployment strategies will result in the most improvement for their business though cloud auditing.

18 January 2021
@ISACA Article

Reinvigorate Your Professional Development at Latin CACS 2021

Professional conferences are an exciting and enriching way to explore valuable learning experiences and form connections with industry professionals. While in-person gatherings were brought to a halt in 2020 due to the global risk of the COVID-19 pandemic...

18 January 2021
Security Article

Cyberrisk Governance: A Practical Guide for Implementation

Despite cybercrime cost amounting to more than US$1 trillion globally in 2020—more than 1% of the global domestic product (GDP)—the topic still does not receive sufficient attention at the board and C-suite levels in organizations, according to a report conducted by the Center for Strategic and International Studies (CSIS) and McAfee.

14 January 2021
Blog Post

Eight Benefits of Seeking a Career in IT

Information technology (IT) is a field that can open up many different career paths. In IT, you could be responsible for installing and configuring hardware, managing third-party software, providing training and support to employees, auditing security systems, or possibly writing custom software.

15 January 2020
Privacy Article

Impacts of Canadian Government Oversight of PIPEDA

The Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) is a comprehensive act that governs collecting, using and disclosing personal information. Initially, the act was a mechanism proposed to ensure trust in e-commerce...

15 January 2021
Blog Post

Princess Ngozi Uche: A CSX-P Pioneer

Princess Ngozi Uche, the first CSX Cybersecurity Practitioner Certification (CSX-P) credential-holder in Nigeria, has a pioneering spirit, as further evidenced by her work to help initiate an ISACA chapter in Port Harcourt.

14 January 2021
Podcast

Assessing the Ethical Implications of Information Technology

IT enterprises with strong ethical frameworks are successful not only in making a greater, more positive impact on society, but in terms of financial and reputational status as well. To achieve this, however, organizations must be able to involve everyone...

14 January 2021
Blog Post

Accelerating to the Cloud, Responsibly

Coming out of 2020, most organizations are probably pivoting from digital transformation to digital acceleration. In only a matter of weeks, the world witnessed unprecedented adoption of digital technology that will shape consumer behaviors and business operations for years to come.

13 January 2021
ISACA Journal Article

Technology-Based Trust With Blockchain

Emerging technologies such as 5G, microservices, the Internet of Things (IoT), cloud computing, containers, blockchain and many others are shaping the meaning of “technology-based trust.” Consequently, technology-based trust deals with the acceptance...

Author: Luis Emilio Alvarez-Dionisi
Blog Post

Building on the Lessons from 2020

As we begin a new year, I think it’s safe to say that many of us are ready to leave 2020 in the rearview mirror.

11 January 2021
Blog Post

Four Ways to Change the Cybersecurity Hiring Process

A few years ago, I was an IT director on the hunt for new IT talent. I went the traditional route, posting jobs, reviewing resumes and holding interviews

8 January 2021
Privacy Article

America’s Newest Privacy Rights Act—California’s CPRA

2023 compliance readiness starts now. The US State of California’s Proposition 24, known as the California Privacy Rights Act of 2020 (CPRA), was passed by voters in the November 2020 election. The CPRA provides additional rights to consumers and places...

8 January 2021
Security Article

Cloud Strategy Challenges

I have had the privilege of working with organizations that adopted cloud strategies and were able to improve productivity for end users and optimize IT operations and cybersecurity. I have also worked with organizations that stepped into the cloud world...

8 January 2021
Blog Post

Threat Hunting and Cyberrisk Assessment Using Cyber Kill Chain

Virtually every organization needs to provide digital services to its clients. However, digitization creates enormous threats for an organization, its customers and its employees.

7 January 20201
Blog Post

Leveraging Marketing to Overcome the Cybersecurity Workforce Shortage

Organizations around the globe are struggling to overcome the challenge of the cybersecurity workforce shortage, and filling this gap has become a top priority as cyberthreats continue to grow.

6 January 2021
ISACA Journal Article

Security and Risk Assessment of IT Defense Strategies Considering the Cyber Kill Chain

Defensive IT architecture helps to deploy defense-in-depth concepts in an organization’s IT architecture, which helps to prevent, identify, detect, contain, respond to and recover from cyberincidents in a timely manner. Defensive architecture in information...

Author: Muhammad Mushfiqur Rahman
Blog Post

Five Security and Emerging Tech Insights for 2021

As we begin 2021, ISACA experts are weighing in with anticipated major trends in the worlds of cybersecurity and emerging technology that they expect to gain traction in the new year.

5 January 2021
Governance Article

Indicator Management: A Question That Should Start With “Why?”

Enterprises’ operational functions often need their data on a real-time basis to know about business performance and have an overall assessment of their strategic and tactical goals. Simultaneously, the risk management function wants to define analytical models ...

5 January 2021
@ISACA Article

Building an Effective Data Privacy Communication Plan Using 3 Design Principles

An effective data privacy communication plan will increase awareness of data privacy requirements and help establish a clear set of steps to execute when a breach occurs. There are 3 reasons why an effective privacy communication plan is critical to the success...

4 January 2021
@ISACA Article

Demonstrate Your Privacy Expertise With the CDPSE Beta Exam

Certification exams are developed by ISACA through consultations with industry experts in the IT community. Beta exams allow for the gathering of valuable feedback from candidates around the world, resulting in final exams—and grades—that accurately...

4 January 2021
@ISACA Article

The Rise of Zero Trust, Explained

As pressure to meet compliance requirements continues to mount, more enterprises are turning to a zero trust approach. To effectively implement the zero trust framework, enterprises should achieve a thorough understanding of its nuances.

4 January 2021
@ISACA Article

UK Cyber Security Council Established to Strengthen Skill Sets, Collaboration

Over 100,000 cyber roles come up in the UK each year, yet half of companies state they have a basic skills gap and a third struggle to fill those roles. ISACA® is proud to help champion the cybersecurity profession as a founding member of the Cyber Security Alliance...

4 January 2021
@ISACA Article

Nominate an Outstanding Individual to Serve on the ISACA Board of Directors

ISACA strives to provide continuous value to members by serving as a beacon of knowledge for the IT community. Electing a strong Board of Directors to govern is an important part of that effort. Nominations for the 2021-2022 ISACA Board of Directors...

4 January 2021
@ISACA Article

ISACA Foundation Strives to Achieve Global Impact in 2021

As key leaders in the cyber field know, organizations across all industries rely on cybersecurity professionals to serve as the frontline of defense against threats and risk. But the shortage of qualified cybersecurity workers is increasing, exposing organizations...

4 January 2021
Privacy Article

Will Low-Earth Orbit Satellites Fly Under the Privacy Radar?

As the world considers what 5G will mean for privacy, low-earth orbit (LEO) satellite Internet continues to gain momentum and quietly fly under the radar from a privacy perspective.

4 January 2021
ISACA Journal Article

A Window of Opportunity: Ending the Cyberworkforce Shortage Once and For All

Two years ago, the cyberworkforce shortage was the number-one concern for chief information security officers (CISOs), security operations center (SOC) managers and other security leaders. Researchers estimated that there would be 1.8 million unfilled...

Author: Philip Casesa
Language: 日本語
ISACA Journal Article

Adaptation of Information Security in the Agile World

One of the core values of Agile is to maintain built-in quality, which implies that security controls should be embedded in the Agile mindset. However, it may be argued that information security and an Agile mindset do not always go hand in hand with...

Author: Gerald Pang
ISACA Journal Article

Information Security Matters: Secrecy and Privacy

The COVID-19 pandemic has accelerated many trends in information technology that were already evident before the global outbreak, including teleworking, cloud-based hosting and distance learning. Not all the accelerated trends were positive, however.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Watching Out for Workforce Risk in the New Normal

What a year 2020 was: climate change marked by wildfires across the globe and record counts of tropical storms; health welfare at center stage from a pandemic that changed people’s lives and attitudes; elections that called cybersecurity effectiveness...

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Intelligence—A Not-So-Mediocre Commodity

“Brains are the only things worth having in this world, no matter whether one is a crow or a man.” Not that long ago, humankind used candles to produce light and horses to travel or to do mechanical work.

Author: Dustin Brewer
ISACA Journal Article

Case Study: Transforming Princeton’s Security Culture Through Awareness

Security awareness and training programs (also known as user awareness programs) educate users about computer security and organizational policies and procedures for working with IT resources. User awareness programs can reduce information risk...

Authors: Dan Blum, David Sherry, and Tara Schaufler
ISACA Journal Article

Tips for Strengthening Organizations From Within, the Tom Hanks Way

At a time when cyberthreats continue to grow, organizations around the globe are struggling to overcome the challenge of a cybersecurity workforce shortage. According to the 2019 Strategies for Building and Growing Strong Cybersecurity Teams...

Author: Abdelelah Alzaghloul
ISACA Journal Article

Security Discipline and Hygiene Mean Healthy, Naturally

In this time of the COVID-19 pandemic, personal cleanliness and hygiene are discussed more frequently than ever before. It is essential to maintain hygiene to stay safe and prevent the spread of COVID-19. Even from a cost perspective, the cost of being cautious...

Author: Sundaresan Ramaseshan
ISACA Journal Article

Help Source Q&A

What is “zero trust” in information security? Is it a new concept or just old wine in a new bottle?

Author: Sunil Bakshi
Blog Post

The Rise of Fintech: Managing and Controlling your Money

Every now and then, I travel across the world of emergent technologies. My passport has been stamped so many times for my visits to the wonderland of IoT, cloud computing, virtual networking, containers, microservices, cybersecurity, virtual machines...

30 December 2020
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 2: Security Reporting for Senior Management

The value of information security may be understood differently within an enterprise. For security specialists, the need for protective measures against known threats is sufficient to justify investments. However, management wants higher level reports presenting results based on figures...

Author: Andrej Volchkov

Artificial Intelligence Regulations Gaining Traction

Not long ago, complex artificial intelligence (AI) systems involving deep learning were mainly just theories. There were very few practical use cases. Today, many organizations are using AI to make their processes more efficient. AI has gained traction much faster than other emerging technologies.

29 December 2020
Blog Post

Looking to the Accelerated Digital World of 2021

“There are decades where nothing happens; and there are weeks where decades happen.” True to this quote by Lenin and as articulated by Fareed Zakaria in his book, Ten Lessons for a Post-Pandemic World...

23 December 2020
ISACA Journal

Artificial Intelligence’s Impact on Auditing Emerging Technologies

Artificial intelligence (AI) is the demonstration and simulation of human intelligence by machines, especially computer systems. AI, robotic process automation (RPA), the Internet of Things (IoT) and blockchain are among the next-generation technologies that are considered disruptive in nature.

Author: Niral Sutaria
Podcast

What Makes a Threat an APT?

APTS are typically driven by experienced cyberactors, significant funding and a target that possesses extremely sensitive data. The depth of these threats means that virtually no enterprise is immune, even those which have implemented highly sophisticated cybersecurity measures.

22 December 2020
@ISACA Article

Auditing Guidelines for Artificial Intelligence

Over the past few years, there has been a tremendous shift toward emerging technologies such as blockchain, robotics and artificial intelligence (AI). Global organizations and governments have come to terms with the impact—and opportunity—of advanced technology.

21 December 2020
@ISACA Article

Compliance Assurance During the Time of COVID-19 and Beyond

Has there ever been a more challenging climate for the second and third lines of defense? The COVID-19 pandemic has quite clearly changed the entire 2020 landscape for financial services. A flurry of economic challenges and hurdles has put tremendous pressure...

21 December 2020
@ISACA Article

Ten Ways Hospitals Can Prepare for Ransomware Attacks

The COVID-19 pandemic has resulted in a surge of ransomware attacks focused on 1 target in particular: hospitals. To help combat this trend, ISACA has provided a tip sheet with 10 key actions hospital cybersecurity teams can take...

21 December 2020
@ISACA Article

#IamISACA: My New and Unexpected Adventure

I spent nearly 4 months of this year shopping for complete strangers, thousands of miles from my home and navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic—and I loved it.

21 December 2020
Blog Post

IT Audit Technology Risk: Knowns and Unknowns

Knowns and unknowns. In a game of word association, some may think of the US National Aeronautics and Space Administration (NASA). It was an associate administrator from NASA’s Office of Safety and Mission Assurance who heightened awareness of known/unknown risks in a 2003 presentation on safety and mission success.

21 December 2020
Blog Post

Let’s Apply APT Lessons From SolarWinds Hack

Well, my cyber and information security friends, it’s that time again. We’re starting to get asked questions about what we do by more than just our immediate supervisors. We get comments such as “I bet you’re busy this week” and “Should I change my password on my account?”

21 December 2020
Blog Post

5 GDPR Compliance Tips for Businesses That Are Still Lagging Behind

We’re more than two years removed from the introduction of the General Data Protection Regulation (GDPR) into EU law.

18 December 2020
Privacy Article

Privacy During a Pandemic

It will soon be one year since the first case of COVID-19 was reported. Ever since that first case, governments, healthcare providers and pharmaceutical companies have been under constant pressure to find a vaccine for this virus.

18 December 2020
Governance Article

The Role of IT Governance During the COVID-2019 Pandemic

It is likely that 2020 will remain in history as the year of COVID-19. The virus has changed everything, affecting personal and professional lives across the globe. Organizations have had to change their ways of working, and as a result, many more people are now working remotely to adhere to social distancing protocols.

16 December 2020
Blog Post

ISACA Community Shows Off Its Diverse Talents in 2020 #IamISACA Stories

Beginning in April, our #IamISACA series has told the stories of the accomplished, volunteer-minded and multitalented people who make up the ISACA community. We hope you have enjoyed reading and viewing these stories as much as we have enjoyed sharing them...

17 December 2020
Blog Post

Eight Future Privacy Governance Imperatives That Boards Have a Duty to Perform

Surveys show that most people still feel they should have more control over their data and are uncomfortable with the sale of their data to third parties, implying that some privacy regulations are failing to effectively protect the privacy of their citizens.

16 December 2020
ISACA Journal Article

The Role of IT Governance During COVID-19 and Beyond: Keeping the Momentum

This is an extremely critical and dangerous period in everyone’s lives. A single message is heard from every corner of the world: “Stay home.” This is a vastly different situation from how the world has functioned for the last five decades.

Author: Lionel Jayasinghe
Podcast

Exploring the Push for Zero Trust

Increasing pressure on many organizations to meet compliance requirements has resulted in a push to adopt a zero trust approach. But for implementation to be successful, enterprises must obtain a thorough understanding of the nuances of the framework.

16 December 2020
Blog Post

Organizational Culture: Friend or Foe in 2020?

2020 has either been a year of reviews or a year of forward reflections depending on what dominated your outlook.

15 December 2020
Blog Post

A Foundational Path for Blockchain Implementation

Twelve years after its birth, blockchain technology has now become mainstream. Its market adoption can be attributed to the industry and blockchain enthusiasts who pushed for new regulations.

14 December 2020
Privacy Article

Why Employee Privacy Matters More Than Ever

For organizations and their employees, 2020 is a uniquely transformative and challenging year. Although this reality is expressed in many ways—including a global pandemic, a deep economic recession, perpetual social unrest and a litany of natural disasters...

14 December 2020
Security Article

When Worlds Collide

This year will likely be remembered unfavorably by most people due to the multitude of hardships, losses and inconveniences associated with the COVID-19 pandemic.

11 December 2020
Blog Post

How to Involve Senior Management in the Information Security Governance Process

Chief information security officers (CISOs) and security specialists often complain about the disinterest of senior management in information security.

10 December 2020
Blog Post

Assessing Risk in a Pandemic

To effectively assess risk in a pandemic, leaders need to focus on the risk at hand, the associated right metrics, and evaluate all elements of risk: impact, likelihood and velocity.

9 December 2020
ISACA Journal Article

Digital Banking Poses Challenges for Third-Party Risk Management

Digital banking is a disruptive trend growing in the banking industry across the world. Simply put, it includes banking services provided primarily or wholly through digital or electronic means.

Authors: Maosen Cai and Han Yan
Blog Post

Navigating the New Hiring Landscape

Daisy Jardine-Viner, a cybersecurity recruitment specialist for NDK Infosec, recently shared her expertise on pandemic-impacted industry hiring trends at ISACA’s EuroCACS conference, hitting on topics including Zoom interview best practices, how the pandemic has altered hiring and what skills and credentials can best position candidates for success in this new climate.

8 December 2020
Security Article

Harnessing Zero Trust Security

Cybersecurity is awash with acronyms, jargon and marketing slogans. Yet, history and headlines demonstrate the ongoing success of adversaries and tell us a different story. Zero trust security offers promise but is largely misunderstood and perceived as yet another overly-hyped buzzword.

8 December 2020
@ISACA Article

Mitigating the Dangers of Malware

Malware, sometimes conflated with electronic “spam,” has long been a commonly used tactic by ill-intentioned cyberactors, geared toward targets that range from hyper-protected government bodies to student email accounts.

7 December 2020
@ISACA Article

Securing Work-From-Home Devices

The outbreak of the COVID-19 pandemic resulted in lockdown measures that were imposed to contain the spread of the virus, which included a freeze on commuting to the office to work in person for almost everyone but essential workers.

7 December 2020
@ISACA Article

ISACA Foundation Commits to Children’s Cybereducation

As developments in technology continue to saturate all aspects of everyday life, it has become more important than ever to ensure that children are properly educated about cyber best practices.

7 December 2020
@ISACA Article

Vote For an Inspirational Volunteer for the ISACA Founders Award

ISACA® is proud to honor members who have shown outstanding dedication to activities that advance ISACA's purpose, including volunteer service and member engagement activities.

7 December 2020
@ISACA Article

#IamISACA: Respecting Technology’s Power–and Its Limits

I currently work as the head of internal audit at SAVE, an organization that manages the airport of one of the most beautiful cities in the world, a city with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships: Venice, Italy. SAVE is also the parent company of several organizations that manage other airports in the Italian northeast airport system, including Treviso, Verona and Brescia.

7 December 2020
Blog Post

How Smart Technology Helps Fintech Companies Succeed

Smart technology has evolved at a rapid pace. In the beginning, smart tech reached consumers in the form of smart household appliances like thermostats, security systems and refrigerators.

7 December 2020
Governance Article

The Role of IT Governance in Addressing Pandemic-Related Cyberrisk

The entire world is now grappling with the COVID-19 pandemic, which is turning out to be not only a massive health challenge, but also one of the most enormous economic challenges in recent history. With every passing day, thousands of positive cases are added to the already huge number of active cases.

7 December 2020
Blog Post

Sizing Up the Impact of COVID-19 and Remote Work on IT Auditors

The year 2020 will go down in the history books as one of the most trying years in modern world history. The COVID-19 pandemic has tested nearly every nation, government, business and individual in many unforeseen ways that heavily impact daily life, with additional consequences and impacts likely into the future.

3 December 2020
Podcast

The Microcomputing Revolution

Since its conception, microcomputing has made waves in the open source community, providing an accessible and relatively user-friendly way for technology owners to create their own amateur smart devices before mass-manufactured ones hit the market.

3 December 2020
Blog Post

#IamISACA: Weekend Studies for Weekday Successes

As a security professional, I am used to new vulnerabilities and threats materializing every day, creating unforeseen challenges and a huge learning scope. It can be difficult, but that is what drew me to the profession in the first place.

2 December 2020
Blog Post

Security and Compliance: What to Expect in 2021

There is little doubt that 2020 has been one of the most challenging years many security professionals have encountered.

2 December 2020
Security Article

Why You Need to Take Cybersecurity Seriously in the New Year

Today’s cyberthreats are more complex and severe than ever. The risk to organizations of all sizes has never been greater. As we begin 2021, it is important to reflect on the state of cyberthreats so that organizations can better secure themselves.

2 December 2020
ISACA Journal Article

Robotic Process Automation to Aid Accounting and Finance Departments

Enterprises are currently experiencing one of the most groundbreaking periods of technology evolution since the Internet first came on the scene decades ago, and the rise of robotic process automation (RPA) is a perfect example.

Authors: Angel R. Otero, and Ryan Paul Fink
Blog Post

Security Awareness as a Corporate Asset

A recent blog post about culture as a corporate asset discussed the importance of a healthy culture in an organization.

1 December 2020
Blog Post

Why Cybersecurity Is a MUST not a SHOULD

There is no doubt that security is now a recognized need within and across organizations. This reflects the acceptance of how an organization’s behavior is dependent on shared beliefs, values, and actions of its employees, which includes their attitudes towards cybersecurity.

30 November 2020
Privacy Article

Privacy Governance and Privacy Engineering in the Cloud

In the light of digital transformation, cloud computing has become widely adopted. The separation of ownership, management and usage rights of resources increases the possibility and severity of privacy risk in the cloud.

30 November 2020
Blog Post

#IamISACA: My New and Unexpected Adventure

I spent nearly four months this year shopping for complete strangers, thousands of miles from my home, navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic.

25 November 2020
ISACA Journal Article

Fintech Governance Challenges, Levels and Theories

The fintech industry is growing at such a fast pace that investors, boards of directors, senior management and government regulators need to reexamine current practices and models of fintech governance. One well-known example of this growth is the US$16 billion ...

Author: Luis Emilio Alvarez-Dionisi
Blog Post

Simplifying the Transition to Quantum-Safe Security with Crypto Agility

The quantum computing threat to public-key encryption is enormous. Large-scale quantum computers are on the not-too-distant horizon.

24 November 2020
@ISACA Article

Five Key Considerations for Developing a Cybersecurity Emergency Action Plan

Recently, the ever-expanding cybersecurity threat landscape, along with an increasing frequency of attacks, has highlighted the need for organizations to develop and implement emergency action plans as part of their business resilience programs.

23 November 2020
@ISACA Article

The Connection Between Data Security and IT Audit

The world’s economy is powered by data. Yet organizations still experience significant difficulties when it comes to protecting and securing information. As ransomware evolves and cloud services attacks increase, enterprises face heightened pressure to secure data.

23 November 2020
@ISACA Article

Transform From Trust to Zero Trust at Asia CACS 2020

This year, the COVID-19 pandemic and its resulting physical distancing requirements have made the idea of congregating with other professionals to explore industry topics and insights seem like a thing of the past. Yet the ISACA community can still gather...

23 November 2020
@ISACA Article

Using ITAF to Empower IT Audit

In the United States in the early 2000s, several very public cases of financial fraud occurred within large organizations such as WorldCom, Adelphia Communications and Enron. The construction and facilities management corporation Carillion in the United Kingdom raised similar fraud concerns...

23 November 2020
@ISACA Article

ISACA CTO Shares Tech Upgrades to Improve Online Learning Experience

To better serve members, ISACA has rolled out 2 significant technology updates. The first is a new learning platform called ISACA PERFORM. PERFORM, as the name suggests, offers an experiential approach to learning that improves engagement and performance.

23 November 2020
Blog Post

Security by Design: Are We at a Tipping Point?

The much-publicized Target breach of 2013—where 70 million customers lost their personal data, 40 million credit and debit card details were stolen, more than US$250 million was spent to manage the breach and the chief executive officer (CEO) and chief information officer (CIO) were replaced—does not even place among the top 15 breaches of this century.

20 November 2020
Podcast

Strategies for Securing Remote Technology

The dust of the COVID-19 pandemic has begun to settle and professionals around the globe are now more comfortable with the realities of remote work. Yet even increased familiarity with working from home still leaves room for security threats to arise.

11 November 2020
Blog Post

How the Concept of Privacy is Shifting

Ivana Bartoletti, a privacy and digital ethics expert recently visited with ISACA Now to share her perspective on major trends in privacy, digital ethics, AI and more.

19 November 2020
Blog Post

Enterprise Security Morphing and Evolving Into Security Intelligence

The ongoing global crisis brought about by the COVID-19 pandemic has caused a huge shift in society and how we conduct our daily lives.

18 November 2020
Blog Post

#IamISACA: CISM Connects the Dots in My Professional Development

At the beginning of my career, I was partly lucky, but later on also quite selective in deciding to work for organizations and bosses that embraced empowerment and supported individual development of their people, as I myself was always a strong advocate of servant leadership and continuous education.

18 November 2020
Security Article

Understanding and Addressing CISO Burnout

The job of a chief information security officer (CISO) is notoriously grueling. CISOs often only remain in their roles for a year or two, with high stress levels and unrealistic organizational expectations among the leading factors that drive CISOs from the job.

18 November 2020
ISACA Journal Article

Harnessing Zero Trust Security

Cybersecurity is awash with acronyms, jargon and marketing slogans. There is no dearth of so-called “silver bullets.” Yet, history and headlines demonstrate the ongoing success of adversaries and tell us a different story.

Author: Rajiv Raghunarayan
Blog Post

Approaching Risk Management in the New Normal

As we approach the end of 2020, it has become clear that the COVID-19 pandemic is not a passing storm or something that we can wait out before returning to a familiar business routine; it is the new normal.

16 November 2020
The Nexus Article

The Cybersecurity Implications of an Evolving Work Environment

It is an understatement to say that COVID-19 has forced significant changes in how most organizations operate today.

16 November 2020
Blog Post

Securing the IoT Landscape of Tomorrow

Security consultants and practitioners have insight into how organizations of various sizes, across both the public and private sectors, are preparing for Internet of Things (IoT) deployments during this unusual pandemic year.

13 November 2020
Privacy Article

Three Ways Your Approach to Privacy Is at Risk

At the federal (or national) level, the risk associated with outdated privacy laws has received good coverage. What has received less coverage is how outdated—and, therefore, risky...

13 November 2020
Blog Post

Raising the Bar Beyond Privacy Compliance

In the context of privacy by default, privacy compliance is not nearly enough.

12 November 2020
Blog Post

#IamISACA: I Love What I Do

Doing your job well with knowledge and commitment requires you to love what you do. I started my career almost 19 years ago, but information security as a profession came into my life 10 years ago.

11 November 2020
ISACA Journal Article

Robotic Process Automation for Internal Audit

Advances in data science, processing capabilities and technology have sparked the fourth industrial revolution. Organizations are rapidly digitalizing parts of their businesses using robotic process automation (RPA) to achieve efficiency and increase quality.

Author: Hassan Toor
Blog Post

Change Is Good

Shortly after its launch in 2014, I bought a Microsoft Surface Pro 3. If you studied for the Certified Information Systems Auditor (CISA) exam using the review manual or online review course, studied for the Certified in Risk and Information Systems Control (CRISC) exam using the online review course, took the Certified in the Governance of Enterprise IT (CGEIT) exam or read an “IS Audit Basics” column anytime since 2016, you likely read words penned on that computer.

10 November 2020
@ISACA Article

Accessing the ISACA Journal Is Easier Than Ever

In today’s digitally saturated world, much media and knowledge consumption takes place electronically. With the free ISACA Journal app, IT industry thought leadership is no exception. The app contains the latest and most timely ISACA Journal content and...

9 November 2020
@ISACA Article

Identify KRIs to Keep Your Business Afloat During the Pandemic

New and sometimes unpredictable IT vulnerabilities have cropped up as a result of work-from-home policies implemented in the wake of the COVID-19 pandemic. One way organizations can combat these situations for effective governance is by identifying...

9 November 2020
@ISACA Article

Securing the Cloud for Competitive Edge

External forces in business today have driven organizations to transform their IT and security practices. The rise of cloud adoption has left many security teams half-invested in their current security measures, while the other half looks toward the future.

9 November 2020
@ISACA Article

The Auditor’s Dilemma

Recently, the COVID-19 pandemic and its effects on the IT industry triggered a memory in my mind as an auditor. It took place some years ago when I had just passed my Certified Information Systems Auditor (CISA) exam and was eager to conduct system...

9 November 2020
@ISACA Article

ISACA Foundation Creates Diversity Pipelines

The lack of diversity in the tech space continues to be a critical, prevailing issue, yet organizations are realizing this challenge extends beyond corporate responsibility, social justice or even regulatory compliance. A lack of diversity undermines good business practices.

9 November 2020
@ISACA Article

ISACA Community Makes a Difference on Second Annual Day of Service

Even a global pandemic could not stop passionate ISACA members and their families from serving their communities. On 3 October 2020, 100 teams of ISACA members from around the world came together to give back for the second annual ISACA CommunITy Day...

9 November 2020
Blog Post

Working from Home with Remote Video Technology

Working from home has gone from being a luxury to a necessity because of the COVID-19 pandemic. Usually, we talk about disrupting technology, but this time, we have an external non-controllable factor that is causing the disruption.

9 November 2020
Governance Article

COBIT Resource Optimization Mapped to TOGAF’s Architecture Review Board

Several years ago, the IT department of the largest bakery factory in the world conducted a COBIT® 5 assessment and implementation of enterprise governance as presented in the article, “A Partial Transition to COBIT 5 Demonstrates Value to IT.”

9 November 2020
Blog Post

One Year In: Tech Update From ISACA’s CTO

Just over one year ago, I came on board as ISACA’s first chief technology officer. I knew I had an exciting challenge in front of me. ISACA members are extremely sophisticated technology professionals, and I needed to make your experience with us elegant, quick and on your terms.

6 November 2020
Security Article

Top Cyberattacks of 2020 and How to Build Cyberresiliency

Cyberattacks rank as the fastest growing crime in the US, causing catastrophic business disruption. Globally, cybercrime damages are expected to reach US $6 trillion by 2021.

6 November 2020
Blog Post

Battling Ransomware: US Hospitals Under Fire

In 2010, I moved away from the financial industry into the world of cybersecurity consulting. My first consulting project was within the healthcare industry, and so was my next big project, and hundreds of projects in which I have participated since.

5 November 2020
ISACA Journal Article

Zero Trust Architecture—Myth or Reality?

Trust is an emotion that cannot be applied to machines; however, it is, regularly. In today’s hostile cyberspace, the “trust, but verify” approach typically results in crisis management. The IT landscape has been changing ever since the first computer was invented. More and more organizations are adopting big data...

Author: Muhammad Asif Qureshi
Podcast

Managing Malware Threats

Phishing emails and dangerous links are among the most pervasive threats to cybersecurity, capable of targeting everyone from seemingly impenetrable government organizations to college students’ university email accounts.

4 November 2020
Blog Post

Don’t Just Fight Privacy Fires: Plan Ahead to Prevent Them

As privacy concerns continue to increase, most of us spend our days fighting fires. With more privacy regulations continuing to be released, it’s difficult to understand the key differences and know what is most important.

3 November 2020
Blog Post

#IamISACA: Diagnosing the Need for a Career Change

Just a few short years ago, having completed my bachelor’s degree in physiotherapy, I was on track to become a doctor in the lake city of Udaipur, India, where I am from. But by the time I completed my doctorate, I realized that something was missing in my career and my life.

3 November 2020
Blog Post

Successful Second Annual CommunITy Day Changes the World!

A global pandemic did not stop the dedicated and passionate ISACA members, staff and their families around the world from giving back to their local communities on ISACA’s second annual CommunITy Day

2 November 2020
The Nexus Article

Getting Started With CMMC, a US DoD Mandate for Cybersecurity

On 31 January 2020, the US Department of Defense (DoD) introduced a new cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC).1 Every cybersecurity and compliance professional, including senior executives, must raise their awareness of this important and valuable cybersecurity standard developed by the DoD.

2 November 2020
Blog Post

Keeping Up with Change with Agile

The phrase “the only constant is change” rings true for every single one of the organizations I have been a part of.

30 October 2020
ISACA Journal Article

Information Security Matters: The Context of Cybersecurity in the Post-Pandemic World

In my previous article, I stated that “serious cyberattacks seem no worse than before” the COVID-19 pandemic. Whenever anyone qualifies a categorical statement, the qualifier is always awfully important. In this case, it invites the question, “Just what is a trivial cyberattack?”

Author: Steven J. Ross
ISACA Journal Article

How to Start Your Quantum Migration Journey

If quantum migration were a train, it would be a cryptoagility train with the destination quantum readiness. All aboard!

Author: Paul Lucier
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 1

Having reliable metrics or key performance indicators (KPIs) in the field of information security is a prerequisite to building a successful security program. Measuring operational efficiency, costs and benefits has always been a concern for managers, and information security is no exception.

Author: Andrej Volchkov
ISACA Journal Article

IS Audit Basics: Ethics in Information Technology

I am sitting down to write this column in mid-August, which, believe it or not, is quite late for an ISACA Journal vol. 6 column (at least for me). The reason? After 3.5 years and 21 articles, I have decided that this will be my last column.

Author: Ian Cooke
ISACA Journal Article

Leaving the Cathedral: A Case Study of Open Source as a Business Strategy

Most practitioners know that support for open-source software can sometimes be a loaded question for an organization. From a usage point of view, there are a few concerns. Organizations worry about compliance with open-source licenses— fearing, for example...

Author: Ed Moyle
ISACA Journal Article

The Bleeding Edge: The Dog Days of IoT

When humans first domesticated wolves, the implications of the symbiotic relationships could not have been foreseen. We (humans) were slowly able to somewhat let down our guards while sleeping with our trusty companions on guard and place some of our hunting burdens on our furry friends.

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Innovation on Trust

Once upon a time, in order to secure a computer, an organization only had to worry about physical security. After all, computers took up an entire room and were programmed using punch cards that were fed into them. However, as computer technology progressed...

Author: K. Brian Kelley
ISACA Journal Article

The Practical Aspect: Privacy Compliance—A Path to Increase Trust in Technology

The need for privacy is increasing at an unprecedented rate. It cuts across technologies and work models, especially the new ones, that create opportunities for and facilitate the management of personally identifiable information (PII).

Authors: Vasant Raval and Samir Shah
ISACA Journal Article

Security and Privacy in the New Normal

Since the beginning of 2020, communities throughout the world—personal and professional—have been impacted in a way that was always only talked about in hypothetical scenarios, such as running an organization completely virtually.

Author: Deepa Seshadri
ISACA Journal Article

The Unintended Consequences of Zero Trust on Enterprise Culture

It has been 10 years since John Kindervag, then with Forrester Research, first laid out the information systems security concept called the zero trust model. In the decade since, few organizations could boldly claim that their information technology environments were safe from hazards and threats emanating from the inside and outside.

Author: Grace F. Johnson
ISACA Journal Article

Predicting Cybersecurity Risk Severity Using Bayesian-Based Machine Learning

Cybersecurity risk assessment is a nebulous process that requires a delicate balance between art and science. Typically, a risk assessor begins by collecting relevant information for all the identified risk factors. The assessor gathers information from logs, architecture diagrams, network topology...

Author: Srinidhi Mallur
ISACA Journal Article

Standards, Guidelines, Tools and Techniques

An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques...

Author: ISACA
Blog Post

The 8 Most Common Cybersecurity Weaknesses to Watch for in Small Businesses

As a cybersecurity expert, you know that all it takes is a single weakness, or a single vulnerability to compromise the integrity of a business.

29 October 2020
Blog Post

#IamISACA: Curious About the Cloud and Addicted to Hockey

It’s hard to believe I have been working in the financial services industry for 20 years. My primary focus over the last 12 years has been building enterprise, operational, and IT risk management programs from the ground up, including enablement of audit readiness.

28 October 2020
Blog Post

#IamISACA: Respecting Technology’s Power – and Its Limits

I’m currently working as the Head of Internal Audit at SAVE, the company managing the airport of the most beautiful city in the world, with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships...

28 October 2020
Blog Post

Implementing the Right to be Forgotten When the Internet Never Forgets

The internet never forgets, or so the adage goes. But what started off as a catchy saying or something that might be relevant to a technology subculture has evolved into a global reality, especially with dropping storage costs, access to cheap internet and, more importantly, the propensity of the human race to share data willy-nilly.

28 October 2020
ISACA Journal Article

Addressing the Human Fallibility That Leads to a Data Breach

Within the last decade or so, cyberincidents have made headlines and have become top strategic risk factors for enterprises.

Author: Farid Vayani
Blog Post

How Law Firms Can Avoid Cybersecurity Fiascos

With each passing month, we’re seeing steep increases in the number of cyberattacks waged against businesses, particularly small businesses.

27 October 2020
@ISACA Article

New Expert Directory Connects Speakers With Opportunities

Industry thought leaders can be an invaluable resource for accessing exclusive, expertise-rich content. Unfortunately, the COVID-19 pandemic has brought many industry events to a halt, making it more difficult for professionals to connect with experts and consume their compelling content.

26 October 2020
@ISACA Article

Defining IT Governance and Its Roles for Business Success

Refining IT governance systems can be invaluable to organizations throughout today’s ever-changing, highly disruptive business environments. Identifying the differences between governance and management and using principles found in COBIT and Certified in the Governance of Enterprise IT...

26 October 2020
@ISACA Article

Making Sense of Privacy

People everywhere are impacted by privacy, or more accurately, the lack of a common, global set of standards, guidelines and laws to help people understand what privacy is, what it means to them and how to take steps to ensure the privacy of information related to individuals, communities, societies and the enterprise.

26 October 2020
@ISACA Article

Managing the Risk of Remote Work

The COVID-19 pandemic has resulted in remote work becoming the new normal for employees worldwide. While this measure has been successful in keeping employees safe, unfortunately, it has introduced new security vulnerabilities that can put an organization’s systems and data at risk.

26 October 2020
@ISACA Article

Staying Connected While Working From Home

Virtually every industry has been impacted by the public health risk posed by COVID-19, and as a result, the realities of the traditional work environment have changed, possibly permanently. Conversations about disrupting technology have been forced to address the coronavirus...

26 October 2020
Governance Article

Leveraging COBIT 2019 to Face the Challenge of Digital Transformation in Small Enterprises

Information is a key resource for all organizations, regardless of their size. It is created, used, retained, disclosed and destroyed. Technology plays a key role in these activities. Both information and technology (I&T) have become an integral part of all aspects of personal and enterprise life.

26 October 2020
The Nexus Article

Treat the Whole Patient: Cybersecurity Amid COVID-19

Treat the whole patient. Public health practitioners have long known that the symptoms a patient presents in the doctor’s office tell only a portion of the story.

26 October 2020
Blog Post

Cloud Native Security: A Blue Ocean

Digital transformation is driving massive workloads across to the cloud as organizations move beyond a traditional brick and mortar model. Cloud provides the flexibility to execute at speed, time to market and embrace change in the digital landscape.

23 October 2020
Blog Post

Why Build a Cybersecurity Culture?

One of the best ways for an organization to reduce cyber risk is to build a culture of cybersecurity. This entails creating a mindset in employees that the risk is real and their daily actions impact that risk.

22 October 2020
Blog Post

#IamISACA: Activating My Spirit of Ubuntu

My friends often ask why I am so passionate about volunteering. Answering this question requires me to look back over my life’s experiences. In the quest to find my purpose, I found great wisdom in Mahatma Gandhi‘s words, with one of my favorite sayings being, “The best way to find yourself is to lose yourself in the service of others.”

21 October 2020
Blog Post

#IamISACA: My Endless Journey in IT

In the early 2000s, studying Computer Science and Engineering was a hotcake field; everyone wanted to study it in Bangladesh. Only those who are truly passionate about IT stayed on this journey, and the rest left. Fortunately, I am one of those who has continued.

21 October 2020
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 2

Security awareness encompasses attitude and knowledge. There is a third component as well, automation, that defines behavior in stressful situations. These concepts were examined in part 1 of this two-part series. However, attitude and knowledge prejudice this kind of automation.

Author: Zsolt Bederna
Blog Post

Key Considerations for Robotic Process Automation

Robotic Process Automation (RPA) is a modern trend in which a typically simple (i.e., requiring no real intelligence) sequence, that up until now involved a human operator, is replaced with a virtual robot.

20 October 2020
Blog Post

Mind the Gap: Bridging the Divide Between Digital Ethics and Privacy

When Gartner highlighted “digital ethics and privacy” as one of its top 10 strategic technology trends for 2019, it noted that “any discussion on privacy must be grounded in the broader topic of digital ethics and the trust of consumers, constituents and employees.”

19 October 2020
Blog Post

Auditing with Microsoft Azure

Writing about Azure audit and its associated audit program is a logical follow-up to a previous ISACA Journal article I wrote on auditing Amazon web services (AWS).

16 October 2020
Blog Post

Cybersecurity Hiring Trends Now and in a Post-Pandemic World

There’s no doubt the coronavirus will permanently change the world we live in. For most of us, the past seven months have been a bumpy ride. Demonstrating adaptability (combined with a big dose of resilience) will be key to keeping the wheels turning career-wise in 2021.

15 October 2020
Podcast

The Evolution of Wi-Fi

Once a technological marvel, the idea of a wireless connection to the Internet has become so engrained in the digital world that it is hard to fathom a time when that was not the case.

15 October 2020
Blog Post

#IamISACA: Learning My Way to a New Career Path

I was approached by my company a few years back with an opportunity to build a cybersecurity program. At the time, I was working in our internal audit department and cybersecurity risk was a rising and prominent concern for our company.

14 October 2020
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 1

People are an essential part of security. They operate processes; produce technology, in the cases of hardware and software; and apply technology; therefore, they are the basis of security. Furthermore, they behave according to their intrinsic and extrinsic sources of motivations.

Author: Zsolt Bederna
Podcast

Why You Need a Proactive Approach to Risk

The wave of remote working arrangements implemented as a response to the COVID-19 pandemic has introduced new and often unpredictable IT vulnerabilities.

14 October 2020
Blog Post

Adapting to Emerging Technology

A pentester, security operations center (SOC) analyst, IT auditor, risk analyst and system administrator walk into a bar.

13 October 2020
Governance Article

Digital Transformation Realized Through COBIT 2019

There is an understanding that is spreading quickly throughout the world: The COVID-19 pandemic has shut down much of the physical world temporarily and the resulting void will be filled by the digital world permanently.

13 October 2020
@ISACA Article

Enhance Professional Development by Renewing ISACA Membership

The rapid pace of global technological innovation in recent years has led to ever-changing expectations for professional skills and competencies. What satisfied employers 1 year ago may no longer be enough, and for that reason, taking advantage of professional development opportunities...

12 October 2020
@ISACA Article

Exploring the Basics of Blockchain

Blockchain can be defined as a type of digital ledger that records and distributes transactions while protecting data integrity and availability. “Of the confidentiality, integrity and availability (CIA) triad, blockchain is trying to solve the integrity issue,” says cyber expert Dustin Brewer in the “Breaking Down Blockchain” episode of the ISACA Podcast.

12 October 2020
@ISACA Article

Pursuing a New Career in Times of Adversity

The turbulent events of this year have resulted in an uncertain job market for many, whether or not they expected to find themselves searching for a new position. This means it is more important than ever for information security...

12 October 2020
@ISACA Article

Zero Trust

So, it has begun. Zero trust, an old cybersecurity term that is being reintroduced with new meaning. If you remember zero trust, it is probably in the context of trusted development. Zero trust meant that all software created, and hardware tools used to enforce a security safeguard...

12 October 2020
@ISACA Article

ISACA Student Groups Open Doors to Opportunities

Edmund Ho studies accountancy and information management at the City University of Hong Kong College of Business (Hong Kong, People’s Republic of China). He serves as the internal secretary of City University’s ISACA Student Group (ISG), which is affiliated with ISACA’s China–Hong Kong chapter and ISACA Global.

12 October 2020
The Nexus Article

Cybersecurity Awareness: Progress or Passivity?

October is Cybersecurity Awareness Month (CSAM), created 17 years ago as a public-private partnership to ensure individuals have the proper resources for online safety. CSAM 2020’s overarching theme is “Do Your Part. #BeCyberSmart” aimed at empowering...

12 October 2020
Blog Post

How COVID-19 Is Changing Risk Management

One of the most visible results of the COVID-19 pandemic is the transition from traditional office-based work to remote work-from-home (WFH) arrangements for global enterprises.

9 October 2020
Blog Post

Cloud Security Breaches: Who is Ultimately Responsible?

Cloud security breaches consistently make news headlines. Yet, the stories of these breaches are often framed with vague explanations — a “misconfigured database” or mismanagement by an unnamed “third party.”

8 October 2020
Podcast

Engineering an Effective Privacy Game Plan

Putting effective privacy measures into practice can be a difficult task for organizations that lack a comprehensive, well-documented privacy strategy. Without one, enterprises may be exposing customer data to vulnerabilities, and could find themselves at risk of noncompliance with privacy regulations.

8 October 2020
Blog Post

#IamISACA: Calligraphy is My Meditation

Starting my career in information security and privacy compliance roles has made for a fascinating journey. I am currently working in the fintech sector, which is a relatively young sector in the digital economy. I am learning disruptive technologies first-hand and also learning about start-up culture.

7 October 2020
ISACA Journal Article

Next-Generation Security

The world is interconnected. An event that occurs in one part of the world (e.g., an infected animal for sale at a market introducing COVID-19 to humans) can have dramatic, unexpected consequences everywhere else.

Authors: Louisa Saunier and Kemal A. Delic
Podcast

Finding the Human Factor in Work from Home

Once considered a privilege, remote work has become a necessity resulting from the public health risk posed by COVID-19.

7 October 2020
Blog Post

Prioritizing People Perils During a Pandemic

With the COVID-19 pandemic continuing to plague the world, it goes without saying that as technology and transformational program leaders, we should be managing our “people” risk a lot closer.

6 October 2020
The Nexus Article

Take Action for Cybersecurity Awareness Month

With so much of our lives taking place online these days, wouldn’t it be great if there was a time of year that was dedicated to cybersecurity? The good news: There is.

5 October 2020
Blog Post

Governance for Effective Digital Transformation

Many successful organizations have been transforming their processes to adapt to the changing environment.

2 October 2020
Blog Post

Embedding Security in the Agile Product Development

Outline security requirements at the beginning of the project, review the design to check if the requirements have been incorporated and perform security testing before go-live. If this sounds familiar, it should.

1 October 2020
Blog Post

Empathy and Flexibility Can Help Us Navigate a Chaotic 2020

Oof. What a year. 2020 has certainly been a year of contradictions. In some ways, it is a year that has trudged along at a glacial pace.

30 September 2020
Blog Post

#IamISACA: Bringing ISACA Closer to Home

In 2009, I was certified as a CISA and became an ISACA member, joining the Lagos Chapter in the west region of Nigeria. Five years after, I relocated to Port Harcourt in the south of Nigeria. At the time, there was no nearby ISACA chapter.

30 September 2020
ISACA Journal Article

Auditing the Cloud: Microsoft Azure

When it comes to the cloud and the methods used to audit this expanding technology, Amazon Web Services (AWS) is not the only major player. There may not be as many advertisements for Azure, but as of 2019, Microsoft was one of the top-three providers of public cloud services.

Author: Adam Kohnke
Blog Post

IT Audits: Running to Stand Still

The work life of an IT auditor can be a thankless one. As the IT department becomes busier, it is increasingly difficult to get IT audit reports over the line. When they are completed, what is the reward?

29 September 2020
@ISACA Article

Six Privacy Considerations for Auditors

As compliance requirements continue to evolve, it is critical for auditors to stay abreast of the most current regulations. Efforts to implement proper privacy measures should not necessarily lead to separate information security projects completed merely for compliance reasons...

28 September 2020
@ISACA Article

Implementing and Executing Privacy by Design

Legislation such as the EU General Data Protection Regulation (GDPR) has popularized the concept of privacy by design, or the notion that privacy be at the forefront during the creation of every process and product in an organization.

28 September 2020
@ISACA Article

Strategies for Securing Complex Cloud Environments

Cloud services are commonly used for data storage, meeting operational needs and running applications. Changing to cloud services enables organizations to create new environments when needed and retire them if business needs shift.

28 September 2020
@ISACA Article

Subscribe to ISACA SmartBrief Newsletters to Learn the Latest Trends in Cybersecurity, Privacy and Governance

ISACA has partnered with SmartBrief to offer a new collection of newsletters focusing on the areas of cybersecurity, privacy and governance. The ISACA SmartBriefs deliver multiple pieces of relevant and timely industry news to subscribers’ inboxes in a regular, comprehensive newsletter.

28 September 2020
@ISACA Article

ISACA CEO David Samuelson’s Commitment to Lifelong Learning

ISACA Chief Executive Officer (CEO) David Samuelson is proud to be a lifelong learner. “Helping people be better so that they can get the most out of their lives has always been a passion of mine,” Samuelson says in a new video as part of the #IamISACA series.

28 September 2020
Blog Post

Pursuing a Multicloud Security Strategy

If your organization is like most, you know that cloud is here to stay. Even if your organization is new to cloud, as a security practitioner, you know that it’s not a matter of “if” but “when” key business processes will find themselves becoming increasingly more dependent on externally-hosted services and cloud technologies.

28 September 2020
The Nexus Article

Secure Cloud Migration Starts With Trust

Several years ago, discussions with IT organizations tended to revolve around convincing skeptics to move to the cloud. This is no longer the case. Over time, those discussions evolved because IT leaders grew to understand the clear value of adopting cloud.

28 September 2020
Governance Article

Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy

COBIT is an IT governance and management framework designed to help organizations create value from their IT initiatives, better manage their risk and optimize resources.

28 September 2020
Blog Post

Make Security Awareness an Experience

In a lot of countries, October is ”Cybersecurity Month,” and organizations like to time their security awareness programs around this period. As we approach October, it is important to start thinking about security awareness training and how best to engage employees.

25 September 2020
Blog Post

CGEIT Preparation Tips and the Timelessness of Good Governance

My preparation for the CGEIT certification exam took about five months of self-study, deep-dive research on the weekends and answering practice questions.

24 September 2020
Blog Post

Building a Privacy Focus Area Using COBIT and the NIST Privacy Framework

As ICT professionals we are overwhelmed with quite a number of frameworks, but it is the nature of the specialization in the field that prompts the need for them.

23 September 2020
Blog Post

#IamISACA: Uplifting Others: The Measure of My Life

The life of a human being should be measured and valued by what it does for others. That is what my parents taught me.

23 September 2020
ISACA Journal Article

Common Sense Authentication

In the mid-1970s, 96 kilobytes of computer memory cost more than US$100,000. Today, 8 gigabytes of computer memory can be purchased for less than US$50. That difference demonstrates the huge advancements in information systems in the last 45 years.

Author: Paul C. Schauer, Ph.D.
Blog Post

The Blurred Lines of Information Privacy Attitudes in the COVID-19 Era

The paradox and the naked reality is that people are simultaneously needing to protect their personal information by not participating in online transactions, while also needing to participate in online transactions to obtain goods or services...

22 September 2020
Blog Post

‘No Other Option’ Than Ethical Hacking

FC, a well-known ethical hacker and social engineer, has been working in the information security field for over 20 years and excels at circumventing access controls.

21 September 2020
Blog Post

IT Governance Value and the Pandemic

Today, more than ever, people, business and information & technology are related: I&T are essential resources to facilitate the survival of people and business.

18 September 2020
Blog Post

What I Learned About Risk During the Pandemic: Meme Edition

The internet is rife with memes that speak to how nobody could have seen what was coming in 2020. From the futility of buying a 2020 calendar to the pretentiousness of answering the question of where you are going to be in five years, they are endlessly funny and help to ease us through these difficult times. v

17 September 2020
Blog Post

#IamISACA: This Time, I’m Here to Stay

The first time I became an ISACA member, I did not stay long. I became a member in 2015 simply because there was a need for an IT auditor at my organization, but that reason was not enough to keep me in ISACA.

16 September 2020
ISACA Journal Article

Addressing Risk Using the New Enterprise Security Risk Management Cycle

Enterprise Security Risk Management (ESRM) is a holistic security program designed to identify and prioritize assets and risk to mitigate those risk areas. ESRM bridges security professionals and asset owners in making informed decisions through the ESRM cycle.

Author: Harisaiprasad Kumaragunta
Blog Post

Like Cold Weather, Handle Election Security with Layers

What I’m going to tell you in this blog post is nothing new, and no secret to most cybersecurity professionals, but it nonetheless bears repeating leading up to the November US election, and really taking to heart.

15 September 2020
Blog Post

Taking Steps to Win the Battle Against Misinformation

As a risk professional working in county government in the state of Kansas, I am on the frontlines of helping to secure the upcoming 2020 US election.

15 September 2020
@ISACA Article

Realizing the Benefits of Robotic Process Automation

Robotic process automation (RPA) reduces the amount of time it takes to perform logical, repetitive tasks, allowing more complex, value-added work to be completed. RPA is software designed specifically to perform manual, regularly occurring tasks, not to be confused with the use of robotic machines to construct a product on an assembly line, which the name may imply.

14 September 2020
@ISACA Article

Problems With Using Record Count as a Proxy for Risk

Developing a cyberrisk appetite can be a daunting task. Many organizations struggle to determine how much risk they have, how much is acceptable and how to measure risk at all. When faced with these problems, many practitioners default to measuring things that are within arm’s reach or appear novel or significant based on someone’s experience.

14 September 2020
@ISACA Article

Finding a Framework That Fits

Enterprises that effectively implement a cybersecurity framework are better able to create value through processes, people and technology. Guided by a framework, organizations can establish their own cybersecurity policies and procedures while adhering to industry best practices.

14 September 2020
@ISACA Article

ISACA Partners With NYU for Member Discounts on Exclusive Cyber Fellows Program

ISACA and the New York University (NYU) Tandon School of Engineering have partnered to offer the CSX Cybersecurity Practitioner (CSX-P) certification at a discounted price along with a 75% scholarship toward a Master’s in Cybersecurity to all ISACA members accepted into the NYU Cyber Fellows Program

14 September 2020
@ISACA Article

Nominations Due 30 September for the 2021 ISACA Awards

ISACA’s professional community is advanced by outstanding contributions from members who strive to exemplify ISACA’s purpose and leadership. It is through the ISACA® Awards peer-recognition program that incredible achievements of volunteers across the industry are celebrated, inspiring future generations of business technology professionals.

14 September 2020
@ISACA Article

ISACA’s New Election Security Study Shows Declining Confidence

In the lead-up to the 2020 US elections, ISACA surveyed more than 3,000 US members in January 2020 and again in July. Results show that confidence levels are low—and declining. Even though experts largely agree that technical controls and security procedures for elections are relatively strong...

14 September 2020
@ISACA Article

Local Outreach Makes a Global Impact on ISACA’s CommunITy Day

Recognized by the American Society of Association Executives (ASAE) with a 2020 Power of a Gold Award for its global impact, CommunITy Day encourages ISACA members and their families to take action in their local communities while ISACA measures the positive effect created globally.

14 September 2020
Blog Post

The Secret to Passing Cybersecurity Certification Exams

Getting ready to take a certification exam in the cybersecurity realm – whether it’s CISM, CRISC, CISSP, CSX-P or another blue-chip certification – can be quite stressful.

14 September 2020
The Nexus Article

A Green Eggs and Ham Guide to Securing Your Critical Infrastructure

Whether your data are in a box, with a fox, in a house, with a mouse, on a train, in the rain, in a car or on a boat... Wherever the critical data that you manage are located—which brings to mind the Dr. Seuss book Green Eggs and Ham...

14 September 2020
The Nexus Article

COVID-19 Cyberattacks Require Businesses to Prioritize Cyberresilience

Businesses and end users are being targeted to download COVID-19 ransomware malware disguised as legitimate applications. We are witnessing an increase in phishing attacks that then lead to ransomware events by using COVID-19 as bait to mislead employees and customers.

14 September 2020
Blog Post

CCPA: Nine Months In

Protecting consumer data privacy has been a critical issue for years, but California was the first US state to actually enact a law.

11 September 2020
Blog Post

Privacy as a Differentiator: Going Beyond Regulations

The array of proposed and adopted privacy laws across the globe, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), reflect growing concerns around privacy.

10 September 2020
Blog Post

Common Misconceptions About Agile Auditing

Before the pandemic disrupted our lives, I attended a fascinating webinar in which the head of a very large internal audit shop shared lessons learned from the department’s Agile journey.

9 September 2020
ISACA Journal Article

US Data Privacy Law: A Disparate Landscape in Need of Consolidation

Even before the EU General Data Protection Regulation (GDPR) brought attention to the issue of data privacy, the United States already had one of the most complex regulatory approaches to privacy, having implemented different laws and regulations by industry...

Authors: Jacob Nix and Pascal A. Bizarro
Podcast

Breaking Down Blockchain

At its core, blockchain functions to maintain the integrity of data and systems. But how does it compare to other databases and when should it be used?

9 September 2020
Governance Article

COBIT and IT Audit—A Partnership for Eternity

The first time I heard about COBIT was almost 10 years ago, as I was starting out as an IT internal audit intern. Since then, I have been using COBIT for various aspects of IT audit, including developing IT audit plans, planning and performing IT audit engagements...

8 September 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Blog Post

Responding to and Protecting Against Ransomware

There have been many recent successful ransomware attacks, and there is frustration that in today’s cybersociety, information security safeguards and best practices are not being followed by local governments, financial services, law enforcement, academia, government agencies, healthcare organizations and businesses and commercial enterprises.

3 September 2020
Blog Post

Choosing the Ideal API with Security in Mind

Application programming interfaces, or APIs for short, provide very secure and standardized ways for applications to work together and deliver greater information and functionality for end users

2 September 2020
Blog Post

#IamISACA: Reaching the Top, and Finding a New Challenge

After more than 10 years as an IT and IS auditor and consultant for one of the Big 4 audit and advisory companies worldwide, I gained world-class experience by working in a high-ranking professional environment on challenging local and international engagements.

2 September 2020
Blog Post

#IamISACA: Striving for Excellence

The 2008-2009 recession gave me the opportunity to look beyond the obstacles and to find out what opportunities lie after a crisis. With that in mind, today’s COVID-19 pandemic reminds me how a crisis turned into an opportunity to land in information security and to become involved with ISACA.

2 September 2020
ISACA Journal Article

Building a Privacy Culture

Privacy is the right to be free from interference or intrusion. Information privacy is most often associated with digitization, but information privacy has been an issue ever since personal information started to be stored on and processed by mainframe and mini-computers.

Author: Muhammad Asif Qureshi
Blog Post

COVID-19: A Pilot for the Future of Work

Daniel Susskind visited with ISACA Now to discuss how AI will impact the professional landscape, how COVID-19 factors in and more. The following is a transcript of the conversation, edited for length and clarity.

1 September 2020
Podcast

The Road to Achieving Privacy by Design

Most organizations would agree that privacy by design is fundamental to growing a successful business and building customer trust. Yet putting this ideal into practice can often prove challenging. In this episode of the podcast...

1 September 2020
@ISACA Article

How to Build a Strategic and Effective GRC Operating Model

Many organizations are facing a set of challenges with regard to governance, risk and compliance (GRC)-related processes, technologies and overall programs embedded within their IT and business enterprise architecture.

31 August 2020
@ISACA Article

Audit Program From ISACA Reviews Microsoft Azure Cloud Platform

To be effective, auditors must familiarize themselves with the latest cloud trends and top cloud computing platforms such as Amazon Web Services (AWS) and Microsoft Azure (Azure) as well as market newcomers and the latest cloud trends.

31 August 2020
@ISACA Article

Navigating Governance in the Wake of COVID-19

An informed risk response is fundamental to the success of IT risk and assurance professionals, and the importance of this tactic has been amplified since the rise of the COVID-19 pandemic.

31 August 2020
@ISACA Article

Discover the Latest in Cybersecurity at ISACA’s Virtual Summit 2020

In the age of the COVID-19 pandemic and physical distancing, gathering in a single room with hundreds of other professionals to explore ideas and the latest industry trends is unlikely to become a reality anytime soon.

31 August 2020
@ISACA Article

New Hall of Fame Recognizes Dedicated Volunteer Service

Volunteering not only benefits the recipient of the service provided, the act of giving creates a ripple effect and encourages participation across entire communities. Donating time to a cause can reinvigorate an individual both personally and professionally.

31 August 2020
Blog Post

Deploying a Data Security Defense

Data security has always been a top priority, but the COVID-19 pandemic has made it even more prominent.

31 August 2020
Blog Post

CDPSE Spotlights Relationship Between Privacy and Security

Few organizations are driving more meaningful change than ISACA for our professions and our careers.

28 August 2020
ISACA Journal Article

IS Audit Basics: Defining Targets for Continuous IT Auditing Using COBIT 2019

I have previously discussed sitting and passing my Certified Information Systems Auditor® (CISA®) exam back in 2005.1 I tend to remember that one of the hot topics at that time was continuous online auditing.

Author: Ian Cooke
ISACA Journal Article

The Dark Side of Robotic Process Automation

Business processes involve performing a sequence of tasks, such as registering a sale, computing value-added tax, sending an invoice, packaging and sending the product, updating the inventory and accounts receivables, etc.

Author: Spiros Alexiou
ISACA Journal Article

Pandemic-Driven Remote Working and Risk Management Strategies

One of the most visible results of the 2020 COVID-19 pandemic has been the mainstream transition from traditional office-based work to remote work-at-home arrangements. Government officials worldwide mandated that nonessential employees stay home.

Author: Brett Bonin
ISACA Journal Article

The Bleeding Edge: Why the Bleeding Edge Is So Bloody

Those of us who have been in this industry for a while have seen amazing accomplishments and growth within the technology sector. We have also seen security breaches happen, usually paired with quick knee-jerk reactions and a “slap-a-Band-Aid-on-it” mentality as a response.

Author: Dustin Brewer
ISACA Journal Article

The Practical Aspect: Working From Home—Reassessing Risk and Opportunities

The technology for remote communication through distributed networks existed in rudimentary form during the 1990s,1 but sophisticated applications for distance learning, video teleconferencing, online chat and telemedicine developed modest acceptance in the early 21st century.

Authors: Vasant Raval and Edward A. Morse
ISACA Journal Article

Information Security Matters: Lessons for the IT Community From the Pandemic

As I write this piece in June 2020, the world has been facing the COVID-19 outbreak for nearly seven months. Millions have been infected; hundreds of thousands have died. Millions more people have lost their livelihoods, at least in the short term.

Author: Steven J. Ross
ISACA Journal Article

Building a Culture of Security

A cybersecurity culture is more than physical barriers of entry into a building, multifactor authentication system access or least privilege authorization. It is a collective mindset of the people in the organization working every day to protect the enterprise.

Author: Paul Frenken
ISACA Journal Article

Applying Agile to Digital Audit Transformation

The following statement sounds like it could have come from today’s news: “54% (of [chief executive officers] CEOs) are funneling money toward growth initiatives, including emerging technologies in mobile devices, social media, and data analytics.”

Author: Chris Sanders
ISACA Journal Article

Emerging Technologies Do Not Call for Emerging Cybersecurity

The world is undergoing constant transformation, and IT is the powerhouse of this process. Data are produced in high volumes every day, and the pace is increasing in areas such as social media, for example, which has evolved from text to images and from images to videos and soon will move from videos to augmented reality (AR) and virtual reality (VR).

Author: Demetrio Carrión
ISACA Journal Article

Case Study: How FAIR Risk Quantification Enables Information Security Decisions at Swisscom

Swisscom is Switzerland’s leading telecom provider. Due to strategic, operational and regulatory requirements, Swisscom Security Function (known internally as Group Security) has implemented quantitative risk analysis using Factor Analysis of Information Risk (FAIR).

Authors: Dan Blum and Laura Voicu
ISACA Journal Article

The Role of Governance in Digital Reporting

In today’s environment, decision-making has become more challenging than ever, and the ability to adapt is vital. The availability of real-time digital reports allows management to form strategies and adjust them to meet changing conditions. The foundation of such decisions...

Author: Rajul Kambli
ISACA Journal Article

Helpsource Q&A

We are a service organization providing IT-based services to customers. Because of containment efforts and stay-at-home orders, most of our personnel are working from home, and only essential support staff who reside near the office are managing support from the office location.

Author: Sunil Bakshi
Blog Post

Ad Threats: What Are They and Why Do They Matter?

Ad fraud has been around for many years, but it’s not the only risk businesses and advertising networks face.

27 August 2020
Blog Post

Become Engaged with the ISACA Community

In addition to ISACA being a top-flight professional global community with great resources for IT professions of all levels, it is a highly collaborative community.

26 August 2020
Blog Post

#IamISACA: Finding Joy in a Varied Career Path

When I was a child, I dreamt of touring the world, seeing new places and meeting new people. Those were the days when my parents could barely afford to send me anywhere beyond our hometown in India, which was in the picturesque state of Goa, some 600 kilometers south of Mumba...

26 August 2020
ISACA Journal Article

Ransomware Response, Safeguards and Countermeasures

It is time to reassess cybersecurity because current efforts to prevent ransomware events are porous and are not fulfilling their purpose. The facts are clear. Ransomware is distributed by a variety of methods, including infected websites, online advertisements and Universal Serial Buses (USBs); direct attacks...

Author: Larry G. Wlosinski
Blog Post

Governance and Innovation Are Not Competitors

I have sometimes heard teams complain that governance is getting in the way of their progress. Usually this is because of out-of-date governance or a misunderstanding by the teams as to what governance is telling them.

25 August 2020
Governance Article

Achieving Operational Excellence Using COBIT 2019

Imagine the last time you went on vacation or a business trip to another city or country. You had a reservation for a rental car, and when you arrived at your destination airport and went to the rental car desk, you saw a lot of people waiting to be assisted.

24 August 2020
Blog Post

In Budget Season, Don’t Forget to Account for Training

With the budget season approaching for many organizations and everyone under a pandemic alert of some sort, it is time to look at what is essential to invest in within your operation’s audit, risk or security department for next year. We know there are always non-negotiable activities and criteria for each budget year.

24 August 2020
Blog Post

Integrating GDPR Into the Threat Intelligence Program

When the EU General Data Protection Regulation (GDPR) went into effect in May 2018, management attention to controls around data breaches—mitigation controls and incident management—became the most important issues that an organization can face based on financial penalties.

21 August 2020
Blog Post

Practical Tips for Managing Privacy Risk

Privacy risk is the likelihood that someone will experience problems resulting from data processing and the impact of these problems should they occur.

20 August 2020
Blog Post

#IamISACA: 400,000 Miles and Counting

I love off-roading. I have traveled all over my country of Brazil and various countries in Latin America in my 1996 Land Rover Defender, which has more than 400,000 miles on it. My trusty Land Rover might not be the fastest or most comfortable...

20 August 2020
Blog Post

#IamISACA: Transforming My Career, One Credential at a Time

My interest in cybersecurity was seeded with the “love letter” computer worm that infected millions of computers in 2000, spreading through emails. People received unsuspecting emails with attachments labeled “I Love You.”

20 August 2020
Blog Post

Using Gamification in Cybersecurity Incident Response Tabletop Exercises

If you are looking for innovative, fun and proven methods of gamification-based learning to apply in organizations that can be used without any restrictions in the development and execution of cybersecurity incident response tabletop exercises (TTEs), Lego Serious Play (LSP) is a worthy choice.

19 August 2020
ISACA Journal Article

Blind Spots for Executives Embarking on a Digital Transformation Program: Managing Risk

In response to declining revenue in one of their customer segments due to changes in market dynamics, a group of executives assembled on a Monday morning to come up with a strategic initiative to counter this problem.

Authors: Chris Ngiba and Mayank Naik
Blog Post

Applied Collection Framework: A Risk-Driven Approach to Cybersecurity Monitoring

Cybersecurity or network security monitoring is incumbent upon organizations through various regulations or laws prevalent in respective countries or regions. The purpose of network security monitoring is to establish and maintain a command and control center that monitors...

18 August 2020
@ISACA Article

Data for Trade

Over the past 2 decades, the Internet has cemented its status as a digital marketplace, making it virtually inevitable that an increasing amount of consumer data will be swapped and even sold. But not all consumers are comfortable with exchanging their data for a service online.

17 August 2020
@ISACA Article

Tips for Scoring or Rating Impact Criteria

Risk management is a forward-looking activity used to reduce uncertainty when making decisions that may impact an enterprise’s ability to meet its strategic objectives. An analysis technique that is useful in improving risk scoring or rating is the development of organization-specific impact criteria. Impact criteria...

17 August 2020
@ISACA Article

ISACAs Audit Program Addresses CCPA Compliance

As expectations for data privacy continue to evolve, auditors are more likely to encounter difficulties when providing assurance for compliance initiatives. Fortunately, in parts of the United States, officials have put together privacy task forces and even enacted legislation...

17 August 2020
@ISACA Article

Recognize Local Service and Chapter Activities With ISACA Awards

ISACA® Chapter Awards recognize outstanding contributions by chapters and individual chapter leaders in fulfilling the needs of ISACA and its professional community. Many ISACA members engage with the organization in their local community through continuing education, certification...

17 August 2020
@ISACA Article

Expert Insights From North America CACS Promote Soft Skills, Career Advancement

The unexpected rise of the COVID-19 pandemic brought live events to a halt. As it became unsafe for event attendees to gather in person, the industry shifted to accommodate online conferences and seminars. To ensure that attendees were still able to learn and network...

17 August 2020
Blog Post

Framing Your Audit Reports in the Language of Business

Of the many excellent resources released by ISACA over the last few years, without doubt one of the more seminal documents is the COBIT 2019 Design Guide. Why? Because it enables IT governance professionals to support the enterprise strategy, the detailed plan for ...

17 August 2020
Blog Post

A Clear and Practical Approach to Risk Assessments

As information security professionals, we conduct risk assessments for companies, projects, new businesses and start-ups, etc. To complete this task, we follow guidelines from trustworthy sources, not limited to online searches, consultancies and security...

14 August 2020
Blog Post

The Quilted Landscape of US Consumer Data Privacy

Consumers are aware of data trade-offs. Creation of a customer account can make online shopping checkout faster; setting up a free social media account can make connecting with others easier. These conveniences are available often in exchange for data that entities use to better...

13 August 2020
Blog Post

IT Governance and the COVID-19 Pandemic

COVID-19 has left a deep impact on society. It still affects the way we live and the way we work. Companies changed their delivery models, and many more people are now working remotely to adhere to new social distancing protocols. No organization was...

12 August 2020
ISACA Journal Article

Incident Response Models

As global regulators start to tentatively embrace the concept of cyberresilience, it is clear that there has been a significant change in the way that cyberattacks are perceived.

Author: Cameron Young
Blog Post

#IamISACA: From Rock Star to Speak Star

Although I play guitar in a band, I’m far from being a “rock star” (well, my mom thinks I’m one), and I don’t think the term “speak star” exists (although it should!) But I decided to title my story this way because the title of an article is like the intro of a song or the name of a presentation: it should catch you from the start.

12 August 2020
Blog Post

#IamISACA: Making Time for What Matters to Me

I was 13 when I decided to become a computer programmer. Before then, I was sure that I would be an electrical engineer, like my father. However, that changed when I saw a TV spot about “Basic programming” on the local TV channel.

12 August 2020
Blog Post

Changing a Risk-Averse Mentality

Caspar Berry is the opening keynote speaker at the GRC Conference 2020, a virtual event to take place 17-19 August. After starting his working life as an actor in BBC drama Byker Grove alongside Ant and Dec, Berry studied economics at Cambridge before making the decision to move to Las Vegas and become a professional poker player.

11 August 2020
Blog Post

How to Prepare for the Digital Hiring Process of the Future

For years we have known when applying for a job that computer software was screening our resumes to determine whether it would make it to the hands of a recruiter. What if I told you that technology now has a more integrated role in the hiring process?

10 August 2020
Governance Article

How to Downsize the Cost of Compliance

The technological developments of the last decades offer organizations many opportunities and possibilities to expand their product portfolio and offer their services in new ways. This requires them to determine how to evolve from paper and manual management to create...

10 August 2020
The Nexus Article

Six Steps to Start Readying for Quantum

On the not-too-distant horizon are quantum computers. They will be capable of so much, including the ability to break the cryptography underlying public key infrastructure (PKI). This creates an unprecedented problem for the encryption and authentication that enterprises put their trust in today.

10 August 2020
The Nexus Article

Stepping Out From the Shadows

As a remote employee and IT professional, the pandemic has only minimally affected my professional life. I wake up each day and go about my routine to provide for my family and, ideally, positively influence the cybersecurity career field, enabling those of you on the frontlines working hard to support your respective enterprises to survive another day in the midst of a dynamic threat environment.

10 August 2020
Blog Post

Local Outreach, Global Impact: ISACA CommunITy Day 2020

So often as a volunteer manager, I hear, “I would like to get more involved, but I am not sure how.” Or “I want to make a difference but do not have much free time.” Now I hear, “How can I participate during a global pandemic?”

7 August 2020
Blog Post

Transforming Your Team: The Value of Group Training

Training is an essential cornerstone of maintaining our ongoing professional relevance. While conferences and webinars should be a staple in any individual or company training repertoire, a perhaps ...

6 August 2020
Blog Post

The Fine Art of Stepping on the Same Rake

For more than half a decade I presented a talk about learning from current events in a “stepping on a rake” series. While the title changed slightly from year to year, the material ...

5 August 2020
Blog Post

#IamISACA: Three Countries and Three Lessons Learned

I originally am from the Philippines and started my career there, working with the biggest telecommunications company in the country. Then I was given a chance to be part of a team of seven Filipinos who were sent to the State of Qatar to build the first certified commercial Security Operations Center (SOC) there.

5 August 2020
ISACA Journal Article

Are Organizations Actually Performing Risk-Based Audits?

Organizations place a strong emphasis on cybersecurity, privacy and compliance. However, many enterprises are uneducated when it comes to identifying, assessing, responding to and monitoring these domains. Auditors provide value in these areas and address these deficiencies via various techniques and approaches.

Author: Blake Curtis
Podcast

Cybersecurity Degrees or Certificates?

When it comes to the ever-expanding field that is cybersecurity, passionate practitioners should adopt the attitude that there is always more to learn.

5 August 2020
Blog Post

Revamped ISACA Awards Program Enhances Prestige and Engagement

As a volunteer on the 2020 ISACA Awards Working Group and past ISACA Michael Cangemi Award recipient, I am excited to help ISACA recognize the incredible contributions our colleagues and organizations make, and the positive impact we, as the global IT community, have on the world.

4 August 2020
@ISACA Article

ISACA Podcast Receives AM&P EXCEL Award for Excellence and Leadership

Launched in 2015, the ISACA Podcast features experts discussing relevant trends in technology. Podcast guests cover topics related to cybersecurity, privacy, audit and governance, applying their unique knowledge and experience to give listeners insights on industry-related topics...

3 August 2020
@ISACA Article

ISACA Awards Program Enhances Global Industry Recognition

In early 2020, the ISACA Awards Working Group, made up of 10 volunteers from around the world, was charged with reviewing the current ISACA Awards portfolio and identifying ways to enhance the program.

3 August 2020
@ISACA Article

Streamline Your Team’s Asset Management Process

As IT environments become increasingly complex, it is more important than ever for teams to practice effective cybersecurity asset management. Yet to many, this topic can be challenging and even frustrating.

3 August 2020
@ISACA Article

The Age of Collaboration and a Distributed Workforce

Like the auditors, evaluators, assessors and certifiers before us, we are now confronted with a new cultural reality brought on by medical concerns. People at risk and people at a lower risk of COVID-19 are changing what they work on, how they work and where they work.

3 August 2020
@ISACA Article

The Evolution of Privacy

The definition of privacy has had many different interpretations in recent years, aligning with the rapid growth of social media, Internet transactions and digital marketing. As a result, even trusted organizations can be susceptible to privacy violations in the form of security breaches...

3 August 2020
Blog Post

Enterprise Risk Summarized Effectively

A risk management process always starts in top-down mode. The enterprise risk management’s (ERM's) long journey begins between methodologies and fears of not achieving business objectives. Roughly speaking, we design a model, define metrics and establish how data are collected.

3 August 2020
Blog Post

Be Prepared and Don’t Panic to Steer Your Career Through Challenging Times

Imagine you’re driving down the highway and, all of a sudden, your hood flies open, blinding your view of the road. What is the first thing you should do?

31 July 2020
Blog Post

Culture as a Corporate Asset

Culture is described as the sum of the shared assumptions, values and beliefs that create the unique character of an organization. Culture, if managed well, can deliver value to stakeholders through the behavior and actions of employees.

30 July 2020
Blog Post

#IamISACA: Overcoming Challenges By Always Learning New Things

I have faced many challenges in my career in project management when implementing technology projects, including the last couple of years working on implementations of cybersecurity frameworks, standards and regulatory requirements to achieve good IT governance.

30 July 2020
Blog Post

Internal Audit Evolution by Unnatural Selection

I get it. You feel like the world is moving at a faster pace. Blockchain teases with the potential of revolutionizing the financial world. Artificial intelligence technologies are expected to be as ubiquitous as electricity, helping us with many decisions and making predictions.

29 July 2020
ISACA Journal Article

Using Gamification to Improve the Security Awareness of Users: The Security Awareness Escape Room

It is vital that organizations take action to improve security awareness. Threat reports increasingly acknowledge and predict attacks connected to the human factor (e.g., ransomware, fake news). Employees pose a high-level risk at all enterprises because it is generally known that they are the weakest link in the chain of information security.

Author: Eszter Diána Oroszi
Podcast

Creating Value by Taking Risks and Overcoming Fear of Failure

The thought of taking a risk can dredge up feelings of discomfort or even outright fear for many. This reluctance has only been amplified by the uncertainty stemming from the COVID-19 pandemic.

29 July 2020
Blog Post

Digital Transformation and Human Error

There was a time back in 2016/2017 when the whole world seemed abuzz with news that robots were about to take over the world, an outcome that would leave many of us humans...

28 July 2020
Blog Post

Controlling the Cloud

The cloud has been and continues to be an important enabling technology for many, both professionally and socially, during the COVID-19 pandemic. We have built a virtual world and now we are putting...

27 July 2020
Governance Article

Effective Capability and Maturity Assessment Using COBIT 2019

COBIT provides guidance to assist enterprises in making key governance system design decisions to successfully achieve enterprise goals and objectives. This is accomplished by focusing on objectives specific to both the governance and management components of a governance system. Organizations vary in how they approach, design and define the parameters for how governance and management operate within an enterprise.

27 July 2020
Blog Post

The Bedrock of a Post-COVID-19 Security Operations Center

Given the profound impact of COVID-19, a constantly evolving threat landscape, constraints of operating a Security Operations Center (SOC) remotely, increased remote workforce, disparate managed and unmanaged endpoints, an avalanche of phishing, malicious campaigns masquerading in the name of COVID-19...

24 July 2020
Blog Post

Carrying Forward John Lainhart’s COBIT Legacy

Back in late 2018, a small group of COBIT enthusiasts were set to meet at ISACA Global in Schaumburg, Illinois, USA, to commence work on what an information security offering for the latest version of COBIT would look like. We were to be led by my dear friend, mentor and one of the founding fathers of COBIT back in 1995, John Lainhart.

23 July 2020
Blog Post

#IamISACA: Feminism and Food Make Me Who I Am

Going back to my childhood, I have always been interested in feminism, and that has only grown stronger as an adult. I am always eager to talk about it and explain when someone does not understand issues related to inequality. To me, feminism is not just about women's rights...

23 July 2020
Blog Post

Quick Questions for IoT Manufacturers

Despite good intentions from the manufacturing community to improve security, the decision of whether and how security is implemented always comes down to economics.

22 July 2020
ISACA Journal Article

Impact of GDPR on Threat Intelligence Programs

The EU General Data Protection Regulation (GDPR) plays a part in enterprises’ overall strategies and, more specifically, in their collection and use of threat intelligence. In particular, it impacts enterprises’ security and privacy strategies for current and planned projects.

Author: Larry Marks
Blog Post

ISACA Foundation: Leveling the Playing Field in the Digital World

Just to give a little history, it was about four or five years ago that ISACA brought together a number of women leaders to talk about the underrepresentation of women in the tech space, and as we started those conversations and we developed a program – it started off as something different, but it eventually became what we know today as SheLeadsTech.

21 July 2020
@ISACA Article

ISACA’s Commitment to Bridging the Digital Divide

ISACA is excited to announce the launch of One In Tech, an ISACA Foundation and nonprofit dedicated to ensuring a healthy digital world for all. Over the past year, ISACA has worked to develop One In Tech as a philanthropic entity...

20 July 2020
@ISACA Article

Governing the New Perimeter: Cloud IAM

Without strong identity and access management (IAM) governance, organizations are more susceptible to dangerous security incidents such as data breaches. Leveraging cloud IAM reduces this risk, enabling organizations to assess improper permission combinations...

20 July 2020
@ISACA Article

Making the Most of ISACA Member Benefits

ISACA is always working to strengthen member benefit offerings. As part of the Member Advantage Savings program, ISACA recently partnered with Clements to offer insurance solutions to members in more than 170 countries.

20 July 2020
@ISACA Article

The AIC Myth

When I joined a banking and finance company as chief information security officer (CISO), I was focused on using the availability, integrity and confidentiality (AIC) triad to secure information.

20 July 2020
@ISACA Article

Build Efficiency Into Your Information Security Governance and Management

Information security breaches can expose an organization to compliance risk, cause harm to customer relationships and result in financial or operational damages. This makes good information security governance and management practices critical to the success of every organization.

20 July 2020
@ISACA Article

#IamISACA: Why I Love to Learn

For me, the pursuit of lifelong learning is not just about gaining the knowledge I need, it is about enjoying the learning process itself. My experience with ISACA has made it even easier to love learning.

20 July 2020
Blog Post

The Twitter Hack: How Did They Do It?

On 15 July, Twitter was hacked in an epic way. One-by-one, a number of accounts were targeted and compromised, including verified accounts of famous users including Elon Musk, Bill Gates, Barack Obama, Kanye West and Joe Biden, and a number of Twitter accounts...

20 July 2020
Blog Post

What Is the Difference Between Requirements and Controls?

Practically speaking, there tends to be a great deal of confusion around the topics of requirements vs. controls. We are all very familiar with the various marketing strategies for complying with the US National Institute of Standards and Technology (NIST), Payment Card Industry...

17 July 2020
Blog Post

#IamISACA: A Toast to Work-Life Balance

Long before I became an IT management professional or a wine aficionado, I dreamed of being an engineer. Machines and computers were all I could think of as a kid, and understanding the logic behind them was my passion for a long time. I studied software engineering...

16 July 2020
Blog Post

#IamISACA: Adapting to Change

I started my career in the finance department during a time when manual accounting systems were mostly used. My true passion since childhood, however, was in IT. I read IT books about programming and networking in my leisure time and started taking courses step by step...

16 July 2020
ISACA Journal Article

Securing and Embracing Infrastructure as Code

Recent advances in computing technology have empowered IT professionals to increasingly rely on abstraction, freeing them from the burden of managing infrastructure and allowing them to focus their energies on delivering quality software as fast as possible.

Author: Taimur Ijlal
Blog Post

Tailoring Enterprise Information Security Training and Awareness for Remote Working

The ongoing COVID-19 outbreak has compelled most organizations to roll out work from home arrangements. In the changed times, work no longer means being inside the office facing your computer. The increase in at-home working also puts organizations at a greater risk of cyber-attacks because home networks are generally not as securely configured...

14 July 2020
Blog Post

Data Ownership Questions in Light of COVID-19

What was clear when writing my recent Journal article, “Data Rights: Single vs. Multiple Ownership?,” is the knowledge that data ownership rights, data source and data quality are unquestionably critical to any data analytics and visualization, at least to a reasonable person...

13 July 2020
Governance Article

COBIT 2019 and the IIA 2019 Guiding Principles of Corporate Governance

2019 was a very productive year for corporate governance. ISACA completed the publication of COBIT 2019, a master framework internationally recognized for the governance and management of enterprise information and technology...

13 July 2020
The Nexus Article

Ignoring Indiscernible Threats Is No Longer an Option

Why have many internal audit (IA) functions failed to drive the type of value stakeholders expect? The question provokes varying responses. Assertions that IA frequently raises in its defense are...

13 July 2020
Blog Post

How the CSX-P Certification Has Bolstered My Credibility in Audit

As an IT or systems auditor, my job is all about assessing and testing controls designed and in place to protect the company’s treasure trove of information. In my case, health insurance claims data of our members is the Holy Grail to be protected. When I go into an audit, my credibility sets the tone for an open and honest dialogue throughout the engagement.

10 July 2020
Blog Post

Beware, Coronavirus-Themed Ransomware is Here

It’s important to recognize how essential grocery stores, hospitals, clinics and supply chain organizations are in light of COVID-19, and it’s equally important to recognize technology as their critical infrastructure. Without it, countless organizations would be left inept, disorganized and overwhelmed.

9 July 2020
Blog Post

#IamISACA: Building an IT Audit Community From the Bottom Up

I started work at the State Audit Office (SAO) of Georgia in late 2013 as an intern. At that time, SAO had no IT audit function, but one was needed to keep up with the government due to rapid development of government electronic systems. I was tasked to learn more about IT audit and build a qualified team.

8 July 2020
Blog Post

#IamISACA: Satisfaction Through Volunteering

Life is all about tackling and winning over challenges that come your way. In that spirit, I want to share some of my experiences with ISACA (mostly with the Chennai, India Chapter) and from my personal life – and how these two became connected.

8 July 2020
ISACA Journal Article

Essential Functions of a Cybersecurity Program

No matter the size of an organization, every organization that depends on information technology to conduct any part of its business should have a functioning cybersecurity program.

Author: Steve Akridge
Blog Post

Leveraging Cybersecurity to Increase Diversity, Equity and Inclusion

As an industry, cybersecurity has always been challenged by a shortage of supply when it comes to talent. This is further complicated by a lack of diversity, an issue that when addressed well has always proven to deliver stronger teams and better results.

7 July 2020
Blog Post

Seven Ways AI is Improving the Job Market – Not Killing It

Artificial intelligence is not a thing of the future anymore. We live in a world where AI is working diligently in the shadows of every major industry. The industrial revolution of the past built the world we are enjoying today, and it was done using the strength...

6 July 2020
@ISACA Article

Congratulations, 2020 ISACA Award Recipients

ISACA is thrilled to recognize the 2020 ISACA Award recipients for their thought leadership and volunteer service. Although COVID-19 challenges have altered the presentation schedule in 2020, the individuals and chapters who have committed to advancing ISACA and the business technology community deserve recognition.

6 July 2020
@ISACA Article

Balance Circumstances With Safety Using Risk IT Materials

Managing business, IT and cybersecurity risk is vital for the success of any organization, especially during the uncertain age of the COVID-19 pandemic. Executives and managers must consider circumstances, security, hazards and even opportunities, all through the lens of risk.

6 July 2020
@ISACA Article

Five Key Considerations When Securing a Work-from-Home Workforce

Recent events have forced many organizations to require their workforces to operate from their homes. For some employees, this is nothing new, but for those who regularly interact with high-risk and controlled data and systems...

6 July 2020
@ISACA Article

Protecting the Integrity of ISACA Certifications

For more than 40 years, ISACA certifications have had a globally recognized reputation for being relevant, valuable and credible. This reputation has benefited certification holders around the globe, and ISACA makes every effort to protect the integrity of its certifications and those who have earned them.

6 July 2020
@ISACA Article

Getting Ahead With CISM

When Omar J. Alarcon traveled overseas to Australia with more than 10 years of professional experience, the competitive job market he found left him motivated to enhance his certifications.

6 July 2020
Blog Post

Preserving Privacy in Video Analytics Solutions in Smarter Cities

Video analytics in smarter cities pose a challenge for security and privacy professionals that are focused on preserving the privacy of the public, while balancing their organization’s desire to utilize information. As with all analytics, these principles come with competing needs.

2 July 2020
Blog Post

#IamISACA: Carrying on My Father’s Volunteering Legacy

After voting precincts began relying upon computers, my father stopped volunteering as an election worker. That’s right about when he passed the torch to me and I signed up.

1 July 2020
Blog Post

#IamISACA: Embracing Cross-Cultural Connections

I worked for a company a long time ago that sent us to a training about cultural differences between the US and UK. Most of our senior managers were in the UK or in the U.S. and we thought, we both speak English so why can’t we communicate?

1 July 2020
ISACA Journal Article

Deploying a Data Security Defense

Maintaining data security has become more challenging in recent years. Many countries have passed and adopted comprehensive laws dealing with this issue, and others are debating the necessity of doing so.

Author: Jason Jiao
Blog Post

Becoming the Boss: Guidance for New Supervisors in an Era of Remote Work

Emily Tsitrian, senior manager of professional services at Castlight Health, presented last week at the Pride Summit in her session, “Boss Up! How to Become the Boss.” Tsitrian visited with ISACA Now following her session to share some of her guidance on transitioning to becoming a supervisor, especially in current times in which remote work has become increasingly commonplace.

30 June 2020
ISACA Journal Article

Information Security Matters: Privacy by Implementation and Execution

When I was in graduate school, I read a lot of scholarly journals. (None of them were as lively nor as useful as the journal you are now reading.) One of the features I loved best was a rousing argument between academics about matters of miniscule interest to the general public.

Author: Steven J. Ross
ISACA Journal Article

Connecting Good Governance With Key Risk

During the COVID-19 pandemic, many enterprises have stated that employee health and well-being are their primary concern. The events of 2020 have also led organizations to evaluate their preparedness for and responses to another major risk factor...

Author: Kevin M. Alvero
ISACA Journal Article

Privacy Risk Management

Concerns about privacy risk have triggered a number of new privacy protection regulations: The US State of California Consumer Privacy Act (CCPA) went into effect on 1 January 2020, the Brazilian General Data Protection Law (LGPD) becomes effective in August 2020...

Author: Andrea Tang
ISACA Journal Article

Digital Governance: Closing the Digital Strategy Execution Gap

Never before has there been such an intense focus on digital as during the COVID-19 pandemic. This has been especially true for the business continuity management (BCM) efforts needed to provide work-from-home functionality to support social distancing.

Author: Guy Pearce and Tony Gaffney
ISACA Journal Article

IS Audit Basics: Enhancing the IT Audit Report Using COBIT 2019

Earlier this year, I authored a column on the “Components of an IT Audit Report.” These components need to provide assurance, inform auditees and others of management and control issues, recommend corrective action, and represent the quality of the audit and the credibility of the audit organization.

Author: Ian Cooke
ISACA Journal Article

The Bleeding Edge: Nothing but Blue Skies—Virtualizing Humanity

I have been a remote worker for approximately five years. The transition was not an easy one. However, in the past two years I have come to a very “Zen” place in my work-from-home routine…or lack thereof.

Author: Dustin Brewer
ISACA Journal Article

The Network: Responding to a Changing Business Landscape

Tracey Dedrick is a C-suite executive experienced in risk, compliance, treasury and investor relations. She was executive vice president (EVP) and head of enterprise risk management for Santander Holdings US, where she was responsible for enterprise risk, operational risk and market risk for the Americas.

Author: Tracey Dedrick
ISACA Journal Article

Innovation Governance: Governance for Better Innovation

Leadership expert and former US Navy SEAL Jocko Willink wrote the following, “And most important, discipline will put you on the path to FREEDOM.” What does this have to do with innovation? Everything, as it turns out.

Author: K. Brian Kelley
ISACA Journal Article

Case Study: Building an Enterprise Security Program

Mercury NZ, a US$2 billion renewable energy generation and retail company, has the most NZ Stock Exchange shareholders of any New Zealand company, serving more than 373,000 residential, commercial, industrial and spot customers across New Zealand.

Author: Katie Teitler
ISACA Journal Article

Cybersecurity Incident Response: Tabletop Exercises Using the Lego Serious Play Method

It is foolish to wait until an enterprise is in the midst of a data breach to test its cybersecurity incident response plan (CSIRP). How likely is it that the enterprise will know that a cyberattack is underway and be able to react appropriately?

Author: Fabian Garzón
ISACA Journal Article

Helpsource Q&A

With the proliferation of cloud computing services available, our organization is considering moving IT-related services to cloudbased services. What are the benefits and risk associated with using cloud services? What steps should we follow when selecting a cloud service provider (CSP)?

Author: Sunil Bakshi
Podcast

Framework Overload

Cybersecurity frameworks can be a valuable tool for organizations, helping them implement best practices and establish documentation for complex processes.

30 June 2020
Governance Article

The Value of IT Governance

Ineffective governance has a substantial impact on business alignment and risk management. Misalignment can result in improper identification of sensitive data, critical services and substandard security controls.

29 June 2020
Blog Post

Open-Minded Approaches to Addressing the Cybersecurity Skills Gap

It is more important than ever that organizations become creative in their approaches to addressing under-resourced security staffs. If you look at ISACA’s State of Cybersecurity 2020 report, which predates COVID-19, 62% of companies are understaffed and 57% have unfilled security positions.

26 June 2020
Blog Post

Risk IT Revitalized

I had the privilege of being on the task force that created the original version of ISACA’s Risk IT Framework several years ago. At the time, I felt Risk IT was an important contribution to the profession...

25 June 2020
Blog Post

#IamISACA: IT Leader By Day, Belly Dancer By Night

I took up belly dancing at the same time I started preparing for my CISA exam 16 years ago. It is great exercise, and concentrating on the music and the movements takes my mind completely off the problems and stressful decisions that I face in my daily work as the leader of a big team of highly skilled IT auditors.

24 June 2020
Blog Post

#IamISACA: Never Too Late to Start a New Dream

In 1984, when I was 16 years old, I had the opportunity to take computer science as an additional school subject. The classes were presented after regular school hours, and this opportunity opened up the new world of computers to me.

24 June 2020
Blog Post

NIST and COBIT: Working in Harmony for More Reliable and Secure Technology

The events of 2020 have shown us, more than ever before, how profoundly circumstances can change, seemingly in a moment. Information and technology are constantly on the move, and we have seen technology revolutions on every front, from mobile devices to changing office environments – even in our spacecraft!

24 June 2020
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 4: Risk Executive Summary

Everyone involved in the enterprise risk management process has probably had to summarize their work and condense a great deal of information into a short presentation. In doing so, it is often necessary to highlight some information at the expense of other information...

Author: Luigi Sbriz
Blog Post

COVID-19 Underscores Value of Resilient Supply Chains

My supply chain focus started when I was the vice president controller for a shoe retailer in the US, and we were hit with an unexpected new tariff on our Chinese products for a piece of metal that was used to keep the holes in place for shoelaces to go through.

23 June 2020
@ISACA Article

Understanding the Science of Risk Management

Every decision an enterprise makes requires thoughtful balancing of circumstances, security, hazards and opportunities, all of which are components of risk. ISACA has updated The Risk IT Framework and Risk IT Practitioner Guide...

22 June 2020
@ISACA Article

Managing Privacy Risk and Expectations

As privacy regulations expand around the world and the emphasis on privacy increases, it is more important than ever for organizations to protect their customers’ privacy. But when a privacy violation occurs in 1 country and affects someone in a different country...

22 June 2020
@ISACA Article

Build NIST Knowledge With COBIT 2019

Learn to combine cybersecurity standards and enterprise governance of information and technology (EGIT) by participating in ISACA’s Implementing NIST Cybersecurity Framework Using COBIT 2019 Training and Certificate Program.

22 June 2020
@ISACA Article

The Rising Security Risk and Mitigation Options for IoT Devices

In our world today, there are more smart devices than there are people. Many people could not make it through a modern workday without using a connected device. A growing number of people are connected to the Internet in one way or another, 24 hours a day.

22 June 2020
@ISACA Article

Ensuring Business Continuity During a Pandemic

The COVID-19 pandemic has forced many businesses to pivot dramatically or risk devastating losses, possibly even closure. As a result, business continuity management has been evolving drastically.

22 June 2020
@ISACA Article

ISACA Buyers’ Guide Connects Members to Products They Need

To connect members to products and solutions that benefit their organizations, ISACA has launched the new ISACA Connect buyers’ guide. Users can access ISACA Connect to research products and services before making a purchase.

22 June 2020
Blog Post

The Importance of Privacy-Focused Monitoring In Light of COVID-19 Work Disruption

The COVID-19 pandemic has increased the already-robust adoption rates for employee monitoring software. Prominent publications, including The Washington Post and The New York Times, have reported on this trend, and they have documented employees’ general unease about the practice.

22 June 2020
Blog Post

Harnessing the Power of Technology in the Fight Against COVID-19

The turn of a new decade has brought an interesting twist to the old debate on the pros and cons of technology. The unprecedented coronavirus pandemic (hereafter referred to as COVID-19 or the pandemic) has not only exposed the fragility of humanity but also a spiral of challenges that may affect our interconnected world for years to come.

19 June 2020
Blog Post

Understanding the Human Side of Cybersecurity

Dr. Jessica Barker, the closing keynoter speaker at ISACA’s EuroCACS 2020 conference, to take place 28-30 October in Helsinski, Finland, is a leader in the human nature of cybersecurity. She has been named one of the top 20 most influential women in cybersecurity in the UK and in 2017 she was awarded as one of the UK’s Tech Women 50.

18 June 2020
Blog Post

#IamISACA: Becoming Richer Through Travel

When Norway decided to go into lockdown for COVID-19, I was actually sitting in Singapore, preparing to travel to the island countries of Palau and Micronesia, where I had lined up a couple of weeks of diving the reefs and chatting up the locals.

17 June 2020
Blog Post

#IamISACA: Hitting Reset in the Back Garden

Due to the blending of home and work life, and especially with the need to educate my three sons from home during the COVID-19 pandemic, it has been harder to ensure some sort of separation at the end of a work day.

17 June 2020
ISACA Journal Article

A Fintech Risk Assessment Model

The financial technology, or “fintech,” revolution is happening right now. Mobile payments are changing consumer spending habits, online brokerage services are creating opportunities to make investments from home, financial chatbots are advising individuals about new...

Author: Luis Emilio Alvarez-Dionisi
Blog Post

Privacy by Design—Opinions Matter

In response to the global health emergency and, after much national soul-searching, the Irish government reluctantly decided to cancel this year’s Leaving Certificate, the set of final exams that a student takes in secondary school here in Ireland.

16 June 2020
Blog Post

Nonsense Compliance

A project manager just completed a cybersecurity project on time and on budget. He schedules the last meeting with his sponsor, the chief information security officer (CISO). While plugging in the beamer for his final presentation, he thinks back at those frenzied few weeks he went through and sighs in relief.

15 June 2020
Governance Article

Communicating the Value of IT Governance

A network patch management tool to be procured is often seen mainly as an expense by the finance department and, therefore, queried subjectively or even rejected.

15 June 2020
Blog Post

Leveraging AI to Provide Better IT Service Management Using COBIT

I started my own Watson Assistant project last year. This was after I was informed of how successful IBM’s help desk, which is based on Watson Assistant, was. As an assurance specialist, I naturally decided to work on something along the same lines.

12 June 2020
Blog Post

#IamISACA: Defying Assumptions and Embracing Opportunities

My introduction to ISACA came in 2013 when I hired Emil D’Angelo out of retirement to help me bring information security up to regulatory acceptable levels at the bank where we worked. A lot of you will know Emil as a past ISACA board chair and a very active and passionate member of the ISACA family.

11 June 2020
Podcast

Protecting the Privacy of Our Digital Selves

As the role of technology has expanded, so has the amount of personal data that are being shared. While people want to protect their privacy, there is often a tradeoff between being able to use a service and not sharing data about yourself.

11 June 2020
Blog Post

Digital Businesses Need Tailored Security Solutions and Services

Many enterprises prefer to outsource their IT security and believe their cybersecurity operations will be managed well. Typical security device management services that are offered by leading managed security service providers (MSSPs) are broadly categorized into the below clusters...

10 June 2020
ISACA Journal Article

The Impact of Poor IT Audit Planning and Mitigating Audit Risk

IT auditors provide reasonable assurance that business processes and their supporting technology are secure and comply with enterprise policies, standards, and applicable statutory and regulatory mandates.

Author: Blake Curtis
Blog Post

Achieving Proper Risk Communication

The goal of communication is multifaceted. It is typically expressed as one or more of the following: to inform, to persuade, to request and/or to build relationships.

9 June 2020
@ISACA Article

Why Patching Is Not Permanent

Misconfigurations lead to exposed data and can introduce as much risk as unpatched vulnerabilities, if not more. Patching helps reduce the attack surface, especially for the OS. But what about databases?

8 June 2020
@ISACA Article

Good Risk or Bad Risk?

It is universally understood, at least in theory if not in practice, that life involves risk. Every action we take has some consequence that we, as adults, are conditioned to understand.

8 June 2020
@ISACA Article

Updated CGEIT Job Practice Reflects New Trends and Technologies

As the IT landscape continues to evolve as a result of innovation and new technologies, it is more important than ever for practitioners to stay abreast of up-to-date information.

8 June 2020
@ISACA Article

ISACA Research Report Evaluates Threat Landscape and Security Practices

As new security practices are implemented due to the spike in remote work caused by COVID-19, data and information are more critical than ever, especially related to cybersecurity performance.

8 June 2020
@ISACA Article

Keep Third-Party Relationships Effective and Efficient

Organizations rely on third parties to be effective. Yet third parties have access to your networks, host your data, manage transactions on your behalf and possess sensitive information.

8 June 2020
@ISACA Article

CISA Holders Keep Up With the Industry

Dusan Zikic started his career as an IT auditor 8 years ago, after graduating from college. He was influenced by 3 mentors who had a positive impact on his professional and personal development and introduced him to ISACA certification...

8 June 2020
Blog Post

What Background Makes a Good DPO?

The enactment of the EU General Data Protection Regulation (GDPR) formalized the role of the Data Protection Officer (DPO) role to ensure there was senior leader in the organization who was responsible and accountable for driving the privacy program and upholding the rights of data subjects and their data.

8 June 2020
The Nexus Article

Hacking the Experience Requirement

In April 2020, I penned a column titled “Qualifying the Skills Gap” which arose from ISACA’s findings in the State of Cybersecurity 2020, Part 1: Global Update on Workforce Efforts and Resources report and discussed the need to dissect the skills gap.

8 June 2020
The Nexus Article

Is Your Security Scalable?

The ability to scale infrastructure and systems to match growth rates, increased workloads, market demands and spikes is critical. This has been tested in recent months with the hyper growth of video conferencing platforms such as Zoom and online shopping...

8 June 2020
Blog Post

COVID-19 Response Still Needs Data-driven Decisions

Effectively gathering, using, storing and archiving data have become major concerns in all industries. Timely and trustworthy data are critical for effective decision-making since the new coronavirus continues to spread.

5 June 2020
Blog Post

Disruptive Technology and the Role of the Auditor

Heraclitus said, “The only thing that is constant is change.” This reflects on today’s ever-changing world with disruptive technologies overturning the way organizations were traditionally run.

4 June 2020
Blog Post

#IamISACA: From ISACA to Fly Fishing, I’m All In

I’m not the type to do something half-way. When I take an interest in something, I dive in deep, try to learn all I can and be the best I can be.

3 June 2020
Blog Post

#IamISACA: Playing the Long Game and Making a Difference

Many people have a galvanizing moment when they are certain about their career goals. That definitely isn’t what my path in cybersecurity looks like. In fact, I originally majored in vocal performance, but decided after two years of study that my career outlook as an opera theater performer didn’t meet my goals for a stable career and family.

3 June 2020
ISACA Journal Article

Security for Internet of Things Device Manufacturers

The Internet of Things (IoT) has introduced new security risk factors that are unprecedented in scope and scale. Although the recommendations presented here are intended for IoT manufacturers...

Author: Welland Chu
Blog Post

CCPA’s Impact on Encryption

The California Consumer Privacy Act (CCPA) is having an impact on the security professionals, auditors, managers and boards responsible for ensuring its effective implementation.

2 June 2020
Blog Post

Driving True Empowerment for Security Teams

Traditional wisdom tells us that organizational commitment is important to the practice of security. Meaning, for an organization to establish and maintain a robust security posture, the organization needs to have what COBIT refers to as the right “tone at the top” – in this case, one that engenders and facilitates security.

1 June 2020
Governance Article

Evaluating Business Service Continuity and Availability Using COBIT 2019

COBIT 2019’s enterprise goal EG06 Business service continuity and availability must be foremost in everyone’s mind today due the ongoing pandemic situation. It is important to identify the critical components that need to be evaluated to assess the preparedness of an organization toward business service continuity and availability.

1 June 2020
Blog Post

Sizing Up COVID-19's Impact on Security Professionals and Their Organizations

Sizing Up COVID-19's Impact on Security Professionals and Their Organizations

29 May 2020
Blog Post

On Respect for the Individual and the Individual’s Data

Google’s holding company, Alphabet, has been investing in its Verily Life Sciences initiative over the last seven years with the aim of revolutionizing healthcare.

28 May 2020
Blog Post

Building a High-Value Cyber Resilience Strategy: Five Essential Tips

The idea of cyber resilience remains a distant dream for many enterprises. Faced with a barrage of high-profile data breaches, most impacting highly respected organizations, some business leaders now harbor deep-seated beliefs that cyber threat actors are undeterrable and cyber resilience...

27 May 2020
Blog Post

#IamISACA: A Gateway to Amazing People and Lasting Relationships

The thing that always amazes me the most about working so closely with our global community is how alike we all are. When you get the amazing opportunity to see people from every country imaginable working alongside one another...

27 May 2020
ISACA Journal Article

Risk Management Strength and Financial Disclosure Quality

Enterprises are increasingly incorporating risk management functions into their operations. This is usually accomplished by establishing a board-level risk committee, hiring a chief risk officer (CRO) or both.

Authors: Cristina Bailey and Joshua J. Filzen
@ISACA Article

An Introduction to Assessing the Compliance Risk of RPA-Enabled Processes

Robotic process automation (RPA)-enabled environments are quite different from traditional environments supported by the core application’s manual processes and their normal automated application controls.

26 May 2020
@ISACA Article

Connecting Cybersecurity and Remote Work

The COVID-19 pandemic has resulted in many organizations shifting to an entirely remote workforce. Remote work better enables people to stay safe while doing their jobs, but being out of the office does present some cybersecurity concerns.

26 May 2020
@ISACA Article

Put an End to Security Attacks by Thinking Like a Hacker

The MITRE ATT&CK Framework is a comprehensive, up-to-date knowledge base of cyberattacker tactics and techniques gathered from actual observation of attacker behavior.

26 May 2020
@ISACA Article

ISACA Research Report Gives a Global Look at Privacy in 2020

Privacy protection and compliance are vital for any organization to thrive, but it can be challenging to identify and understand privacy obligations.

26 May 2020
@ISACA Article

Adapting to Challenging Times With Security Automation

Security attacks are becoming increasingly sophisticated and are growing more aggressive as the pandemic crisis has caused employees to adapt to new methods of working.

26 May 2020
Blog Post

Employing Privacy Frameworks in Uncertain Times

The current global crisis is disrupting and disabling many core business functions. For many, in-office work has transitioned to remote work, requiring virtual conferencing tools and the sharing of sensitive information with a dispersed workforce.

21 May 2020
Blog Post

RA(CI) Light

For decades, IT practitioners have made use of RACI charts. You’ve seen them, those grids that assign roles to tasks or practices. COBIT has had RACI charts in several versions and continues to make use of them in COBIT 2019.

21 May 2020
Blog Post

A Global Pandemic: Cyber Threats and Remote Employees

COVID-19 changed the lives of nearly everyone in the world in a matter of weeks. From work life to home life, essentially every aspect has been altered in some way.

20 May 2020
Blog Post

#IamISACA: Pursuing Clarity of Thought in a Cluttered World

In the frenetic pace of life, it is important that at times we just stop and take a deep breath, clear the mind and refocus our energies on what is important. Being a spouse, parent, volunteer and professional are all important aspects of my life that demand attention and devotion.

20 May 2020
Blog Post

#IamISACA: Why Mentoring Women in Cybersecurity Matters to Me

My experience as a mentor in a career comeback program for Malaysian women who want to return to the cybersecurity workforce has been very meaningful to me.

20 May 2020
ISACA Journal Article

A Decision Tree to Objectively Determine Policy Compliance

Assuring compliance with policies and regulations is a major stake for organizations that invest significant time and money to avoid the consequences and penalties of noncompliance. Yet answering the simple question of compliance with a policy is more complex than it looks.

Author: David Doret
Blog Post

How I Passed the CISM Exam on the First Attempt

In March 2019, I passed ISACA’s CRISC exam and became certified the next month. This achievement motivated me to pursue another ISACA certification – the Certified Information Security Manager (CISM).

19 May 2020
Blog Post

Don’t Get Caught Without Good Governance When the Tide Goes Out

In my many weeks of working from home recently due to the COVID-19 pandemic, I’ve been on regular peer group calls listening to the challenges that my colleagues have dealt with in getting their companies situated to effectively work remotely.

18 May 2020
Governance Article

Brainstorms and Commentary for Using COBIT

This is an exercise in providing creative brainstorm references for using COBIT content to support digital business governance and management activities. It is important to keep in mind that COBIT is a reference model to be used as you see fit. It is the user’s choice as to how to use it—a little or a lot, for comparison or as reference.

18 May 2020
Blog Post

Industry 4.0: Future-Proofing Your Career

A panel of cybersecurity, audit, emerging technologies and governance experts shared their perspectives and advice Wednesday at ISACA’s first virtual conference as part of North America CACS 2020.

15 May 2020
Blog Post

Using Network Segmentation to Combat Ransomware

In the latest ISACA Journal issue, we published a two-part article titled “Avoid Having to Run Somewhere from Ransomware.” The article included a deep dive on what ransomware is, how it infiltrates most systems, our suggestions for the top 10 ways to...

14 May 2020
Podcast

Privacy Expectations and Regulatory Complexities

With the growing number of privacy regulations around the world and the growing emphasis on privacy, organizations must protect their customers’ privacy. But what happens when a privacy violation occurs in one country but affects someone in a different country...

14 May 2020
Blog Post

#IamISACA: Defining Our Success Metrics

Do you believe that where we come from helps us shape our own success? Personally, I do. Actually, I think this has a great deal of impact on what we are able to achieve in life.

13 May 2020
ISACA Journal Article

Practical Data Security and Privacy for GDPR and CCPA

With sensitive data residing everywhere and the breach epidemic growing, the need for advanced data security solutions has become even more critical. Compliance with regulations such as the EU General Data Protection Regulation...

Author: Ulf Mattsson
Blog Post

Managing Risk in a Pandemic: Novel Today, Standard Practices Tomorrow

COVID-19, a novel coronavirus, has come as a shock to many across the globe, changing practically every aspect of our functioning daily lives.

12 May 2020
@ISACA Article

Information Systems in the Time of Pandemic

Protecting sensitive data is critical to everyday operations, but rare events such as the recent outbreak of the novel coronavirus can cause organizations to face unique technological challenges.

11 May 2020
@ISACA Article

A Rise in Collaboration Between Internal Audit and IT Is a Welcome Trend

In October 2019, Protiviti and ISACA released the 2019 Global IT Audit Benchmarking Study, for which more than 2,200 internal audit (IA) executives and professionals around the world were surveyed.

11 May 2020
@ISACA Article

CISA Offers Success Across Disciplines

Anamika Roy loves that every day at her job is so different and, though it can be challenging, she gets to see and learn from so many different clients. Ever-changing technology and processes can sometimes present challenges, but that is exactly why Roy finds it so rewarding.

11 May 2020
@ISACA Article

Cyberhygiene: Going Beyond Dos and Don’ts

The recent barrage of coronavirus advisories by various authorities all have one recommendation in common: maintain personal hygiene until a treatment becomes available. This maxim is true for information security as well.

11 May 2020
@ISACA Article

ISACA Journal Excerpt: How One Organization Is Managing and Evaluating Risk

Rock Holdings, Inc., is a US-based holding company which owns several subsidiary companies including Quicken Loans, the US’s largest mortgage lender.

11 May 2020
@ISACA Article

ISACA Updates CGEIT Certification Exam Content

As the technology environment continues to evolve, it is more important than ever that professionals have the knowledge and skills to strengthen governance at their organizations.

11 May 2020
The Nexus Article

Identifying APTs Through Healthy Network Testing

Cybersecurity threats are often perceived as obviously and immediately disruptive to an organization’s operations. But more subtle threats can be equally debilitating.

11 May 2020
Blog Post

As Telehealth Becomes Common, Security Considerations Increasingly Important

The COVID-19 pandemic has changed almost every aspect of our daily lives. What we’re seeing in healthcare today is unprecedented.

8 May 2020
Blog Post

#IamISACA: Finding Mentors Who Value You

Throughout my career, I have had a couple managers whom I consider my mentors. One mentor I had is the one who brought me into security. I was a programmer when she approached me one day and asked if I wanted to join her security test team, doing pen testing.

7 May 2020
Blog Post

#IamISACA: Making Lifelong Friends Through Volunteering

I first became interested in volunteering at ISACA in 1999 when then-London Chapter President Gerry Penfold asked me to update and run the chapter website.

7 May 2020
Blog Post

From “Meh” to an EPIC Career in Cybersecurity

If you’ve selected IT as a profession, then you’ve chosen life-long learning as a discipline. Like so many STEM fields, the rate of change and advancement in technology is awe-inspiring. And if you hold or aspire to a leadership position in the cybersecurity profession, then the phenomenon of impostor syndrome comes with the territory.

6 May 2020
ISACA Journal Article

Data Rights: Single vs. Multiple Ownership?

Organizations that are interested in accurate and dependable decision support systems; accurate metrics; descriptive, predictive and prescriptive analytics; cause-and-effect analysis; and/or if the enterprise or business process is data driven...

Author: Patrick I. Offor
Blog Post

Telework Successfully During (And After) the COVID-19 Pandemic

For state/province/national leaders, coronavirus is forcing a trade-off between public health and privacy as well as balancing the saving of human lives at the cost of temporarily limiting individual liberties.

5 May 2020
Blog Post

CDPSE Credential Calls Attention to Need for Technical Privacy Professionals

ISACA recently opened its early-adoption opportunity for its new Certified Data Privacy Solutions Engineer (CDPSE) certification. CDPSE is the latest in ISACA’s well-respected line of credentials and offers a unique certification opportunity to professionals who participate in the design...

4 May 2020
Governance Article

COBIT Tool Kit Enhancements

The COBIT Tool Kit has a number of resources to aid practitioners, including an overview, an executive summary, frequently asked questions (FAQs), a listing of the governance and management objectives in spreadsheet format, and more.

4 May 2020
Blog Post

#IamISACA: Innovating and Being a Change Agent in an Amazing Technological World

The start-up has changed my life. The day before my wedding, one of our clients at the company I had worked for at the time experienced an important security incident.

1 May 2020
Blog Post

#IamISACA: Looking on the Bright Side of Life

There are a lot of causes of stress for those of us working in the security industry. For me, the biggest concern is that a lot of decision-makers are unaware of the consequences that can be caused by inadequate budgeting or investment in security, especially in industries where the consequences can be the loss of human lives.

1 May 2020
Blog Post

Utilize IT Governance for Stronger Enterprise Alignment

Ineffective governance has a substantial impact on business alignment and risk management. Malformed alignment can result in improper identification of sensitive data, critical services and substandard security controls.

1 May 2020
Blog Post

Celebrating a Milestone While Transforming ISACA for the Next 50 Years

ISACA Board Chair Brennan P. Baybeck and ISACA CEO David Samuelson recently had a conversation about ISACA reaching its 50-year anniversary in 2019 and how that milestone inspired the organization to reach even greater heights in the future.

30 April 2020
Blog Post

Managing Your Career in Strange Times: Five Steps to Take Now

There is no crystal ball right now. For business, work, our lives, the world – these are unprecedented times. How should we be thinking about career management right now?

30 April 2020
ISACA Journal Article

Human Error: A Vastly Underestimated Risk in Digital Transformation Technology

There should be no doubt that digital transformation is an organizational necessity performed in the interest of maintaining, sustaining and enhancing an enterprise’s relevance to its constituents.

Author: Guy Pearce
ISACA Journal Article

Communicating Technology Risk to Nontechnical People: Helping Enterprises Understand Bad Outcomes

Too often, well-meaning technology professionals attempt to explain risk to their enterprises and fail to achieve their objective. These professionals fully understand the state of the computing environment and the importance of securing it.

Author: Jack Freund
ISACA Journal Article

Case Study: Building a Rock-Solid ERM Culture on FAIR

Rock Holdings, Inc., is a US-based holding company which owns several subsidiary companies including Quicken Loans, the US’s largest mortgage lender.

Authors: Dan Blum and Keith Weinbaum
ISACA Journal Article

Information Security Matters: CISOs in the Cloud

Here is an unoriginal observation: The Cloud changes everything. Oh, wait, that was the Internet. Whatever. It seems that if it is novel, it changes everything. So the Cloud makes most of us information security professionals unnecessary.

Author: Steven J. Ross
ISACA Journal Article

IS Audit Basics: In Defense of Privacy by Design

In a couple of recent editions of the ISACA Journal (referred to as columns one and two herein), my fellow columnist, Steven J. Ross, made a case whereby he believes that, contrary to the EU General Data Protection Regulation...

Author: Ian Cooke
ISACA Journal Article

The Bleeding Edge: The Patter of Emerging Technologies

The idea that we are all connected via some ethereal or other unknown plane is a belief held by metaphysical enthusiasts and religions all around the world. There is something to be said about the interconnectivity of the human spirit and experience.

Author: Dustin Brewer
ISACA Journal Article

Innovation Governance: Massive Automation to Reduce Human Risk

Even in large organizations, it is not unusual to find controls that still involve a great deal of manual effort. In fact, evidence for an attestation may be entirely generated by someone taking screenshots.

Author: K. Brian Kelley
ISACA Journal Article

The Practical Aspect: The Human Elements of Risk

In classical Greek mythology, Daedalus was helplessly watching Icarus, his son, fall to his death. Daedalus, having designed the Minotaur’s Labyrinth, was imprisoned.

Authors: Vasant Raval and Rajesh Sharma
ISACA Journal Article

How to Balance Insider Threats and Employee Privacy

Recent headlines are replete with extremely costly and disruptive examples of insider threats playing a prominent role in high-profile data breaches.

Author: Isaac Kohen
ISACA Journal Article

Addressing Key Pain Points to Develop a Mature Third-Party Risk Management

Third-party risk management is high on the boardroom’s agenda. The business ecosystem is heavily dependent on third-party relationships, and with this dependence comes a responsibility to manage risk.

Authors: Visveshwar Ramasubramaniam and Anil Kumar Singh
ISACA Journal Article

Managing Technology Risk to Protect Privacy and Confidentiality

Enterprises must deal with a large and constantly growing volume of data, and they require the capacity to manipulate and process this information while protecting data sources.

Author: Thiago de Oliveira Teodoro
Podcast

Information Systems in the Time of Pandemic

Many organizations found themselves unprepared for the workplace and business disruptions caused by COVID-19. But it is possible for organizations to act now to protect their information systems.

30 April 2020
@ISACA Article

CISA, CRISC and CISM Named Top Paying IT Certifications

Information security is imperative to every enterprise, with high visibility at the board level. Security practitioners who invest in valuable certifications are important assets and rewarded accordingly.

29 April 2020
@ISACA Article

Earn CPE for Free and Elevate Your Career as an ISACA Member

ISACA members have access to many valuable discounts and perks through ISACA’s benefit program. Educational, professional and cost-saving resources provide members with competitive industry advantages.

29 April 2020
@ISACA Article

Insider Risk: Managing the Delicate Balance

As more and more organizations make the shift to digital, often remote, workplaces, malpractice such as IP theft and codes of conduct violations poses a heightened threat.

29 April 2020
@ISACA Article

Just Browsing

One of the most misunderstood applications we use in the connected environment is the web browser, or simply, the browser. I often hear browsers called by many different names such as Google, the web or “how I get on the line.”

29 April 2020
@ISACA Article

The Role of the CISO and the Digital Security Landscape

Every organization has a different perception of what digital security is—and what it is not. This can create confusion about which position is responsible and accountable for digital security.

29 April 2020
@ISACA Article

Using Security Practices and Compliance Requirements to Protect Data

Because of recent technological innovations and the relatively low cost of data storage, the volume of data organizations accumulate has skyrocketed. As a result, there is now more information that needs to be protected.

29 April 2020
@ISACA Article

Passion of the ISACA Community Brought to Life in #IamISACA Series

ISACA members safeguard their organizations’ most precious assets, get involved with enterprise risk management, and provide governance and assurance over how organizations leverage their technology.

29 April 2020
Blog Post

Managing Our Ever-Growing Data Requires Empowering Users

As data costs have decreased, data retention and complexity have grown. Organizations have identified the need to capture data and retain it in response to legislation, regulation and opportunity. Has the value of our data increased relative to the growth in data volume?

29 April 2020
ISACA Journal Article

Why Was There No Warning? Risk Management

Risk management is an old discipline. As such, some tend to underestimate its importance until something bad happens or a crisis is triggered. And COVID-19 brings up risk management again as a trending topic.

Author: Ramón Serres
Blog Post

Security in the Smart Home

Tech companies have pushed smart home devices and technologies for years. And while we’ve finally reached a point where smart solutions are considered mainstream, we haven’t quite reached total adoption.

28 April 2020
Blog Post

The New Normal: GDPR and Audit

I am writing this blog under COVID-19 lockdown on the eve of my 25th wedding anniversary. Besides feeling somewhat guilty that I am at home while others are out in the frontline, working from home has left me more time to contemplate this milestone as, well, there is no commute and no colleagues to gossip with at the water cooler or when grabbing a coffee.

27 April 2020
Governance Article

COBIT 2019 and COBIT 5 Comparison

COBIT is a broad and comprehensive framework that has been developed to support understanding, designing and implementing the management and governance of enterprise IT (EGIT).

27 April 2020
Blog Post

IT Professionals Make Important Privacy Partners

When asked to describe my responsibilities as a chief privacy officer, I often say my primary function is to be an advocate for the individuals whose personal data my organization collects, maintains and processes.

24 April 2020
Podcast

Cybersecurity Considerations for Remote Work

As a result of the COVID-19 pandemic, many organizations are now trying to manage having an entirely remote workforce. While remote work can allow people to stay safe while doing their jobs, there are some cybersecurity concerns associated with remote work.

24 April 2020
Blog Post

CISM ‘A Natural Fit’ for My Career in Information Security Management

Josh Hamit, vice president, chief information officer at Altra Federal Credit Union, was among a recent set of professionals achieving Certified Information Security Manager (CISM) who helped CISM surpass the milestone of 50,000 certification-holders since its inception.

23 April 2020
Blog Post

Communicating the Value of IT Governance

A network patch management tool to be procured is often seen mainly as an expense by the finance department, and therefore queried subjectively or even rejected.

22 April 2020
Blog Post

Five Organizational Cybersecurity Dangers Amplified by COVID-19

The global pandemic has impacted businesses on an unprecedented level. Only in a handful of instances in the past 100 years have companies and organizations been forced to such extremes to maintain business operations.

21 April 2020
Blog Post

Thank you, ISACA Volunteers!

ISACA Volunteer Appreciation Week is once again upon us (19-25 April 2020), and we take a moment to reflect on the advancements ISACA has made in the last year thanks to the expertise and dedication of thousands of dedicated volunteers.

20 April 2020
Blog Post

A Needed Wakeup Call for Online School Safety

Right now, as millions of kids all over the world are in the midst of crisis learning done digitally, we are creating the perfect cybersecurity storm. Think about it. While many parents are also working at home, they hardly have the time to conduct their own work, let alone watch over their kids as they do everything online.

16 April 2020
Blog Post

Adding Value to the Organization By Bridging the Privacy Gap

Dave Bowden, CISM, CIPT, CIPM, PMP, CSM, VP - Information Security, Data Privacy, Compliance & Information Technology, Zwift, Inc., and a member of ISACA’s privacy advisory group, recently visited with ISACA Now to discuss the state of the privacy field and how different stakeholders in an organization can come together to create comprehensive privacy solutions.

16 April 2020
@ISACA Article

ISACA Welcomes Incoming 2020-21 Board Directors

As part of a multiyear effort to improve our board governance and impact, ISACA has recruited expertise to serve on the board and help ISACA reach new heights. The mix of ISACA global and chapter leadership expertise plus the leadership and industry expertise of the new board directors will bring valuable and diverse perspectives that will make ISACA even better.

15 April 2020
@ISACA Article

Stand Out as a Job Seeker by Improving Your Resume

Though qualified IT talent is in high demand, job seekers must make a strong first impression. Part of that impression is a strong resume that captures the attention of hiring managers.

15 April 2020
@ISACA Article

Addressing Ransomware and Malware Threats

Ransomware and malware can be incredibly detrimental to organizations, and malware seems to be on the rise. Organizations must understand how to combat ransomware and advanced malware.

15 April 2020
@ISACA Article

Connect With Others and Learn in a Virtual Community

With so many people working from home and maintaining a physical distance during this global health crisis, it is easy to feel disconnected or isolated.

15 April 2020
@ISACA Article

Tips for Setting or Evaluating Risk Appetite

At an enterprise level, risk management is about achieving strategic objectives and creating value, all while ensuring that the activities undertaken are neither too risky nor too conservative to achieve the stated outcomes.

15 April 2020
@ISACA Article

Proving Your Skills and Advancing Your Career With a CISA

Muhammad Mushfiqur Rahman likes that his job gives him the freedom to execute an audit plan and that management listens to his comments and suggestions and empowers him to establish a plan accordingly.

15 April 2020
@ISACA Article

Celebrating ISACA Volunteer Appreciation Week

During ISACA Volunteer Appreciation Week (19-25 April), the ISACA staff and leadership will extend their appreciation for the many volunteers who selflessly contribute their time and efforts to advancing information technology for ISACA members and the global community

15 April 2020
Blog Post

#IamISACA: An Introvert Networks Her Way to a New Career

As a self-proclaimed introvert, Lisa DiNezza often has shied away from professional networking and seeking mentors.

13 April 2020
Blog Post

#IamISACA: Connecting Across the Globe

Ramona Ratiu says it is “absolutely amazing” how the challenges faced by security professionals are so similar no matter where in the world people are located.

13 April 2020
Blog Post

#IamISACA: Early Involvement Paying Dividends in My Career

If it had not been for Scott Moody, I would have never gotten this far in my career.

13 April 2020
Blog Post

#IamISACA: Embracing My Underdog Journey

In 2017, I was invited to Chicago to receive the Michael Cangemi Best Article/Book Award, one of ISACA’s highest global honors that recognizes major contributions to the field of IS audit, security and governance publications.

13 April 2020
Blog Post

#IamISACA: Finding Balance in the Wild

Photography is an art form – it takes creativity, imagination and an eye for detail. I really enjoy it, and I especially love wildlife photography.

13 April 2020
Blog Post

#IamISACA: No Quenching My Adventurous Spirit

Before I became an IT auditor, I spent seven years traveling and during that time I got shot twice, once in El Salvador and once in Chicago. I laugh about it now, but I wasn’t laughing about the experience at the time, and it did change my outlook on life.

13 April 2020
Blog Post

#IamISACA: On the Frontlines of Change

Establishing my career in IT risk and assurance as a Jordanian woman has been a fascinating journey.

13 April 2020
Blog Post

#IamISACA: Pivoting to My Passion

The cybersecurity training program through SheLeadsTech, AnitaB.org and City Tech is the reason why I’m in the position that I’m in right now. It really solidified this is the industry that I want to work in.

13 April 2020
Blog Post

#IamISACA: Security a Multigenerational Family Passion

Naganat Guru’s fascination with security has made an impression on his children, who are now following their owns paths in the field.

13 April 2020
Blog Post

#IamISACA: Upskilling and Getting Uncomfortable to Get to the Next Level

I’ve been in security for about 14 years. I started my career in help desk, moved up to desktop support, then server support, built a help desk team and security team, and here I am now.

13 April 2020
Governance Article

How COBIT 2019 Supports the Brazilian GDPR

The General Personal Data Protection Act (LGPD) is the Brazilian law that regulates the processing of personal data. It was sanctioned on 14 August 2018 and entered into force 18 months after its publication.

13 April 2020
The Nexus Article

Qualifying the Skills Gap

In February 2020, ISACA released its State of Cybersecurity 2020, Part 1: Global Update on Workforce Efforts and Resources report. This paper reports on data collected in Q4 2019, and it is similar to the series of reports on the state of cybersecurity issued by ISACA on an annual basis.

13 April 2020
The Nexus Article

Why Cryptographic Infrastructures Require High Availability

In today’s 24/7, hyperconnected world, system failures are simply not an option. Modern society depends on unbroken connectivity, and one of the most critical services requiring high availability is cryptographic infrastructure.

13 April 2020
Blog Post

Incoming Board of Directors Highlights ISACA’s Transformation

In our 50th anniversary year last year, we took stock of ISACA as an organization—what was going well and what we could do better as we strive to be a modern association dedicated to providing world-class learning, membership and enterprise services to our growing community.

10 April 2020
Blog Post

Powerful WordPress Security Tips to Protect Your Site

WordPress is, without a doubt, the most popular content management system on the web. But this also means it’s one of the most frequently targeted content management systems around. This means cybersecurity is of the utmost importance for people and businesses with WordPress websites.

9 April 2020
ISACA Journal Article

The California Consumer Privacy Act and Encryption: Theory, Practice, Risk Assessment and Risk Mitigation

The US State of California Consumer Privacy Act of 2018 (CCPA) will have an impact on security professionals, auditors, managers and boards responsible for ensuring its effective implementation.

Author: Larry Marks
Blog Post

Organizational Cybermaturity Comes to the Forefront During COVID-19

The worldwide pandemic has touched everyone at different levels. Across the globe, people are taking additional steps and implementing new routines into their daily lives in order to help slow the spread of the coronavirus. 

7 April 2020
Blog Post

How COBIT® 2019 Can Help Businesses Thrive in Uncertain Times

With the current world health crisis, more organizations are making the shift to remote working environments for their employees. At ISACA, we are living this today as ISACA’s office is closed and all staff are working remotely.

6 April 2020
Blog Post

Privacy and Respect Under COVID-19

Many actions have been taken to address the COVID-19 pandemic. Some involve penalties for the spread of misinformation in Bosnia and Herzegovina, the derogation of some human rights in an emergency in Romania, Armenia and Latvia and companies like Palantir and Clearview AI negotiating partnerships with US state agencies for infection monitoring by surveillance, geolocation and facial recognition.

3 April 2020
Blog Post

Engaging ISACA’s Community Virtually

Being part of ISACA’s professional community offers not only networking, career advancement and continuing education but also personal relationships, inspirational leaders and mentors. As social distancing has become a global reality for us all at least temporarily, it is more important than ever to focus on the people in our community...

2 April 2020
@ISACA Article

New Certification Coming Soon: Certified Data Privacy Solutions Engineer

According to Indeed.com, the number of job postings on its website with the terms “data privacy” or “data protection” in their titles has increased by 75% in the last 4 years.

1 April 2020
@ISACA Article

Five Key Considerations When Adopting a Zero-Trust Security Architecture

A zero-trust security architecture approach is based on the premise that organizations should not inherently trust any systems that connect to or interact with their technical infrastructure and/or networks without verification and validation of their need to connect and an inspection of their security posture and capabilities.

1 April 2020
@ISACA Article

Managing Privileged Cloud Access

Organizations often store petabytes of user and consumer data on cloud services, and compliance requirements have made it essential that organizations effectively manage privileged access on these systems.

1 April 2020
@ISACA Article

ISACA’s Newest Chapter: Fargo

New ISACA chapters are established to build and expand communities of IT individuals who want to share best practices, provide local continuing professional education (CPE) opportunities, and to promote the value of ISACA certifications. ISACA is excited to announce the formation of the Fargo (North Dakota, USA) Chapter.

1 April 2020
@ISACA Article

Register Now to Take an ISACA Certification Exam From Your Own Home

Because the unprecedented COVID-19 pandemic has shut down test centers in areas across the world, ISACA and PSI, its exam partner, will be offering live remote proctoring of the CISA, CRISC, CISM, and CGEIT certification exams by the end of April 2020.

1 April 2020
ISACA Journal Article

Data Ownership: Considerations for Risk Management

There is no easy answer to the question of who owns data. Indeed, debates about the subject tend to be theoretical. Depending on the situation, the possessor, the user, the creator and the subject of the data could all claim ownership, and sorting it out can pose logistical, technological and even ethical challenges.

Author: Kevin M. Alvero
Blog Post

Location, Organizational Culture Make an Impact When Addressing Privacy Regulations

25 May 2018 came and went. So did 1 January 2020. And businesses around the world didn’t stop (although the current COVID-19 pandemic has certainly presented new challenges). What GDPR did was push organizations across the world to think more, think large and hold themselves accountable. That might seem like old news.

31 March 2020
Podcast

Understanding and Addressing CISO Burnout

A recent survey found that 90 percent of CISOs would take a pay cut if it meant better work/life balance. There are many reasons for CISO burnout, and a broader cultural shift is needed to combat the excessive pressure put on CISOs. In this podcast episode, Dustin Brewer and Frank Downs discuss the reasons for CISO burnout, why it is a problem and how it can be addressed.

31 March 2020
Governance Article

Managing Remote Work Environments With COBIT 2019

More organizations are making the shift to remote working environments for their employees due to the current world health crisis. Those organizations and the personnel responsible for security, infrastructure, risk and governance may need guidance.

30 March 2020
Blog Post

What Do You Think About When You Hear the Words “Cybersecurity” and “Breaches”?

Cybersecurity refers to the technologies and processes implemented to help protect computers and networks from unauthorized access or attacks. A breach is an incident in which confidential information is viewed, stolen or utilized by an unauthorized individual.

27 March 2020
Blog Post

Learning is Evolving, Whether We Like it or Not. So Is ISACA.

No doubt, these are challenging times. Aside from dealing with all the stress at home, where those of us with kids are seeing them face anxiety adjusting to a normal they were never prepared for, we also, as adults, are learning to work differently.

26 March 2020
ISACA Journal Article

Information Security Matters: Information Systems in the Time of Flu

I am not in the public health field either, so if you are concerned about the ability of doctors and hospitals to withstand the surge of demand that a pandemic will bring, speak with your local medical authorities.

Author: Steven J. Ross
Blog Post

Securing Citizens’ Data in an Era of Connected Societies

Southeast Asia has some of the biggest cities in the world, such as Manila, Jakarta and Bangkok, with close to 47% of the local population living in cities. As governments strive to build future cities, where infrastructure and public delivery are connected and seamlessly enabled by digital advancement...

25 March 2020
Blog Post

Five Steps to Realize Your Data-Driven Digital Transformation Strategy

In today’s “data is the new oil” era, no one can say an organization is able to achieve digital transformation without data. Executives and even the board level are talking about data-driven business strategy when they develop business objectives and goals.

24 March 2020
Blog Post

The Importance of Preparing for a Ransomware Attack Hits Close to Home

As a cybersecurity professional, I work with organizations every day to enhance the various aspects of their cybersecurity programs, from foundational capabilities such as data classification to more tactical functions like incident response. I’ve seen the real-world impacts that various types of attacks have on an organization and the efforts that go into recovery.

19 March 2020
@ISACA Article

Cybersecurity Survey Results Reveal Hiring Struggles Persist, More Diversity Progress Needed

ISACA recently released part 1 of its State of Cybersecurity 2020 survey report, which found that cybersecurity teams are still struggling with hiring and retention, with very little improvement from last year.

18 March 2020
@ISACA Article

Best Practices for Privacy Audits

When the EU General Data Protection Regulation (GDPR) rolled out in May 2018, the first questions many asked were, “What is the difference between privacy and security? Is there a different way of assessing privacy and security?”

18 March 2020
@ISACA Article

Applying Extreme Adventuring Principles to a Business Context

Climbing Mount Everest and the workplace challenges IT professionals experience daily may not initially seem similar, but there are valuable lessons from extreme adventuring that can apply in a career context.

18 March 2020
@ISACA Article

Certification as a Path to Pursuing New Interests and Finding a Like-Minded Community

When Jan Anisimowicz, director of audit, risk and compliance at C&F Sp. z o. o., initially pursued the Certified Information Security Manager (CISM) certification, he did not know it would give him the opportunities to extensively travel around the world and discover new hobbies.

18 March 2020
Blog Post

Building A Governance System: A Review of Information Flow and Items Component

The COBIT 2019 framework defines seven components of a governance system that individually and collectively contribute to the good operations of the enterprise system over information and technology. Among those components is information flow.

17 March 2020
Blog Post

Organizational Security Spending Trending Toward Services

Since the emergence of information security online, organizations have poured millions of dollars into products promising to increase speed of incident recognition, response times and overall operational efficiencies. To a certain extent, the idea that automation and enablement work hand-in-hand has proved out over the past several decades.

12 March 2020
Blog Post

Learning From Technology’s Past

When I think of technological progress, in a lot of cases we are seeing new views and takes on existing ideas. Ideas keep coming back around, just like “The Song That Doesn’t End.”

11 March 2020
The Nexus Article

The CCPA Impact Privacy and Cybersecurity Guideline

The US State of California state legislature enacted the California Consumer Privacy Act (CCPA) on 1 January 2020 through Assembly Bill 375 (AB 375), with additional amendments that were passed through Senate Bill 1121 (SB 1121). The CCPA refers to consumers in its language, which by definition includes employees.

9 March 2020
The Nexus Article

Vision or Visibility?

When speaking about IT or cybersecurity, I often come across the strategy/vision or visibility challenge—what comes first? It is almost a chicken or egg question and, while I believe we can develop the vision for IT/cybersecurity without the visibility into current environment, the question becomes: Can we “sell” that vision to decision-makers?

9 March 2020
Blog Post

We Need More Women Working in AI

A study by the World Economic Forum and LinkedIn found that only 22 percent of AI professionals are women. Research by the AI Now Institute found that women make up only 15 percent of the AI research staff at Facebook and only 10 percent at Google

6 March 2020
Blog Post

A Look Back at RSA 2020 Conference: ISACA Attendees Share Their Takeaways and Tips

Several ISACA experts attended the RSA 2020 Conference last week in San Francisco, California, and took advantage of the wealth of onsite sessions and opportunities to meet with others in the tech community. A few shared some reflections from the conference with ISACA Now—both around industry trends and takeaways, and about the first-timer’s overall conference experience.

5 March 2020
Blog Post

In It Together: Expert Advice on Creating Strong Teams at RSA

ISACA’s recently released 2020 State of Cybersecurity survey report revealed some sobering findings around hiring and retention for cybersecurity teams.

5 March 2020
@ISACA Article

Learn Blockchain Basics and Apply Your Skills

Blockchain is a powerful resource to increase the integrity of data, but it is important that security teams fully understand it before using it. To help cybersecurity practitioners better understand blockchain, ISACA’s Cybersecurity Nexus™ (CSX) is offering the CSX Blockchain Basics Course.

4 March 2020
@ISACA Article

Type-Mismatch Error

In programming, one common error encountered is a type-mismatch error (different compilers may call it different things). Space must be allocated to store data in variables, and the way this is done is by defining the type of variable it is.

4 March 2020
@ISACA Article

Improving Data Governance and Management Processes

Data are one of an organization’s most valuable assets. Because of the value of data, it is imperative that organizations have a strong data governance program that aligns with the organization’s business objectives.

4 March 2020
@ISACA Article

New ISACA Journal Column Focuses on Emerging Technology

Keeping pace with cutting-edge technology is a challenge for most governance, audit, risk and information security professionals. The technology landscape and, therefore, the risk landscape are constantly evolving.

4 March 2020
@ISACA Article

Leveraging Audits to Address Third-Party Risk

With the growing number of services consumers expect, many organizations are turning to outsourcing. Leveraging third parties can help enterprises lower their costs and benefit from specialized knowledge and skills that may not exist within the organization.

4 March 2020
@ISACA Article

ISACA’s Newest Chapter: Rwanda

To help IS audit, governance, risk and security professionals in Rwanda better acquire and share knowledge, a new ISACA® chapter has been formed in Rwanda. Prior to the formation of this chapter, those looking to participate in chapter activities had to travel out of the country.

4 March 2020
Blog Post

Evaluating Security Incident Management Programs

The dynamic operational landscape that is created as businesses drive competitive advantage through technology renders a static risk management program ineffective. As enterprises innovate, information technology groups are challenged with revisiting the suitability of architecture, security platforms and/or software deployment to meet business-driven changes.

4 March 2020
ISACA Journal Article

Aligning COSO and Privacy Frameworks to Manage Privacy in a Post-GDPR World

There is one constant in the data privacy landscape: change. The EU General Data Protection Regulation (GDPR) was adopted in 2016 to protect the personal data of EU citizens and harmonize data privacy laws across EU member states. Since then, data privacy has become a growing concern for boards of directors (BoDs).

Authors: Donel Martinez and Joshua Marks
Blog Post

Business Continuity – Pandemic Preparation

The recent outbreak of a new virus, COVID-19, or the coronavirus, has many businesses scrambling to develop or review their business continuity plans. While there is much unknown about COVID-19 and whether it will turn into a pandemic, there are many things business can do today to ensure their businesses continue to operate if it does occur.

3 March 2020
Blog Post

A Compliance-First Mentality Increases Enterprise Risk

Risk, in the context of cybersecurity, constantly looms in the minds of all information security professionals. From the introductory IT help desk professional to the seasoned chief information and security officers, threats, and their potential impact, can cause serious concern and stress if they remain unknown variables.

17 February 2020
Blog Post

Innovating IT Audit To Keep Up With New Technologies

IT is continuing to progress. Personal and business computing solutions are increasingly elaborate and far-reaching. And concepts such as the Internet of Things (IoT), machine learning (ML) and artificial intelligence (AI) have begun to be applied in a practical way.

28 February 2020
ISACA Journal Article

How Internal Audit Can Help Capture Value in Robotic Process Automation Projects

A fundamental value proposition of robotic process automation (RPA) is its ability to reduce time spent on repetitive, rule-based tasks, thereby freeing up precious time that can be allotted to more value-added work. However, a survey of 1,000 US information...

Authors: Kevin M. Alvero and Kevin McCarthy
ISACA Journal Article

Auditing Emerging Technologies: Facing New-Age Challenges

With unprecedented advances in information technology, audit professionals need to gear up to face the challenge of auditing emerging technologies. Auditors need to learn and understand new skills and acquire knowledge related to predictive analytics...

Author: Muhammad Asif Qureshi
ISACA Journal Article

Whose Data Is It Anyway?

Beyond the privacy concerns expressed about organizations such as Facebook and Google, the next wave of data privacy issues is fueling the white-hot inferno that resulted in the globally significant and influential regulation of the EU General Data Protection...

Authors: Guy Pearce and Sandra Ketchen
ISACA Journal Article

Information Security Matters: Amber Heard’s Privacy

Evidently, Amber Heard is an actress in Hollywood. I say “evidently” because I have never seen any of her films or television shows. I first became aware of Ms. Heard when she published an article in The New York Times concerning nonconsensual...

Author: Steven J. Ross
ISACA Journal Article

IS Audit Basics: Incorporating the GDPR Into IT Audits

It is now almost two years since the EU General Data Protection Regulation (GDPR) was enacted. Since then, a lot has been written about the regulation. Indeed, a quick Google search produces about 486,000,000 results. Given the elapsed time since it came...

Author: Ian Cooke
ISACA Journal Article

The Bleeding Edge: Blockchain: Love It or Hate It, It’s Here

I have noticed that the mere mention of the word “blockchain” elicits a myriad of responses among groups of IT security professionals. I find that some individuals roll their eyes, murmuring disapproving phrases such as, “It’s just a glorified database.”

Author: Dustin Brewer
ISACA Journal Article

The Practical Aspect: Organizational RPA Adoption and Internal Auditing

Robotic process automation (RPA) adoption is a gateway for the internal audit function to contribute more to the organization. RPA adoption extends the insights of internal auditors in business processes to help innovate new or modified processes to...

Authors: Vasant Raval and Erica Smith
ISACA Journal Article

Healthcare Organizations’ Compliance With the CCPA

The California Consumer Privacy Act (CCPA) is the first piece of legislation in the US to emulate the EU General Data Protection Regulation (GDPR) and be enacted into law. The CCPA is a milestone in what is likely to become a new era of data privacy...

Authors: Louise Rains Gomez and Thomas Hiney
ISACA Journal Article

Assessing the Risk of Cyberattacks in the Online Gaming Industry: A Data Mining Approach

Malicious hackers employ distributed denial of service (DDoS) attacks to disrupt business by preventing legitimate users from accessing organizations’ websites. In 2018, the direct and indirect losses caused by a single DDoS attack ranged from US$120,000 to US$2 million.

Authors: Kalpit Sharma and Arunabha Mukhopadhyay
ISACA Journal Article

Plan for Successful System Implementations

Organizations need to constantly assess their systems landscape and identify projects that meet business needs and add value to the enterprise. Information technology departments play a crucial role when implementing systems...

Author: Hashim Seedat
ISACA Journal Article

HelpSource Q&A

Question: Is there any standard or framework for managing IT vendors? What best practices should we adopt to effectively manage vendors?

Author: Sunil Bakshi
Blog Post

Three Essentials To Thrive in a High Pressure CISO Role

A recent Ponemon Institute report predicted that the role of the chief information security officer (CISO) will continue to rise in significance. This is underpinned by the growing realization by executives that just one serious security incident or data breach could derail the growth and profitability of their companies because of impact to brand and the cost to remediate, the incurring of fines and legal fees, and/or customer lo

27 February 2020
Blog Post

Differentiating Key Terms in the Information Security Hierarchy

The following terms may be familiar, but they can be used incorrectly. Many of these will be referred to as “policies,” even if that’s not what they truly represent. Having a better understanding of these terms enables your organization to create better governance documentation.

26 February 2020
ISACA Journal Article

The Growing Role of Cybersecurity Disclosures

Yahoo Inc. was fined a US$35 million penalty for failing to disclose one of the largest data breaches in the world, in which hackers captured the personal data of millions of user accounts. The failure to disclose the breach misled investors.

Authors: Jacob Peng and Gregory Krivacek
Podcast

Fear IS OK, But Complacency Will Kill You

Complacency, refusal to deviate from a plan and freezing in stressful situations are harmful in a corporate environment but and can be deadly in an extreme adventuring context. Alison Levine, the first American women's Everest expedition team captain, shares how lessons she learned on Everest can apply in a business context.

26 February 2020
Blog Post

Solving the Cybersecurity Skills Gap Requires a Mindset Change

ISACA’s State of Cybersecurity 2020 research on hiring and retention requires us to confront a challenging reality: We simply aren’t making enough progress.

24 February 2020
Blog Post

Who and What Are Worthy of Trust?

It has become extraordinarily difficult to distinguish between whom or what you can trust, and who or what is out to get you. Indeed, the 29 December 2019 issue of The New York Times included a section highlighting “A Decade of Distrust,” which featured the following quote from Michiko Kakutani...

20 February 2020
@ISACA Article

Improve Your Third-Party Risk Management Program

Most organizations’ risk management programs have room for improvement, especially when it comes to third-party risk. Understanding third-party risk management best practices can help organizations improve their risk program and reduce their overall risk.

19 February 2020
@ISACA Article

ISACA Congratulates 2020 ISACA Award Recipients

ISACA is proud to recognize the outstanding achievements of its individual contributors, chapters and certification exam takers who offer thought leadership, volunteer service and professional contributions that advance ISACA’s purpose and promise.

19 February 2020
@ISACA Article

New Logo and Web Experience Mark a New Era for ISACA

As the new decade begins, ISACA is embarking on a new era with a new look: an entirely new website experience and a new logo. The new website provides smoother navigation, improved searching capabilities and greater security.

19 February 2020
@ISACA Article

Share Your Real-World Experience in a Case Study

One of the best ways to advance the governance, audit, risk and information security fields is to share your real-world experience with other professionals in these areas.

19 February 2020
@ISACA Article

Why Do IT-Related Projects Go Overboard?

IT-related projects are projects with deliverables that use information and related technology. These projects can be new solution implementations, new application software development, business function automation or relate to IT in any other way.

19 February 2020
ISACA Journal Article

Innovation in the IT Audit Process: The IT Semantic Audit Models Audit Segments Using Semantic Graphs

The need for innovation in the IT assurance field is based on evolving requirements for which traditional responses have lagged behind. The ability to have an in-depth understanding of the organization and its changing environment and track its complex technology represents a challenge for IT auditors and IT assurance analysts.

Author: Huáscar Méndez
Blog Post

Digital Transformation: Proper Preparation Prevents Poor Performance

Without proper planning, backcountry winter camping in Canada can be deadly. With temperatures that can easily drop below -25 degrees Celsius (-13 degrees Fahrenheit) during polar vortex conditions while you are out there with little more than snowshoes (or backcountry skis), a tent, backpack and a sleeping bag (and enough nutrition to handle minor emergency situations), any mistakes or omissions from your kit...

18 February 2020

Key Touchpoints on the Job Candidate Journey

When I work with companies as an executive recruiter, I advise them on how they can improve their recruiting and hiring process by mapping different parts of the candidate journey, and how to make an impact through critical candidate touchpoints.

14 February 2020
Blog Post

Your Audit Reports Have Consequences

A report is defined as a spoken or written description of an event or situation. As such, reports can have positive or sometimes negative impacts upon people or subsequent events. Can you remember the first time your brought back a bad school report to your parents or guardian?

12 February 2020
ISACA Journal Article

The NIST Cybersecurity Framework—Third Parties Need Not Comply

How can an organization make third parties comply with NIST?” This question haunts risk management professionals (and their lawyers) who are familiar with all five functions, 23 categories and 108 subcategories of the Cybersecurity Framework (CSF), published by the US National Institute of Standards and Technology (NIST).

Author: Thea Janeway
Blog Post

Expanding Opportunity in Cybersecurity Through Deeper Collaborations Between Schools, Providers and Employers

Ever since I started working in education, from K-12 to higher ed, and now to the professional sector, I envisioned this transformative trifecta that could lead to the ultimate educational outcome – employability.

10 February 2020
The Nexus Article

Cybersecurity Regulations That Impact the Banking Industry

The emergence of cybersecurity many years ago meant that financial services had to adhere to the laws and regulations that came with it. While some industries experienced little disruption from these regulations, the same cannot be said for the global banking industry.

10 February 2020
The Nexus Article

Misinformation—A Rapidly Growing Threat to Enterprises

As if the constant defensive posture of protecting digital assets were not enough, we now must question the authenticity of information. Deepfake reporting is on the rise and, just this past month, a popular US television series included deepfake in its storyline.1 Deepfakes are fake multimedia recordings but are usually manifested as video.

10 February 2020
The Nexus Article

Share Your Real-World Cybersecurity Experience in a Case Study

One of the best ways to advance the cybersecurity field is to share your real-world experience with other professionals in the industry. Consider sharing your successes, key learnings and business solutions by contributing a case study for publication in the ISACA Journal.

10 February 2020
Blog Post

Making Risk Assessments Relevant

Organizations track risk for good reason. Risk is a way of measuring the effects of uncertainty, and the resulting opportunities and potential pitfalls. When risk is measured, it can be managed, and organizations that actively manage risk are better positioned for success, today and in the future.

5 February 2020
Podcast

Lessons Learned From the First-Ever Hack

Inventor Guglielmo Marconi, a key contributor to wireless telegraphy, did not want to engage with anyone who criticized his wireless telegraph technology, and he believed it to be completely secure. But in 1903, magician Nevil Maskelyn hacked a wireless telegraph communication.

5 February 2020
Blog Post

New Look Marks a New Era for ISACA

If you’re a return visitor to the ISACA website, the site probably looks very different than your last visit, but it’s still packed with the valuable resources that keep you coming back.

31 January 2020
Blog Post

Five Common Privacy Problems in an Era of Smart Devices

I gave an Internet of Things (IoT) security and privacy keynote half a dozen times throughout the world last year, along with as many executive presentations. These presentations described the lack of security and privacy engineering within the devices themselves and related contributing factors.

28 January 2020
@ISACA Article

Address the Challenges of SD-WAN

Software-defined wide area networking (SD-WAN) is a useful tool to view an organization’s network architecture. But while it can be useful, its lack of security

22 January 2020
@ISACA Article

Harnessing the Power of Emerging Technology

Emerging technologies such as quantum computing, artificial intelligence (AI) and augmented reality (AR) have tremendous potential and pose significant risk

22 January 2020
@ISACA Article

Learn to Conduct an IT Security Risk Assessment

Organizations must conduct regular risk assessments not only to ensure business continuity, but also to verify that their expenditures are providing a high return on investment.

22 January 2020
@ISACA Article

Romanticizing Fraud: How to Keep Yourself Safe From Hackers

Concepts and terminology differ between the physical and cyberworld. In an attempt to define new terms, IT professionals often come up with terms that confuse and romanticize instead of inform.

22 January 2020
@ISACA Article

Share Your Cybersecurity Knowledge and Experience in The Nexus

One of the best ways to advance the cybersecurity field is to share your expertise and knowledge with other professionals in the industry worldwide. Consider sharing your knowledge by contributing an original article

22 January 2020
Blog Post

CCPA’s Do Not Sell: It’s Here, But What Does It Mean?

So, the California Consumer Privacy Act (CCPA) went into effect – and, the world didn’t burn. Companies have many issues to contend with, but one in particular has presented challenges to businesses that sell personal information.

22 January 2020
Blog Post

Complacency Presents a Glaring Career Risk

Alison Levine, First American Women's Everest Expedition Team Captain and a New York Times bestselling author of “On the Edge,” will be the opening keynote speaker at ISACA’s 2020 North America CACS conference

16 January 2020
Blog Post

Another Buzzword Demystified: Zero-Trust Architecture

I recently attended a security conference with multiple speakers covering a wide variety of topics – one of the topics, “Zero-Trust Architecture” (ZTA), was being addressed by one of the vendors, and I decided to sit-in to listen.

14 January 2020
Blog Post

Using AI as a Defensive Tool

In a previous Journal article, I wrote about artificial intelligence (AI) and talked about the massive amount of digital data that are being accumulated, how new digitally oriented technology is affecting us, the sources of online data (e.g., personal, private), how data are used and how a career in AI can be useful to those interested in developing the skills to use AI.

13 January 2020
The Nexus Article

Cybervictims, Defenders and Cybercriminals: How to Tell Them Apart

In this Orwellian era, when opponents are enemies and enemies are co-conspirators, where news is falsified and trust is endangered, it has become well-nigh impossible to apply clear definitions to attackers, victims and defenders in the context of cyberspace.

13 January 2020
The Nexus Article

Fluid Security: Managing Risk in Hybrid Networks

For years, security teams have been tasked with supporting the shift to the cloud, all while maintaining the responsibility of securing on-premise infrastructure and assets. Many are no doubt dreaming of the day they reach cloud-only status and they can shake off the fragmentation that creates so much complexity and inefficiency.

13 January 2020
Blog Post

Storing for the Future: How Data Centers Will Advance in 2020

The idea that data is an incredibly valuable resource in the modern business landscape isn’t new—but best practices for managing that data seem to change almost by the year.

10 January 2020
@ISACA Article

Improving Your Security Through Red Teaming

In the past, nonmalicious hackers who found and exploited an organization’s weaknesses and notified it of those weaknesses often faced severe penalties, including jail time. But now, this testing activity is a vital element of cybersecurity. Red team testing can help organizations find their biggest vulnerabilities and fortify the security around them. Despite becoming a crucial component of cybersecurity, the skills gap has resulted in a shortage of qualified red team personnel.

8 January 2020
@ISACA Article

Manage Enterprise Cyberrisk by Applying the NIST CSF With COBIT 2019

Modern threat actors target enterprises across all industries regardless of their type, size or geographic location. Comprehensive protection against cyberthreats requires enterprises to assess their information and technology (I&T) and digital assets through a broad lens and to develop their cyberposture as part of a comprehensive governance and management framework. With the proper enterprise governance program in place, the audit and assurance function can help inform risk-reward decisions and maximize enterprise value while addressing stakeholder needs.

8 January 2020
@ISACA Article

Tips for Building a Risk-Optimized Enterprise

The goal of effective risk management is to align the amount of risk taken with the enterprise’s risk appetite to meet the strategic goals and objectives of the organization. When risk is strategically and thoughtfully taken, there are opportunities for competitive advantage, entering additional geographic markets, or developing new products and services.

8 January 2020
@ISACA Article

Volunteer and Earn CPE With ISACA

Making time to volunteer has both personal and professional benefits and can be a component of professional development and growth. ISACA members have access to a plethora of educational content, networking and professional recognition opportunities. This means you can get more involved in engagement programs in 2020 at no additional cost, and these programs can help you build your professional network, solve challenging problems you encounter at work and even earn free CPE hours.

8 January 2020
ISACA Journal Article

Healthy Network Testing to Identify APTs

Advanced persistent threats (APTs) were utilized to breach financial information, costing millions of US dollars during the recent Facebook, Capital One, Google Plus and Uber breaches...

Author: Timothy Neuman
Blog Post

In the New Year, Don’t Fall Back Into the Same Bad Cybersecurity Habits

Around this time each year, many people aim to follow through on their New Year’s resolutions with the hope of finally being able to break that bad habit, which can prove trickier than we would like.

7 January 2020
Blog Post

Who Will Harness AI More Effectively in the New Decade: Cybercriminals or Cybersecurity Professionals?

We know artificial intelligence will loom large in the new decade, and we know cybersecurity will be critically important as well. How those two forces intersect sets up as one of the most fascinating – and consequential – dynamics that will shape society’s well-being in the 2020s.

3 January 2020
ISACA Journal Article

The (Hidden) Cost of Handling Events and Incidents

Because incidents cause trouble and potential losses, there are processes such as business continuity management and disaster recovery planning...

Author: Sven De Preter
Blog Post

Key Steps to Ensuring CISO Effectiveness

n the classic movie “The Wizard of Oz,” protagonist Dorothy Gale leaves Kansas and enters a new world, the land of Oz.

ISACA Journal Article

Applying Privileged Access Management to Cloud Environments

Privilege in IT is like oil: The machine cannot run without it, but too much and there will be a mess. The industry has struggled with privilege over the years and...

Author: Dan Blum
ISACA Journal Article

Innovation Governance: In Everything New, There Is Plenty of Old

I have been an IT professional for more than four decades, starting in the 1980s. So much has changed, yet so much has stayed the same or, more appropriately, returned to the same...

Author: K. Brian Kelley
ISACA Journal Article

Information Security Matters: The Residual Data Center

It is no great secret that organizations are moving more and more applications into the cloud. In fact, a recent research study states that by 2021, 53 percent “of all IT and data processing requirements will be in the cloud...

Author: Steven J. Ross
ISACA Journal Article

IS Audit Basics: The Components of the IT Audit Report

While authoring this column and, indeed, participating in the Audit and Assurance community on ISACA’s Engage Online forum, my opinion is often sought on a wide range of audit-related topics from ISACA members...

Author: Ian Cooke
ISACA Journal Article

The Risk and Rewards of Enterprise Use of Augmented Reality and Virtual Reality

More than 20 years ago, virtual reality (VR) was a simple headset that communicated with video-game consoles and allowed humans to play video games viewed on a four-inch screen housed inside the headset...

Author: Adam Kohnke
ISACA Journal Article

Sponsored Feature: Fluid Security—Managing Risk in Hybrid Networks

For years, security teams have been tasked with supporting the shift to the cloud, all while maintaining the responsibility of securing on-premise infrastructure and assets...

Author: Amrit Williams
ISACA Journal Article

Anticipating the Disruptive and Incremental Innovations Brought by Quantum Computing

Quantum computing has become one of the most interesting areas of research, training and investment, particularly in the IT-related business sector...

Author: Ahmet Efe
ISACA Journal Article

Attaining Digital Transformation Readiness

It does not matter whether it is Industry 4.0, a digital twin, the Internet of Machines, distributed system optimization in edge computing or just plain process digitization, digital transformation initiatives are about positively...

Author: Guy Pearce
ISACA Journal Article

Understanding and Managing the Artificial Intelligence Threat

Artificial intelligence (AI) has come to the forefront of software technology and is presented as both a positive and negative influence on humanity....

Author: Larry G. Wlosinski
ISACA Journal Article

When Victims and Defenders Behave Like Cybercriminals

In this Orwellian era, when opponents are enemies and enemies are co-conspirators, where news is falsified and trust is endangered, it has become well-nigh impossible to apply clear definitions to attackers...

Author: C. Warren Axelrod
ISACA Journal Article

HelpSource Q&A

“Deep fake” is a term derived from deep learning, and it refers to modifying or creating fake videos using human image synthesis and artificial intelligence (AI)...

Author: Sunil Bakshi
ISACA Journal Article

Standards, Guidelines, Tools and Techniques

An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques...

ISACA Member and Certification Holder Compliance
Blog Post

Innovating Yourself as an IS Auditor

As new technologies are developed, we have to stay up to date with them. More so than almost any other practitioner interfacing with information technology, auditors have to work hard at continual education.
Blog Post

Five Revealing Security Incidents of 2019, and What We Can Learn from Them

Every year has its share of security gaffes, breaches, and hacker “shenanigans.” As we enter into the new year, it is inevitable that we will see articles in the mainstream and trade press recapping the worst of them.
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 3

Internal audit often selects the entities to audit using an aging policy or in response to an incident.

Author: Luigi Sbriz
@ISACA Article

Analyzing Cybersecurity Spending in Depth

The US fiscal year 2020 presidential budget for cybersecurity-related activities is set at US$17.4 billion. This represents a 5% increase over the fiscal year 2019 budget and amounts to approximately US$53 for every person in the United States.

23 December 2019
@ISACA Article

CISM: The Key to Entering Executive Leadership

In 2018, Michael Kearns, CISM, chief information security officer (CISO) for Nebraska Methodist Health System, evaluated options to make himself more employable in the next decade. After researching the most desirable certifications security professionals...

23 December 2019
@ISACA Article

How to Manage I&T-Related Risk Using NIST and COBIT 2019

IT and operational technology (OT) create value and promising opportunities for enterprises today—they are no longer just support mechanisms for key resources.

23 December 2019
@ISACA Article

Women Influencing Tech as a New Decade Brings More Change

The end of a year—and the end of a decade—offer the opportunity to pause and reflect, but also to focus on the future and imagine how work lives and enterprises might change and evolve.

23 December 2019
Blog Post

Connecting COBIT 2019 to the NIST Cybersecurity Framework

Among the most exciting projects I’ve worked on has been the integration of NIST’s Cybersecurity Framework with COBIT.

Blog Post

Leveraging Emerging Technology for Better Audits

My first role post-graduation was working as a financial statement auditor. We used tick mark pencils on printed workpapers, and we manually footed (recalculated) balances.
Podcast

Understanding the Marriott Starwood Hack

More than 500 million Starwood accounts were compromised in the recently discovered Marriott Starwood hack. How can those compromised protect themselves, and what are some of the lessons learned? In this podcast, we discuss why the hack happened, how the impact could have been minimized and some key takeaways from Marriott Starwood's response.

20 December 2018
Blog Post

Government Officials Must Become Better Attuned to Data Privacy Regulations

Data privacy and security is more important than ever before. Despite existing policies, the number of data breaches is on the rise and unencrypted personal information is getting into the wrong hands.
ISACA Journal Article

SOC Reports for Cloud Security and Privacy

Cloud adoption has increased by leaps and bounds, adding to the already increasing types of cyberrisk.

Author: Ashwin Chaudhary
Podcast

Using Red Teaming to Improve Your Security

Red team exercises can help enterprises find and address their weaknesses. Unfortunately, the cybersecurity skills gap extends to red teams and blue teams. In this podcast, Frank Downs and Dustin Brewer discuss why red teaming, in conjunction with blue teaming, is a valuable tool for cybersecurity, and they also discuss some of the causes of and solutions to the skills gap.

18 December 2019
Blog Post

Addressing the Challenges of New Privacy Laws

US State of California Senate Bill 327 Information Privacy: Connected Devices (SB 327) goes into effect January 2020.
Blog Post

Artificial Intelligence: A Damocles Sword?

In Greek mythology, the courtier Damocles was forced to sit beneath a sword suspended by a single hair to emphasize the instability of kings’ fortunes. Thus, the expression “the sword of Damocles” to mean an ever-present danger.
@ISACA Article

CRISC: The Perfect Partner to CISA for a Holistic View of Audit and Risk Management

In 2018, Mercy Omollo-Mbai, CISA, CRISC, ISACA Kenya (Africa) Chapter communications committee secretary (2019-20) and IT internal audit manager at Liberty Group East Africa...

11 December 2019
@ISACA Article

ISACA Concludes 50th Anniversary Year With a Look at the Next Decade of Tech

As ISACA’s 50th anniversary year draws to a close, the association looks to the future and explores how to help members navigate tech innovations in the 2020s.

11 December 2019
@ISACA Article

As an ISACA certification holder, you need to earn continuing professional education (CPE) hours by 31 December 2019 to maintain your certification through 2020.

As an ISACA certification holder, you need to earn continuing professional education (CPE) hours by 31 December 2019 to maintain your certification through 2020. As an ISACA member, you can earn CPE hours in many ways...

11 December 2019
@ISACA Article

Learn to Detect Encrypted Traffic

Over the last decade, encrypted network traffic has increased tremendously, making incident responders’ jobs more challenging. Decrypting traffic can be difficult, and while encryption can protect user privacy...

11 December 2019
@ISACA Article

Three More Vs of Big Data

In my 12 June 2019 @ISACA column, I identified the 4 Vs of big data as areas of focus and understanding to properly review, assess and audit big data systems and organizational efforts. There are at least 3 other Vs to consider when reviewing big data systems.

11 December 2019
@ISACA Article

Back in 2001, someone wrote, “In the near future, I am certain we are going to replace passwords.

Back in 2001, someone wrote, “In the near future, I am certain we are going to replace passwords. Maybe a better way to put it is that we are going to replace all those passwords with just one.” Who said that?

11 December 2019
ISACA Journal Article

Security Governance or an Elephant Fight?

There is an African proverb that says, “When elephants fight, it is the grass that suffers.”

Author: Enric Llaudet
Blog Post

Who Am I? CRISC Equips Professionals and Organizations with a Valuable Identity

As a risk practitioner, have you ever tried to describe what you do for a living to a family member or a friend?

Blog Post

AI Practitioners: Our Future Is in Your Hands

Imagine it is sometime in the 22nd century and that the future you is preparing for a complex surgical procedure at the local robot-run hospital, where it has become commonplace for robots to perform sophisticated, repeatable tasks, such as heart surgery, on human patients.
The Nexus Article

Routine Maintenance

I find that many outside of our profession believe cybersecurity is overly complicated and, frankly, nerdy. Because of this view, soft skills required to translate technical issues into business context are extremely important. This belief may also be dissuading youth from pursuing tech careers and, instead, steering them to be simply consumers of technology.

9 December 2019
Blog Post

When Everything Old is New Again: How to Audit Artificial Intelligence for Racial Bias

You may not know it, but artificial intelligence (AI) has already touched you in some meaningful way.

ISACA Journal Article

Building Security Into IoT Devices

There will be more than 64 billion Internet of Things (IoT) devices by 2025.

Authors: Farbod H. Foomany and Nathanael Mohammed
Blog Post

AI and Healthcare: A Life-Saving Combination

Artificial intelligence (AI) and machine learning are common terms in the world of emerging technology. Although still sounding futuristic to some people, AI is already being deployed everywhere from fantasy football weekly recap emails, to retail environments, to advanced, state-sponsored surveillance systems.
Blog Post

Overcoming Legacy Thinking a Key Strategy for Actively Shaping The Future

The rapidly increasing pace of technology change and digital disruption leads to an unprecedented pace at which organizations must address opportunities and risks that could make or break their success. In the new decade of the 2020s, technology-driven exponential change will accelerate even more sharply. Unfortunately, most organizations are ill-prepared for what is to come, and will remain so unless they replace their reactionary approach to the technology landscape with an anticipatory one.
Podcast

Rise of the Digital Natives

The technology landscape of the 2020s is sure to include some sweeping changes. What impact might the rise of more digital natives to leadership roles within their organizations have on how organizations explore and deploy technology? On this episode of the ISACA Podcast's 50th Anniversary Series, guest Alicja Foksinska offers her perspective.

3 December 2019
@ISACA Article

CISM: The Key to Moving From Auditor to Manager

In 2015, Ferry Haris, CISA, CISM, IT risk manager at APG Asset Management, decided that he wanted to branch out from his role as an auditor, but also continue to utilize his base of knowledge...

27 November 2019
@ISACA Article

Five Key Lessons Learned From Publicly Disclosed Data Breaches and Security Incidents

Key lessons can be learned from publicly disclosed data breaches and security incidents. These lessons can help organizations more effectively focus their investments and efforts to prevent themselves from becoming victims in similar instances.

27 November 2019
@ISACA Article

Gain Insight Into Mitigating IT Risk

IT risk management is essential as mitigating risk ensures that organizational value is kept intact. Join IS, IT and business professionals and experts for ISACA’s IT Risk Management Virtual Summit 2019.

27 November 2019
@ISACA Article

Pursuing a New Career With Passion: A Few Minutes With Zinet Kemal

Zinet Kemal, CISA, CySA+, Network+, Security+, was a legal assistant in Ethiopia before moving to the United States 6 years ago. Once she arrived in the United States, her technology career journey began...

27 November 2019
@ISACA Article

Share Your Feedback on the ISACA Podcast

The ISACA Podcast offers thought leadership, practical strategies and career guidance in a quick and easy-to-digest format. To better serve you, ISACA welcomes your feedback on the podcast. If you want to learn more about a specific topic...

27 November 2019
@ISACA Article

Why Auditors Rarely Find Fraud

In today’s world where corporate scandals often make front-page news, fraud prevention and detection are becoming a priority for management and decision-makers.

27 November 2019
Blog Post

How Big Data Aids Cybersecurity

The increasing reliance on big data and the interconnection of devices through the Internet of Things (IoT) has created a broader scope for hackers to exploit.
ISACA Journal Article

Auditors Have a Role in Cyberresilience

Cyberthreats are an issue for any organization or individual anywhere in the world due to the increasing dependence on computer systems, infrastructure, the Internet, social media and technological innovation.

Author: Shemlse Gebremedhin Kassa
Podcast

Dynamic Information Security in a Static Organizational Culture

Understanding an organization’s culture is essential when building a cybersecurity program. But how can security professionals learn about the culture, and how should that drive security programs? In this podcast, we discuss how to build a strong cybersecurity culture, how to leverage the organization’s culture when developing security initiatives and strategies to overcome impediments to a cyberculture.

27 November 2019
Blog Post

Ignorance is Not Bliss When It Comes to Defending Against the Dark Web

The dark web ecosystem continues to evolve as a place where cybercriminals can sell and access stolen data, purchase black-market items such as guns, drugs and hacking software, and connect with like-minded individuals.
Blog Post

Infosecurity-ISACA Conference Highlights: Hands-On Experiences and Dialogue Around Emerging Technologies, 2020 Predictions and Women in Tech

Theresa Payton set the tone for the first day of last week’s Infosecurity ISACA North America Expo & Conference in New York City, delving into the multifaceted landscape of emerging technologies with the audience of information security professionals, and also sharing anecdotes from one of her most high-profile jobs, as White House CIO under the George W. Bush administration—including a story of negotiating with a cyber criminal on the dark web at her kitchen table over three nights.
Podcast

Overcoming Complexity to Secure Critical Infrastructure

Complex interdependencies in the supply chain and elsewhere can make assessing risk difficult, particularly when it comes to protecting critical infrastructure. In this episode of the ISACA Podcast, guest Charlie Harry provides his perspective on how governments and organizations can overcome these challenges.

25 November 2019
Blog Post

Information Governance: You Have to Start Somewhere

Deborah Juhnke, senior consultant with Information Governance Group LLC, cited a definition of information governance as “an organization’s coordinated, interdisciplinary approach to satisfying information compliance requirements and managing information risks while optimizing information.”
Podcast

Cyberattacks on Industrial Technology and SCADA Systems

An unsophisticated attack on industrial control systems can halt the operations of manufacturing plants, resulting in lost revenue and reputational harm. But a few simple steps can help organizations prevent attacks from happening and recover quickly when they do occur. In this podcast, we discuss the steps organizations can take to secure their operations.

21 November 2019
Podcast

Cyberleadership in an Ecosystem Context

To tackle the complex challenges of the cyberlandscape, strong leaders are needed. But what makes someone a leader, and what should be expected of leaders? In this podcast, Matt Doan discusses how to be a leader, why more cyberleaders are necessary and why it’s beneficial to think of cybersecurity in an ecosystem context

21 November 2019
ISACA Journal Article

What the Board Needs to Know About the Organization’s Cybersecurity Status

Cybersecurity breaches have come to the attention of boards of directors (BoDs) because of their impact.

Author: Kumaragunta Harisaiprasad
Podcast

Diving into Data with Computer-Assisted Audit Tools

Computer-assisted audit tools can help auditors improve testing and more efficiently deal with the barrage of data being created these days. Infosecurity-ISACA North America Expo and Conference presenter Rochelle Vargas discusses why she considers these tools to be game-changers for auditors.

20 November 2019
Podcast

Seeing Beyond Taboos to Understand the Dark Web

Many organizations are intimidated by the dark web or don't think they have the needed expertise to counter security threats that originate there. In this episode of the ISACA Podcast, recorded from the Infosecurity-ISACA North America Expo and Conference, conference presenter Alex Holden makes the case for why organizations need to prioritize understanding the dark web, and explains how they can go about doing it.

20 November 2019
Podcast

New Paths in the Pursuit of Knowledge

Learning and certification have been at the heart of ISACA's 50-year history, but many of the ways in which technology professionals have pursued industry expertise have changed with the times. Guest Allan Boardman provides his perspective on what has changed and what has stayed constant for learners in ISACA's professional community.

19 November 2019
Blog Post

What Do You Expect in the Next Decade of Tech?

What are some of the major changes you expect to see in the technology landscape in the next decade?
ISACA Journal Article

Cybersecurity Takedowns

Information security programs are not easy or totally successful on a global scale.

Author: Larry G. Wlosinski
Podcast

Examining the NordVPN Hack

The use of VPNs is often touted as a strong security measure, but what happens when the VPN service you use is compromised? In this podcast, Dustin Brewer and Frank Downs discuss the recent NordVPN hack, the importance of pen testing and auditing, and lessons learned from the incident.

15 November 2019
Blog Post

How Blockchain is Revolutionizing the Travel and Hospitality Industry

The potential of blockchain technology has inspired hype and buzz for years.
@ISACA Article

Tips for Improving Risk Assessment and Analysis

In honor of ISACA’s 50th anniversary, this column seeks to provide tips on an area of risk management that has been very slow to change—quantitative risk and decision analysis.

13 November 2019
@ISACA Article

Applying COBIT to Vendor Risk Management

Almost all enterprises today employ third-party vendors or suppliers. When outsourcing any product or service, risk must be assessed. Successful enterprises separate themselves from unsuccessful ones in how they govern and manage their risk...

13 November 2019
@ISACA Article

What Is in Store for the Next Gen Auditor?

The IT audit profession is changing and evolving, and the IT auditor must change and evolve with it. The next generation of audit emphasizes looking toward the future rather than only examining the past.

13 November 2019
@ISACA Article

Invest in Your Future and Save With ISACA Membership

Continuing education and pursuing new certifications allows you to invest in your career and yourself. By joining ISACA you receive discounted access to global industry conferences, save on certification exams and prep materials...

13 November 2019
@ISACA Article

ISACA Gives Back Around the World

On 5 October 2019, 2,800 volunteers gathered around the world to give back to their communities during ISACA’s first-ever worldwide day of volunteerism, ISACA CommunITy Day.

13 November 2019
ISACA Journal Article

Accountability for Information Security Roles and Responsibilities, Part 2

Part 1 of this article proposed a method using ArchiMate to integrate COBIT 5 for Information Security with enterprise architecture (EA) principles, methods and models to properly implement the chief information security officer’s (CISO’s) role.

Authors: Tiago Catarino and André Vasconcelos
Blog Post

Feeling Like A Fraud: Imposter Syndrome

“Imposter Syndrome can be defined as a collection of feelings of inadequacy that persist despite evident success.
Podcast

Dispelling Myths About the Tech Workforce Gender Gap

The misconceptions about why women are underrepresented in the tech workforce are numerous – some cling to the notion that girls and women aren't as interested or proficient in tech fields, despite plenty of evidence to the contrary. In this SheLeadsTech Series episode of the ISACA Podcast, guest Beverly Allen addresses some of the misconceptions about the gender gap in technology fields such as cybersecurity.

12 November 2019
Blog Post

Value Professional Networking Early in Your Career

Depending on your personal interests, social skills and professional goals, professional networking may or may not be your favorite activity. Whether or not you enjoy networking, it should be a priority in your professional life – especially earlier in your career as you are building your professional network.
The Nexus Article

Tokenization: Your Secret Weapon for Data Security?

Consider this: 4.1 billion records have been compromised in the first half of 2019 alone, a 54% increase over the same period in 2018. Organizations in nearly every industry are facing an ever-growing and out-of-control cybersecurity crisis.

11 November 2019
The Nexus Article

Third-Party Risk Management Vs. Provider’s Accountability

Lately, I have been reflecting on the need to assess third-party risk and how other business sectors have mitigated this risk in the past. I have concluded the origin for this need is what economists call a “market failure.”

11 November 2019
Governance Article

Transitioning From COBIT 5 to COBIT 2019 | ISACA

COBIT 5 was released in 2012 and, after 6 years, in November 2018, the first titles in the updated COBIT 2019 framework began to appear. Implementers observe that, in practice, enterprises often require several years to become familiar with an upgraded framework and adopt new guidance and standards.

11 November 2019
Podcast

Using COBIT to Govern and Manage Third-Party Risk

Every organizations uses suppliers, and these suppliers (while adding value) also can pose a risk. In this podcast, Mark Thomas discusses some of the main challenges organizations face when managing their vendor and supplier risk, how to use COBIT to govern and manage this risk, and how organizations not using COBIT can put the tips presented in this podcast into practice.

8 November 2019
Blog Post

What I Wish I Knew When I Started in IT Audit

Who among us does not sometimes reflect on our journey and certain days that remain nailed to our memory, either because they were too tough to forget or too good to be true?

7 November 2019
Blog Post

Information Security for Biomedical Devices

Though device manufacturers have worked to improve the cybersecurity of their medical devices, there is still a long way to go. Improvements aside, there are distinct steps the IT information security department can take to reduce risk and improve cybersecurity for medical devices.
Podcast

Using COBIT for Effective Digital Transformation

Digital transformation can give organizations a competitive edge and improve their operations. The COBIT framework can be used as a powerful tool for digital transformation efforts. In this podcast, we discuss how to use COBIT to guide your organization’s digital transformation efforts.

5 November 2019
Blog Post

AI or GDPR?

Consider an organization adopting artificial intelligence (AI) as being represented by a self-driving car.

Blog Post

For Tech and IT Startups, Coworking Spaces Make the Most Sense

When most people think about coworking spaces, they immediately picture a bunch of freelancers and solopreneurs working on independent ventures at shared desks. But coworking spaces are more versatile than this.
ISACA Journal Article

Information Security Matters: Un-Privacy by Design

At the end of my last column, I allowed myself a bit of a sneer at the notion of “privacy by design.”

Author: Steven J. Ross
ISACA Journal Article

Data Auditing: Building Trust in Artificial Intelligence

While IT risk management driven by standards/frameworks such as the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) ISO/IEC 27001:2005 Information technology—Security techniques—Information security management systems—Requirements, British Standard (BS) 7799-3 (2006) and ISACA’s Risk IT (2009) have been around for more than a decade, in reality, IT risk management can trace its roots back to the very reason for the establishment of ISACA 50 years ago.

Author: Guy Pearce
ISACA Journal Article

The Intelligent Audit

Artificial intelligence (AI) is a key contributor to recent technological innovations, including autopiloted cars.

Authors: Pascal A. Bizarro, Emily Crum and Jake Nix
ISACA Journal Article

The Network: Walt Blackwood

What is the biggest security challenge that will be faced in 2020?

Author: Walt Blackwood
ISACA Journal Article

IS Audit Basics: Auditing Software Licenses

Those of you who have read my bio are aware that in addition to writing for the ISACA Journal, I am also a topic leader for the Audit and Assurance community on ISACA’s Engage Online forum.

Author: Ian Cooke
ISACA Journal Article

The Practical Aspect: Some Security-Related Reminders

As a discipline, information security has come a long way.

Author: Vasant Raval
ISACA Journal Article

Innovation Governance: Innovate Yourself

A couple of years ago, I made the statement during a presentation that the amount of information collected in auditing systems and controls is orders of magnitude greater than what we collected 10 years ago.

Author: K. Brian Kelley
ISACA Journal Article

Auditing the Crown Jewels From a Cyberrisk Perspective

Auditing standards require auditors to produce a documented risk-based audit plan, taking into account input from senior management and the board.

Author: Jaco Cloete
ISACA Journal Article

Trends, Challenges and Strategies for Effective Audit in a Rapidly Changing Landscape

Traditional audit is a typically retroactive activity that identifies risk in running operations and proposes solutions.

Author: Spiros Alexiou
ISACA Journal Article

Inherent Risk in Adopting RPA and Opportunities for Internal Audit Departments

Many organizations are rapidly moving to implement robotic process automation (RPA) because it helps leverage multiple fronts, including cost advantage, workforce optimization, quality improvements, flexible and dynamic execution, speed, and agility.

Author: Gaurav Priyadarshi
ISACA Journal Article

Preparing for the Next Generation of Auditing

Whether one is auditing a rapidly transforming organization, executing audits of emerging technologies, mentoring new auditors or guiding experienced auditors, an element shaping the 21st century business environment is an increased emphasis on data analytics.

Author: Grace Johnson
Blog Post

Rising Complexity, Higher Stakes for Enterprise Risk Management

Cyber risk has understandably become a focal point for enterprise risk managers, but the risk landscape is multi-layered and extends beyond the realm of cybersecurity. In addition to contending with a daunting array of cyberthreats, enterprises are determining how much risk they are willing to accept in deploying emerging technologies, working through a heightened focus on customer privacy and adjusting to changes in the regulatory environment.
Blog Post

The Role of Data Strategy in Optimizing Organizational Processes

The relevance of data cannot be over emphasized in today’s world, where change is the only constant. Decisions that managers and executives tend to make emanate from the availability of data analysis.

@ISACA Article

Common Misconceptions About Radio Waves, Radio Frequency and Wireless Communication

Think about the last time you communicated via radio. Many people think they only listen to the radio in the car or think about the time when Morse code, walkie-talkies and teletype machines were more prevalent.

30 October 2019
@ISACA Article

Preparing for an IT Audit

As IT risk and regulations change, IT departments are tasked by auditors and compliance professionals to clarify IT processes, provide audit evidence and identify control issues.

30 October 2019
@ISACA Article

The Top Challenges Facing IT Auditors

While innovation and emerging technologies are imperatives for any organization looking for a competitive edge, they have created challenges for the IT audit industry. To provide insights on the challenges that IT auditors face...

30 October 2019
@ISACA Article

ISACA Podcast Explores Parallels Between Environmental Sustainability and Digital Transformation

To glean valuable industry insights, gain practical knowledge and keep up with industry trends, subscribe to the ISACA Podcast. In these podcasts, security experts, published authors, conference speakers and industry experts share...

30 October 2019
@ISACA Article

New Research Explores Critical Risk Categories and Overall Risk for Organizations Today

The turbulence in today’s risk landscape is unprecedented, and many organizations are wondering how their risk mitigation is faring relative to other enterprises. To examine risk management leaders’ insights on current organizational risk mitigation strategies...

30 October 2019
@ISACA Article

A Passion for SheLeadsTech: A Few Minutes With Karen Sandhu

Karen Sandhu, CISA, CRISC, is a professional with 15 years of risk management experience in information security, data privacy, emerging technology risk, cloud security, security incident response, governance and internal controls.

30 October 2019
Blog Post

Technology Emboldening Innovators on the Ground, in the Air and Beyond

A future in which passengers order air taxis, victims of serious accidents tap neurotechnology to rise above limitations and AI/machine learning-fueled space exploration allows astronauts to trek deeper into the universe – for longer periods – was boldly presented on Monday, 28 October, at the Dare Mighty Things technology conference in Chicago, Illinois, USA.
ISACA Journal Article

Making AI GDPR Compliant

As one of the strictest regulations related to data protection and privacy, the EU General Data Protection Regulation (GDPR) has attracted attention from countries all over the world.

Author: Andrea Tang
Blog Post

Practical Recommendations for Better Enterprise Risk Management

Based upon my experience in Enterprise Risk Management, I was not surprised to see respondents to new State of Enterprise Risk Management research from ISACA, CMMI Institute and Infosecurity identify risk identification and risk assessment to be the most employed risk management steps in their organizations
Podcast

Volunteerism: The Catalyst of ISACA’s Sustained Growth

From its proud but humble origins as a small group of auditors in the Los Angeles area, ISACA has evolved over the past 50 years into a thriving global association of business technology professionals. A spirit of volunteerism has been the catalyst, as explored in this episode of the ISACA Podcast with guest Michael Cangemi.

29 October 2019
Governance Article

COBIT 2019 for Enterprise Governance Strategy | ISACA

Strategy is a plan for achieving a set objective. COBIT 2019 is here to help practitioners apply standard information and technology (I&T) controls to enterprise governance strategy. Mapping control objectives from the International

28 October 2019
Blog Post

CISOs and CMOs Joined At The Hip in the Era of Big Data

Senior leaders in business and government ought to take note of ISACA’s State of Cybersecurity 2019 research, which details the findings of a global survey of cybersecurity professionals.
Blog Post

Senior IT Audit Leaders Discuss Cybersecurity Data Analytics

Senior IT audit leaders met to discuss a wide variety of topics, including audit analytics, IT audit’s role in cybersecurity and incident management, and agile/DevOps shops, at the recent IT Audit Leaders Summit in Geneva, Switzerland, as part of EuroCACS/CSX 2019. Participants shared opinions and best practices, and strategized on the path forward with new technologies and business practices.
ISACA Journal Article

Ensuring Vendor Compliance and Third-Party Risk Mitigation

Implementing the EU General Data Protection Regulation (GDPR) is a significant challenge for most enterprises because it requires many to completely change their perception of personal data security.

Author: Jan Anisimowicz
Blog Post

Securing the SWIFT Cross Border Payment System Within Banks

A series of cyber-attacks involving the SWIFT banking network have come to light in recent years. The first public report of these attacks came from the Bangladesh Central Bank, and we have also seen attacks at State Bank of Mauritius, Cosmos Bank (India) and City Union Bank (India).
Podcast

Addressing the Challenges Facing IT Auditors

Organizations that want to have a competitive edge must leverage the power of emerging technology, but this technology adds complexity to IT auditing. What can auditors do to address this complexity, and what is the role of business leaders when it comes to IT audit? This podcast, in partnership with Protiviti, discusses the results of the 2019 Global IT Audit Benchmarking Study and provides insights on the top challenges IT audit professionals face, how to address these challenges and the skills IT auditors must have.

22 October 2019
Blog Post

Is Your Organization Supporting Paths to Develop Women as Leaders?

Is your organization supporting women in reaching leadership positions? Why is this important?
Blog Post

Saluting the Spirit of Volunteerism That Made CommunITy Day a Success

On ISACA’s first CommunITy Day on 5 October, 2019 – a day in which our global professional community came together over one day to volunteer in their local communities – the passion, creativity and industriousness of ISACA’s professional community was on full display.
@ISACA Article

Third-Party Risk Management Vs. Provider’s Accountability

Lately, I have been reflecting on the need to assess third-party risk and how other business sectors have mitigated this risk in the past.

16 October 2019
@ISACA Article

What We Can Learn About Cybersecurity From Game of Thrones

Even after cybersecurity professionals have built “walls,” they can become obsessed with adding newer, bigger layers of defense. If you have watched Game of Thrones (GoT), you may notice this attitude is similar to the behaviors...

16 October 2019
@ISACA Article

Improving How Information Security and Risk Management Work Together

Technology is essential for organizational success, but as technology and innovation evolve, risk grows. The increase in risk makes transparent risk management vital, and regular communication between the IT and risk management...

16 October 2019
@ISACA Article

Participate in Hands-On Experiences and Gain In-Depth Technical Knowledge at Geek Street

16 October 2019
Blog Post

Establishing Credibility with More Experienced Clients and Business Partners

I graduated college with all the confidence in the world. However, I then entered Corporate America, and I had a rude awakening.
ISACA Journal Article

Accountability for Information Security Roles and Responsibilities, Part 1

In recent years, information security has evolved from its traditional orientation, focused mainly on technology, to become part of the organization’s strategic alignment, enhancing the need for an aligned business/information security policy.

Authors: Tiago Catarino and André Vasconcelos
Blog Post

A Seat at the Table: Internal Auditors as Operational Partners and Organizational Strategists

IT auditors new to the profession may hear references to a time when the internal audit function was viewed as the “police.” Years ago, it was not uncommon for organizations to perceive internal audit’s responsibilities of assessment and evaluation as being similar to that of a policing function.

Podcast

Applying Environmental Sustainability to Digital Transformation

Environmental sustainability principles support a healthy ecosystem that sustains life. Much of the language used in environmental sustainability is also used in the digital ecosystem. In this podcast, we discuss how environmental sustainability principles can be applied in a digital transformation context to protect a valuable resource of modern times: information.

15 October 2019
Blog Post

ISACA’s SheLeadsTech™ Second Day of Advocacy in DC: Paving Pathways for More Women and Girls in Tech

More than 60 women and men gathered on Capitol Hill in Washington, DC, on 7 October for the SheLeadsTech program’s second annual Day of Advocacy.
The Nexus Article

Email Warning Banners: Are We Using Them Effectively?

Imagine walking out to your mailbox on a sunny day. Most of us can relate to eagerly awaiting a package containing the latest gadget that you bought online. You reach into the mailbox, leaf though the contents and are likely disappointed that your postal carrier has deposited a pile of bills; it is a tragedy that occurs far too often.

14 October 2019
The Nexus Article

Securing Tomorrow: Investing in Digital Education

Scan your favorite news sources and you will see frequently repeated words such as “breach,” “compromise,” “exposure,” “identity theft” and “hacker.” Headlines routinely highlight the impact (or potential impact) to critical infrastructure, economic prosperity, financial markets, etc.

14 October 2019
Blog Post

Big Data Analytics Powering Progress in Animal Agriculture

There has been significant progress in technologies that can be utilized in the livestock industry. These technologies will help farmers, breeders associations and other industry stakeholders in continuously monitoring and collecting animal-level and farm-level data using less labor-intensive approaches.
Blog Post

ISACA Well-Positioned to Advance Learners’ Journeys

I am the product of a liberal arts education. On the surface, what I learned in school has very little relevance to my day to day right now, yet, when you dig deeper, the communication and critical thinking skills that education instilled in me helped in ways beyond measure.
Blog Post

Regulatory Landscape Provides Added Incentive for Enterprises to Explore Blockchain

The increasing emphasis on data privacy gained widespread attention last year with the enforcement deadline of the General Data Protection Regulation (GDPR).
ISACA Journal Article

The Human Factor in Information Security

Humans represent a mystery to be deciphered by security/cybersecurity experts because their behaviors, attitudes, beliefs, rituals and decisions (the general characteristics that define a culture) constitute a little-understood universe for executives and their heads of security.

Author: Jeimy J. Cano M.
Blog Post

Cybersustainability: Ensuring Digital Strategies That Protect Data

Increasingly, security professionals use language that makes a distinct comparison between our physical environment and our digital infrastructures.

Blog Post

Will Women in Tech Benefit from Millennials Weighing in or Exiting Out of Overdemanding Tech Cultures?

The tech industry has been burning through talent and losing IP for decades, but this is usually after years or even decades of contributions. Some suggest it is based on work-life balance challenges, but a recent ISACA study, Tech Workforce 2020: The Age and Gender Perception Gap, highlights how millennials factor into this equation, too.
Blog Post

Tips for the Novice IT Auditor

Norman Ralph Augustine once said, “Two-thirds of the Earth’s surface is covered with water. The other third is covered with auditors from headquarters.” This highlights the rise of the auditing profession and the importance that more and more companies are placing on internal and external audits due to increasing regulatory requirements.
Blog Post

How the CISM and CISSP Certifications Can Complement One Another

In 2003, I had just completed my MSc in Information Security. I was excited about my future career prospects as I believed I had obtained at least the minimum level of knowledge needed to enter the information security field.
ISACA Journal Article

Fighting Fraud

Occupational fraud, e.g., internal theft, employee fraud and asset misappropriation, plagues enterprises of all sizes.

Authors: Chris Errington, Kevin M. Alvero, and Wade Cassels
@ISACA Article

Celebrating Success While Acknowledging Risk share

During an IS audit, I had the opportunity to observe a financial organization’s disaster recovery drill. They had planned to run the business from an alternate site for 1 full day.

2 October 2019
@ISACA Article

Maintaining Cybersecurity Resilience

As organizations continue to innovate with cloud technology and Internet of Things (IoT) devices, they must be diligent in securing these innovations. Technology will only continue to grow and change, and there are basic measures organizations...

2 October 2019
@ISACA Article

Maximize Your LinkedIn Experience

LinkedIn is essential in today’s digital world—as a personal branding, career advancement and networking tool. As you navigate LinkedIn, you may wonder how you can maximize the value of your LinkedIn profile to allow you to stand out in the eyes of potential employers and recruiters.

2 October 2019
@ISACA Article

How to Better Manage Third-Party and Enterprise Risk

Enterprise risk is affected by the overall vendor risk management program. As reliance on third parties to deliver products and services becomes greater over time, building sound enterprise processes and governance around third-party risk management becomes more critical.

2 October 2019
@ISACA Article

ISACA’s Newest Chapter: Ahmedabad, India

A desire to create more awareness about ISACA and its certifications led to the formation of the Ahmedabad (India) Chapter making it ISACA’s 222nd chapter. ISACA is currently represented by chapters in 96 countries across the world.

2 October 2019
Blog Post

Are We Asking the Right Questions When It Comes to the InfoSec Skills Shortage?

Chatting with a colleague recently about local economic issues, she made a remark which I found profoundly interesting at the time.
Podcast

Making Strides in Tech Workplace Culture

ISACA recently surveyed nearly 4,000 professionals in the tech workforce to find out what motivates them, what factors influence retention most and how perceptions about the workplace vary between women and men. In this SheLeadsTech Series episode of the ISACA Podcast, we delve into several of the survey findings.

1 October 2019
Blog Post

How 20 Minutes Can Lead to a More Inclusive Tech Workforce

If perceptions were always reality, why would a company that has hired professionals after conducting reasonable background checks be wary of internally orchestrated fraud and other white-collar crime?
Blog Post

Who Should the CISO Report To? It Depends

The information security challenges faced by enterprises are dependent on the unique characteristics of the business. This means there is no one “right” answer for where the CISO sits on the org chart.

Podcast

Exploring Cybersecurity Misconceptions in Pop Culture

Popular culture depictions of cybersecurity, while entertaining, are often inaccurate, which could be dissuading people from exploring careers in cyber. In this podcast, we discuss some common misconceptions of cyber in pop culture, how that affects the cyberworkforce and how cyberprofessionals can draw people into cybersecurity careers.

26 September 2019
ISACA Journal Article

Sustainable Development for Digital Transformation, Part 2

Increasingly, organizations connect their on-premises infrastructures to cloud-based technologies, both from a Software-as-a-Service (SaaS) and an overarching infrastructure perspective.

Authors: Joe Raschke and Karen Walsh
Blog Post

The 2010s: A Decade of Growth and New Focal Points for ISACA

The 2010s have seen remarkable growth at ISACA.
Podcast

Breaking Down Barriers in Mobile Security

The need for mobile security solutions has exploded in the 2000s, but many of organizations' traditional security considerations are insufficient when it comes to accounting for the proliferation of mobile devices. In this 50th Anniversary Series episode of the ISACA Podcast with guest Eric Green, we find out why it is so hard for individuals and their organizations to get it right on mobile security, and what can be done to break down those barriers.

24 September 2019
Blog Post

I Know What I Know (If You Know What I Mean)

Edie Brickell (incidentally the wife of singer/songwriter Paul Simon) had a modest 1988 hit titled “What I Am.” The opening lines of the song contain the lyrics “I'm not aware of too many things. I know what I know if you know what I mean.”
Blog Post

What Capital One Got Right

The massive cyber breach of Capital One, reported in late July, quickly brought a chorus of condemnation of the company from a wide circle of pundits, concerned customers, competitors and potential investors. Lost in the media fray was Capital One’s exceptional incident response.
Blog Post

How Company Culture Helps Shape the Risk Landscape

In today’s environment, companies all over the globe are experiencing culture risk.
@ISACA Article

Managing Third-Party Risk

Third-party vendors are integral to delivering products and services for many enterprises, and this can pose a risk to the organization itself.

18 September 2019
@ISACA Article

CISA: The Stepping Stone to an Auditor’s Success

Dapo Ogunkola discovered the value of the Certified Information Systems Auditor (CISA) certification as an intern early in his career. While interning at a Nigerian bank in 2008, Ogunkola says, “I noticed all my mentors in the internal audit department were all CISAs...

18 September 2019
@ISACA Article

Leading as an Auditor and Woman in Tech: A Few Minutes With Deidre Melton, Internal Auditor and Investigator at Florida A&M University

Deidre Melton, CISA, CRISC, CISM, CFE, CIA, serves as an assurance, risk assessor, investigator and advisory professional specializing in IT and cybersecurity at Florida A&M University (USA).

18 September 2019
@ISACA Article

Proactive Risk Management

While no one can predict the future, one can reasonably anticipate negative events and their outcomes, and even plan for appropriate responses. Risk management is a proactive planning process that mitigates and provides plans around negative events...

18 September 2019
@ISACA Article

Why COBIT 2019 Matters for Auditor

The new publication COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution contains key concepts that can help auditors build prioritized audit plans.

18 September 2019
ISACA Journal Article

Factors Influencing the Adoption of Cybersecurity Situational Awareness Programs

The rapid and sustainable advancement of the IT environment has improved domestic and industrial operations and connectivity.

Author: David V. Hart
Blog Post

Sizing Up Email Security Protocols

Given the many instances of email security compromises, it has become vital to provide additional security to emails from the domain administrator level. Security protocols such as Domain-Based Message Authentication, Reporting and Conformance (DMARC), Domain Keys Identified Mail (DKIM), Sender Policy Framework (SPF) and Brand Indicators for Message Identification (BIMI) to prevent address spoofing are considered below.
Blog Post

Has GDPR Been a Success So Far?

Since 25 May, 2018, the General Data Protection Regulation (GDPR) has been providing unified rules for data processing, requiring wider protection for the rights and interests of data subjects, and establishing important guidelines around the flow of information in the European Union.
Governance Article

Using COBIT 2019 Performance Management Model to Assess Governance & Management Objectives | ISACA

COBIT 5 was released in 2012 and, after 6 years, in November 2018, the first titles in the updated COBIT 2019 framework began to appear. Implementers observe that, in practice, enterprises often require several years to become familiar with an upgraded framework and adopt new guidance and standards.

16 September 2019
Blog Post

Third-Party Vendor Selection: If Done Right, It’s a Win-Win

The benefits that can be realized from using third parties to support the delivery of products and services are always part of any good sales pitch by prospective vendors. Often these benefits include reductions in operational spend, scalability, improved delivery time, specialized capabilities, and the availability of proprietary tools or software, all of which equate to a competitive advantage for companies leveraging third-party relationships effectively.
Blog Post

US Government Innovates Cyber Job Fulfillment

Cybersecurity professionals believe their teams are understaffed, many teams have unfilled positions, open positions often take six months or more to fill, and job candidates often are not qualified for the positions for which they applied, as evidenced in the last several State of Cybersecurity annual surveys conducted by ISACA.
ISACA Journal Article

Call for Supply Chain Security

Awareness of the risk to enterprise information assets through the supply chain surged after the 2013 Target Corp. data breach.

Author: Tom Bray
Blog Post

CISOs Must Address Their Blind Spot for Effective Oversight of ICS Security

Cybersecurity resilience of Industrial Control Systems (ICS), Building Management Systems (BMS) and other Operational Technology (OT) systems is falling behind, a critical challenge considering the potential impact of a cyberattack on ICS and OT could result in the loss of lives and/or major environmental damage.

Blog Post

How to Prepare for Taxation in a Digitalized Economy

While IT professionals and auditors are not required to be tax experts, they do need to have a certain level of mindfulness with regard to taxation within the digitalized economy going forward as tax collection is slowly but surely becoming part of the natural business ecosystem where taxation happens by default.
Blog Post

Improve ROI From Technology By Addressing the Digital Risk Gap

All too often, IT and risk management professionals seem to be speaking a different language—that is, if they even speak at all. Bridging the Digital Risk Gap, the new report jointly authored by RIMS, the risk management society®, and ISACA, promotes understanding, collaboration and communication between these professionals to get the most out of their organizations’ technological investments.
The Nexus Article

A Key to Strengthening IT Security? Chaos

The chaos theory, a mathematics discovery first observed in the second half of the 20th century, aims to explain or even give some predictability to complex systems. At first glance, the chaos theory resembles most mathematical discoveries—a theoretical pursuit.

9 September 2019
Blog Post

How Responsible Are Cloud Platforms for Cloud Security?

These days, just about every software platform or app available has some kind of cloud functionality.
@ISACA Article

Innovating to Make a Difference and a Profit

Automation has allowed machines to take over many jobs people used to perform, freeing humanity up to innovate and pursue more purposeful, meaningful careers. In this Off-Stage and Off-Script episode of the ISACA Podcast...

4 September 2019
@ISACA Article

Apocryphal Risk Management

Oftentimes, stories are widely circulated in organizations and serve as a source of truth. For instance, it could be an enterprise’s belief that an organizational apocalypse will occur if the website goes down.

4 September 2019
@ISACA Article

Complying With New Laws and Regulations Around the World

The EU General Data Protection Regulation (GDPR) inspired the US states of California and Washington to enact similar privacy laws, and many more states and countries are expected to follow suit.

4 September 2019
@ISACA Article

Join ISACA for a Global Day of Service on ISACA CommunITy Day

ISACA is committed to giving back and hopes to give ISACA members around the world a chance to make the world a better place during this new event, ISACA CommunITy Day on 5 October 2019. This inaugural event exemplifies ISACA’s purpose, promise and values with a day of volunteer service.

4 September 2019
@ISACA Article

Secure Your Networks Perimeter

Gaining perimeter access to networks can easily be accomplished via physical or proximity means. Some easy ways to thwart nefarious actors are to turn off your phone Wi-Fi when you leave your work or home ...

4 September 2019
Blog Post

Five Ways to Identify Early Leadership Opportunities as a Young Professional

It has been said that leadership cannot be learned and that it is an innate ability. While that may be true to a degree, there are steps young professionals can take to hone their innate leadership abilities through experience early in their careers.
Blog Post

Interesting Times Ahead: Why Young Professionals Should Consider Careers in Information Security

About 10 years ago, when I was deciding on my major in university, I was very anxious about where my decision would lead me. I eventually chose Management of Information Systems, and fast forward 10 years later, I’m working as an information security consultant at a Big 4 firm.
ISACA Journal Article

HelpSource Q&A

Does the IT risk management process differ from organization to organization?

Author: Sunil Bakshi
Blog Post

Cybersecurity a Central Ingredient in Evolving Digital Business Models

About the only thing shifting as fast as the cyber threat landscape is the typical enterprise’s org chart.
Blog Post

Digital Transformation Oversight Extends Beyond Technology

Digital transformation. Digitalization. Digitization. Three business terms in common use today that describe the differences in scope of the organizational digital effort, in this case in order of decreasing scope.
Podcast

Rebuilding Institutions for an Online World

Many of our institutions were created before the internet and major shifts on the technology landscape introduced unforeseen risks, threats and opportunities. In this Off-stage and Off-script edition of the ISACA Podcast, Infosecurity-ISACA North America Expo and Conference keynote speaker Jamie Bartlett provides his perspective on how to course correct.

3 September 2019
ISACA Journal Article

Enhancing the Board’s Readiness for Digital Transformation Governance

Shortcomings in IT governance and in the skills and competencies of boards to provide the requisite direction for digital transformation (DX) mean that boards in general are ill-equipped for DX oversight and for the nature of the decisions required to effectively achieve it.

Author: Guy Pearce
ISACA Journal Article

Value Creation Through Effective Data Strategy

It is often said that data are the new oil. This adage signifies not only how vital and valuable data are.

Author: Rajul Kambli
ISACA Journal Article

Information Security Matters: Why Do We Need Data Privacy Laws?

There has been no shortage of data privacy laws enacted in the past few years. The one that has received the most attention is the EU General Data Protection Regulation (GDPR).

Author: Steven J. Ross
ISACA Journal Article

IS Audit Basics: Providing Audit Committee Guidance

The Directive on Security of Network and Information Systems (NIS Directive) has been transposed into law in many European countries.

Author: Ian Cooke
ISACA Journal Article

The Network: Adam Kohnke

What is the biggest security challenge that will be faced in 2020?

Author: Adam Kohnke
ISACA Journal Article

The Practical Aspect: Today’s Interdisciplinary Auditors

The job of auditors has always been interdisciplinary. At the core of the auditor’s professional development is a multitude of disciplines—including accounting.

Author: Vasant Raval
ISACA Journal Article

The Need for a Digital Security Architecture

IT and security professionals tend to have a high degree of focus on tools and technology. While some place additional focus on processes.

Author: Jimmy Heschl
ISACA Journal Article

Digital Transformation of Taxation

The advancement of technology from analog electronics and mechanical devices to the digital technology available today emerged in the 1980s, when the Third Industrial Revolution was born.

Author: Helena Strauss
ISACA Journal Article

Sustainable Development for Digital Transformation, Part 1

Digital business models expand the numbers of an organization’s identities. Using new technologies to increase revenue and streamline business operations creates interconnected digital ecosystem.

Author: Joe Raschke
ISACA Journal Article

HelpSource Q&A

A speaker at a conference I recently attended stated that “Organizations must adopt digital transformation to stay ahead in business.”

Author: Sunil Bakshi
Blog Post

Know Who Your Customers Really Are or Prepare for Trouble

Recently in the UK, the women’s national football team manager, Phil Neville, called for all social media accounts to be verified and accountable as the result of a spate of racist postings, and asked for a boycott of social media until the situation is addressed.
Blog Post

Auditing Green IT

Sustainability has become a key focus in the 21st century.

Blog Post

Trsar Family Helps Ensure ISACA’s Growth in ‘Good Hands’

As ISACA celebrates its 50th anniversary in 2019, we are telling stories of the members, volunteers and staff who have contributed to ISACA’s growth and global impact. Below is an excerpt from a feature article on the ISACA staff father-son duo of Terry Trsar and Tim Trsar.
Blog Post

Keys to More Effective Vendor Risk Management

Certain industries have a better conceptual understanding of their supply chain than others. For instance, in manufacturing, it’s very clear that raw materials come in one end and out the other comes a completed, processed product for consumption.

Podcast

How to Stay Motivated About Cybersecurity, Build Your Network and Earn CPE

Enthusiasm for cybersecurity helps professionals stay motivated, and finding a network of like-minded professionals can be invigorating. Conferences can help cybersecurity professionals learn more and stay excited about cyber, but the amount of information gained from them can be overwhelming. In this Cyber Pros Exchange podcast, we discuss how you can make the most of a conference experience.

28 August 2019
Blog Post

Ethics in IT: An Emerging Frontier in the Enterprise Governance of IT

Trust. Privacy. Transparency. Three words that have invaded our technology lexicon. In an age of fashionable falsehoods, it is probably not surprising that these words permeate almost any aspect of our lives in technology, in government and even in our organizations.

Blog Post

Improving Cybersecurity Awareness Through Hacking

Cybersecurity awareness is a topic that most organizations and leaders know is important, but is typically treated as a check box requirement to remain compliant with regulations or mandates placed on the enterprise. Most leaders will argue that cybersecurity awareness training is very important but only marginally effective.
Blog Post

How Cybersecurity Can Better Support Digital Transformation Business Goals

Consumers are demanding we offer outstanding user experiences and technology interfaces, and we need to strategize how we both safeguard and leverage ever-growing portfolios of data and systems to differentiate ourselves from our competitors.

Blog Post

Learning to Secure AI

The trends appear to be presenting themselves all over the place; TV commercials, online ads, corporate product announcements, etc., are all saying the same thing: Artificial intelligence (AI) adoption and use are exploding.
@ISACA Article

Earn CPE While Learning About Emerging Trends at EuroCACS CSX Conference

Further your knowledge of information systems, business and cybersecurity at this year’s EuroCACS/CSX conference, 16-18 October 2019. This year’s event combines computer audit, control and security...

21 August 2019
@ISACA Article

Paving the Future of Tech With Cybersecurity Education Teen Cybersecurity Activist Kyla Guru

Security and safety are primary needs for all people. The requirements for both have changed in the digital age and need everyone’s attention now more than ever.

21 August 2019
@ISACA Article

Systems Thinking in Risk Management

Systems thinking is the ability or skill to solve problems in a complex system. Systems thinking focuses on understanding the way subsystems and resources of a system are interrelated and identifying interdependencies of subsystems in the context of the organization.

21 August 2019
@ISACA Article

Using EDR to Address Unmanaged Devices

Endpoint detection and response (EDR) systems allow enterprise security managers to detect how and when an endpoint has been compromised. But what happens when the endpoint is an unmanaged device?

21 August 2019
Blog Post

Exploring COBIT 2019s Value for Auditors

COBIT 2019 is a terrific resource for a wide range of business technology professionals.
ISACA Journal Article

Effective User Access Reviews

User access review is a control to periodically verify that only legitimate users have access to applications or infrastructure.

Author: Sundaresan Ramaseshan
Podcast

Who Holds the Keys to Your Data

Data centers no longer look the same as they did years ago. More and more is being outsourced, and the involvement of third parties can create risk for organizations. In this podcast, we discuss the implications of an outsourced data center and what organizations can do to keep their data safe.

20 August 2019
Blog Post

In the Age of Cloud Physical Security Still Matters

As a security consultant, I’ve had the opportunity to assess the security postures of clients of all shapes and sizes. These enterprises have ranged in sizes from a five-man startup where all security (and information technology) was being handled by a single individual to Fortune 500 companies with standalone security departments staffed by several people handling application security, vendor security, physical security, etc. This post is based primarily on my experiences with smaller clients.
Blog Post

The Role of Ethics in Risk Management

Most people are aware of and talking about risk management. However, barring a handful of high-profile and sophisticated IT organizations, for most enterprises, it is more talk vs. the actual implementation of risk management practices.
Governance Article

Digital Business Transformation Using COBIT 2019 | ISACA

In today’s economy, digital business transformation is not an option—it is business imperative. Many enterprises develop a false sense of transformation security by running isolated digital projects and change initiatives that are not strategically transformational.

19 August 2019
Blog Post

The Film Industry and IT Security

For those in the ISACA community who are fans of popular culture, you might have noticed in recent years that, in many cases, film and TV stars are beginning to look more like you and I, and less like the muscle men of our youths.
Blog Post

Ethical Considerations of Artificial Intelligence

Have you ever stopped to consider the ethical ramifications of the technology we rely on daily in our businesses and personal lives?

Blog Post

The Key Point Everyone is Missing About FaceApp

Much has been written in recent weeks about the widely publicized privacy concerns with FaceApp, the app that uses artificial intelligence (AI) and augmented reality algorithms to take the images FaceApp users upload and allow the users to change them in a wide variety of ways.

ISACA Journal Article

Preparing for the AI Revolution

C-level executives, security professionals, IT technicians and audit managers face constant pressure to assess, assimilate and govern emerging technology, including artificial intelligence (AI).

Author: Adam Kohnke
Blog Post

Auditing a Migration Plan When Transferring from On Site to the Cloud

Have you ever audited a computer system’s migration plan when transferring it from on site to the cloud? Here are some recommendations to keep in mind based on lessons learned from migration practices:
Blog Post

Applying Chaos Theory to Security

It has become almost impossible to face cybersecurity issues just by using the presently available countermeasures; hackers always find aways to bypass them.

Blog Post

The Digital Age: A New World of Purpose-Driven Opportunity

Jon Duschinsky, an entrepreneur, social innovator and firm believer in leading a purpose-driven existence, will be the closing keynote speaker at ISACA’s EuroCACS/CSX 2019 conference, to take place 16-18 October in Geneva, Switzerland. Duschinsky recently visited with ISACA Now and shared his thoughts on why being purpose-driven is more realistic than ever in today’s digital age. For more of Duschinsky’s insights, listen to his recent appearance on the ISACA Podcast.
The Nexus Article

(Mental) State of the Security Practitioner

In today’s world, the need to take care of oneself is more important than ever. The “always on” mentality exerted upon many salaried employees—especially those charged with detecting, responding and recovering from incidents...

12 August 2019
Blog Post

Modernized Maritime Industry Transports Cyberthreats to Sea

If there is one universal truth we have learned from developments on the cybersecurity landscape in recent years, it is that none of us are free from cyberthreats. Attackers identify and exploit vulnerabilities wherever they might exist, regardless of the target’s geographic location, whether the target is an individual or an enterprise, or which industry sector the target represents.
@ISACA Article

Earn Up to 37 CPE Hours at Infosecurity ISACA Conference

This year, ISACA and Infosecurity Group have collaborated to debut the Infosecurity ISACA North America Expo and Conference. ISACA will leverage its Cybersecurity Nexus™ (CSX) workshops, certification prep and CSX Training Platform ...

7 August 2019
@ISACA Article

Homomorphic Encryption: Privacy Throughout the Data Life Cycle

As cybersecurity experts, we are sometimes confronted with encryption techniques that go far beyond our understanding of the math involved.

7 August 2019
@ISACA Article

Learning to Navigate the Job Marketplace

Looking for a new job can be daunting. You must determine where to start your search and what skills you need for certain positions. Then you must apply to openings, land an interview and receive an offer.

7 August 2019
@ISACA Article

Securing the Internet of (Kitchen) Things

The kitchen has become a testing ground for Internet-connected devices. While these devices can make cooking easier and more enjoyable, they also present a security risk. In the recent ISACA Podcast episode...

7 August 2019
Blog Post

ISACAs Global Impact To Be Celebrated on ISACA CommunITy Day

On 5 October 2019, ISACA will conduct its inaugural ISACA CommunITy Day, a day of global service for ISACA members (through their chapters) and staff to give back to their local communities
ISACA Journal Article

Chaos to the Rescue

The chaos theory was discovered in the mathematics field and began to be observed in daily life during the second half of the 20th century.

Authors: Jean Jacques Raphael, Jean Claude Célestin and Eric Romuald Djiethieu
Podcast

Innovating with a Purpose

As automation has taken hold, more and more jobs that people used to perform are now taken care of by machines. That means humans have more opportunities to innovate and pursue purpose-driven careers that are meaningful to them on a personal level. In this Offstage and Offscript edition of the ISACA Podcast, EuroCACS/CSX 2019 keynote speaker Jon Duschinsky discusses why people and organizations should be enthused about the new professional landscape.

6 August 2019
Blog Post

FaceApp Puts Privacy Back Under Spotlight

There has been a heightened surge of questions about data privacy in recent weeks, especially in light of the app called FaceApp.

Blog Post

Measuring Risk Quantitatively

Quantitative risk has become a growing field of interest for information security professionals.

Governance Article

Impressions From Delivering COBIT 2019 Foundation Training for Auditors | ISACA

Due to the nature of their profession, IT auditors are some of the stakeholders most interested in COBIT. Delivering COBIT 2019 Foundation training to groups of IT auditors is a good way to glean insights and tips from the IT auditor’s perspective.

5 August 2019
Blog Post

Establishing a Foothold in the Professional World as a Young Professional

Extracurricular activities have filled my schedule for as long as I can remember. I was always involved in academic clubs and societies, and in most I held leadership positions.
Blog Post

How To Land Your First Job in Cybersecurity

Taking that first step on the career ladder is a difficult challenge in pretty much any industry. Even for entry-level opportunities, employers generally look for some level of previous industry experience. The question is, how do you get experience without having experience?

2 August 2019
Blog Post

Where to Begin Addressing the Policy-to-Execution Gap

How do you transform security and privacy compliance requirements into practical steps that can be executed by a team?
Blog Post

Assessing Public Sector Cyber Risk

The past decade has seen a significant advance in cyber risk assessment maturity.
Blog Post

Capital One Data Breach | Cybercrime | ISACA Blog

What We Should Learn from the Capital One Data Breach. ISACA reviews how learnings presented an opportunity to understand & improve our own security operations.

ISACA Journal Article

Auditing Green IT Governance and Management With COBIT 5

Today’s organizations find themselves facing a relatively new challenge—governing and managing sustainability—since sustainability has become an important issue and is increasingly essential for business.

Authors: J. David Patón-Romero, Maria Teresa Baldassarre, Moisés Rodríguez, and Mario Piattini
ISACA Journal Article

The IoT as a Growing Threat to Organizations

There is a new cyberthreat that is growing with the potential to have major impact on information security and personal privacy.

Author: Larry G. Wlosinski
Podcast

Internet of Medical Things

Medical devices that are connected to the Internet can empower patients and help healthcare providers better monitor their patients’ health. But these connected devices also pose a great security risk as they collect personal health information. In this podcast, we discuss the risk and benefits of connected medical devices, the regulatory landscape surrounding Internet of Medical Things devices, and how to securely configure them.

31 July 2019
Blog Post

Peer Recognition of Outstanding Achievements Within ISACA Community

The prestige of the ISACA Awards Program is evident by the high caliber of recipients who are nominated and selected by their peers. Consider the eight Global Achievement Award recipients honored at North America CACS in 2019.
Blog Post

Addressing the Vulnerabilities of IoT Devices

My recent Journal article on the Internet of Things (IoT) was inspired by an article I read on a botnet takedown that involved the digital recording devices that many people have connected to their television.
Blog Post

How to Approach Mitigating Third-Party Risk

Vendor management comprises all processes required to manage third-party vendors that deliver services and products to organizations.
Blog Post

COBIT 2019 and Marathons

Training is important for marathon runners, but there are a number of specific factors that go into marathon runners achieving their personal best. Take a look at the examples below (and for you non-runners, your COBIT and digital transformation muscles will be exercised soon enough):
@ISACA Article

Tips for Prioritizing Risk in Your Risk Register

News outlets across the world report that organizations of all types continue to suffer grave impacts from cyberthreats and incidents.

24 July 2019
@ISACA Article

Learn, Network and Volunteer With Peers Around the World

Engage—ISACA’s online portal in which professional community members can learn, network and participate—will celebrate its 1-year anniversary in September 2019.

24 July 2019
@ISACA Article

Listen and Learn More About the Baltimore Ransomware Attack

A ransomware attack leveraging an unpatched vulnerability affected several of Baltimore (Maryland, USA)’s, government services. In the recent Cyber Pros Exchange episode of the ISACA Podcast, Frank Downs and Dustin Brewer...

24 July 2019
Blog Post

Transitioning GDPR Preparations Into Operations

While organizations may think that they have done everything needed to prepare for GDPR, they may not have thought about how they arrive at assurance over GDPR, especially considering that being prepared for GDPR is different from having GDPR as part of operations.
Podcast

Cyber in the Kitchen

The kitchen has become a testing ground for Internet-connected devices. While these devices can make cooking easier and more enjoyable, they present a security risk. In this podcast, we discuss the risk of IoT-connected devices and how you can leverage their benefits while remaining secure.

23 July 2019
Blog Post

Cyber Lessons for Enterprises from the Equifax Breach and Record Fine

Government regulators and representatives of Equifax announced a settlement on penalties and consumer restitution related to the 2017 data breach that exposed sensitive information belonging to 148 million people.
Blog Post

The Need for Speed

In the 1980's movie Top Gun, the protagonist utters the phrase, “I feel the need, the need for speed!” Peter “Maverick” Mitchell was an F-14 Tomcat pilot, an interceptor jet capable of flying more than twice the speed of sound.
Blog Post

NIST Risk Management: What you Should Know | ISACA Blog

In late December 2018, NIST published a second revision of SP800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.
Blog Post

Taking Precautions With Smart Home Gadget Security

Smart home gadgets have been among the most popular holiday, housewarming and any-occasion gifts for the last few years. Whether it’s an interconnected home security system, a pet camera, or a voice-activated assistant like the Amazon Echo, homeowners and renters alike love having these tech gadgets in their homes.
ISACA Journal Article

Redefining Corporate Governance for Better Cyberrisk Management

Corporate governance refers to the set of responsibilities to be fulfilled by the higher-level management structures of an organization, such as the management team, board of directors (BoD), and board and management committees.

Author: Vimal Mani
Blog Post

Reimagining the Enterprise Landscape Through Advanced Technology

Stafford Masie, CEO of Google Africa (2006–09) and Non Executive Board Member at ADvTECH, will be the closing keynote speaker at the 2019 Africa CACS conference, to take place 19-20 August in Johannesburg. Masie, an inventor, mentor and keen observer of how to humanize technology, recently visited with ISACA Now to discuss how enterprises in Africa and beyond can take advantage of the major technological forces of the day, such as artificial intelligence and advances in fintech. The following is a transcript, edited for length and clarity:
Podcast

Women in Technology: Starting Early to Address the Leaky Pipeline

As a high school student, Kyla Guru already has started her own cybersecurity education program and helped launch a conference for high school girls interested in technology. In this SheLeadsTech Series edition of the ISACA Podcast, Guru talks about how she became so engaged, so quickly, in cybersecurity and championing girls and women in technology.

16 July 2019
Blog Post

Defining the ROI of Automation

In his opening remarks to the general session of the Institute of Internal Auditors (IIA) 2018 Midyear Meetings in Orlando (Florida, USA), IIA Global Board Chairman Naohiro Mouri said that throughout his international travels while in office, he rarely heard from audit practitioners about the “pain of automation” despite the oft-cited benefits of automation technologies and their potential to revolutionize the internal audit function.
Blog Post

Getting Creative to Solve Security Challenges in Healthcare

A recent article about information security challenges in healthcare pointed to the lack of resources many security teams report.
Governance Article

Why Peter Pan Hates COBIT 2019 | ISACA

Why would Peter Pan have an opinion on COBIT 2019, and a dark one no less? No, COBIT is not the name of the newest deckhand working for Captain Hook. Rather, it can be explained by my experience in which many enterprises are averse to change and

15 July 2019
Blog Post

Practically Implementing DevSecOps

The explosion of DevSecOps has caused a lot of excitement and worry within the cybersecurity community. It is no longer of question of should an organization implement DevSecOps, but rather when and how?

Blog Post

Vendor Selection for ISO 27001 2013 Certification

The Information Security Management Systems Certification (ISO 27001:2013) helps organizations prove they are managing the security of clients’ and stakeholders’ information, and can generate the need for three types of vendors: certification body, internal audit and implementation.
@ISACA Article

Aligning Governance and Risk Management to Maximize Impact

Governance, risk management, control and business professionals from around the world can meet at the IIA and ISACA-hosted Governance, Risk and Control (GRC) Conference. This year’s conference, which takes place...

10 July 2019
@ISACA Article

Five Key Considerations When Developing Information Security Risk Treatment Plans

Risk treatment plans are an essential component of an organization’s information risk management and security strategy program.

10 July 2019
@ISACA Article

Celebrating the 2019 ISACA Award Recipients and Nominating for the 2020 Awards

The 2019 ISACA Global Achievement Awards were presented at North America CACS in May 2019. Recipients from around the world gathered to accept their honors after being nominated by their peers in 2018

10 July 2019
Blog Post

Are the British Airways and Marriott GDPR Fines a Tipping Point?

For many months, infosec and privacy colleagues alike have been telling me that the FUD (fear, uncertainty and doubt) about the terrifying levels of EU fines under the European Union General Data Privacy Regulation (GDPR) have disappeared from the boardrooms and executive management meetings.
Blog Post

Stripping Off the Monster Tag from IT Governance An Inclusive Approach

It is said that anything with two heads is a monster. I usually think of this saying when carrying out IT governance reviews, as inclusive governance seems to be a missing link.
Podcast

The Staying Power of the CISA Certification

The Certified Information Systems Auditor (CISA) certification is ISACA's flagship certification and has played a major role in the organization's growth and global cachet over ISACA's 50-year history. In this 50th Anniversary Series edition of the ISACA Podcast, guest Thomas Phelps discusses how the CISA has remained relevant amid a dynamic and fast-changing technology landscape.

9 July 2019
The Nexus Article

Qualified Certificates as a Foundation for Digital Transformation

Human tasks such as handwritten signing are an obstacle to digital transformation. These human tasks interrupt process digitalization and create the need for the implementation of expensive processes such as accessing, storing and archiving paper-based documentation.

8 July 2019
Blog Post

Rebuilding Institutions for an Online World

Author and journalist Jamie Bartlett will be the closing keynote speaker at the Infosecurity ISACA North America Expo and Conference, which will take place 20-21 November 2019 in New York City. Bartlett recently visited with ISACA Now to discuss his outlook on how technology is reshaping society, beginning with his contention that the internet is killing democracy. The following is an edited transcript of the interview:
Podcast

Does IT Auditing Still Make Sense?

The role of IT auditors has changed as technology has changed. In this podcast, we discuss the role of IT audit and how IT audit can help strengthen information security and cybersecurity measures.

2 July 2019
Blog Post

Coincidence or History?

On 23 October 1969—just a few months after Apollo 11 landed on the moon—the Electronic Data Processing Auditors Association (EDPAA), later to become ISACA, was incorporated.

Blog Post

Don’t Forget These Factors When Considering a Certification

Part of growing as a young professional is being willing to continually learn and knowing your education should never stop.

1 July 2019
Blog Post

Five Ways to Jump-Start Your Career in the Tech Workforce

Are you a student or an early-career professional seeking to kick-start your career in tech? Do you feel a bit overwhelmed by the possibilities out there, unsure of yourself, and lacking a clear idea not only of where you'd like to go, but how you can get there?
Blog Post

Securing Your Data The Crown Jewels of Your Enterprise

Every organization has data that is vital for its organizational growth. Typically, most organizations build security around infrastructure, network and applications. But with data leakage becoming more prevalent, organizations are now considering data to be their crown jewel.
ISACA Journal Article

Information Security Matters: Someone Else

Running an IT department used to be so simple. The programmers wrote programs; the technicians migrated the programs into production; and the operators ran them. Learn how this has changed.

Author: Steven J. Ross
ISACA Journal Article

Evolving From Qualitative to Quantitative Risk Assessment

It is only recently that quantitative risk for information security has been introduced as a possible evolution from qualitative risk methodologies.

Author: Benoit Heynderickx
ISACA Journal Article

IS Audit Basics: Lessons From History

So, and in case you have been living in a cave somewhere, ISACA is 50—a significant historical milestone. Here are the lessons we've learned along the way.

Author: Ian Cooke
ISACA Journal Article

Innovation Governance: The Balance of Speed and Protection in Innovation

Organizations embrace innovation in order to outcompete others in their space. The mission in audit is to protect the business.

Author: K. Brian Kelley
ISACA Journal Article

The Network: Brennan P. Baybeck

What is the biggest security challenge being faced in 2019?

Author: Brennan P. Baybeck
ISACA Journal Article

Understanding Compliance Risk in Finance and Banking

Banks need to design automatic & continuous risk assessments that align with compliance & regulatory issues.

Author: Muhammad Waheed Qureshi
ISACA Journal Article

The Pain of Automation

Internal audit leaders are looking at automation technologies for many of the same reasons as business management.

Authors: Wade Cassels, Jane Traub, Kevin Alvero, and Jessica Fernandez
ISACA Journal Article

Acknowledging Humanity in the Governance of Emerging Technology and Digital Transformation

Artificial intelligence (AI) and robotics have captured the imagination of humans. A quick search for AI and robotics in pop culture finds that it stretches back to Mary Shelley’s book.

Author: Guy Pearce
ISACA Journal Article

The Internet of Medical Things—Anticipating the Risk

The Internet of Medical Things (IoMT) is and has been a driving force of the networked medical device landscape ecosystem.

Author: Mohammed Khan
ISACA Journal Article

Rethinking Risk

Not all that long ago, getting the enterprise to invest in IT required some convincing.

Author: Rajesh Srivastava
ISACA Journal Article

Three Strategies for a Successful DevSecOps Implementation

The DevSecOps methodology movement began in response to security concerns with the DevOps methodology.

Author: Taimur Ijlal
ISACA Journal Article

Bridging the Gap Between Policies and Execution in an Agile Environment

With the perpetual occurrence of high-profile attacks and data breaches caused by software vulnerabilities, a new trend known as secure by design (“shifting left”) has gradually shaped the software world.

Authors: Mina Miri, Amir Pourafshar, Pooya Mehregan, and Nathanael Mohammed
ISACA Journal Article

Analyst and Adversary

Each year, reports of new threats and security breaches reveal the ever-increasing sophistication of attackers and their methods for outwitting available control mechanisms.

Author: Jeimy J. Cano M.
ISACA Journal Article

HelpSource Q&A

Is enterprise governance of IT (EGIT) relevant for SME organizations?

Author: Sunil Bakshi
Blog Post

Continuous Security Validation

No corporate executive should feel secure. Every day, we keep hearing about yet another company getting hacked or losing sensitive data.
Podcast

Moving Risk Management From Fear and Avoidance to Performance and Value

Many organizations view risk management as an unpleasant process that has to be done to meet regulatory requirements. But what if risk management were leveraged to add value to organizations and strengthen their security measures? In this podcast, we discuss how to use risk management to improve performance and add value.

27 June 2019
@ISACA Article

North America CACS Conference Highlights Impact of Disruptive Technologies

The North America CACS 2019 conference took place 13-15 May 2019 in Anaheim, California, USA. This conference, which is held for IS audit, assurance, control, governance and security professionals...

26 June 2019
@ISACA Article

Can Organizations Afford Proprietary Models for Third-Party Assessments

When implementing a third-party risk management or vendor risk management (VRM) program, there are many decisions that must be made: How many levels of criticality should there be?

26 June 2019
@ISACA Article

Take the Next Step in Your Cybersecurity Career

ISACA is introducing 3 new Cybersecurity Nexus™ (CSX) Cybersecurity Career Pathways course offerings to enable those with prior industry certifications and a strong IT/cybersecurity foundation to prepare for a new role or career advancement.

26 June 2019
@ISACA Article

The Sheer Gravity of Underestimating Culture as an IT Governance Risk

Poor IT governance can be even worse than no IT governance. Managing IT risk as part of governance of enterprise IT (GEIT) is a key factor to IT governance success, as discussed in Guy Pearce’s ISACA Journal, volume 3, article...

26 June 2019
@ISACA Article

Understanding Technology Shifts in the Financial Sector

From mobile payments to the use of artificial intelligence (AI) to the introduction of new security risk, technology has had a profound impact on how the financial sector operates. In this 50th Anniversary Series episode of the ISACA Podcast...

26 June 2019
Blog Post

Extracting More Value from IoT Using COBIT 2019

The time for making predictions about the number of IoT devices in future years and waiting for that time to come is long gone (however, if you really want to know, one source predicts there are going to be 75 billion IoT devices in 2025).
Podcast

Examining the Baltimore Ransomware Attack

A ransomware attack leveraging an unpatched vulnerability affected several government services for the city of Baltimore (Maryland, USA). In this podcast, we discuss how this ransomware attack occurred, the services it affected and lessons learned from this attack.

25 June 2019
Blog Post

50th Anniversary Q&A with ISACA CEO David Samuelson

David Samuelson was appointed chief executive officer of ISACA on 1 April of 2019, the year of ISACA’s 50th anniversary. Samuelson recently visited with ISACA Now to discuss the meaning of joining the organization during its milestone year and how ISACA can draw upon its decades of industry leadership to become even more impactful in the future. The following is an abbreviated transcript of the Q&A interview.
Governance Article

Lessons Learned While Combining COBIT 5 & ITIL | ISACA

An engagement at a financial technology (fintech) organization provided a novel first-hand experience of working with COBIT 5. Despite more than 7 years’ experience in governance, risk and compliance (GRC) projects that involved COBIT 5

24 June 2019
Blog Post

How Small and Medium Businesses Can Leverage Cybersecurity for Client Value: Six Ways to Get Started

Small and medium-sized businesses (SMBs) lack the resources of a large business, in both finances and personnel, making it more difficult to extract client value from a robust cybersecurity program.
Blog Post

How to Properly Review an SOC Report

As a follow-up to a blog post previously published by The Mako Group’s Chief Audit Executive, Shane O’Donnell, let’s dig a little deeper into what you should be reviewing when you receive your vendors’ SOC 1, SOC 2 or SOC 3 reports.
Podcast

Technology Shifts in the Financial Sector

From mobile payments to the use of artificial intelligence to the introduction of new security risks, technology has had a profound impact on how the financial sector operates. In this 50th Anniversary Series episode of the ISACA Podcast, Ashley Holmes analyzes the past, present and future state of fintech. Holmes notes that banks and others in the financial services sector have to manage a balancing act in embracing innovation and automation while not alienating customers that still expect a certain level of human-to-human service and accessibility.

18 June 2019
Blog Post

ISACA’s Future Brimming With Opportunity

As my relationship with ISACA unfolded through various volunteer roles for the past 25 years, I have had the privilege of seeing the organization evolve – through good times and challenging times – just as many of us have experienced in our personal lives and careers.
Blog Post

Patch Management Practice

Unpatched systems represent a very serious IT security threat with potentially extremely important consequences, as documented in a large number of high-profile breaches that exploited known unpatched vulnerabilities.
Blog Post

Drive Your Own Destiny in Achieving Goals

An individual would be hard-pressed to debate that behaviors and habits individuals exercise in their personal lives have no bearing or effects on their professional career.
Blog Post

Three Steps to Begin Transforming Your Cybersecurity Program

The nature of risk management has changed over the past 2 decades. Previously isolated IT infrastructures are more connected with the outside world, and organizations face an ever-expanding threat landscape.
@ISACA Article

4 Vs of Big Data

Big data requires strong data handling processes in data-intensive systems. Today, with the incredible growth of data collection into systems of diverse kinds and sizes around the world, we need to understand big data basics for review, audit and security purposes.

12 June 2019
@ISACA Article

ISACA Podcast Now Available on Stitcher

The ISACA Podcast, which provides coverage of and unique perspectives on IT audit, security, governance and risk issues affecting organizations today, is now available on the Stitcher app. Stitcher can be accessed through iOS devices, Android devices and through a web player.

12 June 2019
@ISACA Article

The Evolving Role of the CIO

Interested in learning what the role of the chief information officer (CIO) is and how it is evolving? What are some of the challenges CIOs face in their daily work, and what are the required skills, knowledge and attributes needed to ...

12 June 2019
Blog Post

Rethinking Cost Analysis in the Era of Cloud Computing and Emerging Tech

Have you thought about cost analysis in the era of cloud operation, combined with other emerging technologies? There is an orthodox way of considering cost analysis: Costs can be fixed, variable or some combination of the two. However, when it comes to analyzing IT costs, traditional cost analysis in the era of emerging technologies is inadequate.
Blog Post

A Look at CIS Controls Version 7.1

CIS Controls Version 7.1, released in April 2019, was developed by Center for Internet Security (CIS), which consists of a community of IT experts.
Blog Post

Increasing Your Organizaton’s Cybermaturity

Managing cyberrisk is critically important for organizations. Interconnectedness, digitization, the focus on utilizing data and providing enhanced client experiences expand the attack surface and expose an organization to increased cyberrisk.
The Nexus Article

Data Security and Niche Software

Inside a large corporation, it is sometimes easy to forget that not everyone’s life revolves around SAP, Salesforce, Adobe Experience Manager or Microsoft Azure. Squadrons of software categories exist to help small and mid-size businesses operate in niche markets that do not align with (and, frankly, could not afford) the offerings of the larger players.

10 June 2019
The Nexus Article

Building Cybersecurity Culture With Effective Awareness and Training Programs

Different information sources claim that 90% of cyberattacks are successful because of the mistakes made by information technology users.1, 2 The range of mistakes is broad and includes bad password practices, systems with open vulnerabilities, susceptibility to phishing and spear phishing attacks, risky information sharing practices and more.

10 June 2019
Governance Article

5 Steps for Auditing IT Risk Management Using IT Risk Management Audit/Assurance Program | ISACA

With the increasing complexity of IT systems and their widespread implementation in virtually all spheres of life (e.g., medicine, banking, manufacturing, education), managing IT risk effectively becomes extremely challenging.

10 June 2019
Blog Post

ISACA at Infosecurity Europe: Expert Speakers and New Research at Europe’s Largest Infosec Event

ISACA expert speakers, past board directors and chapter leaders provided insight and new research while ISACA representatives highlighted ISACA certifications and training solutions at Infosecurity Europe 2019, 4-6 June in London.
Blog Post

Integrating Human and Technical Networks in Organizational Risk Assessments

The US government’s recent efforts to ban the introduction of specific foreign IT vendors’ equipment in government networks is emblematic of the growing concern among organizational leaders posed by global supply chains, highlighting the broad interdependencies between technical and human systems
Blog Post

Innovation Is About People

I was a member of an innovation team because of my expertise in servers, Active Directory and general information security practices.

Blog Post

MIT CISR Research Forum: Designing for Digital Leverage

The MIT CISR Research Forum (Europe), hosted by Heineken, recently was held in Amsterdam. As a partner of MIT CISR, ISACA was represented at the event. Presentation titles on the agenda like “Quick Look: What Is Your Digital Business Model?” by Joe Peppard, “Digitized Is Not Digital” by Jeanne Ross, “Managing Organizational Explosions During Digital Transformation” by Nick van der Meulen, and others, provided a good general sense of what the event would be all about.
Blog Post

The Role of Culture on IT Governance

It was 150 years ago that Sir Edward Tylor first referenced culture (in an anthropological sense) in his book Primitive Culture.

Blog Post

Why Don’t We Apply Due Diligence in Selecting Social Media Providers?

I’ve reviewed many social media implementations across a large variety of companies and, among the many concerns from a security perspective, is the total lack of due diligence over their selection.
@ISACA Article

Risk Analysis Requires Business Acumen

It is relatively easy for those in information security to spend their entire careers without a solid understanding of how the organizations they work for make money. This is true whether they work in a for-profit or nonprofit organization.

29 May 2019
@ISACA Article

Learn to View Your Cybersecurity Program Holistically

With the rise of cloud use, cybersecurity must adhere to more complex requirements. Organizations must consider third parties, IT systems, regulations such as the Payment Card Industry Data Security Standard...

29 May 2019
@ISACA Article

How to Implement Continuous Oversight and Monitoring of Your Enterprise’s Cloud Services

Cloud computing and cloud services are increasingly being used in the implementation of emerging technologies including artificial intelligence (AI), big data analytics and Internet of Things (IoT) devices.

29 May 2019
@ISACA Article

Risk Analysis: Then and Now

As part of ISACA’s 50th anniversary celebration, I am looking at the past and evaluating how risk analysis has changed by comparing the approach proposed in my recent IS Audit Basics column...

29 May 2019
@ISACA Article

ISACA and Protiviti Probe IT Audit’s Toughest Challenges and Best Practices in IT Audit

IT audit individual professionals and teams worldwide face challenges with cybersecurity, privacy, data management and governance, building effective partnerships with the IT organization, dealing with ongoing digital transformation and disruption...

29 May 2019
Blog Post

Digital Ethics Rising in Importance

The innovative capabilities of technology – as well as the potency of that technology – is advancing at a remarkable pace, creating new possibilities in today’s digital economy.

Blog Post

Build, Nurture Your Professional Network – And Start Early

It can be surprising for professionals entering the workforce to realize that grades and knowledge is not the ultimate definer of your success.

28 May 2019
Blog Post

ISACA Opens Doors for Young Professionals with Early Leadership Opportunities

The value of being an active member in a professional organization such as ISACA cannot be overstated.

Blog Post

Sharpening the Axe

Internal auditors are under increasing pressure to add value to what is valued while, at the same time, helping to protect their enterprises from risk such as cyberattacks.
Blog Post

Tapping into ISACA’s Network to Shed Light on the Psychology of Information Security

I was always fascinated by the complexity of the technology discipline. The truth is, it’s very broad. ISACA helps to define some of the career pathways for young professionals through its educational resources and certification program. This made me think about where I saw myself adding value to the industry.
Podcast

Managing Unstructured Data

In an era of data overload, dealing with unstructured data poses distinct challenges to organizations. In this Off Stage and Off Script Series edition of the ISACA Podcast, North America CACS 2019 conference presenter George Khalil provides his perspective on which pitfalls should be avoided when it comes to managing unstructured data.

28 May 2019
Blog Post

ISACAs Past Future Come Together at North America CACS

ISACA’s 50th anniversary year is about simultaneously honoring our past while visualizing how our professional community will innovate the future. Last week’s experience at our North America CACS conference in Anaheim provided tremendous inspiration on both fronts.
Blog Post

A Deeper Look Into the WhatsApp Hack and the Complex Cyber Weapons Industry

On 13 May, the Financial Times reported the discovery of a major security flaw in the popular messaging app, WhatsApp. The pervasive vulnerability, which affected both Apple and Android devices, allowed malicious actors to inject commercial spyware by ringing up unsuspecting targets using WhatsApp’s VOIP-based call function.
Podcast

Protect Your Data Against Insider Threats

Most organizations know how to respond to malicious outsiders who may try to steal sensitive data. But what about the insider threat? In this podcast, we discuss ways to protect against the insider threat, and we use the example of a distillery to show the steps you can take to protect your data.

21 May 2019
Blog Post

The Role of Incident Management in Identifying Gaps During Stabilization Period

Deploying an enterprise resource planning (ERP) system is challenging, and identifying gaps that could lead to risk is one of the most important aspects of stabilization.
Governance Article

Governing Digital Transformation Using COBIT 2019 | ISACA

Many countries have launched ehealth initiatives as a response to public-sector transformation. It is one of the business sectors impacted by the vertical digitization movement that has become the trend in the last decade along with eeducation, ebanking, egovernment and more.

20 May 2019
Podcast

Advancing Gender Diversity in Leadership Roles

While organizations increasingly understand the value of gender diversity in leadership roles, they don't always know how to make it a reality. In this episode of the ISACA Podcast's SheLeadsTech Series, Kellie McElhaney provides guidance on steps organizations can take to create meaningful inclusion in their leadership ranks.

17 May 2019
Blog Post

Controls in the Cloud Moving Over Isnt As Easy As Flipping a Switch
@ISACA Article

The Backwaters of Technology

There are backwaters of your enterprise that have technologies that have fallen out of favor like broken toys that have been forgotten.

15 May 2019
@ISACA Article

Use DNS to Secure the Cloud

Today, users access cloud applications from anywhere and everywhere they may be. Data are no longer only stored in physical data centers.

15 May 2019
@ISACA Article

Videos Released to Help You Learn About Intelligent Automation

As more enterprises across multiple industries adopt automation and artificial intelligence (AI) to remain competitive, IT auditors must also understand the risk around AI, machine learning (ML) and robotic process automation (RPA) to keep their organizations safe.

15 May 2019
@ISACA Article

Time for Technology Organizations to Commit to Women in Leadership Roles

In the digital age, technology organizations face relentless pressure to innovate before they are out-innovated or wholly disrupted. But many tech organizations are undermining their ability to compete by not making a concerted effort to assemble diverse leadership...

15 May 2019
@ISACA Article

Use the ISACA Career Centre to Find New Career Opportunities and Talent

ISACA’s online Career Centre is designed to help members navigate a successful career in the IS/IT industry. Members can use this tool to post their resume in the online resume database and even use it to learn how to leverage ISACA training and certification resources for career development.

15 May 2019
@ISACA Article

Evolving From Accountant to IT Auditor With a CISA Certification

As a professional who started his career as a chartered accountant, Sreekrishna Rao has encountered some resistance from stakeholders because he is not an IT engineer.

15 May 2019
Blog Post

Securing Major League Baseball - On and Off the Field

Three strikes and you're out is one of the more well-known sayings in baseball, but it only takes one devastating cyberattack to inflict huge damage on Major League Baseball or any of its 30 teams.
Blog Post

The Evolution and Power of Disruptive Technology Insights From an Executive Panel at NA CACS

At ISACA’s North America CACS conference Tuesday morning, an executive panel spoke on the past 50 years of tech disruption—and where technology is taking us in the future.
Podcast

A New Rubric for IT Retention and Recruiting

The old methods of recruiting and retaining qualified IT professionals often disadvantages women and minorities. A new method of finding and keeping diverse candidates is needed.

14 May 2019
Blog Post

A Spectrum of Professions The World Needs Us

From the days of determining how to secure and derive value from early computers to today’s challenges as organizations enact digital transformation, it has been a remarkable 50 years for ISACA’s professional community.
Blog Post

IT Audit Stay Relevant or Perish

“Victory awaits him who has everything in order – luck, people call it. Defeat is certain for him who has neglected to take necessary precautions in time. This is called bad luck.” –Roald Amundsen, The South Pole
The Nexus Article

Understanding and Implementing a Culture of Cybersecurity

Cultures have been studied by sociologists and anthropologists for a very long time. The fact that culture is an area of scientific study speaks to its importance and the need to understand culture and its impact on people and their behaviors.

13 May 2019
Blog Post

Driving or Driven by Disruption The AI Maturity Model

On 25 April 2019, Microsoft passed the trillion-dollar market cap threshold and passed Apple as the most valuable company in the world.
Blog Post

The Features and Challenges of IoT-Based Access Control

Employees and guests can use IoT-based access control for convenient access. Through their mobile device, they can be connected to a facility’s access control through digital ID securely.
Podcast

Professional Networking Over the Years

While social media has helped to reshape the professional networking landscape, some fundamentals of networking remain the same. In this 50th Anniversary series episode of the ISACA Podcast, ISACA member Matthias Kraft discusses what has changed, and what has not, when it comes to professional networking.

8 May 2019
Blog Post

ISACA-Infosecurity Keynoter Theresa Payton Design Security for Humans

Theresa Payton, former White House CIO and a prominent cybersecurity expert, will deliver the opening keynote address at the Infosecurity ISACA North America Expo and Conference, to take place 20-21 November 2019 in New York City. Payton recently visited with ISACA Now to reflect upon her time in the White House and provide analysis on how the technology and cybersecurity landscapes have evolved in her time since leaving the role. The following is a transcript of the interview, edited for length and clarity.
Blog Post

The Importance of Cyberresiliency

Cybersecurity is an endless process of chasing and preventing known attacks; anticipating attacks; and monitoring, alerting, patching, remediating and implementing solutions. It is becoming a maintenance function that trails hackers and other bad actors.
Blog Post

Cyber Threat Intelligence Feeds | ISACA Blog

Cyber risk is business risk. Business are digitizing and governments are putting in place policies to promote digitalization and smart-city projects. While this helps citizens and organizations to adopt technology advancement, the continuous increase in cyberattacks, in both frequency and sophistication, pose significant challenges for organizations that must defend their data and systems from threat actors.
ISACA Journal Article

The Practical Aspect: Small Business Interruptions

According to the Allianz Risk Barometer 2019, for the seventh year in a row, executives and insurance experts worldwide are most concerned about business interruption risk scenarios.

Authors: Vasant Raval and Rajesh Sharma
ISACA Journal Article

Successful Outcomes by Crowdsourcing Risk Management

Crowdsourcing cybersecurity risk management across the enterprise presents opportunities for security leaders to bolster their program resilience through other resources.

Author: Mike Saurbaugh
ISACA Journal Article

Information Security Matters: Does IT Auditing Still Make Sense?

IT auditors are important to information security and have been since the auditing profession realized it needed to get hip to machines in the basement that were eating their balance sheets.

Author: Steven J. Ross
ISACA Journal Article

Moving Risk Management From Fear and Avoidance to Performance and Value

For cybersecurity professionals, the nature of risk management is evolving from an outside-in fear-and-avoidance approach to a strong inside-out approach.

Author: Brian Golumbeck
ISACA Journal Article

IS Audit Basics: Developing the IT Audit Plan Using COBIT 2019

The IT Assurance Framework (ITAF) requires that the IS audit and assurance function shall use an appropriate risk assessment approach and supporting methodology to develop the overall IS audit plan.

Author: Ian Cooke
ISACA Journal Article

Innovation Governance: Innovation and the Auditor

Innovation teams research new and innovative ways for the business to compete. This usually means accelerating a development cycle.

Author: K. Brian Kelley
ISACA Journal Article

The Network: Mais Barouqa

What is the biggest security challenge that will be faced in 2019?

Author: ISACA
ISACA Journal Article

The First Steps of Quantitative Risk Management

Things have been changing in the risk management arena these last few years.

Author: Ignacio Marambio Catán
ISACA Journal Article

Auditing Amazon Web Services

As organizations increase adoption of cloud services for running enterprise architecture and applications, auditors are required to step up their game and learn new in-depth audit skills.

Author: Adam Kohnke
ISACA Journal Article

Guest Editorial: ISACA—50 Years of Keeping Pace With Changing Technology

Anniversaries always spark the desire to revisit the events that have taken us from then to now. ISACA’s 50th anniversary is no exception.

Author: Robert G. Parker
ISACA Journal Article

Advanced Analytics for Technology Risk

Over the decades, information systems security has evolved in many ways.

Author: Mukul Pareek
@ISACA Article

What Is There in Terminology? Risk Analysis, Risk Assessment and Risk Evaluation

Determining risk is common sense, and risk management is “common sense formalized.” Many times, we subconsciously determine risk to make decisions.

1 May 2019
@ISACA Article

Auditing Amazon Web Services

With more and more organizations continuing to adopt cloud services and hosting on public cloud platforms, knowing how to audit these platforms becomes crucial.

1 May 2019
@ISACA Article

What Your Organization Can Do About Insider Threats

Insider threats hamper many organizations that find themselves unprepared to detect the threats posed by personnel they trust. Knowing the top motives for insider threats can help organizations be more prepared to implement the correct countermeasures.

1 May 2019
@ISACA Article

Meeting Consumers' Demand for Data Privacy

Consumers around the world are demanding better privacy rights and data protection. Many organizations are prepared for the EU General Data Protection Regulation (GDPR), but there are many more data privacy regulations on the horizon.

1 May 2019
Blog Post

Stakeholder Management: Push or Pull? (Or Is it More About Building Trust?)

Managing projects for the best possible outcome is a bit art and a bit science. From a high-level view, stakeholder management includes: identifying the people that could impact a project, understanding the expectations of the stakeholders and their impact on a project, and developing strategies for effectively engaging the decision-making project stakeholders.
ISACA Journal Article

A Model and Best Practices for Risk Transformation

Increasing globalization and the associated business transformation mean that enterprises are now complex networks dependent on both the nodes within other organizations and the nodes within the same organization.

Author: David Vohradsky
ISACA Journal Article

Access Controls Over Third-Party Applications

With an increasing focus on and potential exposure to confidential data, and every organization must take the appropriate precautions to secure customer data.

Author: Kathleen Martin
ISACA Journal Article

Bulletproof Risk Management to Thrive in the Digital Economy

Digital technologies have profoundly changed lives, blurring the lines between the digital and physical worlds.

Author: Sudhakar Sathiyamurthy
ISACA Journal Article

Incident Management for ERP Projects

A bad plan with good execution can be considered a dream come true, but a good plan with poor execution can be a nightmare.

Author: Rajul Kambli
ISACA Journal Article

Practical Cyberrisk Management

Cybersecurity and information security (cyber) professionals, staff, managers and board members are faced with the real issue of how to deal with cyberrisk, and this is a high priority for board members.

Author: Jaco Cloete
ISACA Journal Article

Practical Patch Management and Mitigation

Patches are quick fixes of known software bugs that presumably were not known at the time that the software was released.

Author: Spiros Alexiou
ISACA Journal Article

The Non-IT Manager’s Role in Enterprise IT Risk Management

The impact of IT on business operations cannot be ignored in today’s business environment.

Authors: Nishani Edirisinghe Vincent, and Vinod U. Vincent
ISACA Journal Article

The Sheer Gravity of Underestimating Culture as an IT Governance Risk

For those who may think that any form of governance of enterprise IT (GEIT) is better than no IT governance, it is important to consider the fact that poor IT governance is a significant, documented cause of IT failure.

Author: Guy Pearce
ISACA Journal Article

Three Ideas for Cybersecurity Risk Management

The terms “information security” and “cybersecurity” are commonly used to address risk to information.

Author: Sakthivel Rajendran
Blog Post

Navigating Change An Imperative for Technology Professionals

The fast-changing technology and regulatory landscape calls for members of ISACA’s professional community to continually refresh their knowledge and training.
Podcast

Combating Cyberattacks With a Culture of Cybersecurity

Cybersecurity’s role in recent years has grown considerably, but the most common exploits have remained the same over decades. Because of the sophisticated approaches many of these attacks use, people are unable to identify that phishing attacks today are fundamentally similar to the phishing attacks that occurred years ago. In this podcast, we discuss some common security attacks, building a security culture and the role of the C-suite in cybersecurity.

30 April 2019
Blog Post

Building an Audit Program for AWS

When I produced my auditing Amazon Web Services (AWS) Journal article for volume 3, I was just wrapping up my very first audit against an AWS environment.
Blog Post

Five Software Programs To Improve the Security of Business Websites

Cybersecurity may soon become an issue of higher concern than physical safety. We already share too much personal information online without paying attention.
Governance Article

Tips for Implementing COBIT in a Continuously Changing Environment | ISACA

There is a new term coined here: “COBITIAN.” It describes professionals who love COBIT and are excited and happy for the evolution to COBIT 2019, including its new governance and management objectives, design factors, and focus areas concepts.

29 April 2019
Blog Post

The ISACA Way How I Earned the CISM CISA CRISC and CGEIT in 10 Months

Earlier this year, when I earned the last one of the Fab 4 of ISACA certifications – CISM, CISA, CRISC and CGEIT – I decided to write a post about my experience and the lessons I learned along the way. I hope this will be useful for anyone preparing to obtain these industry-recognized credentials.
Blog Post

GRC Keynoter Patrick Schwerdtfeger Endless Insights Within Organizations Reach

Patrick Schwerdtfeger, closing keynote speaker at the GRC Conference 2019, to take place 12-14 August in Ft. Lauderdale, Florida, USA, is a business futurist specializing in technology topics such as artificial intelligence, blockchain and FinTech. Schwerdtfeger recently visited with ISACA Now to discuss how these and other components of digital transformation will reshape the business landscape going forward. The following is a transcript of the interview, edited for length and clarity:
Blog Post

How to Get Your Employees to Care About Cybersecurity

With each highly publicized data breach or cyberattack, it becomes increasingly evident that businesses can’t sit back and hope their security strategy is strong enough to withstand an assault.

Blog Post

The Impact of the Thailand Cybersecurity Law | ISACA Blog

In the past 5 years, the cybersecurity agenda has been raised and discussed and in many forums because cyberattacks have been developed for various purposes, and the number of cybersecurity incidents or data breaches have increased dramatically every year.

Blog Post

The Gap Within the Skills Gap What Does Cybersecurity Really Need

I recently took to LinkedIn to air my views on one of the most talked-about topics in the world of tech: the cybersecurity skills gap. The skill gap is often discussed in urgent terms and, given my job as a cybersecurity recruiter, I see how it plays out in practice.

@ISACA Article

Tips for Improving the Risk Management Process

The enterprise mission, strategy and objectives are the basis for understanding the dynamic risk landscape in which the enterprise operates.

17 April 2019
@ISACA Article

Using Continuous Oversight to Improve Security

Monitoring information system security is an established management practice. It ensures compliance for both information security and privacy. Data protection and compliance maturity levels also help establish how to align with information assurance programs.

17 April 2019
@ISACA Article

New ISACA Podcast Episodes Now Posting Weekly

To provide you with valuable industry insights in a quick and flexible manner, new ISACA Podcast episodes are now being released weekly.

17 April 2019
@ISACA Article

Call for Nominations: 2020 ISACA Awards

Do you know outstanding colleagues who have dedicated themselves to advancing ISACA’s core areas of audit, information security, risk and IT governance? Have you worked with an outstanding volunteer who has contributed to ISACA’s success?

17 April 2019
@ISACA Article

Phishing Awareness and Your Enterprise

Email delivery is the primary source of malware dissemination. Cyberattackers rely on phishing attacks because they work and easily can target users several times a month.

17 April 2019
Blog Post

Why IT Teams Should Avoid Complacency

We are in 2019, and have all witnessed the effects of disruptive start-up companies, the growth and stability of the cloud market, the emergence of CI/CD practices and the simple need for agility. Inversely, there are organizations where none of what I mentioned is happening.
Blog Post

The Challenge of Assessing Security for Building Automation Systems

Building automation systems (BAS) have many characteristics that differ from traditional information processing systems, including different risks and priorities. Furthermore, these types of automation systems are subject to different performance and reliability requirements, and often employ operating systems, applications and configurations that may be considered unusual IT practices.
ISACA Journal Article

Enterprise Transformation to Cyberresiliency

Serious cyberbreaches with criminal intent and attacks on enterprises are becoming more alarming due to their scale, magnitude of severity and progressive consequences. The average cost of each lost record rose from US $141 to US $148, the average cost of a breach of 1 million records was nearly US $40 million, and the cost of a breach of 50 million records was estimated to be US $350 million.

Author: Robert Putrus
Podcast

The Evolving Role of Technology Governance

As technology increasingly has become a central driver of business performance, the governance of that technology has become more challenging and more important for organizations. In this ISACA Podcast 50th Anniversary series program, ISACA board director Tichaona Zororo provides his perspective on how technology governance has evolved over the years and the impact that the COBIT framework has made for governance professionals.

16 April 2019
Governance Article

COBIT 2019 Hot Off the Press | ISACA

2019 is off to a strong start—there is an exciting year to come, and a refreshed and revitalized IT governance framework to explore. Released in December 2018, COBIT 2019 is a major revision of the well-established set of guides for effective IT governance.

15 April 2019
Blog Post

Tips to Prepare for ISACAs CRISC Exam

My motivation to pursue ISACA’s CRISC certification was to improve my skills, knowledge and understanding of enterprise and IT risk management.
Blog Post

ISACA Celebrates Volunteer Participation

It’s my favorite week of the year at ISACA – Volunteer Appreciation Week. It is a time when we all reflect on the important and impactful contributions members of our professional community have selflessly made to advance our organization and our industry. It is also a time to invite those who have not yet joined our volunteer corps to participate in ways that align with their interests and availability.
Podcast

Another Win for Global Consumer Data Rights

There is a growing international movement advocating for the protection of consumer data and privacy. The EU passed the General Data Protection Regulation (GDPR), and not long after, the state of California passed a similar data protection law. In this podcast, we compare and contrast GDPR with California’s law and discuss the growing emphasis on privacy and what it means for organizations and individuals.

10 April 2019
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 2

An enterprise risk monitoring process requires the involvement of all the internal processes in the organization but under different perspectives, due to the processing of data having different degrees of granularity.

Author: Luigi Sbriz
Blog Post

Why I’ve Gone From Avid Skeptic to Avid User of Biometrics

My first job in security – and in fact my first job out of school – was for a biometrics company.

Blog Post

Global Passion for ISACA Comes Through Loud and Clear

As I begin my time as ISACA’s new chief executive officer, having just completed my first week in the role, one thing continues to impress me – the passion our professional community feels for ISACA.

Blog Post

Simplifying Enterprise Risk Analysis

How many enterprise risk analysis reports must an organization release? A few years ago, I faced this question in light of cost, time and complexity of the solution.

Blog Post

Happy 50th to the Organization That Keeps Me Ahead of the Curve

Recently, I celebrated a birthday (no, I am not going to tell you which birthday), and my 6-year-old niece who called to wish me a happy birthday asked me if I was wise now.
@ISACA Article

David Samuelson Takes Reins as ISACA's New CEO

David Samuelson became ISACA’s new chief executive officer on Monday, 1 April, bringing an extensive, successful leadership track record in learning products and services, technology innovation, and business strategy and execution to the position.

3 April 2019
@ISACA Article

Five Key Considerations When Evaluating Cyberinsurance

Cyberinsurance can be a valuable tool and risk management capability in any small, medium or large organization’s tool box if properly understood and leveraged.

3 April 2019
@ISACA Article

Securing Your Enterprise's Digital Records

Digital records are the way of the future. Organizations must adapt to this change in information storage and distribution by implementing the proper cybersecurity governance measures.

3 April 2019
@ISACA Article

Negotiate Your Next Job Offer

When approaching your next job interview, know your market value and how to advocate for it. Coming up with a strategy to negotiate and being able to read the room while you are making your own deal are invaluable skills.

3 April 2019
@ISACA Article

Report of the Nominating Committee

The charge of the ISACA Nominating Committee, as described in section 4.5(c) of the ISACA bylaws, is to prepare a slate of candidates for the ISACA Board of Directors, consisting of a board chair, vice-chair, directors and past board chairs.

3 April 2019
@ISACA Article

Slate of 2019-20 Board of Directors - Article 6

ISACA will hold its Annual General Meeting (AGM) on 13 June 2019 in Seattle, Washington, USA, where it will install the 2019-20 Board of Directors.

3 April 2019
@ISACA Article

Auditing GDPR for Small and Medium Enterprises

Enterprises of all sizes that handle European Union (EU) citizen’s data must comply with the EU General Data Protection Regulation (GDPR).

3 April 2019
@ISACA Article

Study and Register for the Updated CISA Exam Now

The Certified Information Systems Auditor (CISA) job practice has been updated to ensure that the exam and the related review materials reflect the most current industry trends impacting IT audit and related professional disciplines.

3 April 2019
@ISACA Article

Listen to How You Can Start Building Your Career Network Early With ISACA

In a recent 50th anniversary series episode of the ISACA Podcast, Mais Barouqa, CISA, CRISC, CGEIT, COBIT 5 Foundation, GRCP, ISO/IEC 27001:2013 LA, ITIL, discusses how ISACA credentialing and volunteer opportunities have helped her grow as a young professional.

3 April 2019
@ISACA Article

Applying Marketing Techniques to Raise Security Awareness

Security awareness and training is key to both the enterprise’s and its employees’ responses to security threats. Training employees on the proper response can help prevent security incidents.

3 April 2019
Blog Post

North America CACS Keynoter Sekou Andrews: Technology Pros Should Be Storytellers, Too

Sekou Andrews, a prominent poetic voice performer who blends inspirational speaking and spoken word poetry, will be the closing keynote speaker at ISACA’s 2019 North America CACS conference, to take place 13-15 May in Anaheim, California, USA. Andrews recently visited with ISACA Now, discussing why technology practitioners should also consider themselves to be storytellers and how changes on the technology landscape will lead to “a rediscovery of what it means to be human.” For more of Andrews’ insights on these and other topics, listen to his recent appearance on the ISACA Podcast.
Podcast

How Technology Professionals Can Find Their Voice

Technology professionals sometimes struggle to connect on a human level when discussing their technology-driven business challenges and opportunities. In this Offstage & Offscript edition of the ISACA Podcast, 2019 North America CACS keynote speaker Sekou Andrews explains why finding ways to humanize their expertise better positions technology practitioners for success.

3 April 2019
Podcast

The State of Cybersecurity, 2019

The role of cybersecurity is becoming increasingly important, and organizations need cybersecurity professionals with technical skills and business acumen. In this podcast, we explore the biggest cybersecurity challenges facing enterprises, the skills gap and how to draw people to careers in cyber.

3 April 2019
Blog Post

Proactively Embracing Innovation

When looking at innovation, it may seem daunting to involve audit properly to protect the organization. With any new effort, there are a lot of unknowns. In traditional project processes, there should be enough time to discover major issues and handle the risk revealed.
Governance Article

IT Governance for Dummies, Part 2 | ISACA

Both business and IT are “unconsciously incompetent” 1 when dealing with the issues relating to both the need for and scope of IT governance in this age of digital disruption. That is the thesis of the first installment of this 2-part series.

1 April 2019
Blog Post

Being an Effective Cybersecurity Leader Amid Increasing Pressure Expectations and Threats

It’s important to think about leadership in the cybersecurity realm through the lens of the “lines of defense” model.
ISACA Journal Article

Enterprise Risk Monitoring Methodology, Part 1

The different business objectives and the specific structure of any organization prevent the possibility of adopting a single monolithic enterprise risk monitoring process suitable to control all its operations.

Author: Luigi Sbriz
Blog Post

Defining the Role of the CISO

Organizations have diverse understandings of what digital security is and is not. As a consequence, they wrestle with who is responsible and who is accountable for digital security.
Blog Post

Technology a Key Driver in UN Conclusions

It’s a wrap. At approximately 7.30 p.m. in New York City on Friday night, the final gavel fell on the negotiations at the 63rd session of the Commission on the Status of Women at United Nations headquarters.

Blog Post

How Security Improvements Can Lead to Business Process Optimization

Security improvements are often viewed skeptically, as they always seem to be associated with higher time requirements and rising costs.
Podcast

What Is Information Security Worth?

Information security professionals understand the value of their work, but it can be difficult to show those outside information security how valuable it is. In this podcast, we discuss some ways that the information security practitioner can showcase the value of information security.

27 March 2019
Blog Post

The Next Challenge in IT Compliance Reporting: SOC2 2017 Trust Services Criteria

In the aftermath of GDPR, the next big change in the IT compliance standards landscape is here. The period of applicability for the new System and Organization Controls for Service Organizations: Trust Services Criteria (SOC2 2017 Trust Services Criteria) has just begun – all SOC2 reports with an examination period ending on or after 15 December, 2018 will have to be issued as per the new standard.
Podcast

The Future of IT Audit

On this ISACA 50th Anniversary Series Podcast, Krysten McCabe, of The Home Depot, looks ahead to the future of the IT Audit profession, given the rise of automation and other changes to the technology landscape.

26 March 2019
ISACA Journal Article

Productivity, Unexpected Outcomes and Opportunity When Using AI in Audits

Whether it is completely recognized or not, the age of artificial intelligence (AI) is here.

Authors: Avani Desai, and Doug Barbin
Blog Post

Five Considerations for Data Breach and Incident Reporting in the EU

The increasing amount of cybersecurity incidents cause a serious negative impact on enterprises, prompting legislators around the world to explore new policies and regulations.
@ISACA Article

Vendor Risk Management An Essential Tool for GDPR

In 2018, the General Data Protection Regulation (GDPR) came into effect in the European Union, leading many organizations to continuously work to adhere to the regulation.

20 March 2019
@ISACA Article

Diving Into NIST Risk Management Framework Revision 2

The US National Institute of Standards and Technology (NIST) recently updated its Risk Management Framework (RMF). Revision 2 (V2) provides updates and changes to the 2014 NIST RMF that considers privacy, supply chain security, and software and system security.

20 March 2019
@ISACA Article

Find Talented Professionals and Employers at ISACA Online Career Fair

Finding the right match between employer and employee can be tricky. Whether you are a potential candidate or a potential employer, the ISACA Online Career Fair is for you.

20 March 2019
@ISACA Article

Accelerate Your Way to Becoming a CSXP

Based on the real day-to-day job tasks of the cybersecurity professional, ISACA has developed a new accelerated path to earning the Cybersecurity Nexus (CSX) Cybersecurity Practitioner (CSXP) credential.

20 March 2019
@ISACA Article

In Retrospect 33 Years of COBIT

It was late 1995 when Erik Guldentops, my then boss at SWIFT, relentlessly insisted that his auditor team “think about the concept ‘control objective’ and how they would define it in simple words.”

20 March 2019
Blog Post

Why You Need to Align Your Cloud Strategy to Business Goals

Your company has decided to adopt the cloud – or maybe it was among the first ones that decided to rely on virtualized environments before it was even a thing. In either case, cloud security has to be managed. How do you go about that?
Blog Post

How IT Teams Can More Efficiently Deliver Stakeholder Satisfaction

Billy Beane was one of the first general managers in the history of Major League Baseball to use data to build out a successful team with a fraction of the budget relative to his peers. Like many IT leaders, he had to do more with less.
Governance Article

Defining Target Capability Levels in COBIT 2019 | ISACA

The COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution outlines a robust, logical and quantifiable process for designing a governance system over enterprise information and technology (I&T).

18 March 2019
ISACA Journal Article

Implementing a Cybersecurity Culture

Culture is an important topic that has been studied by anthropologists and sociologists for years.

Authors: Luis Emilio Alvarez-Dionisi, and Nelly Urrego-Baquero
Blog Post

ISACA at RSA 2019: Sharing Research and Spurring Conversations

The theme of last week’s RSA Conference 2019, “Better,” gave ISACA the opportunity to engage with information and cybersecurity professionals on how we collaboratively move the technology field into a better future.
Blog Post

SheLeadsTech Returns to United Nations

SheLeadsTech was back this week at the United Nations for the 63rd Session of the Commission on the Status of Women to continue the critically important work of empowering women and girls by providing access to social protection and appropriate infrastructure, including technology infrastructure.
Blog Post

C-Suite: The New Main Target of Phishing

We know that phishing attacks are on the rise, but did you know that more and more executives are falling for these phishing emails every day? New phishing campaigns targeting executives are intelligently crafted and difficult to spot.
Blog Post

Didn’t You Read My Email??’ and Other Security Awareness Fallacies

I live in Austin, Texas, USA, where the bumper sticker quotient is fairly high, although diminishing with every vehicle that comes here from places like Dallas (no offense, Dallas — I don’t have any bumper stickers on my car either). One of my favorites is, “If you’re not appalled, you’re not paying attention.” I’m sure it was written with politics in mind, but it’s absolutely relevant for cybersecurity, too.
Podcast

Attracting More Women to Cybersecurity

Organizations continue to struggle with filling open cybersecurity positions – a challenge that is particularly pronounced when it comes to bringing women aboard to fill cybersecurity roles. In this month’s SheLeadsTech Series edition of the ISACA Podcast, Australia-based cybersecurity recruiter Charlotte Osborne provides a recruiter’s perspective on why organizations struggle to attract and retain female practitioners, and offers some potential solutions enterprises can explore to put together stronger and more diverse teams.

13 March 2019
Blog Post

GDPR Audits for SMEs Are All About the Language

It is often said that a good auditor is a good communicator, and this is particularly true when dealing with smaller organizations.
The Nexus Article

10 Questions and Answers When Deploying a PKI

Public key infrastructure (PKI) is at the core of the enterprise IT backbone, and its integration with core IT applications is growing, according to the 2018 Global PKI Trends Study by nCipher Security and Ponemon Institute.

11 March 2019
@ISACA Article

Determining Emerging Risk

Determining what is an emerging risk can be a very difficult prospect for organizations trying to get ahead of bad things that may be coming their way.

6 March 2019
@ISACA Article

Do You Know Your DNS Security Risk

If your enterprise has a Domain Name System (DNS) infrastructure, its security should be assessed.

6 March 2019
@ISACA Article

Auditing CASBs

Cloud computing continues to rise in popularity due to its ability to cut costs, downsize data centers, personalize service coverage from cloud service providers (CSPs) and provision faster.

6 March 2019
@ISACA Article

Understand the Future of Data Protection and Privacy by Attending Virtual Summit

Participate in dynamic discussions with fellow IS/IT professionals around critical issues affecting your data protection and stakeholder privacy in a free, half-day virtual summit

6 March 2019
@ISACA Article

Using Technology and Your ISACA Member Advantage

Today, supercomputers are generating advanced algorithms and big data tools to provide intelligent vertical solutions for a wide range of industries.

6 March 2019
Blog Post

Artificial Intelligence and Cybersecurity: Attacking and Defending

Cybersecurity is a manpower-constrained market – therefore, the opportunities for artificial intelligence (AI) automation are vast.
ISACA Journal Article

Conducting User Activity Monitoring Using Existing IT Infrastructure

The term “insider threat” has become commonplace in the lexicon of chief information security officers (CISOs).

Author: Max Alexander
Podcast

The Cybersecurity Skills Gap

Having technical skills is no longer enough for cybersecurity professionals; enterprises are also looking for employees with business acumen. In this podcast, we discuss the shortage of skilled cybersecurity professionals, the impact that has on the industry and how people can get the skills they need to build a career in cybersecurity.

5 March 2019
Governance Article

Designing Your Organization’s Custom COBIT

Governance over a complex and continuously evolving domain such as enterprise information and technology (I&T) requires a multitude of components, including processes, organizational structures, information flows, behaviors, etc.

4 March 2019
ISACA Journal Article

Stop Looking for the Purple Squirrel

It is entirely possible, even probable, that the cybersecurity skills gap is, at least partly, something of our own making: our fixation with purple squirrels.

Author: Marcelle Lee
ISACA Journal Article

IS Audit Basics: Auditing Cybersecurity

There are several rites of passage one goes through on the way to becoming an experienced IT auditor. After completing college, one gets a job, although not necessarily in audit.

Author: Ian Cooke
ISACA Journal Article

HelpSource Q&A

As a security manager, how can we build a cybersecurity culture?

Author: Sunil Bakshi
ISACA Journal Article

Innovation Governance: What Is Innovation?

Audit professionals must keep up with new IT practices within their organizations.

Author: K. Brian Kelley
ISACA Journal Article

How to Increase Cybersecurity Awareness

The development of information and communication technology is growing at a fast pace. As a result, the Internet has become easy to access.

Authors: Nipon Nachin, Chatpong Tangmanee, and Krerk Piromsopa
ISACA Journal Article

Sponsored Feature: Why Security Product Investments Are Not Working

Enterprises invested in firewalls to keep malicious actors out of the infrastructure.

Author: Sean Keef
ISACA Journal Article

How Root Cause Analysis Fits Into Various Audit Types

True audit work is not just finding the things that have gone or may go wrong, but also involves finding the root causes of the discoveries made by auditors.

Author: Amra Durmisevic-Mutapcic
ISACA Journal Article

Moving Toward Better Security for Today and Tomorrow

Establishing an organizationwide culture of cybersecurity is top-of-mind for many security leaders.

Author: Mike Saurbaugh
ISACA Journal Article

The Network: Raef Meeuwisse

Consumer and shareholder trust are being eroded by the number of security failures and data breaches.

Author: ISACA
ISACA Journal Article

The Two Key Challenges of GDPR Adoption

The day the EU General Data Protection Regulation (GDPR) went into effect, 25 May 2018, marked a real landmark regarding personal data protection for which much information and training has been distributed, more or less accurately.

Author: Ramón Serres
ISACA Journal Article

Another Win for Global Consumer Data Rights

The California Consumer Privacy Act (CCPA) of 2018 continues a growing global crusade for increased consumer privacy rights and data discretion in the wake of the EU General Data Protection Regulation (GDPR), and it will have a number of similar implications on organizations conducting business in California, USA.

Author: Dave Brunswick
ISACA Journal Article

Information Security Matters: What Is Information Security Worth?

I deliberately chose a title that poses a provocative question. By itself, it is unanswerable without some refinement. Whose security? From what? For what? How long? And what exactly do we mean by worth?

Author: Steven J. Ross
ISACA Journal Article

The Role of the CISO and the Digital Security Landscape

Organizations have diverse understandings of digital security. As a consequence, they wrestle with who is responsible & accountable for digital security.

Author: Robert Putrus
Podcast

The Road to GDPR Compliance

Despite the GDPR compliance deadline having passed and the lofty noncompliance fines, many organizations are still unsure of how to address GDPR compliance. In this podcast, we discuss the scope of GDPR, customers’ growing concern for privacy and practical steps your enterprise can take to become GDPR compliant.

28 February 2019
Blog Post

Paying for Apps with Your Privacy

Don’t look at your device when I ask you this question: How many apps do you have on your smartphone? Or, if you use your tablet more often, how many apps do you have on your tablet? Remember this number or write it down.
Blog Post

Environmental Drift Yields Cybersecurity Ineffectiveness

Your cybersecurity tools are working, optimized, and providing real, measurable, business value. They are successfully blocking attacks, detecting nefarious activity, and alerting the security team.
ISACA Journal Article

The Benefits of Information Security and Privacy Awareness Training Programs

In today’s world of hackers and identity thieves, there is an underlying need for every government and commercial organization/business to have an awareness training program.

Author: Larry G. Wlosinski
Podcast

Building an Early Relationship with ISACA

Providing early opportunities for young professionals to accelerate their career paths and expand their networks has long been a hallmark of ISACA. In this 50th Anniversary Series episode of the ISACA Podcast, ISACA member Mais Barouqa discusses how ISACA credentialing and volunteer opportunities have helped her grow as a young professional.

26 February 2019
Blog Post

Three Keys to Improving Medical Device Security

A report released in January by the Healthcare & Public Health Sector Coordinating Councils details the need for better security for medical devices, a topic infrequently discussed in healthcare until recently.

Blog Post

How to Ensure Data Privacy and Protection Through Ecosystem Integration

My recent ISACA Journal article, “Data Privacy, Data Protection and the Importance of Integration for GDPR Compliance,” describes how the movement and processing of personal data, along with the procedures around those workflows, are central to General Data Protection Regulation (GDPR) compliance.
Blog Post

Is Your GRC Program Ready to Thrive in the Digital Economy?

Digital technologies have profoundly changed our lives, blurring the lines between the digital and physical worlds. From its humble beginnings, the current constellation of tools and technologies that empower organizations has grown smarter.

Blog Post

Certifications and the Paycheck: Trends and Truth

New highly validated data from 3,305 employers reveals that the average cash market value for hundreds of tech certifications is at its lowest point in four years. Meanwhile, pay premiums for non-certified skills in the same period have gained 6 percent in value on average.
@ISACA Article

The Risk FARM

In today’s ever-changing risk environment, there are always areas of consideration for the risk practitioner including the dynamic threat world, the many and continuous vulnerabilities that are ever-present, and the potential impacts on the enterprise and its activities

20 February 2019
@ISACA Article

Protecting Your Data in the Cloud

The security provided using Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure as cloud services is better than you could expect from your organization’s personal data center.

20 February 2019
@ISACA Article

Preparing for Blockchain Technology

Blockchain is a distributed network system that is often associated with Bitcoin, the first global decentralized currency.

20 February 2019
@ISACA Article

The IT Auditors Take on the Future of IT Audit

In August 2018, ISACA surveyed IT auditors for The Future of IT Audit: Research Brief to gain insight on what the future of the audit profession may look like in the wake of emerging technology.

20 February 2019
@ISACA Article

Security Leaders Share Insights at ISACA’s Annual IT Security Leaders’ Summits 2018

In 2018, security leaders gathered in Las Vegas, Nevada, USA, and London, England, for ISACA’s annual IT Security Leaders’ Summits (formerly known as the CISO Forums).

20 February 2019
@ISACA Article

ISACA Congratulates 2019 ISACA Award Recipients

ISACA is proud to recognize the outstanding achievements of its individual contributors, chapters and certification exam takers who offer thought leadership, volunteer service and professional achievements that advance ISACA’s purpose and promise.

20 February 2019
Blog Post

Data Analytics in Internal Audit: State of the Data, 2019

Data Analytics in Internal Audit: State of the Data, 2019. ISACA reviews successful IT auditors can translate complex technical analytics or non-techies.

Blog Post

Moving Beyond Stubborn Reluctance to Comply with GDPR

Last May marked the beginning of the application of the General Data Protection Regulation (GDPR), which harmonized and unified the rules governing privacy in the European Union. Leading up to and following the adoption of the regulation, data protection has been in the focus of attention all around the world
Blog Post

Getting Your GDPR Compliance Program Into Gear With Proper Record Keeping

Compliance procedures are notoriously demanding, and European Union General Data Protection Regulation (GDPR) compliance programs are no different.

Governance Article

Agile GEIT, Building Trust & Maximizing Value Delivery: Pt 2 Practitioners Guide | ISACA

To minimize the impact that ever-increasing legal and regulatory requirements have on Agile’s ability to respond effectively and efficiently to customer needs and maximize value delivery in a timely manner require a governance of enterprise IT (GEIT) system equally focused on managing IT risk and the delivery of a value-add outcome to the organization.

18 February 2019
ISACA Journal Article

HelpSource Q&A

We are finding it difficult to hire security staff with appropriate skills.

Author: Sunil Bakshi
Blog Post

More on Password Dictionaries

As a follow-up to our recent ISACA Journal article, “NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk,” we wanted to provide some additional thoughts on the password dictionary concepts.
Blog Post

Women in Cybersecurity | ISACA Blog

Before beginning my career in cybersecurity recruitment, I worked in the female-dominant industry of travel public relations. I was largely oblivious to the challenges of being a female in the workplace because I was surrounded by other strong businesswomen on a day-to-day basis.
Blog Post

North America CACS Keynoter Guy Kawasaki Sizes Up Innovation, Entrepreneurship

Guy Kawasaki, a Silicon Valley-based author, speaker, entrepreneur and evangelist, will be the opening keynoter at ISACA’s 2019 North America CACS conference, to take place 13-15 May in Anaheim, California, USA. Kawasaki recently visited with ISACA Now to discuss some of the themes he will explore at North America CACS, including innovation and entrepreneurship. The following is an edited transcript. For more of Kawasaki’s insights, listen to his recent interview on the ISACA Podcast.
Podcast

The Ingredients of Successful Innovation

What drives successful innovation on the modern enterprise landscape? In this ISACA Podcast Behind the Curtain series program, 2019 North America CACS conference opening keynote speaker Guy Kawasaki addresses some of the key elements that contribute to organizations’ ability to innovate – such as creativity, hard work, opportunism and a little bit of good luck.

12 February 2019
Blog Post

5G and AI: A Potentially Potent Combination

Discover more about 5G and AI: A Potentially Potent Combination. Readapting to 5G and AI integration on smartphones chips for cloud & on-device processing.

Blog Post

For the Board, GDPR Compliance Implementation Reporting Is More Than Just About Exposure and Progress

Whether from a conformance (compliance) or performance perspective, 2 enterprise governance tasks of particular interest are knowing what questions to ask in the process of performing due diligence and knowing what data and information to request to support the due diligence process.
The Nexus Article

Five Questions to Ask in Your Next Cybersecurity Job Interview

Career development and advancement is important to most professionals and, in the case of cyberprofessionals, the current state of a wide range of available jobs and not enough skilled professionals to fill them can be a job seeker’s dream.

11 February 2019
Blog Post

New Cybersecurity Pilot Program to Expand Career Pathways for Women in Chicago

Women in the Chicago area who are interested in exploring a career path in cybersecurity, particularly those who are underrepresented in the field, will now have the opportunity to join a pilot program launched last week by ISACA, along with AnitaB.org and the City Tech Collaborative.
ISACA Journal Article

Cybersecurity and Fintech at a Crossroads

Financial technology (fintech) is a prominent topic for the banking and financial services industry worldwide.

Author: Vimal Mani
Blog Post

How to Approach Blockchain Deployment While Mitigating Risk

Blockchain has emerged as one of the most promising technological developments of the past decade.
@ISACA Article

Improving Efficiency of Security Incident Response Using SOAR

Managing IT is a fairly complicated task due to its complexity.

6 February 2019
@ISACA Article

Keep Your Organizations Data Private

New technologies have allowed more opportunities to access and misuse sensitive information.

6 February 2019
@ISACA Article

Build Your Organization's Awareness of Phishing

It only takes 1 uninformed employee to open an email with a link to a phishing website for malicious actors to bypass your organization’s security.

6 February 2019
@ISACA Article

The Future of Facing Cyberattacks as a CISO

Cybersecurity becomes more and more important in the face of the rising number of cyberattacks.

6 February 2019
@ISACA Article

Dynamic and Comprehensive: CSX Virtual Cyber Academy

The Cybersecurity Nexus™ (CSX) Virtual Cyber Academy is a comprehensive, real-world training solution that tests your skills in a live, dynamic network environment on a cloud-based learning platform.

6 February 2019
@ISACA Article

How to Protect Digital Data Privacy

More personal data are available to enterprises than ever before due to the rise of automation, the Internet of Things (IoT) and artificial intelligence (AI).

6 February 2019
Blog Post

ISACA Anniversary Celebration – and Social Media Campaign – Are Underway

ISACA’s yearlong 50th anniversary celebration is underway around the globe, and one of the best ways to be part of the global celebration is through social media.
Blog Post

Protecting Patient Records in 2019 and Beyond

A program called MyHealthEData was unveiled in 2018. Through this program, the US Centers for Medicare & Medicaid Services (CMS) is promoting the adoption of IT environments that allow simpler sharing of health data to outside organizations, as well as better access. The CMS will also allow easier access to claims data by medical beneficiaries.
Governance Article

A Dynamic Approach to Tailoring Governance in the Era of Digital Disruption | ISACA

We are living in exciting times where the impact of disruptive technology is seen in all aspects of our professional and personal lives. We are witnessing the phenomenal pace of technology change and the resultant impact on enterprises in terms of innovative business processes facilitated by information systems with underlying technology

4 February 2019
ISACA Journal Article

How Google Voice and AI Can Interfere in Users’ Privacy

In the modern age of the Internet of Things (IoT), life is made easier for everyone by being connected to the Internet.

Author: John Mason
Blog Post

Incorporating Privacy into Data Protection Strategy

Nowadays, the term privacy echoes across boardrooms globally, where each country and enterprise races to update its laws and policies to keep up with the need for data privacy controls.
Podcast

The Mother of All Breaches

The largest data breach to date was recently discovered. The Collection 1 data breach has 773 million records, and these data were found from a variety of sources. In this podcast, we discuss what makes the Collection 1 breach different from other breaches and what you can do if your information was compromised.

31 January 2019
Blog Post

Certification Spotlight with … Marco Schulz

The ISACA Now blog occasionally highlights the impact ISACA certifications have in the evolving business landscape, as well as how certifications have impacted individual members of the ISACA professional community. Today, we profile Marco Schulz, CISM, CISA, CGEIT, CEO at marconcert GmbH (Germany).
Blog Post

Google’s GDPR Fine Reinforces Need for Intentional Data Governance

For those of us who work in information security, data privacy and governance, we seem to traverse daily from one headline to another. A new corporate victim announces they were breached to the tune of 100 million records.
Blog Post

IT Audit in 2019: Hot Topics & Trends | ISACA Blog

The turn of the calendar to a new year is always a great time to take pause and reflect. Now that 2019 is in full swing, I wanted to take a quick snapshot of hot topics and trends for the IT audit field in 2019. And just to make sure I wasn’t completely winging it, I checked in with a couple valued industry contacts.
Blog Post

Practical DLP Implementation

Practical implementation and management of data loss prevention or protection (DLP) solutions or a portfolio of solutions should follow a logical process to ensure the holistic protection of information resources.
ISACA Journal Article

Cost of a Data Breach

Many know the adage, “time is money.” It is a sensible guide for anyone with persistent stress in their professional (and personal) lives. The IBM/Ponemon Institute 2018 Cost of a Data Breach Study...

Author: Salvatore J. Stolfo
Blog Post

How Tech Roles Provide Women Great Career Paths

I am often asked by women young and old, “Were you intimidated by technology or afraid to start your first job in tech?”
Blog Post

Cybersecurity and its Critical Role in Global Economy

Cybersecurity and its critical role in the global economy – a very interesting topic indeed, and one that is taking center stage this week at the World Economic Forum in Davos after being identified as one of the top five global risks.
Blog Post

Expired TLS Certificates Must Be Used as a Learning Experience

A recent report from the British research firm Netcraft showing that 80 US government websites had expired Transport Layer Security certificates during the ongoing US government shutdown rightfully has caused quite a stir, and ISACA members ought to be paying attention.
@ISACA Article

What to Consider When Implementing CCTV

Today, it seems everyone is watching us. In the modern urban setting, there are more closed-circuit television (CCTV) cameras recording life than ever thought possible one generation ago. The volume of information captured is

23 January 2019
@ISACA Article

Combat AI Malware

Cybercriminals have turned to artificial intelligence (AI) to access large-scale data illegally. With the potential for AI to be weaponized, cybercriminals can use AI to automate their cybercrime processes and forge video to transform the meaning of evidence and truth.

23 January 2019
@ISACA Article

Gain Insights on Managing Vendor Risk

Vendor risk management (VRM) is increasingly critical to protecting organizations that outsource products and processes to vendors. VRM helps to protect the organization’s assets while maintaining efficiency.

23 January 2019
@ISACA Article

Engage Offers Ways to Learn, Network and Participate

ISACA’s new Engage portal offers opportunities to learn, network and participate at ISACA in a virtual environment. If you were part of ISACA’s online communities in the past, your discussion posts from the last year have migrated to the new platform.

23 January 2019
@ISACA Article

The Bank of Ghana Recommends ISACA Credentials for Cybersecurity Professionals

ISACA certifications are globally recognized and allow ISACA members to progress their careers, raise their earning potential and add value in their current positions. In October, the Bank of Ghana recognized ISACA certifications...

23 January 2019
Governance Article

IT Governance for Dummies, Part 1 | ISACA

Before deciding not to read on, arguably, there are a lot of us out there showing little thought or judgement about what IT governance really means and what we should be doing about it. When reviewing some of the facts and figures herein, it appears that some people are doing things in a very careless manner.
Blog Post

Auditing the GDPR

Like in many professions, the new year is traditionally a time for planning for IT auditors. This year, I am willing to wager that many of your resulting IT audit plans include something to do with the EU General Data Protection Regulation (GDPR).
ISACA Journal Article

HelpSource Q&A

What are the best practices a CISO should ensure to provide assurance on application security?

Author: Sunil Bakshi
Blog Post

Big Data: Too Valuable and Too Challenging to Be Overlooked

As the new year begins and business leaders refine their 2019 plans, how to effectively deploy technology increasingly will be a focal point of conversations in the boardroom and elsewhere throughout the enterprise.
Podcast

Confronting Gender Bias in the Tech Workforce

Gender bias in the workplace plays out in a variety of ways – some obvious, others much more subtle. In this ISACA SheLeadsTech series podcast with guest JJ DiGeronimo, we discuss the ways in which enterprise leaders can make the tech workforce more welcoming to female practitioners and the key ingredients for success in programs designed to counteract gender bias in the workplace.

17 January 2019
Blog Post

GDPR Compliance as a Competitive Advantage

Last year was a milestone in the field of privacy as the General Data Protection Regulation (GDPR) put privacy into the spotlight in and outside the European Union.
Blog Post

The US Government Shutdown’s Potentially Lasting Impact on Cybersecurity

The partial US government shutdown is the longest in modern history and continues to drag on as both political parties remain entrenched, refusing to budge from their respective positions. The inability to reach an agreement, or at least to open the government, may have lasting impacts on the effectiveness of cybersecurity in the federal government.
Blog Post

A New Approach to Finding Cybersecurity Talent for the Future

The cybersecurity profession is facing a shortage of qualified talent to fill an increasing demand for positions, as so many reports inform us. What I find self-fulfilling about our “talent dilemma” is the acknowledged rapid rate of technology change, yet the ongoing quest for specific technical experience and expertise. We seek plug-and-play people to match technology components, rather than individuals with foundational skills and an aptitude and desire to learn changing technology.
Blog Post

The Business Risks Behind Slow-Running Tech

Entrepreneurs and IT leaders frequently underestimate the true power that slow technology has to negatively impact a business.
ISACA Journal Article

Continuous Modernization

Blockchain, cognitive computing, artificial intelligence (AI) and virtual reality are revolutionizing the way people work.

Authors: Vinay Parisa, Biswajit Mohapatra, and Srividya Vinod
Blog Post

Shifting Technology Landscape Positions Auditors for Greater Impact

Enterprises are exploring opportunities driven by digital transformation, identifying technology-driven paths to deliver more value, more quickly, while also benefiting from new process efficiencies. IT auditors must do the same to ensure they remain valued partners by the organizations for which they work.
Blog Post

Start with the Why: A Strategic Lifecycle for Information Security

Many presentations by information security managers for stakeholders within their organizations include the depiction of a lifecycle in one form or another to underline that information security is not a one-off project, but a continuous activity.

@ISACA Article

Strengthening Internal Audits Influence and Impact

Boards, audit committees, senior executives, risk managers and the business need internal audit’s best efforts in today’s environment of ongoing disruption and increasing risk. These stakeholders also need internal audit’s objective

9 January 2019
@ISACA Article

Learn to Audit AI

Artificial intelligence (AI) will not only impact how enterprises do business, but will also impact society as a whole. Emerging AI technologies will cause disruptions to the way everyone, including IT auditors perform their work...

9 January 2019
@ISACA Article

ISACA Turns 50—Join the Celebration!

ISACA is celebrating its 50th anniversary this year, and members are essential participants in the year-long celebration.

9 January 2019
@ISACA Article

ISACA’s Advocacy and Public Affairs Team Engages With EU Officials and Organizations

Since its launch last year, ISACA’s Advocacy and Public Affairs team has engaged with key stakeholders and officials around the globe on behalf of the professions it serves through meetings ...

9 January 2019
Podcast

ISACA – 50 Years and Counting

ISACA is celebrating its 50th anniversary in 2019, having evolved from a grassroots, Los Angeles-based organization focused on electronic data processing in 1969 to the global business technology association it has become today, with 140,000 members and local chapters in more than 220 countries. In this 50th Anniversary Series podcast, ISACA board chair Rob Clyde addresses how the organization has changed – and what aspects have not changed – over the past 50 years, and what technological forces will help shape the organization’s future.

9 January 2019
Blog Post

Empower Auditors to Think Big Picture on AI

The new white paper, Auditing Artificial Intelligence, provides an overview of what AI is, why auditors need to be aware of AI, and how the COBIT 2019 framework relates to AI auditing.
Governance Article

Agile GEIT Practitioners Guide, Part 1 | ISACA

Ever-increasing legal and regulatory requirements have an impact on Agile’s ability to respond to customers’ needs in a timely, effective and efficient manner.
ISACA Journal Article

Blockchain Explained and Implications for Accountancy

Blockchain technology underlies cryptocurrencies such as Bitcoin and Ethereum and is capable of storing data that has notably useful characteristics, especially for accounting data.

Authors: Pascal A. Bizarro, Andy Garcia, and Zachary Moore
Blog Post

How to Hack a Human

Have you ever wondered just how many ways there are to hack the human mind and just how effective each technique is? I did; so I set about collating all of the techniques for human control and influence:
Blog Post

Five Cost-Effective Ways for Small Businesses to Achieve Compliance

In today's world, all large and small companies are required to show and prove constant compliance to do or sustain business. The task may be somewhat easy for large companies by hiring more employees to achieve; small businesses do not have the luxury to hire more people at competing rates with large companies as well as reduced revenue.

Blog Post

50th Anniversary Year Provides Inspiration to Look to ISACA’s Future

When ISACA – then known as the Electronic Data Processing Auditors Association – was incorporated by seven Los Angeles area professionals in 1969, “there was no authoritative source of information,” according to ISACA’s first president, the late Stuart Tyrnauer. There was “no cohesive force, no place to turn to for guidance.”
Blog Post

What Are Challenges in Deployment and How Can They Be Mitigated?

Transformation offers many key benefits, and any enterprise that would like to sustain and grow in this ever-changing, fast-paced world would be subject to the deployment of new systems.

ISACA Journal Article

Security Issues in IoT: Challenges and Countermeasures

Internet of Things (IoT)-connected devices have become an integral part of daily life. The IoT is quickly growing as more and more devices are attached to a global network.

Authors: Gokhan Polat, and Fadi Sodah
ISACA Journal Article

Data Privacy, Data Protection and the Importance of Integration for GDPR Compliance

The EU General Data Protection Regulation (GDPR) guidelines require that organizations protect the personal data and privacy of EU citizens.

Author: Dave Brunswick
ISACA Journal Article

Reporting on GDPR Compliance to the Board

Preparing for compliance with the EU’s GDPR, a multinational organization sought a simpler way to affect the complexity of the compliance matters facing the organization.

Author: Guy Pearce
ISACA Journal Article

IS Audit Basics: Assurance Considerations for Ongoing GDPR Conformance

How can we ensure that the newly developed GDPR processes and procedures transition into day-to-day practices and become business as usual?

Author: Ian Cooke
ISACA Journal Article

HelpSource Q&A

There are multiple regulations and laws requiring protecting the privacy-related data of customers and stakeholders.

Author: Sunil Bakshi
ISACA Journal Article

NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk

The updated US NIST standards on password security published in the Special Publication 'Digital Identity Guidelines' represent a novel approach to improve IT security.

Authors: Bachman Fulmer, Melissa Walters, and Bill Arnold
ISACA Journal Article

Sponsored Feature: Why Attackers Are Turning Their Attention Toward ERP Applications

Business-critical SAP and Oracle applications (also known as enterprise resource planning [ERP] applications) run the economy by managing the critical data and processes of large global organizations.

Author: Juan Pablo Perez-Etchegoyen
ISACA Journal Article

The Road to GDPR Compliance: Overcoming the Compliance Hurdles

The passage of the EU General Data Protection Regulation (GDPR) has brought unprecedented attention to data protection legislation and the protection of personal privacy.

Author: Corlane Barclay
ISACA Journal Article

The Network: Tyler Hardison

What is the biggest security challenge that will be faced in 2019?

Author: ISACA
ISACA Journal Article

The Four Questions for Successful DLP Implementation

Information is a critical aspect of organizational success. Organizations with a better understanding of their information have been known to excel over those with a limited grasp of their information.

Author: Christopher Nanchengwa
ISACA Journal Article

Information Security Matters: Fifty Years of Information Security—A Recollection

This being the first issue of the ISACA Journal of 2019, which happens to be celebrating ISACA’s 50th anniversary!

Author: Steven J. Ross
Governance Article

GEIT Framework at Work, Part 6: Follow-Up & Continuous Improvement | ISACA

Readers of this series of articles have seen the progression of steps taken in the implementation of 1 particular element of governing and managing enterprise IT (GEIT): managing security, as defined in COBIT 5’s APO13 Manage security process.

26 December 2018
ISACA Journal Article

Launching a Value-Based Analytics and RPA Program

Many organizations are probably already using some form of data analytics in customer profiling, engineering or—hopefully—assessing IT risk.

Author: Chris Sanders
ISACA Journal Article

Identifying Challenges and Mitigating Risk During Deployment

Most people have come across the frequently used term “transformation” over last couple of years.

Author: Rajul Kambli
Governance Article

A New COBIT Is in Town and I Really Like How It Looks | ISACA

ISACA released the latest version of the COBIT framework and I can tell you without hesitation that this latest structure is one of the best governance and management frameworks to date for the enterprise governance of information and technology (EGIT).

10 December 2018
The Nexus Article

Closing the Skills Gap: Staying Current in a Changing Workplace

The cybersecurity skills gap has been a reality for organizations for several years and will be for the foreseeable future. The inability of organizations to close that gap is exacerbated by rapid evolution in the workplace.

10 December 2018
ISACA Journal Article

The Age of PowerShell

The IT industry is changing at a rapid pace, and gone are the days when administrators managed just a handful of servers. In today’s rapid deployments, system administrators are required to handle tens of hundreds of servers that are spun up or destroyed, as demand dictates.

Author: Ignacio Marambio Catán
ISACA Journal Article

Advancing Information, Advancing Technology, Advancing COBIT

Information technology has changed the world, the way people work, and the way people communicate and live.

Author: Graciela Braga
ISACA Journal Article

The Network: Glory Ninsiima

How do you think the role of IT auditor is changing or has changed?

Author: Glory Ninsiima
ISACA Journal Article

Agile GEIT—Building Trust and Maximizing Value Delivery

The Agile methodology is defined as a set of principles and values that guide software development teams toward responding effectively and efficiently to customers’ needs, thereby reducing the business risk of irrelevance.

Author: Michael Bergman
Governance Article

Basic Lessons From COBIT Foundation Training | ISACA

The COBIT 5 Foundation course helps students prepare for a multiple-choice exam. However, the answer options offered on the exam are not the only choices the learner should be making.

26 November 2018
Podcast

Addressing Tomorrow’s Threats Today

Threatcasting has indicated that IoT and AI are going to be some of the biggest security concerns in the future. But what can we do now to protect these home devices? And why does it matter if an Internet-connected appliance, like a smart coffee maker, is compromised?

20 November 2018
ISACA Journal Article

Demand Management’s Evolution and Maturity Assessment

Economic recessions, globalization, offshoring and demographic changes are factors that have affected and shaped business strategies, organizational structures, markets and fortunes of people and enterprises.

Authors: Gianluca Giorgini, Stefano Aiello, Alberto Buffon, and Mariano Corso
Podcast

COBIT’s Impact on the Governance Profession

ISACA’s COBIT framework has helped practitioners around the world better manage and govern their information and technology for more than two decades. In this ISACA 50th Anniversary series podcast, we examine the impact COBIT has made for governance professionals and how the framework has evolved, including the recent launch of COBIT 2019.

13 November 2018
Governance Article

Board Support Can Revolutionize Cities. COBIT 5 Can Help Attain It

Most people, including many readers of this article, live in cities. Revolutionizing cities may seem like it is not an IT or technical issue, but smart sustainable cities are important for IT professionals.

12 November 2018
The Nexus Article

Digital Currency and the Need for Trust

For the first time in modern history, our civilization is on the verge of a new concept in monetary transactions with cryptocurrency. Cryptocurrency could be hugely disruptive to many industries and could completely change money transfer services industries, but trust must be the cornerstone before it can gain wide acceptance and be legitimized.

12 November 2018
Podcast

Why We Failed

A centralized security approach for distributed systems has left many organizations vulnerable to attacks. In this Knowledge Series podcast, we discuss the ways in which security professionals have “failed” during the move toward decentralized processing.

12 November 2018
ISACA Journal Article

Growing a Cybersecurity Career

Those who have owned a house plant have probably noticed that no matter where the plant is placed, it grows toward the strongest source of light—a phenomenon called “phototropism.”

Author: Philip Casesa
ISACA Journal Article

Automation, Governance and Security in a Software-Defined World

For more than 15 years, virtualization platforms have revolutionized computing by completely decoupling processing power from hardware resources.

Author: Julio Pontes
ISACA Journal Article

Adding Increased Value—The IT Auditor’s Role in a SOX Audit

When a substantive audit is being performed where application controls are not being relied upon, could there be risk that needs to be tested, or at least identified, by an IT auditor even if application controls are not playing a role?

Author: Jeffrey T. Hare
ISACA Journal Article

A Heightened Sense of Awareness

Each individual in an organization who manages information and information systems must fully understand his or her specific security responsibilities.

Authors: Wade Cassels, Kevin Alvero, and Randy Pierson
ISACA Journal Article

Future-Proofing a Career in Cybersecurity: The Skills Gap

Security professionals are in high demand, but the challenge is that there are not enough qualified employees to fill open enterprise requisitions.

Author: Mike Saurbaugh
ISACA Journal Article

Is Artificial Intelligence a Career Path for You?

Is the world changing too fast? Can society continue to do the best it can?

Author: Larry G. Wlosinski
ISACA Journal Article

The Practical Aspect: Why Worry About IoT?

The Internet of Things (IoT) refers to physical objects that have embedded network and computing elements and communicate with other objects over a network.

Authors: Vasant Raval and Ranjit D. Thaker
ISACA Journal Article

Information Security Matters: How We Can Succeed

Just as the distributed model displaced the centralized (i.e., mainframe) one, I now believe that we are on the threshold of a new era, that of a multi-modal, utility, cloud-based, commercial, Software as a Service (SaaS) (choose any two terms at your pleasure) architecture.

Author: Steven J. Ross
ISACA Journal Article

Tools: Skill Acquisition in a Rapidly Evolving Workplace

The cybersecurity skills gap has been on the surface of employers’ awareness for several years.

Author: Robin Lyons
ISACA Journal Article

Effective Strategies for Creating and Maintaining a Diverse and Inclusive IT Audit Team

Broadly put, it is widely accepted in today’s corporate world that diverse organizations are preferable to their homogenous counterparts.

Authors: Julie Balderas, Asim Fareeduddin, Femi Richards, Ruwel Sarmad, and Jack Wall
ISACA Journal Article

Defining the Chief Digital Officer Using COBIT 5

The digital revolution’s pace is rapidly increasing, causing numerous disruptions and transformation in more and more industries.

Authors: João Catarino, Isabel Rosa, and Miguel Mira da Silva
ISACA Journal Article

IS Audit Basics: Affect What Is Next Now

To celebrate its 15th birthday, LinkedIn asked its members to share what they wanted to be when they were 15.

Authors: Ian Cooke and Martin Cullen
Governance Article

Introducing COBIT 2019: The Motivation for the Update? | ISACA

The upsurge of digital transformation has made information and technology (I&T) crucial in the support, sustainability and growth of enterprises.

29 October 2018
ISACA Journal Article

Evidential Study of Ransomware

Ransomware infections are rising exponentially. Attackers are motivated to extort money from individuals and organizations by infecting their systems with malicious code.

Authors: Aditya K. Sood, Pranshu Bajpai, and Richard Enbody
ISACA Journal Article

Red Teaming for Cybersecurity

Red teaming has been a buzzword in the cybersecurity industry for the past few years.

Author: Seemant Sehgal
ISACA Journal Article

It’s Time to Stop Today’s Cybersecurity Insanity

You may have heard the adage, “Insanity is doing the same thing over and over again and expecting different results.”

Author: Gregory J. Touhill
Podcast

Examining the Facebook Breach

The recent Facebook data breach affected millions of users, and the way the exploit was carried out differed from many attacks in the past. In this security podcast, we discuss the Facebook security breach, how to respond to this kind of breach and the widespread impact this attack has.

10 October 2018
Governance Article

GEIT Framework at Work, Part 5: Confirming the Results | ISACA

There comes a point in any long-term initiative when the issues have been identified, the mitigation plans developed, the appropriate work products defined, and those products and plans have been implemented.

2 October 2018
Governance Article

How to Prepare for the COBIT 5 Foundation Exam

The COBIT 5 Foundation course helps the student prepare for a multiple-choice exam. However, the answer options offered on the exam are the not the only choices the learner should be making.

1 October 2018
Podcast

Digital Transformation? Boards Are Not Ready for It!

Any enterprise that wants to remain competitive must have a strong board of directors leading it toward digital transformation. Unfortunately, boards of directors may not always be knowledgeable enough to promote digital transformation. In this podcast, we discuss why boards of directors may not be able to how to prepare boards to lead digital transformation efforts.

30 September 2018
ISACA Journal Article

Lack of Oversight and Credentialing Process for Digital Forensic Investigators

Despite the phenomenal growth in the digital world and crimes committed using digital techniques and tools, there are literally no foundational requirements to perform digital forensic investigations.

Author: Nima Zahadat
ISACA Journal Article

Using COBIT 5 to Get and Give Board Support for Revolutionizing Cities

Most people, including many readers of this article, live in cities.

Author: Graciela Braga
Governance Article

GEIT Framework at Work, Part 4: Outlining the Work Products | ISACA

No governance of enterprise IT (GEIT) initiative can be accomplished without careful attention to the work products and the project plan. They are the elements that deliver tangible results from GEIT.

17 September 2018
Podcast

Making the Case for Workplace Gender Diversity

While many studies have shown the business benefits of gender diversity in the workforce, employees often are skeptical of the value of diversity, especially without strong sponsorship from the C-Suite. In this month’s ISACA SheLeadsTech podcast with guest Andrew McNeilis, chief commercial officer at Phaidon International, we look at recent research on this topic and explore strategies that can be deployed to strengthen organization-wide commitment to gender diversity.

17 September 2018
ISACA Journal Article

Effective Interactive Privileged Access Review

Most organizations would agree that it is a good practice, albeit not an easy one, to establish rules relating to the amount and type of access to provide to particular job roles.

Author: Sundaresan Ramaseshan
ISACA Journal Article

Understanding Cybersecurity Risk

Progressive organizations know that risk is a fact of business. More than that, they recognize the need for integrated and sustainable solutions to address critical operational failures.

Author: Syed Alay Raza
The Nexus Article

Cloud Insecurity: The Need for Stronger Identity Management

With cloud usage growing exponentially, are we asking enough questions about cloud security for organizations to make informed risk management decisions?

10 September 2018
Podcast

Exploring a Fun Career in Cybersecurity

Cybersecurity can be a very fun career. Even those who do not have technical backgrounds can thrive in a cybersecurity role. In this podcast, we discuss what makes a cybersecurity career fun, how to begin a cybersecurity career and why the perception of cybersecurity careers is so important.

10 September 2018
ISACA Journal Article

Examining Cybersecurity Risk Reporting on US SEC Form 10-K

On 27 June 2017, A.P. Moller-Maersk, Merck & Co., Inc., TNT, WPP, DLA Piper, Rosneft, the Ukrainian state postal service and Princeton Community Hospital in West Virginia, USA, were among the numerous organizations...

Author: Grace F. Johnson
Governance Article

Tips for Implementing IT Governance With COBIT 5 | ISACA

Underlying the implementation of a number of governance of enterprise IT (GEIT) initiatives are information governance and information management issues such as big data, analytics...

9 July 2018
ISACA Journal Article

How Boards Engage in Digital Strategy and Oversight

Boards of directors (BoDs) are ultimately accountable for strategic decision-making and control in organizations.

Authors: Steven De Haes, Laura Caluwe, Anant Joshi, and Tim Huygh
ISACA Journal Article

Speeding Up Software Delivery With Effective Change Management

The value in software is realized only when the end product is in the hands of its intended users. Traditional software development can be slow.

Authors: Evan Bass and W. Noel Haskins-Hafer
ISACA Journal Article

HelpSource Q&A

Considering the changes happening in IT, I feel there is a need for updating my skills; however, I am not sure what studies I should pursue to ensure that my skills are not outdated.

Author: Sunil Bakshi
ISACA Journal Article

Bitcoin Boosting Businesses

Love them or hate them, cryptocurrencies have been turning the financial world upside down over the past few years.

Author: Josh Wardini
ISACA Journal Article

Guest Editorial: Digital Transformation Insight for 21st Century Organizations

In the IT and cybersecurity realms, change is inevitable. Digital advancements fuel innovative ways of doing things.

Author: Gregory J. Touhill
ISACA Journal Article

The Practical Aspect: Mergers and Acquisitions, Should Internal Audit Be Involved in Due Diligence?

Corporations today, especially large corporations, find acquisitions to be a crucial means to achieve their strategy.

Authors: Vasant Raval and Chandni Jalan
ISACA Journal Article

Information Security Matters: Why We Failed

The last time there was a shift…in the way information technology was organized occurred when we moved from massive centralization—mainframes to distributed processing.

Author: Steven J. Ross
ISACA Journal Article

Data and Analytics Progress During the Last Four Years

In the last few years, there has been an increase in the usage, volume and importance of data and analytics.

Author: Angel Serrano
ISACA Journal Article

Digital Transformation? Boards Are Not Ready for It!

Boards of directors (BoDs) should be involved in directing and leading their organizations toward digital transformation, ever wary of the not inconsiderable risk scenarios along the way.

Author: Guy Pearce
ISACA Journal Article

Sponsored Feature: Innovating Internal Audit to Unlock Value

As new businesses are created and old ones spun off, processes evolve, technologies are adopted, and regulatory demands fluctuate, the internal audit function must develop new approaches to advise management on key issues, anticipate risk and be more forward-looking.

Authors: Clay Young and Erik Kiaer
ISACA Journal Article

The Network: Kevin Murphy

How do you think the role of the cybersecurity professional is changing or has changed?

Author: Kevin Murphy
ISACA Journal Article

Impacts of Blockchain on the Auditing Profession

Blockchain’s disruptive effect is widely recognized in the financial sector, although the level of awareness in other sectors and their professions is still in its infancy.

Authors: Nathalie Brender and Marion Gauthier
ISACA Journal Article

IS Audit Basics: Auditing the IoT

Determining the IoT pre-audit planning for the subject, objective, scope, and procedures for data gathering.

Author: Ian Cooke
ISACA Journal Article

Cyberconflicts: Reflections and Implications for Today’s Enterprises

Cyberconflict, or the so-called cyberwar, is an issue that could be seen as falling into the category of being “a truth through plausible deniability.”

Author: Jeimy J. Cano M.
Podcast

I Left My Security in the Office

Remote work is growing increasingly more common, and with good reason; it offers numerous benefits to enterprises that leverage it. But this new way of working also presents new security challenges. In this podcast, we discuss some of those challenges and how to combat them.

30 August 2018
Governance Article

Better the Process You Know Than the Gaps You Don’t | ISACA

The FirstRand Group is a financial services provider in South Africa. It is one of the largest financial institutions in South Africa and the holding company of First National Bank (FNB), a retail and commercial bank.

20 August 2018
Podcast

The Elevation of Cybersecurity to a Board-Level Imperative

Cybersecurity has found its way onto board agendas for enterprises across all industries throughout the world, yet remains a mighty challenge. In this ISACA 50th Anniversary series podcast, we examine how cybersecurity came to command such high-profile attention and what organizational leaders can do to improve cyber preparedness.

20 August 2018
ISACA Journal Article

The Downstream Effects of Cyberextortion

In the mid-1800s, manufacturing was alive and well in the Chicago (Illinois, USA) area. Demand for industrial goods was growing.

Author: Tony Martin-Vegue
ISACA Journal Article

The Price of a Data Breach

In this modern age, the volume of data shared among different platforms has exponentially increased as technology becomes more prevalent across all industry sectors.

Authors: Van Ha Le and Bianca Zamora
The Nexus Article

Combatting “Fileless” Malware

If you are a security practitioner, you do not need me to tell you how bad malware is. We all have war stories of critical system outages, angry users and other disruptions to the well-oiled machinery of our enterprise’s technology that occurred because of a particularly nefarious malware incident.

13 August 2018
Podcast

IoT, Machine Learning and Artificial Intelligence: Nothing to Fear

When some people think of machine learning and artificial intelligence, their thoughts go immediately to Skynet or devices taking over humankind. But machine learning and artificial intelligence can significantly improve the quality of everyone’s life, whether it be through applications at home or during medical procedures. In this security series podcast, we discuss machine learning and artificial intelligence and the benefits and challenges they pose.

10 August 2018
ISACA Journal Article

Addressing the Challenges of IT Audits by Supreme Audit Institutions

Supreme Audit Institutions (SAIs) refer to the national agencies entrusted with ensuring accountability in the functioning of national governments through external audit.

Author: Shourjo Chatterjee
Governance Article

COBIT 5: How to Get Inspired | ISACA

Even best-in-class frameworks need to be half as inspiring as a good novel—and twice as inspiring for practitioners to read and use them! As a COBIT trainer, I use the following tips on how to capitalize on COBIT...

6 August 2018
ISACA Journal Article

Data Spill Lessons From the Oil Industry

Historically, data management was a money outflow for organizations; the primary expense was allocated to data archival to comply with regulatory requirements.

Author: Sridhar Govardhan
ISACA Journal Article

Cybersecurity Employee Retention and Management Culture

Ask security leaders if they have enough cybersecurity professionals on staff and the likely response will be “no.”

Author: Mike Saurbaugh
Governance Article

GEIT Framework at Work, Part 3: Creating a Project Plan | ISACA

There is an old saying about the importance of planning: “Failing to plan is planning to fail.” While the saying has become almost a cliché from years of use, it is essentially true.

23 July 2018
Podcast

How Women Can Capitalize on Opportunities in the Tech Workforce

While the disproportionately male nature of the tech workforce can be challenging for some women to navigate, many organizations are actively looking to bring more women into tech roles. In this ISACA SheLeadsTech Series podcast, we discuss how organizations can make those roles more appealing for women and why this might be a great time for women who are interested in joining the tech workforce.

20 July 2018
Podcast

The Promises and Jeopardies of Blockchain Technology

Blockchain technology has the potential to change every industry, from finance to healthcare. However, blockchain presents some risk, and enterprises need to consider this risk if they are thinking about adopting blockchain technology. In this podcast, we discuss the benefits of blockchain and some of the challenges that it may present.

20 July 2018
ISACA Journal Article

Technology Innovation Dynamics: Innovation Governance

Complex adaptive system (CAS) cognations typically reflect bounded individual agents interacting and adapting to each other and the associated environment.

Author: Robert E. Davis
Podcast

The State of Cybersecurity

With the increasing number of connected devices, the need for skilled cybersecurity professionals is even greater. In this Security series podcast, we discuss the most common cybersecurity threats, the skills gap and how the skills gap can be remediated.

11 July 2018
ISACA Journal Article

Securing the SWIFT Infrastructure Across the Cyber Kill Chain

Secure SWIFT infrastructure enabled by IT and information security functions.

Author: Vimal Mani
Governance Article

The Victorian Protective Data Security Framework and COBIT 5 | ISACA

The amount of data being produced, processed, communicated and stored is larger than ever before. 1 Most people are well aware that information about them is typically held by a variety of organizations ranging from governments to private organizations.

9 July 2018
The Nexus Article

Overexposed and Underprepared: Top Reasons to Consider SIEM Now

Who are the biggest targets for hackers and cybercriminals? You are. Intruders are finding the holes in your network, your devices, your applications—and they are accessing your data.

9 July 2018
The Nexus Article

Boost Security in Your Organization with Tactical Two-Factor Authentication

Social engineering is on the rise. Organizations are nearly 3 times more likely to get breached by social attacks than via actual vulnerabilities, according to Verizon’s 2018 Data Breach Investigations Report.

9 July 2018
ISACA Journal Article

Information Security Matters: I Left My Security in the Office

For many people, information technology has changed the very meaning of work.

Author: Steven J. Ross
ISACA Journal Article

Help Source Q&A

Our organization is considering multiple projects for developing and implementing IT-based solutions.

Author: Sunil Bakshi
ISACA Journal Article

The Promises and Jeopardies of Blockchain Technology

The idea of the distributed ledger of everything, which burst into the public scene in 2008 with the publication of the fascinating white paper, Bitcoin: A Peer-to-Peer Electronic Cash System, has transitioned from hype to reality much faster than many experts had predicted.

Author: Phil Zongo
ISACA Journal Article

The Power of IT Investment Risk Quantification and Visualization: IT Portfolio Management

Is it worth the incremental effort to determine IT financial investment risk as part of the IT investment business case?

Author: Guy Pearce
ISACA Journal Article

Roles of Three Lines of Defense for Information Security and Governance

Assurance, governance, risk, compliance, information security and cybersecurity functions can all work in one way or another on information security and governance.

Author: Amelia Ho
ISACA Journal Article

Data Governance From the Actuary and Risk Management Perspectives

Data governance comprises a holistic management system that coordinates and manages how data move in the organization, responsibilities and data flows, and all risk and actions related to data.

Author: Mehmet Zeki Önal
ISACA Journal Article

Tools: Using Audit Tools to Support Strategic Objectives

Organizations that seek excellence tend to maintain a sharp focus on their strategic objectives.

Author: Robin Lyons
ISACA Journal Article

IS Audit Basics: Add Value to What Is Valued

Enterprises have many stakeholders, and “creating value” means different—and sometimes conflicting—things to each of them.

Author: Ian Cooke
ISACA Journal Article

Getting the Basics of Cybersecurity Right

Security professionals understand and acknowledge that there are a myriad of challenges facing cybersecurity teams today.

Author: Ramón Serres
ISACA Journal Article

Protection From GDPR Penalties With an MFT Strategy

Companies facing the EU’s looming General Data Protection Regulation (GDPR) compliance mandate could benefit from a modernized managed file transfer (MFT) solution.

Author: Dave Brunswick
ISACA Journal Article

The Network: Rob Clyde

What do you see as the biggest risk factors being addressed by information security professionals?

Author: ISACA
ISACA Journal Article

Integrating KRIs and KPIs for Effective Technology Risk Management

Performance evaluation is a key element of any management system and a good governance practice.

Author: Rama Lingeswara Satyanarayana Tammineedi
ISACA Journal Article

Cybersecurity Education Based on the NICE Framework: Issues and Challenges

The need for cybersecurity professionals and skills is growing rapidly in the United States and around the world due to several factors, including the continuous growth of the Internet, online social networks, smartphones, e-commerce and other global issues, such as cyberhacking and terrorism.

Author: Izzat Alsmadi
Governance Article

Tips for Making COBIT 5 Implementation Fit the Enterprise | ISACA

COBIT 5 in an organization is an ambitious aspiration and a noteworthy endeavor. It demonstrates the maturity, willingness and commitment to improve.

25 June 2018
ISACA Journal Article

The Methods and Costs of Data Breaches

“Data breach” has become a common term, so much so that it seems as though not a day goes by without mention of a data breach occurring.

Author: Mohammed J. Khan
ISACA Journal Article

As Hospitals Get Smart, Cybersecurity Challenges Will Increase

Healthcare technology is at a critical juncture of rapid growth, seamless implementation and the need for constant adaptability.

Authors: Justine Bone, Violet Morris and Chadwick Williamson
Podcast

The Impact of Automation and Robotics

While there are concerns about the influence automation could have on the technology workforce, automation also can drive economic growth and create new types of technology jobs. In this ISACA 50th Anniversary Series podcast, we discuss the transformative impact of automation and robotics on the tech workforce and society in general.

18 June 2018
Governance Article

GEIT Framework at Work, Part 2: Plan the Solution | ISACA

This article is the second in a 6-part series that looks at the practical application of a governance of enterprise IT (GEIT) framework. This article focuses on planning the resolution of the issue identified in part 1.

11 June 2018
The Nexus Article

Train Barefoot Doctors in Your Organization

In the mid-20th century, rural China lacked basic healthcare services. This occurred for a variety of reasons, but the end result was obvious: without basic healthcare services, the ability to treat simple illnesses or educate the population on proper hygiene or family planning was limited or nonexistent outside of large urban areas.

11 June 2018
ISACA Journal Article

Protect, Detect and Correct Methodology to Mitigate Incidents: Insider Threats

In terms of cybersecurity, many organizations tend to worry about external threats such as hacking or distributed denial-of-service (DDoS) attacks.

Author: Max Alexander
ISACA Journal Article

IT Risk Management Based on COBIT 5 for Risk at Deutsche Telekom AG

The purpose of risk management is to protect the values of an organization.

Author: Horst Moll
Governance Article

Update of System Audit Standard & System Management Standard in Japan | ISACA

The Japanese Ministry of Economy, Trade and Industry (METI) published the System Audit Standard and the System Management Standard in 2004. Despite significant changes to the IT environment after that date, no updates to these materials were published.

29 May 2018
ISACA Journal Article

Building a Strong Security Posture Begins With Assessment

Hacked! Attacked! Leaked! Daily news headlines scream high-profile information security failures and their consequences.

Author: Tyler Hardison
Podcast

Applying a Technological Integration

Innovation is required for any enterprise that wants to remain competitive. But how can innovation be balanced with other business goals? In this Knowledge Series podcast, we discuss the importance of innovation and a possible framework than can be leveraged to best utilize innovation.

18 May 2018
Podcast

Mentors and Role Models in the Tech Workforce

A shortage of role models was cited in ISACA research as one of the roadblocks for women in the technology workforce. In this podcast with guest Jan Babiak, we discuss some of the steps both women and men can take to empower female practitioners and enhance gender diversity.

18 May 2018
ISACA Journal Article

Merging Internal Audit Departments

As organizations try to keep up with rapid changes in technology, they are using acquisitions as a way to quickly develop entirely new lines of business or to simply close gaps in technological capability.

Authors: Kevin Alvero, Randy Pierson, and Wade Cassels
Governance Article

GEIT Framework at Work, Part 1: Identifying the Problem | ISACA

This article is the first in a 6-part series that looks at the practical application of a governance of enterprise IT (GEIT) framework. The starting point is discussed in this article—forming an awareness that a problem exists and how to approach it.

14 May 2018
The Nexus Article

PKI Explained: Why It Is Necessary and Relevant Now More Than Ever

Unauthorized access, unsigned applications (malware) and unsecured email. What can help prevent these top 3 cyberthreats impacting organizations today? Public key infrastructure (PKI). PKI enables a trusted environment by authenticating and ensuring the integrity of data and users.

14 May 2018
ISACA Journal Article

Never Waste a Good Information Security Incident

Hospitals, major organizations and government offices across the globe had been hit by a massive wave of cyberattacks that seized control of computers until the victims paid a ransom.

Authors: Yuri Bobbert and Talitha Papelard-Agteres
ISACA Journal Article

Event Category Catalog for SOC Use Cases

The majority of modern organizations have embarked on the path security operations centers (SOCs) are building.

Author: Aleksandr Kuznetcov
ISACA Journal Article

Cybersecurity vs. Master Data Management

The exposure of data for up to 14 million of Verizon’s customers in July 2017 was an enormous embarrassment, particularly for an organization that presents itself as a premium cybersecurity consultancy.

Authors: Chip Jarnagin and Sonja Hammond
ISACA Journal Article

IS Audit Basics: Auditing Data Privacy

Determining pre-audit planning for the subject, objective, scope, and procedures for data gathering.

Author: Ian Cooke
ISACA Journal Article

HelpSource Q&A

How can we assess risk associated with blockchain technology?

Author: Sunil Bakshi
ISACA Journal Article

Building Bridges With the Board—Innovation in Information Governance

IT professionals and enterprise board members live in two very different worlds. Boards worry about strategic concerns such as revenue.

Author: T. Sean Kelly
ISACA Journal Article

Tools: Active Defense

Every year, ISACA conducts its annual Global State of Cybersecurity research. The second part of the survey asks about security practices in the field: what is working and what is not.

Author: Ian Cooke
ISACA Journal Article

Secure Elections in a Smart World

When people hear the term “cyberwarfare,” there are a few things that come to mind.

Author: Ed Moyle
ISACA Journal Article

Web Applications Authorization Risk When Using Windows Accounts

The use of Windows accounts to authorize users to applications introduces risk that an auditor should evaluate.

Author: Alex Quiles
ISACA Journal Article

Intellectual Property Protection for High-Tech’s Crown Jewels

Theft of intellectual property (IP) is an emerging threat and a topic of boardroom conversation for organizations across the United States, particularly for those in the high-tech industry.

Authors: Ray Cheung, and Mike Porter
ISACA Journal Article

Security in Depth

The methodology of network security has changed drastically due to the aggressive pace at which data have grown and the need for constant real-time access becoming the norm.

Author: Charles Hale
ISACA Journal Article

The Network: Lucio Augusto Molina Focazzio

How do you think the role of the IS audit professional is changing or has changed?

Author: ISACA
ISACA Journal Article

Healthcare Security—Three Paradoxes and the Need for a Paradigm Shift

Is the CIO role still relevant for IT security in healthcare? The world of information and data management is changing faster than anyone could have predicted.

Author: Giuliano Pozza
ISACA Journal Article

Letter From the Editor: From Print to Digital—The Journal Transformation

As technology continues to transform the way people consume information, the work of ISACA’s professional community becomes more important—and challenging.

Author: Jen Hajigeorgiou
ISACA Journal Article

Information Security Matters: Security in the Migration to a Multi-Modal Environment

I have been a data center rat my whole career, starting as a systems engineer for a hardware vendor and, today, as a consultant.

Author: Steven J. Ross
ISACA Journal Article

Clash of the Titans

One of the major challenges chief information security officers (CISOs) face in almost any organization is prioritizing information security interests with regard to IT interests.

Author: Ofir Eitan
Podcast

Interview with Piotr and Matt Era

In this podcast, the president of the ISACA Warsaw (Poland) Chapter speaks with ISACA CEO Matt Loeb, CGEIT, CAE, FASAE, about the future of ISACA. Loeb also discusses the needs of ISACA members, GDPR preparation and how ISACA can best serve its diverse membership.

30 April 2018
ISACA Journal Article

Complying With GDPR: An Agile Case Study

Designed to give European Union residents better privacy rights, the EU General Data Protection Regulation (GDPR) comes into force in May 2018.

Authors: Mina Miri, Farbod H. Foomany, and Nathanael Mohammed
ISACA Journal Article

AWS Migration: Advantages, Risk & Mitigation Measures

It is no surprise that many enterprises, ranging from early start-ups to mature global enterprises, have considered or implemented a migration to Amazon Web Services’ (AWS) cloud computing services.

Authors: Ray Cheung, Vikas Sharma, and Bhupinder Singh
Governance Article

Seven COBIT 5 Implementation Pitfalls to Avoid | ISACA

Good practices are as good as those who practice them. As a COBIT trainer, I recommend the following tips which can help COBIT users become “good” COBIT 5 practitioners.

9 April 2018
ISACA Journal Article

Sometimes, Cyberattackers Are Going to Get In: The State of Cybersecurity 2018

The cybersecurity problem in a nutshell is that criminals are launching cyberattacks against the global attack surface comprised of the world’s people.

Author: Keith Price
Podcast

Reasonable Software Security Engineering

Threat modeling is becoming a valuable security tool, especially in light of GDPR. In this podcast, we discuss the importance of threat modeling and the first steps your enterprise can take to begin leveraging it.

29 March 2018
Podcast

Disaster Recovery Management in the Multimodal Era

The multimodal era of technology presents numerous benefits and challenges. In this podcast, we discuss what availability and disaster recovery management look like in the multimodal era.

29 March 2018
ISACA Journal Article

Minimizing the High Risk of Failure of Corporate Innovation

Much of today’s new technology may not impact the organization’s business directly, but it almost certainly will impact it indirectly

Author: Guy Pearce
Governance Article

Improving the Service Desk by Using COBIT 5 | ISACA

The IT service desk plays a significant role in the day-to-day operations of any organization. When it functions well, all other activities perform well.

26 March 2018
ISACA Journal Article

Rethinking User Access Certifications

Access certification involves a manager or system owner reviewing users’ entitlements (access) to a system or systems to ensure that the users have access to only what they need.

Author: Vincent J. Schira
ISACA Journal Article

E-Governance of Currencies

Innovative ideas pave the way for efficient and seamless governance in any type of organization.

Author: Vijayavanitha Sankarapandian
The Nexus Article

Three Milepost Markers on the Road to PCI Compliance

Compliance is a journey, not a destination—an ongoing, multistep process. It is not boxes to check off—check it and forget it—but milepost markers along the way to ensure that compliance is consistent, such as ensuring that device inventories and configuration standards are kept up to date.

12 March 2018
The Nexus Article

Two Common Choke Points in the Incident Response Process

Many organizations simply do not have the luxury of maintaining an in-house incident responder or incident response staff. This leaves the organization with 2 options...

12 March 2018
ISACA Journal Article

Digital Ethics & the Blockchain

How the digital transformation turns out may depend on how well it supports core values such as prosperity, fairness, integrity, transparency and privacy atop an Internet that erodes some of these values.

Author: Dan Blum
ISACA Journal Article

IS Audit Basics: Innovation in IT Audit Process

In June 2015, ISACA began publishing a set of white papers titled “Innovation Insights.”

Author: Ian Cooke
ISACA Journal Article

HelpSource Q&A

Traditionally, our organization has a policy to adopt established technology solutions.

Author: Sunil Bakshi
ISACA Journal Article

Information Security Architecture: Gap Assessment and Prioritization

A top-down approach to enterprise security architecture can be used to build a business-driven security architecture.

Author: Rassoul Ghaznavi-Zadeh
ISACA Journal Article

The Missing Link in Assessing Cyberrisk Factors Through Supply Chains

In February 2014, one of the biggest discount retailers in the United States, Target Corporation, reported a data breach within its network system that caused the leak of 110 million customers’ financial and personal information.

Author: Ofir Eitan
ISACA Journal Article

Tools: Five Linux Distributions With Tools for Audit

This article identifies Linux distributions that provide collections of hundreds or, in some cases, thousands of tools, many of which audit professionals might find valuable.

Author: Ed Moyle
ISACA Journal Article

Technology’s Role in Enterprise Risk Management

The new COSO ERM framework document, Enterprise Risk Management—Integrating With Strategy and Performance, is expected to have a level of global influence similar to Internal Control–Integrated Framework.

Author: Jennifer Bayuk
ISACA Journal Article

Applying a Technological Integration Decision Framework to Innovation Governance

Innovation is the process of transforming an idea or concept into a functional and marketable value proposition reflecting creative opportunity.

Author: Robert E. Davis
ISACA Journal Article

Sponsored Feature: Centralized, Model-Driven Visibility Key to IT-OT Security Management

The threat landscape has changed significantly for operational technology (OT) environments as their connectivity to IT networks and the Internet has exponentially increased.

Author: Ron Davidson
ISACA Journal Article

The Network: Stephen Doyle

What is the biggest security challenge that will be faced in 2018?

Author: ISACA
ISACA Journal Article

Why Cyber Insurance Needs Probabilistic and Statistical Cyberrisk Assessments More Than Ever

In 2016, there were instances where cybersecurity stocks did not fare well, and one reason attributed to this occurrence was that investors needed some high-profile breaches2 to lure them back into investing in cybersecurity stocks.

Author: Indrajit Atluri
ISACA Journal Article

Information Security Matters: Disaster Recovery Management in the Multimodal Era

The concept of an organization’s information systems operating in a space and on equipment owned by that organization has been replaced by systems residing in.

Author: Steven J. Ross
Governance Article

Here Comes the GDPR. Are You Ready? | ISACA

By now, most have at least heard of something called the EU General Data Protection Regulation (GDPR). If not, you may be in for a big surprise.

26 February 2018
ISACA Journal Article

Web Monitoring: From Big Data to Small Data Analysis Through OSINT

Every organization should know what information is circulating on the Internet about its activities so that it can use concrete actions to handle any potential threats.

Authors: Paolo Gasperi, Luigi Sbriz, and Marco Tomazzoni
ISACA Journal Article

Data Loss Prevention—Next Steps

Around 2007, it became obvious that the information security defenses that were implemented by the government and businesses to prevent data loss were not totally effective.

Author: Larry G. Wlosinski
Governance Article

Process Capability Assessment Using COBIT 5 as a Compliance Requirement | ISACA

Governance and management of enterprise information technology (GEIT) is the practice of applying enterprise resources (enablers) to the creation and delivery of value to enterprise stakeholders.

12 February 2018
ISACA Journal Article

Security Monitoring as Part of the InfoSec Playbook

There are best practices and guiding principles that firms must rely on to develop, adjust and mature their security monitoring strategy, processes and procedures.

Author: Larry Marks
ISACA Journal Article

Internet of Transformation: What Does IoT Mean for Your J-O-B?

While today everyone worships their smartphones as if the device itself demands their constant and public attention, there’s a new transformative technology that’s even more pervasive—practically inescapable—and yet largely invisible to the average person.

Author: Chris Poulin
Podcast

Mistakes Happen—Mitigating Unintentional Data Loss

Data loss, whether intentional or accidental, is a concern for most enterprises, especially considering recent regulatory changes. In this podcast, we discuss ways to prevent data loss and how to address it if it happens.

1 February 2018
Governance Article

Portfolio, Program & Project Management Using COBIT 5, Pt 3 | ISACA

This is the continuation of a series of articles published in COBIT Focus beginning in September 2017. The first article 1 discussed the approach for mapping COBIT 5 with the Project Management Institute (PMI’s) standards and publication...

29 January 2018
ISACA Journal Article

A COBIT 5 PAM Update Compliant With ISO/IEC 330xx Family

Determining the level of process maturity for a given set of IT-related processes allows organizations to determine which processes are essentially under control and which represent potential pain points.

Authors: Joao Souza Neto, Rafael Almeida, Pedro Linares Pinto, Miguel Mira da Silva
ISACA Journal Article

Best Practices for Corporate Cyberintelligence Processes

Cyber Incident response is no different than any other type of warfare. It requires strategy, and tactics.

Authors: Ofir Eitan and Aviv Srour
ISACA Journal Article

Mistakes Happen—Mitigating Unintentional Data Loss

Nobody intends to lose data, and but it happens. Often. Immature processes, inadequate tools and unaware users reveal themselves as the weak links.

Author: Mike Van Stone and Ben Halpert
Governance Article

GDPR Countdown & COBIT 5 | ISACA

Compliance with the EU General Data Protection Regulation (GDPR) begins on 25 May 2018, giving us almost 6 months to finalize GDPR preparations. Doing nothing is not an option.

15 January 2018
ISACA Journal Article

Toward Encrypted and Private Databases

The number of data breaches annually totals thousands in the United States alone. More importantly, the total number of records exposed has reached the billions.

Author: Josh Joy
The Nexus Article

The Top Four Security Vulnerabilities You Might Be Overlooking

Daily news headlines scream high-profile information security failures and consequences—Hacked! Attacked! Ransomware!—reinforcing that the severity of risk posed to sensitive information is unprecedented. Security threats can put your organization and your customers’ sensitive information at risk, costing you in customer loss, diminished trust in your brand and regulatory fines.

8 January 2018
Podcast

Meltdown and Spectre Vulnerabilities

The recently discovered Meltdown and Spectre vulnerabilities affect nearly all computers and smart phones. In this podcast, we discuss these vulnerabilities, the responses to them and what you can do to be secure in light of this discovery.

8 January 2018
ISACA Journal Article

The Machine Learning Audit—CRISP-DM Framework

Machine learning is revolutionizing many industries, from banking to manufacturing to social media.

Author: Andrew Clark
ISACA Journal Article

When What Is Lost Is Lost Forever: Data Privacy

The “Kodak Moment” has been redefined from capturing and immortalizing memories on film to waking up the next day and seeing entire industries disappear.

Author: William Emmanuel
ISACA Journal Article

Book Review: ISACA Privacy Principles and Program Management Guide

ISACA Privacy Principles and Program Management Guide provides a comprehensive explanation of all things privacy.

Author: ISACA
ISACA Journal Article

IS Audit Basics: Backup and Recovery

ISACA reviews 4 backup and recovery principles as the technology evolves due to technological improvements.

Authors: Ian Cooke
ISACA Journal Article

HelpSource Q&A

The European Union (EU) General Data Protection Regulation (GDPR) will take effect in May 2018.

Author: Sunil Bakshi
ISACA Journal Article

Cloudifying Threats—Understanding Cloud App Attacks and Defenses

Cloud applications (apps) and services have revolutionized business productivity and efficiency by providing a robust and flexible environment in which to share and transfer data.

Authors: Aditya K Sood and Rehan Jalil
ISACA Journal Article

Implementation of Big Data in Commercial Banks

Big data can be described as a huge volume of data that cannot be treated by traditional data-handling techniques.

Author: Adeniyi Akanni
ISACA Journal Article

Big Data Deidentification, Reidentification and Anonymization

Big data seems indeterminate due to its constant use in intellectual data science fields and science, technology and humanities enterprises.

Author: Mohammed J. Khan
ISACA Journal Article

Applying AI in Application Security

The use of artificial intelligence (AI) in cyber security will help organizations enhance existing application security capabilities.

Author: Kiran Maraju
ISACA Journal Article

Tools: Data Protection Tools

Data protection is critical, but it can sometimes be less visible than other types of security controls.

Author: Ed Moyle
ISACA Journal Article

The Network: Sandy Fadale

What is the biggest security challenge that will be faced in 2018?

Author: ISACA
ISACA Journal Article

Information Security Matters: Managing Availability in the Multi-Modal Era

A few columns back, I wrote about the security of multi-modal IT environments, and in which applications and infrastructure are operated in colocation (colo) sites.

Author: Steven J. Ross
Governance Article

Portfolio, Program & Project Management Using COBIT 5, Pt 2 | ISACA

This article illustrates how mapping of COBIT 5 with PMI standards helps provide assurance that the COBIT 5 framework can be used as a single integrated framework across organizations.

ISACA Journal Article

Big Data Analytics and Its Transformational Effect on Global Business

In their capacity as a tool, computers will be but a ripple on the surface of our culture.

Author: Ravikumar Ramachandran
Podcast

Governance, Risk, Compliance and a Big Data Case Study

Leveraging big data correctly can help enterprises gain value. That happened at a major bank a few years ago, but the regulatory landscape has changed, and that affects the way enterprises handle big data. In this podcast, we discuss a big data case study and explore how it may have differed given today’s regulations.

19 December 2017
ISACA Journal Article

An IoT Control Audit Methodology

An IoT Control Audit Methodology. As the IoT industry evolves, more controls can be added to the method as required.

Authors: Marcin Jekot and Yiannis Pavlosoglou
Podcast

Anatomy of an IoT DDoS Attack and Potential Policy Responses

Attacks in the Internet of Things are becoming more prevalent, and it is crucial to know how to address them. In this podcast, we will discuss what an IoT DDoS attack looks like and some policy responses that could address it.

14 December 2017
ISACA Journal Article

Using Darknet Concepts for IoT Security: Tor of Things

In today’s always-connected world, the concept of device connectivity, the Internet of Things (IoT), has already solidified.

Author: Mike Kuzminski
Governance Article

Drive Transparent and Measurable Value With COBIT 5 Process Metrics | ISACA

COBIT 5 combines the goals cascade and the balanced scorecard (BSC) 2 perspectives to ensure that metrics at all levels track the achievement of overall objectives of the organization.

Governance Article

Delivering Disruptive Innovation Using the COBIT 5 Framework | ISACA

Delivering Disruptive Innovation Using the COBIT 5 Framework. Helps define business continuity policy & scope based on the strategy and stakeholder objectives.
ISACA Journal Article

Assurance Across the Three Lines: A Collaborative Defense

In day-to-day vocabulary, a line of defense is defined as a structure used to defend against attack.

Author: Ability Takuva
ISACA Journal Article

Petya/NotPetya: Why It Is Nastier Than WannaCry and Why We Should Care

US National Security Agency (NSA) hacker tools dumped on the dark net, based on the EternalBlue exploit, are continuing to evolve into attacks increasing in frequency and severity.

Author: F. Charlene Watson
ISACA Journal Article

Book Review: Configuration Management: Using COBIT 5

Configuration Management: Using COBIT 5 provides a clear and concise walk-through of the configuration management process and associated threats, mitigation actions, COBIT 5 enablers and other useful information.

Author: ISACA
ISACA Journal Article

Book Review: Security, Audit and Control Features: Oracle Database

Security, Audit and Control Features: Oracle Database 3rd Edition aims to assist assessors in reviewing the security of an Oracle database environment.

Author: ISACA
ISACA Journal Article

Creating and Defining a Culture of Security: The Human Factor

The security of technology has become an increasing global concern.

Author: Pedro Alexandre de Freitas Pereira
ISACA Journal Article

Auditing Big Data in Enterprises

There is no stagnation in information security. One major national incident often leads to more robust reporting requirements.

Author: Abdullah Al-Mansour
ISACA Journal Article

The Value of Certification

There are many insightful posts across the Internet that discuss certification. Do credentials matter? Do certifications lack value? Are industry credentials even worth pursuing?

Author: Thomas Johnson
ISACA Journal Article

IS Audit Basics: Auditing Mobile Devices

By the time this article is published, it will have been about 20 months since the US Federal Bureau of Investigation (FBI) unlocked the iPhone of the San Bernardino, California, gunman who killed 14 people.

Author: Ian Cooke
ISACA Journal Article

Digital Identity—Will the New Oil Create Fuel or Fire in Today’s Economy?

Digital identity has the power to propel your enterprise forward…or it can cause you to crash and burn. How you govern and manage it will make all the difference.

Author: Dan Blum
ISACA Journal Article

HelpSource

We are in the process of selecting a data loss prevention (DLP) tool.

Author: Sunil Bakshi
ISACA Journal Article

The Practical Aspect: Challenges of Security Log Management

In the world of information systems, data has gained the most influential position. Data are about entities—resource.

Authors: Vasant Raval and Saloni Verma
ISACA Journal Article

Information Security Matters: Information Security in Context

I do not believe in information security.

Author: Steven J. Ross
ISACA Journal Article

The Network: Sarah Orton

How do you think the role of IS auditor is changing or has changed?

Author: Steven J. Ross
ISACA Journal Article

Making the SoA an Information Security Governance Tool

The ISO and the IEC’s ISO/IEC 27001:2013 standard has defined the requirements for an information security management system (ISMS).

Author: Daniel Gnana
ISACA Journal Article

Evasive Malware Tricks: How Malware Evades Detection by Sandboxes

Sandboxes are widely used to detect malware. They provide a temporary, isolated and secure environment to observe if a suspicious file attempts anything malicious.

Author: Clemens Kolbitsch
ISACA Journal Article

Sponsored Feature: The AICPA’s New Cybersecurity Attestation Reporting Framework Will Benefit a Variety of Key Stakeholders

As a relentless wave of cyberattacks continues, organizations are under intense pressure from key stakeholders and regulators to implement and enhance their cyber security programs to protect customers, employees and the valuable information in their possession.

Authors: Sandra Herrygers, Gaurav Kumar, and Jeff Schaeffer
ISACA Journal Article

Governance, Risk, Compliance and a Big Data Case Study

By showing what would have changed if a previously successful big data analytics project was performed given today’s governance.

Author: Guy Pearce
Governance Article

Using COBIT in Government Departments | ISACA

The government of India is focused on ensuring the effective delivery of government services to its customers who consist of citizens.

ISACA Journal Article

Exposing the Fallacies of Security by Obscurity: Full Disclosure

It is unlikely that anyone is ignorant of the concept of full disclosure. While today we often see it applied to cyber security and the like.

Author: Kevin Johnson
ISACA Journal Article

Does Fully Disclosed Mean Fully Exposed? Nondisclosure

Every day, between 10 and 20 vulnerabilities are publicly disclosed, a few more than that are discovered, and an estimated 10-100 times that are created by software developers around the world.

Author: Pete Lindstrom
Governance Article

COBIT 5 to Assess IT Processes Capabilities & Evaluate Compliance World Lottery Association Security Control Standard | ISACA

The internal audit team of one of the biggest gaming operators in Europe implemented a cloud-based governance.

Podcast

Information Security in the Multi-Modal Era

As the traditional notion of a data center changes and enterprise data are being sent to numerous locations, the challenge of keeping data secure is evolving. In this edition of the ISACA Podcast, we discuss how to address security in a multi-modal era.

29 September 2017
ISACA Journal Article

The AREM Window: A Strategy to Anticipate Risk and Threats to Enterprise Cyber Security

Businesses seeking to establish themselves in privileged positions in a digitally modified society must anticipate the competition and explore new opportunities in unstable environments.

Author: Jeimy J. Cano M
Governance Article

Focus on COBIT Adoption Rather Than Implementation | ISACA

Organizational change management (OCM) focuses on helping people adapt to change. Research shows that by acknowledging the importance of OCM and taking steps to address the people side of change.

ISACA Journal Article

Key Competencies of the Effective Governance Professional

Over the last 20 years, organizations have realized that they need to effectively manage and retain high-quality employees in order to be successful.

Author: Noman Sultan
ISACA Journal Article

A Risk-Based Management Approach to Third-Party Data Security, Risk and Compliance

Process guidelines and a framework for boards of directors and senior management must be considered when providing oversight, examination and risk management of third-party business relationships in the areas of information technology, systems and cyber security.

Author: Robert Putrus
ISACA Journal Article

Factors to Consider to Minimize Identity Theft in Mobile Banking

Using mobile devices to complete commercial transactions is a newer scientific advancement in the information and communication technology (ICT) sphere.

Author: Adeniyi Akanni
Governance Article

Portfolio, Program & Project Management Using COBIT 5 | ISACA

Portfolio, Program and Project Management Using COBIT 5. COBIT 5 with PMI standards can be used as an “single integrated framework” across organizations.

ISACA Journal Article

Compliant, Yet Breached: Compliance vs. Security

“The hackers focused on overcoming our security controls while the security and compliance teams were measuring our security in terms of adherence with formal compliance certification.”

Author: Tony Chandola
ISACA Journal Article

Design With the End in Mind

Innovations in the marketplace have accelerated sharply, and the implications have tremendous impact on the business environment.

Authors: Sudhakar Sathiyamurthy and Grant Thornton
ISACA Journal Article

IS Audit Basics: Doing More With Less

The Institute of Internal Auditors (IIA) defines internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.

Author: Ian Cooke
ISACA Journal Article

Addressing Shared Risk in Products Application Vulnerability Assessments

Service organizations with a bespoke application in a regulated industry have special challenges in addressing application vulnerabilities.

Author: Michael Werneburg
ISACA Journal Article

Blockchain: Identifying Risk for Distributed Ledgers

Blockchain technology, commonly expected to drive the next wave of digital infrastructure and process innovation, is rapidly developing into maturity.

Author: Filip Caron
ISACA Journal Article

Information Security Matters: Information Security in the Multi-Modal Era

Data centers used to be so simple.

Author: Steven J. Ross
ISACA Journal Article

The Network: Justine Bone

How do you think the role of the cyber security professional is changing or has changed?

Author: ISACA
ISACA Journal Article

Instilling a Culture of Security Starts With Information Governance

A company facing privacy and security challenges can leverage culture to implement necessary procedural and technological transformations to strengthen security.

Author: T. Sean Kelly
ISACA Journal Article

Barriers and Enablers to Auditors Accepting Generalized Audit Software

Although generalized audit software (GAS) has been shown to significantly improve the efficiency and effectiveness of audits, many auditors do not use this technology.

Authors: Marianne Bradford and Dave Henderson
ISACA Journal Article

Tools: Can Penetration Testing Tools Help an Audit?

Sometimes, it can feel as though auditors get the short end of the stick when it comes to the tools available to assist in the work that they do.

Author: Ed Moyle
ISACA Journal Article

Anatomy of an IoT DDoS Attack and Potential Policy Responses

In recent years, the impact and frequency of cyberattacks have significantly increased, from millions of personal records compromised to hundreds of millions and even a billion records in the case of Yahoo.

Author: Hari Mukundhan
ISACA Journal Article

A View of Blockchain Technology From the Information Security Radar

Blockchain is a distributed database that maintains a continuously growing list of records called blocks that are secured from any kind of tampering and revision efforts.

Author: Vimal Mani
ISACA Journal Article

Rethinking Cybervalue at Risk: A Practical Case for Risk Quantification

Cyberrisk is a universal issue. The trustworthiness of various risk assessment methods in pursuit of risk-based decisions is largely questioned in the marketplace.

Authors: Sudhakar Sathiyamurthy and Grant Thornton
Governance Article

Participatory Health Care Security
ISACA Journal Article

Building a Security Culture: Why Security Awareness Does Not Work and What to Do Instead

It is no secret that phishing has become a huge problem. In 2016, the Anti Phishing Working Group noted that there were 1,220,523 total phishing attacks.

Author: Joseph Opacki
Governance Article

Privacy Principles for GDPR Compliance | ISACA

Using ISACA Privacy Principles for GDPR Compliance. Demonstrate how the ISACA Privacy Principles could be mapped into the full set of COBIT 5 processes.

Governance Article

A Group IT Governance System Model With a Pair of Wheels: Oversight & Shared IT | ISACA

The financial industry in Japan has seen a growing number of organizing financial groups or conglomerates since the Japanese antitrust law was revised in the late 1990s.

ISACA Journal Article

Enterprise Security Architecture—A Top-down Approach

Enterprise Security Architecture—A Top-down Approach. SABSA, COBIT and TOGAF & their relationships with security framework for enterprises.

Author: Rassoul Ghaznavi-Zadeh
ISACA Journal Article

Demystifying Cyber Security in Industrial Control Systems

Industrial control systems (ICSs) are changing by relying more on off-the-shelf information technology (IT), thereby exposing these systems to more IT risk.

Author: Sri Mallur
Governance Article

COBIT 5 Aids Transition to Smart & Sustainable Cities | ISACA

A new edition of The Green Standards Week has finished, but the journey for cities has just begun.

ISACA Journal Article

Proposal for the Next Version of the ISO/IEC 27001 Standard

In this article, the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) ISO/IEC 27001:2013 standard is introduced briefly and compared to ISO/IEC 27001:2005.

Author: Tolga Mataracioglu
ISACA Journal Article

Book Review: Transforming Cybersecurity

Transforming Cybersecurity, published by ISACA, should be read in the context of COBIT 5 for Information Security and the COBIT 5 framework.

Author: ISACA
Governance Article

COBIT 5 for Risk—A Powerful Tool for Risk Management | ISACA

COBIT 5 for Risk—A Powerful Tool for Risk Management. There is only one globally accepted business framework in the IT domain. That framework is COBIT 5.

Podcast

Social Media Rewards and Risk

Most enterprises use social media, and the use of these sites can help organizations be closer to their clients. But the use of social media also poses some threats to an organization. In this podcast, learn more about the benefits of social media, the risk associated with social media use and how to mitigate this risk.

3 July 2017
ISACA Journal Article

Challenges and Lessons Learned Implementing ITIL, Part 2

The Emirates National Oil Company embarked on an initiative to realize value out of IT assets through Information Technology Infrastructure Library (ITIL) process implementation.

Authors: Mathew Nicho, Shafaq Khan, and Ram Mohan
ISACA Journal Article

IS Audit Basics: Audit Programs

ISACA reviews how to create an audit program, utilizing good reference resources & collaboration with IS peers.

Author: Ian Cooke
ISACA Journal Article

A Guide to Auditing Attachment Fields in Access Databases

Guide to Auditing Attachment Fields in Access Databases. Examples include customer records, employment records, inspection reports & patient records.

Authors: Joshua J. Filzen and Mark G. Simkin
ISACA Journal Article

Challenges and Lessons Learned Implementing ITIL, Part 1: Realizing Value Through Business IT Alignment

A key issue often cited by information systems (IS) executives in the last three decades is aligning IT with business, which assists in realizing value from IT investments.

Authors: Mathew Nicho, Shafaq Khan, and Ram Mohan
ISACA Journal Article

Mobile Workforce Security Considerations and Privacy

In 2012, a software developer who mainly worked remotely for a US firm had the idea of fully outsourcing his work to China.

Author: Guy Hermann Ngambeket
ISACA Journal Article

Information Security Matters: André Maginot’s Line

Some time ago in this space, I used an obscure statement by a nearly forgotten British Prime Minister to make some points about cyber security.

Author: Steven J. Ross
ISACA Journal Article

The Network: Theresa Grafenstine

How do you see ISACA growing and adapting to the constantly changing marketplace and needs of its constituents over the next year?

Author: Steven J. Ross
ISACA Journal Article

Exploring How Corporate Governance Codes Address IT Governance

IT governance, also referred to as governance of enterprise IT (GEIT) or corporate governance of IT, is a subset of corporate governance that is concerned with enterprise IT assets.

Authors: Steven De Haes, Anant Joshi, Tim Huygh, and Salvi Jansen
ISACA Journal Article

Key Ingredients to Information Privacy Planning

The metrics associated with privacy data breaches are astounding. In 2016, 554, and454,942 records were breached from 974 reported incidents.

Author: Larry G. Wlosinski
ISACA Journal Article

Social Media Rewards and Risk

Social media is a powerful tool that gives organizations the ability to expand their brand value; it can also tarnish a brand overnight.

Author: Mohammed J. Khan
ISACA Journal Article

Tools: Mobile Security Tools on a Budget

Mobile has arisen as one of the most flexible—and most prevalent—business tools available. From email to calendaring to business applications.

Author: Ed Moyle
ISACA Journal Article

Help Source Q&A

The question I have is what are the privacy issues associated with these mobile teams using their own devices for the organization’s work?

Author: Sunil Bakshi
ISACA Journal Article

Book Review: Controls and Assurance in the Cloud: Using COBIT 5

Controls and Assurance in the Cloud: Using COBIT 5 provides comprehensive process practices and a governance framework to use when conducting an assessment of cloud computing, including its associated security risk.

Author: ISACA
Governance Article

Which Screws Have to Tighten?
ISACA Journal Article

Breach Your Castle for Better Security

Asymmetric warfare is “the application of dissimilar strategies, tactics, capabilities and approaches used to circumvent or negate an opponent’s strengths while exploiting his weaknesses.”

Author: Danelle Au
Governance Article

COBIT 5 for Risk: Making Sense of IT Risk Management | ISACA

COBIT 5 for Risk: Making Sense of IT Risk Management. Each component of IT risk management is identified & helps practitioners find guidance in IT risk management.

ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 7: The 5 Whys Tool

The 5 Whys tool has been around since the 1930s. It is simple and effective but unknown to many.

Author: Ed Gelbstein
ISACA Journal Article

Boosting Cyber Security With Data Governance and Enterprise Data Management

The relationship between cybersecurity and the regulatory requirements for data governance, data stewardship and enterprise data management is set to strengthen.

Author: Guy Pearce
Governance Article

COBIT 5 & the GDPR | ISACA

COBIT 5 and the GDPR. Reviews how by applying the COBIT 5 enablers to the DPC road map, it is possible to determine the basic scope where COBIT can help.
ISACA Journal Article

The Benefits of the Statement of Applicability in ISMS Projects

The statement of applicability (SoA) is the main link between risk assessment and risk treatment in an enterprise or in an organization within an enterprise and, therefore, is a requirement for information security management system (ISMS) implementations.

Author: Jayakumar Sundaram
ISACA Journal Article

Book Review: Security Considerations for Cloud Computing

Security Considerations for Cloud Computing provides a brief overview of cloud computing, its associated security risk and information for decision makers in an organization.

Author: Diana Hamono
ISACA Journal Article

HTTPS Posture Assessment

HTTPS has been around since 1994. Historically, HTTP over Secure Sockets Layer (SSL)/Transport Layer Security (TLS) was treated as a dark and capricious form of magic best left undisturbed.

Author: Kurt Kincaid
ISACA Journal Article

IS Audit Basics: Data Management Body of Knowledge—A Summary for Auditors

A previous column reviewed the domains of data and information audits.

Author: Ed Gelbstein
ISACA Journal Article

Security Assurance in the SDLC for the Internet of Things

During the Internet of Things (IoT) Village held at the DEF CON security conference in August 2016, 47 new vulnerabilities affecting 23 IoT devices from 21 manufacturers were disclosed.

Authors: Sivarama Subramanian and Balaji Swaminathan M.
ISACA Journal Article

IT Asset Valuation, Risk Assessment and Control Implementation Model

The first steps in information security strategic planning in any form of business are risk management and risk evaluation.

Author: Shemlse Gebremedhin Kassa
ISACA Journal Article

Managing the Risk of IoT: Regulations, Frameworks, Security, Risk and Analytics

Does the recent distributed denial of service (DDoS) attack on Dyn officially mark the passing of the Internet of Things (IoT) fear, uncertainty and doubt (FUD) stage, or is this still the beginning of the stage?

Author: Indrajit Atluri
ISACA Journal Article

Book Review: Responding to Targeted Cyberattacks

Organizations today are concerned about information security primarily due to the fact that the type and nature of attacks are undergoing a lot of changes that make them difficult to detect and prevent.

Author: ISACA
ISACA Journal Article

IoT Needs Better Security

The Internet of Things (IoT) is an ecosystem of connected things (stationary or mobile devices). 34 billion devices are to be connected to the Internet by 2020.

Author: Hemant Patel
ISACA Journal Article

Information Security Matters: The End of the Beginning?

At each stage in the evolution of information security, there has been a problem—access control, viruses, hackers, data leakage, to name a few—that has seemed insuperable.

Author: Steven J. Ross
ISACA Journal Article

The Network: Jane Whitgift

How do you think the role of the information security professional is changing or has changed?

Author: ISACA
ISACA Journal Article

Safeguarding Mobile Applications With Secure Development Life Cycle Approach

In today’s age of bring your own device (BYOD), the smartphone is one of the preferred mobile devices to access enterprise information.

Author: Sakthivel Rajendran
ISACA Journal Article

Help Source Q&A

Various surveys point out that 20 to 50 billion devices will be connected using the Internet by 2020.

Author: Sunil Bakshi
ISACA Journal Article

Importance of Recertification Completeness in the Control Environment

Owners of critical business data need to ensure that all application and database user entitlements and privileges are recertified on a periodic basis to make sure that only authorized individuals have access to the enterprise’s data.

Author: Kathleen Martin
Governance Article

COBIT 5 Goals | Meeting Stakeholder Needs | ISACA

Applying the Goals Cascade to the COBIT 5 Principle Meeting Stakeholder Needs. Reviews meeting stakeholder needs with real-world examples.

ISACA Journal Article

The Validity of Penetration Tests

Penetration (pen) tests are critical to operating and maintaining an effective information security program.

Author: Brent Michel
Podcast

Sustainability

It is becoming increasingly important for enterprises to implement sustainable practices. But how can enterprises strike a balance between profitability and sustainability? In this podcast, we discuss what green IT looks like, the business benefits of sustainability and the role of an auditor in a sustainable enterprise.

13 April 2017
ISACA Journal Article

IS Audit Basics: Risk-based Audit Planning for Beginners

A young Certified Information Systems Auditor (CISA) asked for suggestions about where and how to start to plan an IS audit.

Author: Ed Gelbstein
ISACA Journal Article

Enterprise Vulnerability Management

Today’s enterprises have solutions in place to help with the detection and management of their information systems vulnerabilities, especially as it relates to system software and firmware.

Author: Trevor J. Dildy
Governance Article

How COBIT 5 Can Help Reduce the Likelihood & Impact of the Top 5 Cyberthreats | ISACA

2017 is here with cyber breaches increasing, with their impacts rippling ever further into business and personal life.

Governance Article

Using Visual Models for Adopting IT Governance Practices | ISACA

IT governance (ITG) can be adopted using a mixture of various structures, and processes and relational mechanisms that encourage behaviors consistent with the organization’s mission.

ISACA Journal Article

Navigating the US Federal Government Agency ATO Process for IT Security Professionals

IT security professionals such as risk managers and information security managers maintain a US federal government agency’s information system using the Federal Information Security Management Act (FISMA) in a manner that is unique to the US federal government.

Author: Jo Anna Bennerson
Governance Article

Organizational Prudence & Wisdom Within Governance of Business and Enterprise IT | ISACA

COBIT 5 has integrated data management, risk management and IT governance into a governance and management framework that can provide strategic direction in a holistic and innovative manner.

ISACA Journal Article

Tools: Tools You May Already Have That Add Assurance Value

To understand how the business side of any organization intersects with technology, ask an internal auditor.

Author: Ed Moyle
ISACA Journal Article

Auditing Social Media

Auditing Social Media. Social media risks include reputational damage, information leakage, regulatory noncompliance & loss of intellectual property.

Author: Paul Phillips
ISACA Journal Article

Agile Audit

Time constraints are an integral part of every auditor's work.

Author: Spiros Alexiou
ISACA Journal Article

Creating Assurance in Blockchain

Blockchain—a distributed ledger technology that underpins bitcoin and is also being tested by a variety of companies to track ownership of assets without a central authority—is everywhere.

Author: A. Michael Smith
ISACA Journal Article

Audit Transparency in Action

Professional trainers have many opportunities to speak to companies and organizations about leading practices in the internal/IT audit industries.

Author: Danny M. Goldberg
ISACA Journal Article

How Analytics Will Transform Internal Audit

Many companies are just beginning to apply analytics techniques to internal audit challenges.

Author: Robert E. (Bob) Kress and Dave M. Hildebrand
ISACA Journal Article

The Practical Aspect: Third-party Risk Management

The business model of the early 20th century depicted a large, integrated company that owned, managed and directly controlled its resources.

Authors: Vasant Raval and Samir Shah
ISACA Journal Article

Dealing With Difficult Data

Applying data analytics (DA) techniques to the information systems (IS) internal audit process has moved from a desired activity to a required one.

Author: Michael T. Hoesing
ISACA Journal Article

Standardized Scoring for Security and Risk Metrics

With breaches and hacks in the news every day, information security is now firmly on the board’s agenda.

Author: Mukul Pareek
ISACA Journal Article

Information Security Matters: Do You Need a Disaster Recovery Plan…?

DRaaS offers a number of advantages over the use of commercial hot sites or internal recovery data centers.

Author: Steven J. Ross
ISACA Journal Article

The Network: Shan Senanayake

How do you think the role of the information security professional is changing or has changed?

Author: Steven J. Ross
ISACA Journal Article

Cloud Computing in Developing Countries: Opportunities and Challenges

The number of fixed and mobile broadband subscribers, Internet users and cellular service consumers is on the rise globally.

Author: Awais Ahmed
ISACA Journal Article

IS Audit Basics: The Auditors, IS/IT Policies and Compliance

Every organization tries to formalize aspects of its culture through policies. These policies define what is expected of members of the workforce and describe how noncompliance is dealt with.

Author: Ed Gelbstein
ISACA Journal Article

Retirement Profile: Farewell Ron Hale

How have you seen ISACA change over the years of your service to the organization?

Author: ISACA
Podcast

COBIT 5 Principles Where Did They Come From

COBIT 5, a framework for the governance and management of enterprise IT, is a valuable resource that leverages proven practices, global thought leadership and groundbreaking tools. In this podcast, we discuss the COBIT 5 principles, where they came from and how enterprises can leverage the framework.

23 February 2017
Podcast

Implementing the NIST Cyber Security Framework

The US National Institute of Standards and Technology’s Cybersecurity Framework can help enterprises secure their valuable information assets. The COBIT® 5 framework can be used to implement the NIST framework. In this podcast, we discuss the specific ways in which COBIT 5 can help enterprises that want to implement the Cybersecurity Framework.

23 February 2017
Podcast

The Automation Conundrum

The increasing proliferation of artificial intelligence systems presents many concerns. But not adopting AI systems could result in enterprises falling behind and missing key opportunities. In this podcast, we discuss AI threats, how to prevent these threats and the benefits of adopting AI systems.

23 February 2017
Podcast

The G7 and Cyber Security Podcast

A recent G7 meeting produced a document on cyber security, outlining international state cyber security behavior. While discussing cyber security at this level shows great progress, there is still room for growth. In this podcast, we discuss the G7 Principles and Actions on Cyber, why it is important, and areas for improvement.

23 February 2017
Podcast

Addressing Cybersecurity Vulnerabilities

Internet security is a growing concern and IT leaders need to increase public awareness of cyber security. Unchecked cyber security risk factors can greatly harm enterprises. In this podcast, we discuss areas for improvement that could prevent cyberattacks.

22 February 2017
Podcast

Are Software Flaws a Security Problem?

Who is responsible when customer-facing systems crash? Program crashes can cause security problems. In this podcast, we explore how many causes of unexpected downtime are the same as those that lead to security breaches.

22 February 2017
Podcast

Auditing Agile: A Brave New World Podcast

Auditing Agile can be difficult, but auditing Agile and Scrum artifacts can provide considerable value to an enterprise. In this podcast, we discuss how to audit Agile and the myriad benefits it can provide.

22 February 2017
Podcast

Balancing the Cybersecurity Battlefield

Cyber security is a priority for enterprises, but the skills shortage in security is a global concern. Women can provide a unique perspective on cyber security, but are still vastly underrepresented in information security. In this podcast, we discuss some of the challenges women in cyber security face and how to overcome these challenges.

22 February 2017
Podcast

Benefits and the Security Risk of Software-defined Networking

The growth in connected devices is increasing the difficulty of managing devices and related network traffic. Software-defined networking can make the process of managing these devices more efficient. In this podcast, we discuss the benefits and challenges associated with software-defined networking.

22 February 2017
Podcast

Challengeable Truths

There are many widely held information security beliefs, but do all of them hold true? In this podcast, we challenge some commonly held information security beliefs and explore whether or not they should be held as truths.

22 February 2017
Podcast

Chief Cyber Officer

Chief information security officers are typically thought of as being responsible for cyber security. But is this structural model the most effective way to manage cyber security? In this podcast, we discuss the merits of creating the role of chief cyber officer to deal with cyber security issues.

22 February 2017
Podcast

Cyber Privacy

Should cyberattacks be considered privacy violations? If cyberattacks are framed as privacy violations, the Generally Accepted Privacy Principles could be applied to cyberattacks. In this podcast, we use GAPP to provide insight on how privacy can be protected from cyberattackers.

22 February 2017
Podcast

Cybersecurity for a “Simple” Auditor

Because cyber security and information security are often conflated, their audit processes might also be conflated. Despite the lack of cyber security standards, it is possible to develop a cyber security audit process. In this podcast, we discuss the ways to develop a process for cyber security audits.

22 February 2017
Podcast

Cyberwhatsit

The word “cyber” is growing in usage, but there is a lack of verbal clarity with respect to what it actually means. This ambiguity can lead to uncertainty about how to handle cyberrisk. In this podcast, we discuss the definitions of cybertheft, cyberattacks, cyberthreats and cyber security and the implications of these definitions.

22 February 2017
Podcast

Frameworkers of the World, Unite II

How are organizations complying with the US National Institute of Standards and Technology Cybersecurity Framework? In this podcast, we look at the framework as though it were a standard to determine how organizations can adhere to it.

22 February 2017
Podcast

Performance Measurement Metrics for IT Governance

As technology evolves and transforms, enterprises rely more and more on technology resources and vendors. Because of this reliance, key performance indicators are necessary to measure the performance of IT service delivery. In this podcast, we discuss how to develop performance metrics, the criteria for good metrics and leveraging COBIT 5 to develop performance metrics.

22 February 2017
Podcast

Protecting Information - Practical Strategies for CIOs and CISOs

Information is one of the most valuable assets of every organization. Protecting information typically a high priority for chief information officers, but better protection is more likely if the CIO works with a chief information security officer. In this podcast, we discuss the role of the CIO and CISO and provide a management and reporting structure.

22 February 2017
Podcast

The Criticality of Security in the Internet of Things

The Internet of Things is evolving at a rapid pace, and it is becoming increasingly difficult to keep up with these “smart” devices. Because this technology is advancing so quickly, it is necessary to build security and privacy controls into connected devices. In this podcast, we discuss why these controls should be built in, how to incorporate security into device building and some of the barriers of developing with security in mind.

22 February 2017
Podcast

Three Ways to Simplify Auditing Software Security Requirements and Design

Building security into software is a prerequisite for information assurance, and it is far cheaper to fix a defect in design than to fix it after production. Auditors can play a role in ensuring security is built into software. In this podcast, we discuss the ways in which organizations can incorporate security into the software design process.

22 February 2017
Podcast

Unsung Security Heroes

Information security is no longer the sole responsibility of IT professionals. People across the enterprise contribute to keeping information safe. In this podcast, we discuss some roles that support information security, but are not typically thought of as security roles.

22 February 2017
Podcast

Weary Willie's Guide to Cyberrisk Management

Cyberrisk can never be eliminated, but it can be minimized so that it is more manageable. In this podcast, we discuss the professionals who should be involved with cyberrisk management and what effectively managed cyberrisk looks like.

22 February 2017
Podcast

Why Everyone Dislikes the IT Auditor and How to Change It

IT auditors have a very important role, but are often criticized by management or users of IT audit services. While some attitudes cannot be changed, auditors can work to gain the trust and respect of those whom they are auditing. In this podcast, we discuss some of the common critiques and how IT auditors can address these issues.

22 February 2017
ISACA Journal Article

What Every CISO Must Know About SSH Keys

Secure Shell (SSH), also known as Secure Socket Shell, is a cryptographic network protocol for operating network services securely over an unsecured network.

Author: Tatu Ylonen
ISACA Journal Article

Capability Framework for Privileged Access Management

The average total cost of a data breach is about US $4 million, whereas the average cost for a stolen record increased slightly from US $154 in 2015 to US $158 in 2016.

Authors: Richard Hoesl, Martin Metz, Joachim Dold, and Stefan Hartung
Governance Article

The Essence of Information | ISACA

I was taught that information was processed data. While the definition was useful, it was not very enlightening.

ISACA Journal Article

Book Review: COBIT 5 for Business Benefits Realization

COBIT 5 for Business Benefits Realization is part of the COBIT 5 body of knowledge, which covers audit and assurance, risk management, information security, regulations and compliance, IT operations, governance of IT (GEIT), as well as value from IT investments.

Author: ISACA
ISACA Journal Article

IS Audit Basics: Preparing for Auditing New Risk, Part 2

Part 1 of this column explored domains of risk that are rapidly becoming apparent as they take unprepared organizations (in terms of policies on how to deal with them) by surprise. Social networks and bring your own device (BYOD) are two notable examples.

Author: Ed Gelbstein
Governance Article

Extending COBIT 5 Data Security and Governance Guidance | ISACA

Organizations need the ability to seamlessly enforce security policies across the enterprise to protect sensitive data and control access to those data, regardless of where the data flow.

ISACA Journal Article

The Persistent Insider Threat: Is Enough Being Done?

In today’s world, and the main asset for businesses is the data they store. As enterprises become more dependent on technology and data.

Author: Rodney Piercy
ISACA Journal Article

Evolving Cyberrisk Practices to Meet Board-level Reporting Needs

Imagine being an executive sitting on the board of directors for an organization. Of the following two risk report statements, which one would likely be more meaningful and useful?

Authors: Jack Jones and Chief Risk Scientist
Governance Article

Developing Business Capabilities Using COBIT 5 | ISACA

Developing Business Capabilities Using COBIT 5. Identify control activities of business capabilities to satisfy control requirements for compliance objectives.

ISACA Journal Article

Smart Sustainable Cities Need Well-governed Disruptive IT, Not Just IT

Most people live in cities, so they enjoy or endure city attributes as part of their day-to-day lives.

Author: Graciela Braga
ISACA Journal Article

HelpSource

I have heard from vendors that cognitive technologies such as machine learning can assist in my risk management and security efforts.

Author: Sunil Bakshi
ISACA Journal Article

Smashing the Information Security Policy for Fun and Profit

One of the chief components of an organization’s information security strategy is the security policy.

Author: David Eduardo Acosta R.
ISACA Journal Article

Kickstarting Cloud ROI

Many enterprises are quick to leap into cloud relationships. Very often, they do so without any analysis—formal or informal—of the value they expect to get in return.

Author: Cheryl Ritts
ISACA Journal Article

The Automation Conundrum

Learn how as intelligent systems increasingly take on vital business roles, the risk that crucial business decisions might be based on flawed algorithms invariably rises.

Author: Phillimon Zongo
ISACA Journal Article

A Machine Learning Approach for Telemedicine Governance

Telemedicine is a component of ehealth that uses information and communication technology (ICT) to deliver health care services to overcome distance and connect the provider and the patient.

Authors: Shounak Pal and Arunabha Mukhopadhyay
ISACA Journal Article

Sponsored Feature: Indicators of Exposure and Attack Surface Visualization

Working with identified IOEs rather than vulnerabilities and other risk data allows security teams to use the power of contextual analysis to determine actions that will reduce their attack.

Author: Ravid Circus
ISACA Journal Article

Tools: Using Open Source Tools to Support Technology Governance

Most practitioners are already very accustomed to using technical tools for specific tactical purposes when it comes to security or assurance within their environments.

Author: Ed Moyle
ISACA Journal Article

Information Security Matters: State-on-state Cyberconflicts

In the second quarter of 2016, a colleague shared with me an article and a database titled “The Dynamics of Cyber Conflict Between Rival Antagonists, 2001–11,” written by Brandon Valeriano of the University of Glasgow and Ryan C. Maness of the University of Illinois.

Author: Steven J. Ross
ISACA Journal Article

The Network: Gail Coury

How do you think the role of the information security professional is changing or has changed?

Author: ISACA
ISACA Journal Article

IS Audit Basics: Preparing for Auditing New Risk, Part 1

This is the first of two articles attempting something unwise: predicting future risk arising from information systems and technology.

Author: Ed Gelbstein
Governance Article

Setting the Record Straight: Convincing Management of COBIT’s Value in Risk Management

Although COBIT remains an extremely valuable tool for IT risk management, many Latin American companies still find themselves slightly confused when trying to understand what it takes to carry out a complete or partial COBIT implementation.

ISACA Journal Article

An Ethical Approach to Data Privacy Protection

Privacy breaches disturb trust and run the risk of losing security. In this article, ISACA explains how to follow an ethical approach to data privacy protection.

Authors: Wanbil W. Lee, Wolfgang Zankl,and Henry Chang
ISACA Journal Article

IS Audit Basics: Challenges Addressed by Fundamentals

Challenges set before auditors today are imposing. With seemingly endless changes in technology and the resulting effect on organizations, there is a tendency to feel overwhelmed.

Author: Gordon Stoor
Governance Article

COBIT For IT Organizational Design | ISACA

Using COBIT for IT Organizational Design. Reviews the organization design be done as per theory and then fine-tuned to accommodate the politics.

ISACA Journal Article

The New EU General Data Protection Regulation—Benefits and First Steps to Meeting Compliance

The New EU General Data Protection Regulation—Benefits and First Steps to Meeting Compliance. Sets expectations for controlling personal data for EU citizens.

Author: Eva Sweet
ISACA Journal Article

IS Audit Basics: The Domains of Data and Information Audits

In my early days as a practitioner, the use of computers was referred to as data processing and electronic data processing (EDP).

Author: Ed Gelbstein
Governance Article

COBIT 5 Mapping for Establishing Enterprise IT Strategy | ISACA

COBIT 5 Mapping Exercise for Establishing Enterprise IT Strategy. Explains how instituting controls can be used to establish IT strategy & IT goals BSC values.

ISACA Journal Article

The Tone at the Top: Assessing the Board’s Effectiveness

Thought leaders have long recognized that strong leadership and ethical culture are foundational building blocks of enterprises with top-performing risk management programs.

Author: Gary Roboff
Governance Article

COBIT 5: Creating Buy-in and Empowering Teams to Change

It is an inescapable fact that IT is changing the way organizations do business. There is a global emphasis on digital transformation.
ISACA Journal Article

Achieving Excellence in Supplier Risk Management

Achieving Excellence in Supplier Risk Management. Review of robust supplier risk management framework incorporating regulatory expectations.

Author: Shirali Vyas
ISACA Journal Article

The Dilemma for Workplace Usage: Wearable Technology

The Dilemma for Workplace Usage: Wearable Technology. ISACA community’s attitudes toward wearables’ potential risk & security impacts at work.

Authors: Craig Krivin, Sanjay Bhide, Sandeep Desai, Ravi Dhaval, Joe Norris, Amanthi D. Pendegraft, Susan E. Snow, and Dan Wagner
Governance Article

COBIT 5: Taking IT Governance and Management to the Next Level | ISACA

A Big 4 professional services firm in the Middle East was selected by a leading retail bank to assist in finding solutions to problems related to IT governance and IT management.

ISACA Journal Article

Book Review: Vendor Management Using COBIT 5

Vendor Management Using COBIT 5. ISACA discusses life cycle management for third-party services and the overall vendor management process.

Author: ISACA
ISACA Journal

Information Security Matters: The G7 and Cyber Security

In May 2016, the G7 leaders met in Ise-Shima, Japan, and produced a document that has real meaning for all of us who care about cyber security.

Author: Steven J. Ross
ISACA Journal Article

Advanced Data Analytics for IT Auditors

Advanced Data Analytics for IT Auditors. ISACA reviews data analytics techniques & tools that can help auditors discover hidden knowledge in data.

Author: Spiros Alexiou
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 6: Barriers to Learning to Learn

Previous columns have explored how to facilitate the process of learning to learn, and covering knowledge acquisition.

Authors: Ed Gelbstein and Stefano Baldi
ISACA Journal Article

Assessing Security Controls: Keystone of the Risk Management Framework

Assessing Security Controls: Keystone of the Risk Management Framework. Informed decisions involves risk-decision fidelity & risk acceptance.

Author: Lance Dubsky
ISACA Journal Article

The Network: Marcus Chambers

What is the biggest security challenge that will be faced in 2017? How should it be addressed?

Author: ISACA
ISACA Journal Article

Information Ethics: Information Ethics in the Mid-21st Century

The emergence of cyberspace has produced a new crop of rather difficult-to-resolve dilemmas, although the precepts and paradigms to address them remain the same.

Author: Vasant Raval
ISACA Journal Article

Cyberrisk Assessment Using Bayesian Networks

Organizations are increasingly realizing that the management of cyber security risk in complex environments needs to be addressed using suitable decision-making techniques.

Author: Venkatasubramanian Ramakrishnan
ISACA Journal Article

Delivering Personal Data Protection Compliance on a Global Scale

The European Union (EU) General Data Protection Regulation (GDPR) was published in the Official Journal of the European Union and officially set an application date.

Author: Ilya Kabanov
ISACA Journal Article

Performance Measurement Metrics for IT Governance

Performance Measurement Metrics for IT Governance. Enterprises use key performance indicators (KPIs) to measure IT performance service delivery.

Author: Sunil Bakshi
ISACA Journal Article

Enhancing the Audit Follow-up Process Using COBIT 5

Implementing an audit follow-up process using the COBIT 5 enablers and ISACA's Information Technology Assurance Framework (ITAF) 2 provide value to the enterprise.

Author: Ian Cooke
Governance Article

Ensuring Value From IT-enabled Investments | ISACA

Ensuring Value From IT-enabled Investments. GEIT ensures benefit realization to the stakeholders by optimizing risk and resource utilization.

ISACA Journal Article

Data Lineage and Compliance

Learn how data lineage gained momentum as the volume of data, complexity of systems environments and compliance requirements continue to grow.

Author: Eva Sweet
Governance Article

A Partial Transition to COBIT 5 Demonstrates Value to IT

Several years ago, the IT department of the largest bakery factory in the world, with a presence in the United States, Mexico, Central America, South America, Asia, Europe, Canada and the United Kingdom, conducted a COBIT 4 assessment and implementation of a enterprise governance.

ISACA Journal Article

Preparing Financial Firms for Cybersecurity Threats and Protecting Their Reputations

It is difficult to deny the impact of cyber security threats on businesses worldwide. In 2015, the average total cost of a data breach (including customer turnover, reputation losses and damaged goodwill) was US $3.79 million, up from US $3.52 million in 2014.

Author: Peter Tessin
Governance Article

Change Enablement for GEIT Implementation & Improvement | ISACA

Frameworks, best practices and standards are useful only if they are adopted and adapted effectively.

ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 5: CPEs and Learning to Learn

The IS Audit Basics column that appeared in the volume 1, 2015, and issue of the ISACA Journal contained a table illustrating the impermanence of information systems.

Author: Ed Gelbstein
ISACA Journal Article

Boardroom Dynamics: Group Support for the Board’s Involvement in a Smart Security Decision-making Process

Decision making during business meetings is an elusive phenomenon for a couple of reasons. Business meetings have been defined as …a gathering where people speak up.

Authors: Yuri Bobbert and Hans Mulder
Governance Article

Using COBIT 5: Enabling Information to Perform an Information Quality Assessment | ISACA

Information is considered a main resource for any organization as the evolution of information technology in recent decades has reached almost all organizations.

ISACA Journal Article

Geolocation—The Risk and Benefits of a Trending Technology

Geolocation is a trending technology that uses data to identify a user’s physical location. Check out our article to learn about the risk and benefits of geolocation.

Author: Betsie Estes
Governance Article

Introduction to COBIT Videos Provide Insights into COBIT 5 | ISACA

The Introduction to COBIT Video Series is a collection of short videos that explain, in a straightforward, simple manner, the many features, tools and benefits of the COBIT 5 framework.

ISACA Journal Article

Information Systems Security Audit: An Ontological Framework

An information systems security audit (ISSA) is an independent review and examination of system records, activities and related documents.

Author: Shemlse Gebremedhin Kassa
Governance Article

Ambiguities in Translation of Information and Knowledge Concepts in COBIT 5

After the release of COBIT 5 in 2012, ISACA initiated translations of the framework into other languages by collaborating with chapters and volunteer contributors.

ISACA Journal Article

Auditing for FISMA and HIPAA: Lessons Learned Performing an In-house Cybersecurity Audit

Within the last two years, and the author’s research-oriented company installed a commercial, off-the-shelf (COTS) tool within its Moderate network to use for survey work.

Author: Craig R. Hollingsworth
ISACA Journal Article

A Critical Perspective on Safeguard Selection Processes

Safeguards have become an essential part of every IT environment. As companies become more reliant on modern technology.

Author: Stefan Beissel
ISACA Journal Article

Cyberattacks—The Instability of Security and Control Knowledge

In a world of accelerating change that is moving toward more digital tendencies, security and control practices have become an ongoing exercise in reinvention.

Author: Jeimy J. Cano M.
ISACA Journal Article

How to Audit the Human Element and Assess Your Organization’s Security Risk

The 2016 Data Breach Investigations Report (DBIR), and Verizon’s ninth annual report, revealed some grim news—the human threat vector is more dangerous than ever.

Author: Tom Pendergast
ISACA Journal Article

An Integrated Approach for Cyberthreat Monitoring Using Open-source Software

As cyberthreats evolve each day, and detecting these threats is becoming more important. Recent studies show that the time between a breach occurring and being detected is.

Author: Furkan Caliskan
ISACA Journal Article

Cyberinsurance: Value Generator or Cost Burden?

Data are now considered a wealth generator for the 21st century. Consequently, the financial costs of data loss through cyberevents can be staggering.

Author: Syed K. Ishaq
ISACA Journal Article

Planning for Information Security Testing—A Practical Approach

Planning for Information Security Testing—A Practical Approach. Before an audit, it's important to know the types of information security testing.

Authors: Karina Korpela and Paul Weatherhead
ISACA Journal Article

Information Ethics: The Challenge of Being “Good”

Moral behavior is, perhaps, and easy to talk about, but difficult to put in practice. The answer to the question Did I do the right thing? may not be unequivocal.

Author: Vasant Raval
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 4: Mind Mapping

Many years ago during a rainy November evening in London, England, I decided to browse a bookshop to keep dry and warm and also see what had been released recently.

Authors: Ed Gelbstein and Stefano Baldi
ISACA Journal Article

The Network: Leonard Ong

What is the biggest security challenge that will be faced in 2017? How should it be addressed?

Author: ISACA
ISACA Journal Article

Balancing the Cybersecurity Battlefield

History shows that women bring a different value to the work environment and improve overall operational effectiveness and financial results. In key financial metrics, companies with women on their boards of directors (BoDs) outperform those without women.

Author: Daksha Bhasker
ISACA Journal Article

Holistic IT Governance, Risk Management, Security and Privacy: Needed for Effective Implementation and Continuous Improvement

Holistic IT Governance, Risk Management, Security and Privacy: Needed for Effective Implementation and Continuous Improvement.

Authors: John W. Lainhart IV, Zhiwei Fu, and Christopher M. Ballister
ISACA Journal Article

Information Security Matters: Unsung Security Heroes

Long ago and far away, I was the president of the EDP Auditors Association, which, some years later, changed its name to ISACA. So here we are, 35 years after my term in office, and I marvel at what ISACA has become: 140,000 constituents in more than 200 chapters in 180 countries.

Author: Steven J. Ross
Governance Article

The Importance of Planning a Governance of Enterprise IT Implementation | ISACA

There is plenty of anecdotal evidence describing failed GEIT projects and the problems associated with GEIT implementations. Here is the importance of planning.

ISACA Journal Article

Book Review: Securing Mobile Devices

Securing Mobile Devices. Guide for security professionals & governance, risk & compliance in using COBIT 5 framework to obtain assurance in auditing.

Author: ISACA
Governance Article

COBIT: The Road Ahead

Since its release, COBIT 5 has been downloaded tens of thousands of times, has been widely discussed on social media, and has been prescribed for use by national governments and municipalities alike.

ISACA Journal Article

Book Review: Advanced Persistent Threats

Advanced Persistent Threats: How to Manage the Risk to Your Business is available from the ISACA Bookstore.

Author: ISACA
ISACA Journal Article

Security Predictions 2016: A Data Analysis Approach

The topic of information security has evolved to one of the top concerns among policymakers and corporations.

Author: Daniel Schatz
Governance Article

The Five A’s of Enterprise Governance of IT | ISACA

At the 2016 COBIT Conference in New Orleans, many of the presenters talked about the need to adopt and adapt the framework.

ISACA Journal Article

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 2

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 2. Key elements of the audit including audit strategy & derived plans chosen.

Author: Ed Gelbstein
ISACA Journal Article

Privacy in the Era of Monitoring and Surveillance: A Conceptual Framework on Personal Data Protection

Many believe this is a period in human history in which geopolitical tensions perpetuate uncertainty.

Author: Jeimy J. Cano M.
Governance Article

Program & Project Management Approach | ISACA

ISACA An Appropriate Approach for Program and Project Management. COBIT 5’s BAI01 process, supporting materials, & documentation provide guidance for PMOs.

ISACA Journal Article

The New Age of Near-zero Privacy

The New Age of Near-zero Privacy. ISACA examines the rapid loss of privacy & how to mitigate exposure risk of personal data and images.

Author: C. Warren Axelrod
Governance Article

Creating Value |Value of COBIT 5 | ISACA

In COBIT 5, we are taught that enterprises exist to create value for their stakeholders. A truism if ever there was one.

ISACA Journal Article

Finding the Dirt in the Windows Control Environment

For many information systems auditors, reviewing domain accounts in an Active Directory (AD) environment is sufficient for testing controls around user authentication.

Author: Vincent Kha
ISACA Journal Article

Benefits and the Security Risk of Software-defined Networking

Benefits & the Security Risk of Software-defined Networking. Software-defined networking (SDN) uses virtualization to expand network efficiency.

Author: Tony Wang
ISACA Journal Article

Network Access Control: Has It Evolved Enough for Enterprises?

Network Access Control: Has It Evolved Enough for Enterprises? Does it need a more usable technical solution before it is utilized everywhere?

Author: Trevor J. Dildy
ISACA Journal Article

Data Science as a Tool for Cloud Security: Cloud Generation Visibility, Detection and Protection

Sharing, collaboration and anywhere access are the prominent features of modern cloud applications. However, cloud security faces scalability challenges.

Authors: Aditya K. Sood and Michael Rinehart
ISACA Journal Article

Inquiring Into Security Requirements of Remote Code Execution for IoT Devices

The Internet of Things (IoT) is an evolving concept and is described in various ways, and one of the most common being an infrastructure of interconnected objects.

Authors: Farbod Hosseyndoust Foomany, Ehsan Foroughi, and Rohit Sethi
ISACA Journal Article

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 1

IS Audit Basics: Elements of an IS/IT Audit Strategy, Part 1. IS/IT strategy steps for auditors to define, target, & determine resources needed.

Author: Ed Gelbstein
ISACA Journal Article

Mobile App Security—Audit Framework

Mobile App Security—Audit Framework. For the proper controls on mobile apps to be developed & tested, one must first dissect the layers of risk.

Author: Mohammed J. Khan
ISACA Journal Article

Managing Cloud Risk: Top Considerations for Business Leaders

Cloud adoption continues to grow at a rapid pace, and transforming businesses across the globe. Here are some top considerations for business leaders.

Author: Phil Zongo
ISACA Journal Article

Mobile Payments as a Security Control?

Ask any merchant and he/she will tell you that accepting credit card payments comes with its own set of security challenges.

Author: Rob Clyde
ISACA Journal Article

From Static Networks to Software-driven Networks—An Evolution in Process

The networking industry is gradually transforming itself from a hardware-centric approach to a software-defined platform.

Author: Nikesh Dubey
ISACA Journal Article

Information Security Matters: Chief Cyber Officer

In this article, ISACA explains how there is no need for a chief cyber officer because the chief information security officer (CISO) performs that function.

Author: Steven J. Ross
ISACA Journal Article

The Network: Debbie Newman

What is the biggest security challenge that will be faced in 2016? How should it be addressed?

Author: ISACA
ISACA Journal Article

The Interview as an Audit Tool During an IT Audit

Conducting onsite interviews is a critical part of any IT audit and can lead to the gathering of information not readily apparent through reading documentation and examining physical evidence.

Author: Henry Bottjer
ISACA Journal Article

Mobile Computing Device Threats, Vulnerabilities and Risk Are Ubiquitous

Mobile Computing Device Threats, Vulnerabilities & Risk Are Ubiquitous. Review the actors, threats, vulnerabilities, & risk with mobile devices.

Author: Larry G. Wlosinski
Governance Article

Transforming Risk Culture Through Organizational Culture Leveraging COBIT 5 for Risk | ISACA

Organizations must implement systems and mechanisms to drive change and achieve results in order to enable a workforce that understands and practices security as part of daily work life.

ISACA Journal Article

Application of Situation Awareness in Incident Response

With the exponential increase in security incidents due to known and unknown causes, the responsibilities of the computer security incident response (CSIR) team have become more complex.

Author: Teju Oyewole
ISACA Journal Article

Maximize Value, Adopt a Flexible Approach to Auditing Major Projects

For most organizations, project execution is the primary means of achieving business objectives—such as cost reduction.

Author: Joseph Zipper
Governance Article

Improving Business With COBIT 5 | ISACA

Benefits realization of IT-enabled investments is a strategic imperative. In a 2008 study on benefits realization.

ISACA Journal Article

Security in an Age of Distraction

In addition to the challenges that security awareness programs have always faced in obtaining the attention of participants and communicating information to promote secure behaviors, practitioners must deal with a new obstacle—individuals distracted by a multitude of electronic devices.

Author: Kerry A. Anderson
Governance Article

Root Cause Analysis | ISACA

Buried in COBIT 5 processes such as APO11 Manage quality and APO12 Manage risk in the Align, and Plan and Organize (APO) domain.

ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 3

The first two parts of this series of articles on auditing IS/IT risk management covered the audit of activities looking back in time to identify opportunities for improvement.

Author: Ed Gelbstein
ISACA Journal Article

Black Swans—From Expecting Risk to Expanding Technology

In today’s world, and one of the fastest-growing and changing aspects of human lives is technology.

Author: Mustafa S. Poonawala
ISACA Journal Article

Implementing Segregation of Duties: A Practical Experience Based on Best Practices

Implementing Segregation of Duties: A Practical Experience Based on Best Practices. Enforcing SoD is an effective risk management strategy.

Author: Stefano Ferroni
Governance Article

Enterprise IT Governance Implementation Model Using COBIT 5 | ISACA

Creating Value with an Enterprise IT Governance Implementation Model Using COBIT 5. Reviews service delivery from COBIT 5 with implementation in EITG.

ISACA Journal Article

Technology and Regulatory Compliance in Global Organizations: Stuck Between a Rock and a Hard Place

For big corporations, doing business in today’s world comes with the good (profits, and shareholder satisfaction) and the bad.

Author: Ola Bello
Governance Article

Monitoring, Evaluating and Assessing Compliance | ISACA

A 2015 Deloitte Risk Services Report found that 35% of companies still do not actively measure the effectiveness of their compliance programme.

Governance Article

Are Your IT & Strategic Business Goals Aligned? | ISACA

Developing and using models to help represent relationships between business strategy and IT is an effective method to show the strategic effect of IT within the enterprise.

ISACA Journal Article

Ensuring Vendor Continuity

Ensuring Vendor Continuity. Vendor checklist for critical services should be considered during planning, request for proposal (RFP) & evaluation.

Author: Samuel Shanthan
ISACA Journal Article

A Secure Data-gathering Approach in Wireless Sensor Networks: Considering QoS Via Hashing Mechanism

Data collection is a challenging task in wireless sensor networks (WSNs) due to the limitations in communication bandwidth and the energy budget, but it provides a secure data-gathering approach.

Authors: Michael Roseline Juliana and Subramaniam Srinivasan
ISACA Journal Article

Protecting Information—Practical Strategies for CIOs and CISOs

Organizations that don't position their information security group (ISG) strategically within the organization’s structure often fail to receive the desired benefits. Visit this article to learn more.

Author: Devassy Jose Tharakan
ISACA Journal Article

How Boards Realise IT Governance Transparency: A Study Into Current Practice of the COBIT EDM05 Process

In our increasingly digitised economy, IT has become fundamental to support, sustain and grow organisations.

Authors: Steven De Haes, Anant Joshi, Tim Huygh, and Salvi Jansen
ISACA Journal Article

Information Security Matters: Challengeable Truths

In information security, I have seen a vast revolution, from the days of “It cannot be done” to today’s “It must be done.” My enthusiasm about our profession has not only not abated, but it has increased enormously in the years—still just a few years—that the reality of the threat of cyberattacks has been recognized.

Author: Steven J. Ross
ISACA Journal Article

Can Elliptic Curve Cryptography be Trusted? A Brief Analysis of the Security of a Popular Cryptosystem

Can Elliptic Curve Cryptography be Trusted? A Brief Analysis of the Security of a Popular Cryptosystem for smart card, phone, IoT & Bitcoin

Author: Veronika Stolbikova
ISACA Journal Article

Strengthening Value and Risk Culture Using a Real-time Logical Tool

The Basel Committee on Banking Supervision identifies the fact that the IT and data architectures used by banks were inadequate to support comprehensive management of financial risk.

Authors: Simon Grima, Robert W. Klein, Ronald Zhao, Frank Bezzina, and Pascal Lélé
ISACA Journal Article

The Complexity Is in the Details: New EU Data Protection Law Promises User Control

Four years after its introduction, the European Commission has recently come to agreement on the General Data Protection Regulation (GDPR) as organizations around the globe await the details, which should be released soon.

Author: Michael Vanderpool
ISACA Journal Article

Big Data—Hot Air or Hot Topic?

There are many different definitions of the term ‘big data’, and concerns about whether it will necessitate significant changes in business operations in the short term.

Author: Angel Serrano
ISACA Journal Article

Information Ethics: Moral Dialogue on the IT-leveraged Economy

In information ethics, we face moral questions in four spheres, or roles: as a person, and as an economic agent, as a company leader and beyond a firm’s boundaries.

Author: Vasant Raval
ISACA Journal Article

The Network: Khawaja Faisal Javed

What is the biggest security challenge that will be faced in 2016?

Author: ISACA
ISACA Journal Article

Going Beyond the Technical in SIEM

This article addresses an existing imbalance between technical issues and process aspects related to SIEM. This gap is the root cause of some skepticism with and disappointment in SIEM.

Author: Aleksandr Kuznetcov
ISACA Journal Article

Internet Security Audits for Government: An Overview of the Lessons Learned in the Netherlands

Politicians are considering deploying IT audits to diminish the chance of a cyberattack on government websites. This article explains the lessons learned from the Netherlands cyberattacks.

Author: Jeroen van Lewe
Governance Article

Stuck Thoughts

The goal of continual improvement is to optimize efficiency, effectiveness and economic efficiency. You do this by continuously checking your processes, making improvements and sustaining those improvements.
ISACA Journal Article

The Art of Data Visualization: A Gift or a Skill?, Part 2

Part 1 of this article covered the four layers to understand before starting to design visualizations. Those layers are know the data, know the message, know the audience and know the options.

Author: Karina Korpela
Governance Article

Enhancing Intelligence/Wisdom Within the COBIT 5 Governance of Information Model | ISACA

Pathways toward the WM vision must be addressed in relationship to knowledge, intelligence, creativity/innovation, learning, intelligence and wisdom, especially from DIKIW and semiotic perspectives.

ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 1

IS Audit Basics: Auditing IS/IT Risk Management, Part 1. Differences between conducting an IS/IT audit & an IS/IT risk management audit.

Author: Ed Gelbstein
Case Study

Implementing COBIT 5 at ENTSO-E | ISACA

The IT director of the European Network of Transmission System Operators for Electricity (ENTSO-E) undertook a pragmatic approach toward implementing COBIT 5.

ISACA Journal Article

Board-level Information Technology Committees

Board-level Information Technology Committees. Review of 23 companies with board-level IT committees and their roles & responsibilities.

Author: Nancy Lankton
ISACA Journal Article

Book Review: Phishing Dark Waters

With down-to-earth language, authors Christopher Hadnagy and Michele Fincher successfully explain the reasons why someone, though knowledgeable about technology and aware of the dangers of phishing schemes, can fall for simple attacks.

Authors: Christopher Hadnagy and Michele Fincher
Governance Article

A Governance & Management Model for the Public Sector Shared Services Center Based on COBIT 5 | ISACA

Shared services is an environment in which a company can absorb activities that support the principle processes of each of the company’s other business units.

Governance Article

Understanding Architecture Roles | ISACA

When I teach classes on governance, I ask the class this: If you were newly made manager of something—security.

ISACA Journal Article

Book Review: Securing the Virtual Environment

Securing the Virtual Environment: How to Defend the Enterprise Against Attack explains that some advantages of virtualization include increased IT agility, greater hardware utilization, improved disaster recovery abilities and better business continuity capabilities.

Authors: Davi Ottenheimer and Matthew Wallace
ISACA Journal Article

ATM Risk

ATM Risk - Criminals are known for using include ATM skimming, ATM hacking, & radio frequency identification (RFID) credit card skimming.

Author: Henry Santiago
ISACA Journal Article

Encryption in the Hands of End Users

As a defense strategy, many organizations are expanding their usage of encryption which provides protection from unauthorized access and reduces the likelihood of data theft.

Author: Eric H. Goldman
Governance Article

Internal Controls White Paper Released

The objective of this white paper is to introduce internal control within the context of IT governance and management and to explain its use.

ISACA Journal Article

IS Audit Basics: Auditing IS/IT Risk Management, Part 2

Part 1 of this article described the commonalities, differences and possible overlaps between the IS/IT internal auditors and the IS/IT risk management functions managed by the CIO.

Author: Ed Gelbstein
ISACA Journal Article

Ataraxia and Premeditation as Elements of Judgment in the Risk Analysis Process

Typical cliché assumes that misfortunes are opportunities. Instead, one can prepare using tools to implement a realistic perspective without engaging in optimism in the management of uncertainty.

Author: David Eduardo Acosta R.
ISACA Journal Article

Essential Frameworks and Methodologies to Maximize the Value of IT

Essential Frameworks and Methodologies to Maximize the Value of IT. Practical guidance, benchmarks & tools to efficiently operate frameworks.

Author: Laurent Renard
ISACA Journal Article

Quick Fixes for Improving Cyberdefenses

There is an increasing trend of companies moving to e-business models with connectivity using multiple channels such as the Internet, mobile devices, social media, and the cloud in an anytime, anywhere, always-on model. Businesses, small or large, are part of cyberspace and are continually connected directly and indirectly.

Author: Sanjiv Agarwala
ISACA Journal Article

Book Review: Data Privacy for the Smart Grid

The data privacy concerns raised by the authors are numerous and include being able to make assumptions about the health of the residents, which might be of interest to insurance companies.

Authors: Rebecca Herold and Christine Hertzog
ISACA Journal Article

Information Ethics: Is Information Technology Responsible for Corporate Crises?

During the early 1990s, I was visiting with the president of a top-ranked graduate management institute in India.

Author: Vasant Raval
ISACA Journal Article

Risk Management in Agile Projects

Agile practices allow the management of a range of risks encountered in product development. In this article, we discuss an agile approach to risk management.

Author: Alan Moran
ISACA Journal Article

Optimizing Software Development With Lean Value Chain Analysis

Lean is a philosophy of continuous, and incremental improvement of business processes, products and services.

Author: Vimal Mani
ISACA Journal Article

Auditing Agile: A Brave New World

Auditing Agile: A Brave New World. Agile presents a unique conundrum from validating software development to documenting audit work papers.

Author: Chong Ee
ISACA Journal Article

Application Security Risk: Assessment and Modeling

Why are breaches continuing despite cutting-edge solutions supported by compliance? ISACA explains the risks of assessment and modeling of application security.

Authors: Shubhamangala B. R. and Snehanshu Saha
ISACA Journal Article

IS Audit Basics: Is There Such a Thing as a Bad IS Auditor?, Part 2

In this column, the profiles of typical IS auditors (other than the timid) represent an increasing level of danger to the organization. There are overlaps among the various profiles.

Author: Ed Gelbstein
ISACA Journal Article

A Nontraditional Approach to Prioritizing and Justifying Cybersecurity Investments

Investments in cybersecurity tend to be fairly significant, so organizations continually seek ways to determine whether the investments were appropriate based on return.

Author: Robert Putrus
ISACA Journal Article

The Network: George Quinlan

What is the biggest security challenge that will be faced in 2016? How should it be addressed?

Author: George Quinlan
ISACA Journal Article

Information Security Matters: Weary Willie’s Guide to Cyberrisk Management

Looking at Emmett Kelly’s shtick after all these years made me think about cybersecurity. Now, the mind works in curious ways, and mine more so than most. I am probably the only one who sees cybersecurity in a clown’s act. What Weary Willie was telling me is that if we cannot eliminate a problem, we should make it small enough that it becomes manageable.

Author: Steven J. Ross
ISACA Journal Article

HelpSource Q&A

My company uses a cloud-based email service provider for corporate email. The same vendor also provides storage space for all the employees to store data.

Author: Ganapathi Subramaniam
Governance Article

The Need for Sanctions

In many organizations, applying the COBIT 5 Culture, Ethics and Behavior enabler is hard. Many believe that all you need to do is write a policy, tell people about it and watch them change. However, it does not work that way in the real world.

ISACA Journal Article

Evaluating IT Integration Risk Prior to Mergers and Acquisitions

Evaluating IT Integration Risk Prior to Mergers and Acquisitions. Review of Risk and Benefits associated with IT integration in M&A.

Author: Deepak Khazanchi
Governance Article

Initiating GEIT Using COBIT 5 at the Oman Ministry of Manpower | ISACA

While attending one of the ISACA continuous professional education (CPE) sessions related to optimizing IT spending using COBIT 5 practices.

ISACA Journal Article

Security in the Payment Card Industry: The Importance of Data Integrity

Security in the Payment Card Industry: The Importance of Data Integrity. Large retailers to mom & pops are vulnerable if proper data security is not in place.

Author: Mark Johnston
Governance Article

Tips for Understanding the COBIT 5 Enabler of Process | ISACA

The activities defined in a process are generally aided by a reference model such as COBIT 5 , ITIL or the CERT Resilience Management Model (CERT-RMM).

ISACA Journal Article

IS Audit Basics: Is There Such a Thing as a Bad IS Auditor? Part 1

Previous columns explored what it takes for an audit to be successful and also the characteristics of a good auditor.

Author: Ed Gelbstein
ISACA Journal Article

A Framework for Automated Compliance Monitoring in Oracle/SAP Environment

It is not uncommon for IT departments to be unaware of security best practices specific to SAP and to lack the business knowledge necessary to perform a segregation-of-duties (SoD) analysis.

Author: Balraj Thuppalay
Governance Article

Process Standardization Is Key | ISACA

Our IT frameworks and methodologies have one thing in common. They all call for the development and standardization of processes.

ISACA Journal Article

Using Color to Enhance Spreadsheet Accuracy and Usefulness

Auditors often embed colored labels in spreadsheets to enhance accuracy and usefulness. This article presents ideas using Microsoft Excel 2013.

Authors: Joshua J. Filzen and Mark G. Simkin
Governance Article

Dubai Customs COBIT 5 Implementation | ISACA

The management at Dubai Customs endeavors to be on the leading edge of the latest management frameworks and it utilizes many global best practices to manage activities in all business processes.

ISACA Journal Article

Maturity Security Information Governance: Applied to the Telecom Segment in Brazil

Information security is a primary concern that pervades all organizations and comprises confidentiality.

Authors: Kleuber Tormim, Vitor Tormin Nishi, and Mauricio Rocha Lyra
ISACA Journal Article

Managing Data Protection and Cybersecurity—Audit’s Role

Data protection and cybersecurity go hand-in-hand due to the nature of the risk involved. The underlying assumption is that all data.

Author: Mohammed J. Khan
ISACA Journal Article

Actionable Security Intelligence From Big, Midsize and Small Data

Actionable Security Intelligence From Big, Midsize and Small Data. Examines synergies among big, midsize & small data and provide chance to overtake the attackers.

Author: C. Warren Axelrod
ISACA Journal Article

Transforming the IT Audit Function—Taking the Digital Journey

Today’s digital revolution is disrupting every corner of the business world and every function across the business enterprise.

Author: Robert (Bob) E. Kress
ISACA Journal

Auditing Cybersecurity

Auditing Cybersecurity. An approach to assess the adequacy of a firm’s cybersecurity posture. Taking the cyber vulnerability assessment approach.

Author: Martin Coe
ISACA Journal Article

Comparison of PCI DSS and ISO/IEC 27001 Standards

This article discusses the interoperability of PCI DSS 3.1 and ISO/IEC 27001:2013. The pros and cons of the PCI DSS and ISO/IEC 27001 standards are compared.

Author: Tolga Mataracioglu
ISACA Journal Article

Seven Software-related Incidents and How to Avoid or Remediate Them

Verizon’s 2015 Data Breach Investigations Report, which addresses industry verticals such as education & entertainment, points to key incidents related to data breaches to watch for.

Author: Frederick G. Mackaden
ISACA Journal Article

How to Be the Most Wanted IS Auditor

The audit profession is known to businesses of all kinds, especially those that are governed by regulation.

Author: Sanjiv Agarwala
ISACA Journal Article

Information Security Matters: Cyber/Privacy

There is a lot to be learned by considering certain cyberattacks as privacy violations. GAPP offers some guidance, but the principles are not a tight fit with the cybertheft of personal information.

Author: Steven J. Ross
ISACA Journal Article

The Art of Data Visualization: A Gift or a Skill?, Part 1

The ability to create eye-catching visuals is not an inherited skill. The skills required for most effectively displaying information are not intuitive.

Author: Karina Korpela
ISACA Journal Article

How COBIT 5 Improves the Work Process Capability of Auditors, Assurance Professionals and Assessors

How COBIT 5 Improves the Work Process Capability of Auditors, Assurance Professionals and Assessors with common tasks & activities to complete.

Author: Graciela Braga
ISACA Journal Article

The Network: Urmilla Persad

What do you anticipate being the biggest compliance challenge in 2016? How will you face it?

Author: ISACA
ISACA Journal Article

Guest Editorial: Why Everyone Dislikes the IT Auditor and How to Change It

Well, to be truthful, not everyone dislikes the IT auditor. But there have been a lot of remarks made over the years.

Author: Tommie W. Singleton
ISACA Journal Article

IS Audit Basics: Trust, but Verify

There is much to be gained from an open, collaborative relationship between auditors and auditees in which both parties focus on understanding and managing business risk.

Author: Ed Gelbstein
ISACA Journal Article

Book Review: People-centric Skills

This book is written as an intriguing tale about the lives of a fictional audit team, their daily client interactions and their aspirations to grow into an excellent audit team. The authors highlight the work ethic, techniques and skill sets required of a high-performing, modern-day audit team.

Authors: Danny M. Goldenberg and Manny Rosenfeld
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 3: Dealing With Conflict

An auditor will sooner or later be faced with two kinds of conflicts: conflict of interest and interpersonal conflict.

Author: Ed Gelbstein
ISACA Journal Article

Developing a Common Understanding of Cybersecurity

Cybersecurity is frequently discussed, but the meaning and scope of the term have not been consistent.

Author: Deepak Rout
Article

Does a COBIT 5 Self-assessment Help the Business to Get Control of a Shared Service Center?

In the summer of 2014, the chief information officer (CIO) of a shared service center (SSC) owned by 3 different, culturally diverse types of companies asked the author to perform an assessment based on COBIT 5. The most pressing question the CIO needed to answer for...
ISACA Journal Article

Real-life Risk Theory

Most IT professionals know the theory and importance of addressing and mitigating risk. Daily resource limitations and task prioritisation.

Authors: Mette Brottmann, Klaus Agnoletti, Morten Als Pedersen, Ronnie Lykke Madsen, Michael Rosendal Krumbak, and, Thor Ahrends
ISACA Journal Article

Information Ethics: Transparency and the IT Professional

The word transparency originated in the field of engineering. It has to do with the physical property that allows the transmission of light through a material.

Author: Vasant Raval
ISACA Journal Article

Cloud Computing: Cloud Computing as an Enabler of New Business Models and Start-ups—Aligning On-demand SME Needs Through Cloud Computing

As a free and simple cloud-based contract management application for small and medium-sized enterprises (SMEs).

Author: Angelique Schouten
ISACA Journal Article

Back to the Future in Device Security: Leveraging FIPPs to Proactively Manage IoT Privacy and Security Risk

The Internet of Things (IoT) represents an unknown set of forces. One known is that IoT-connected devices will generate exponential levels of new data leading to powerful insights.

Authors: Doron Rotman, Chris Kypreos, and Sarah Pipes
ISACA Journal Article

Information Security Matters: Cybersecurity for a “Simple” Auditor

A few issues back, I wrote about the US National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity. In that article, I pointed out that the framework conflates information security and cybersecurity, which I believe should be differentiated.

Author: Steven J. Ross
ISACA Journal Article

Revising Cybersecurity Skills for Enterprises

Cyberspace is a virtual environment. Today, it does not matter which device is used for connecting to the Internet.

Authors: Ivo Ivanovs and Sintija Deruma
ISACA Journal Article

The Network: Nickson Choo

What has been, or do you anticipate being, the biggest compliance challenge in 2015? How will you face it?

Author: ISACA
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 3: Can Auditors Prevent Project Failure?

This column focuses on a serious concern to business managers: What causes large software projects to have huge cost and timescale overruns and/or fail to meet expectations or.

Author: Ed Gelbstein
ISACA Journal Article

Internet of Things—The Fate We Make for Ourselves

The fantasy once associated with science fiction films is becoming increasingly similar to modern life.

Author: Jim Seaman
ISACA Journal Article

Risk and Ethics in Cyberspace

Risk and Ethics in Cyberspace. How to minimize the vulnerability, eliminate the threat or mitigate the risk associated with the problem.

Author: Wanbil W. Lee
Article

COBIT 5 Adoption: Understand and Be Understood

One of the most important discoveries for the human age was the Rosetta Stone. This piece of granite was the key element to decoding and understanding Egyptian hieroglyphs. Using this stone, it became possible to understand what the Egyptians wrote in their papyrus and allowed us to understand how the ancient Egyptians lived and thought...
ISACA Journal Article

Book Review: Governance, Risk Management and Compliance

Those who peruse this book can gain a clear understanding of how the establishment of the right processes, organization and technologies can guarantee the accomplishment of corporate governance goals.

Author: Richard M. Steinberg
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 2: Can Auditors Prevent Project Failure?

This three-part series within the IS Audit Basics column continues a discussion on a matter that, over many years, has been of concern to business managers everywhere.

Author: Ed Gelbstein
ISACA Journal Article

Vulnerability of Login Credentials at the Heart of Cyberhacks and Data Breaches

Corporate entities and retailers are scrambling to shore up network security by addressing the primary vulnerability of network security: the login. Unique behavioral biometrics may be the solution.

Author: Jeff Maynard
Podcast

Stanley Baldwin’s Bomber

If organizations operate under British politician Stanley Baldwin’s declaration that “The bomber will always get through,” they can greatly improve their security posture. Assuming a breach will happen encourages organizations to build strong defensive measures. In this podcast, we discuss why organizations should assume attackers will always get in and steps they can take to remain strong in the event of a breach.

2 September 2015
ISACA Journal Article

Addressing Cybersecurity Vulnerabilities

Addressing Cybersecurity Vulnerabilities. 10 areas of improvement to help security professionals detect, prevent and address security incidents.

Author: Omar Y. Sharkasi
ISACA Journal Article

The Underground Threat

According to the Symantec Internet Security Threat Report (ISTR), the annual cost of cybercrime to consumers in the US is more than US $38 billion. Visit this article for more information.

Author: Larry G. Wlosinski
ISACA Journal Article

Information Security Matters: Stanley Baldwin’s Bomber

Stanley Baldwin was a British politician who won numerous national elections in the 1920s and 1930s.

Author: Steven J. Ross
ISACA Journal Article

Cyberinsurance—The Challenge of Transferring Failure in a Digital, Globalized World

As organizations enter the international context and leverage their IT operations, their visibility increases.

Author: Jeimy J. Cano M.
ISACA Journal Article

HelpSource

How do I ensure that my organization has controls to protect itself from cyberrisk? In other words, what are the key controls that my company must implement to protect itself from cyberrisk?

Author: Ganapathi Subramaniam
ISACA Journal Article

Cybersecurity Detective Controls—Monitoring to Identify and Respond to Threats

Detective controls are a key component of a cybersecurity program in providing visibility into malicious activity and attacks on an organization’s IT environment.

Author: Fredric Greene
ISACA Journal Article

Accelerating Access Management to the Speed of Hacks

Organizations grant network access nearly every minute of every day. Hackers frequently try to get inside networks using co-opted access credentials. Yet most IT departments still review access privileges only quarterly or semiannually.

Author: Chris Sullivan
ISACA Journal Article

Preparing for a Cyberattack by Extending BCM Into the C-suite

There are many steps that can be taken to avoid a cyberbreach, but statistically speaking, the odds are that every company has been or will be breached at some point.

Author: Gary Lieberman
ISACA Journal Article

The Network: Daniela Gschwend

What has been, or do you anticipate being, the biggest compliance challenge in 2015?

Author: ISACA
ISACA Journal Article

IS Audit Basics: Auditors and Large Software Projects, Part 1: Can Auditors Prevent Project Failure?

Large software projects have been notorious because of: Their large budget and timescale overruns, Failing to deliver the promised benefits and more!

Author: Ed Gelbstein
ISACA Journal Article

Cybersecurity in the Quantum World

Most people probably lock their doors when they are not at home. They trust that the things they value—family photographs.

Author: Michele Mosca
ISACA Journal Article

Information Ethics: Monitoring Morality—Is Assurance of Information Ethics Feasible?

My honest thought about monitoring is: I do not like being monitored! I am not alone. A large majority of individuals and organizations would assert that they do not like being monitored.

Author: Vasant Raval
ISACA Journal Article

Book Review: IT Auditing and Application Controls for Small and Mid-sized Enterprises

Former US President John F. Kennedy said, “The Chinese use two brush strokes to write the word ‘crisis.’ One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger, but recognize the opportunity.”

Authors: Jason Woods, William Brown, and Harry Howe

How COBIT 5 Helped Al Rajhi Bank to Meet Compliance and Regulatory Requirements

Founded in 1957, Al Rajhi Bank is one of the largest Islamic banks in the world with total assets of SR 288 billion (US $76.8 billion), a paid up capital of US $4.3 billion and an employee base of more than 8,400 associates. With more than 50 years of experience...
ISACA Journal Article

Book Review: FISMA Compliance Handbook

FISMA Compliance Handbook is a valuable reference guide to compliance requirements in the United States.

Author: Laura Taylor
ISACA Journal Article

Cloud Computing Success Depends on the Right Network

In their ongoing quest to increase productivity, enhance operating efficiencies and reduce costs, more and more IT executives are moving to the cloud.

Author: Corey Eng
ISACA Journal Article

Cloud Computing: Cloud Application Enables ViralMint to Turn Potential Disaster Into Success

Social media marketing firm ViralMint rolled out a new feature that proved so popular that the increased customer traffic swamped the capabilities of the existing load balancer solution and greatly increased application response times.

Authors: Siva Mandalam and Rohan Dighe
ISACA Journal Article

Three Ways to Simplify Auditing Software Security Requirements and Design

It is common knowledge that building security into software is an important prerequisite for information assurance.

Authors: Rohit Sethi and Ehsan Foroughi
ISACA Journal Article

Data Protection Act and GAPP Alignment

With increasing privacy laws and regulations, global data privacy risk has become one of the major drivers of spotlighting the role of IT auditors.

Author: Mohammed J. Khan
ISACA Journal Article

Deep Web Data Extraction Based on URL and Domain Classification

The rapid development of computer and networking technologies has increased the popularity of the web.

Authors: B. Aysha Banu and M. Chitra
ISACA Journal Article

Vendor Risk Management Demystified

Outsourcing is often a default strategy for today’s businesses. While it has huge potential benefits to offer enterprises.

Author: Dipti Patel
ISACA Journal Article

Information Security Matters: Are Software Flaws a Security Problem?

I suspect I share with many readers of the ISACA Journal an annoyance with customer service people who tell me that they cannot give me any information because the system is down.

Author: Steven J. Ross
ISACA Journal Article

HelpSource

How should I go about establishing the security function and building a culture that is supportive to controls implementation?

Author: Ganapathi Subramaniam
ISACA Journal Article

State and Impact of Governance of Enterprise IT in Organizations: Key Findings of an International Study

Given the centrality of IT for enterprise risk management and value generation, a specific focus on governance of enterprise IT (GEIT) has arisen over the last two decades.

Authors: Steven De Haes, Anant Joshi, and, Wim Van Grembergen
ISACA Journal Article

Vendor Governance in the Age of Information Security

From businesses to government agencies, nearly every entity contracts some aspect of software development, system integration and hosting services—creating an emerging crisis in accountability.

Author: Arian Eigen Heald
ISACA Journal Article

The Network: Christos Dimitriadis

What is the biggest security challenge being faced in 2015? How should it be faced?

Author: Steven J. Ross
ISACA Journal Article

IS Audit Basics: Helping Auditees Prepare for an IS/IT Audit

IS Audit Basics: Helping Auditees Prepare for an IS/IT Audit. Suggestions for how to facilitate the preparation for & conduct of an IS/IT audit.

Author: Ed Gelbstein
ISACA Journal Article

Auditing Linux/Unix Server Operating Systems

Auditing Linux/Unix Server Operating Systems. This review covers auditing the physical security system, passwords, servers, & much more.

Author: Muhammad Mushfiqur Rahman
ISACA Journal Article

IS Audit Basics: Auditing Small IS/IT Organizations: When Is an IS/IT Organization Small?

IS/IT can be found virtually everywhere, and when it fails to deliver the services that people need, the result is discontent or worse.

Author: Ed Gelbstein
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge, Part 2

This issue examines a further set of soft skills that may require a longer period of time to acquire, that are likely to develop over time and that always leave room for improvement.

Author: Ed Gelbstein
Case Study

COBIT 5 and ITIL Adaptation at a Saudi Municipality

Providing good service to citizens is the main aim of the municipality, and information plays a crucial role. The municipality has to pay proper attention to, and focus on, information management.

ISACA Journal Article

Security Mysteries in the Cloud

In the world of IT, “cloud” is a big buzzword. Many organizations are moving to cloud computing because of its on-demand service offerings over the Internet, virtualization and cost efficiency.

Authors: Sivarama Subramanian and Devaraj Munuswamy
Case Study

Bahrain Government Embraces COBIT 5 Governance and IT Management

The Kingdom of Bahrain’s eGovernment Authority is focused on ensuring the effective delivery of government services to citizens, residents, businesses and visitors (collectively, the customers). The aim is to improve the lives of a nation’s citizens by doing much more than simply implementing technology...

18 May 2015
Case Study

COBIT to Implement Information Security | ISACA

Leveraging COBIT to Implement Information Security (Part 4). Shows how the requirements for certification of the ISMS framework using outlines in this 4-part series.

ISACA Journal Article

Information Security Matters: Frameworkers of the World Unite 2

Every now and again, I like to take a poke at standards, just to see what makes them work. Under consideration here is the cybersecurity framework published by the US National Institute of Standards and Technology early in 2014.

Author: Steven J. Ross
ISACA Journal Article

The Time for Sustainable Business Is Now: Leveraging COBIT 5 in Sustainable Businesses

Stakeholders expect that businesses create value, but at what cost? In the end, stakeholders and businesses are looking for the same thing: to protect their future.

Author: Graciela Braga
ISACA Journal Article

How to Evaluate Knowledge and Knowledge Management in the Organization Using COBIT 5

This article seeks to evaluate how the use of COBIT 5 can enhance the due diligence for knowledge management and knowledge evaluation within an enterprise.

Author: Bostjan Delak
ISACA Journal Article

Cloud Computing: Software-defined WAN Changes Retail Security Paradigm

The adoption of cloud-based retail applications, as well as increasing demands for agility, for example, with pop-up retail, is changing the requirements for network access.

Author: Steve Woo
ISACA Journal Article

The Underestimated Social Engineering Threat in IT Security Governance and Management

The Underestimated Social Engineering Threat in IT Security Governance & Management. Reviewing the human factor as a necessary part of IS.

Author: Roberto Puricelli
ISACA Journal Article

Evaluating Cloud Automation as a Service

Organizations have already discovered how cloud automation as a service can help them share applications and information regardless of the technology in use or their location.

Author: Andrew Evers
ISACA Journal Article

Book Review: Gray Hat Hacking

Gray Hat Hacking: The Ethical Hacker's Handbook is written by a team of experts with advanced knowledge in gray hat hacking and penetration testing.

Authors: Allen Harper, Shon Harris, Jonathan Ness, Chris Eagle, Gideon Lenkey, and Terron Williams
ISACA Journal Article

IS Audit Basics: The Soft Skills Challenge

ISACA Journal: IS Audit Basics: The Soft Skills Challenge. Reviews soft skills that do not appear in the Certified Information Systems Auditor examination.

Author: Ed Gelbstein
ISACA Journal Article

Navigating I/O Flows/Networks to Enhance the Governance Management Cycle

What constitutes true adoption of COBIT 5? Is it a minimum condition that at least one principle of COBIT 5 is adopted for true adoption of COBIT 5?

Author: Makoto Miyazaki
ISACA Journal Article

The Network: Opeyemi Onifade

What are your three goals for 2015?

Author: ISACA
ISACA Journal Article

Information Ethics: The Limits of Rules

T. H. Green, a renowned ethicist, once said: “…Whatever moral capacity must be presupposed, it is only actualized through the habits, institutions, and laws, in virtue of which the individuals form a nation.”

Author: Vasant Raval
ISACA Journal Article

Toward a Secure Data Center Model

Toward a Secure Data Center Model. Defining data centers, security models, technical controls, consolidated frameworks and administration.

Authors: Brett van Niekerk and Pierre Jacobs
ISACA Journal Article

Simultaneous Implementation of an Integrated ISMS and a BCMS

The implementation of and certification to global best practice standards can be quite challenging for most organizations given the resources.

Author: Nurudeen Odeshina
Article

COBIT 5 Principles and Enablers Applied to Strategic Planning

Two years ago in Mexico City, work was underway at an organization that offers managed print services and document solutions. This organization decided to start an effort to reinforce.....

20 April 2015
ISACA Journal Article

Book Review: Cybersecurity—The Essential Body of Knowledge

The book’s objective is to provide a comprehensive understanding of cybersecurity. Its target audience is anyone interested in the field of cybersecurity, ranging from students to educators and professionals.

Authors: Dan Shoemaker and William Arthur Conklin
Case Study

COBIT Helps Organizations Meet Performance and Compliance Requirements

A consulting company in the United Arab Emirates worked with three different organizations to help each organization meet its governance, risk and compliance (GRC) requirements.

6 April 2015
ISACA Journal Article

IS Audit Basics: Auditor: About Yourself (And How Others See You)

This article begins an exploration of some of the human factors that play a role in an auditor’s success.

Author: Ed Gelbstein
Case Study

Establishing a Governance and Management Structure for E-commerce Using COBIT 5

A company based in Lagos, Nigeria, is in the business of sales and distribution of its brand of shoes through physical outlets in the Lagos area. In a bid to expand its operations to areas outside of its physical outlets and to also have a better competitive showing in the Nigerian marketplace, ....
ISACA Journal Article

Book Review: Fraud Prevention and Detection

The book covers preventive measures or controls, including the boards responsibility, the importance of good governance and robust enterprise risk management (ERM).

Author: Rodney T. Stamler, Hans J. Marschdorf, and Mario Possamai
ISACA Journal Article

ERP Implementation in the Education Sector: Using a Hybrid IT Governance Framework

Enterprise resource planning (ERP) aims to enhance business productivity, quality and efficiency by integrating operations and processes.

Authors: Manas Tripathi and Arunabha Mukhopadhyay
ISACA Journal Article

Checking the Maturity of Security Policies for Information and Communication

The transformations experienced by organizations due to technological advances has made information.

Author: Mauricio Rocha Lyra
ISACA Journal Article

Book Review: The Soft Edge

How many times has it been asked if an initiative (e.g., a start-up, a new project, an audit, a security assessment) will be successful or, more generally, whether it would be possible to predict the future performance of a company?

Author: Rich Karlgaard
ISACA Journal Article

Cloud Insecurities

Information security events that affect cloud systems are occurring with no end in sight - the cloud should be treated as a non secure environment with numerous threats and concerns.

Author: Larry G. Wlosinski
ISACA Journal Article

A Practical Approach to Continuous Control Monitoring

This article describes how to create and view attachment fields, as well as how to audit attachment fields in Access databases.

Author: David Vohradsky
ISACA Journal Article

Evaluating Information Security Solutions: Swapping the Cost of Failure for Success

One of biggest budget busters for an information security program is technology solutions that are not a good match for the organization.

Author: Kerry A. Anderson
ISACA Journal Article

Information Security Matters: Cyberwhatsit

I did a Google search on the word cyber and was told there are 467 million references to that term. This seems to me an awfully exact number, but I guess we can agree there are a lot of references.

Author: Steven J. Ross
ISACA Journal Article

Information Ethics: Information Technology and Innovation Ethics

Entrepreneurship and small business are at the core of economic growth. After all, and new giants such as Google and Facebook germinated from humble beginnings.

Author: Vasant Raval
ISACA Journal Article

Selected COBIT 5 Processes for Essential Enterprise Security

COBIT 5 processes can improve the effectiveness of enterprise security in an organization. In this article, we discuss how they are essential for enterprise security.

Author: Fredric Greene
ISACA Journal Article

Strategic Alignment and E-health Governance

There has been rising interest in adopting e-health governance frameworks to obtain reassurance that investments return the expected results in health care.

Authors: Elena Beratarbide, Thomas W. Kelsey, and Hermenegildo Gil
ISACA Journal Article

The Network: Lilia Liu Chung

What are your three goals for 2015?

Author: ISACA
ISACA Journal Article

Book Review: Governance of Enterprise IT Based on COBIT 5

When governance and management of enterprise IT (GEIT) is needed, COBIT 5 is frequently the framework of choice for organizations all over the world.

Author: Geoff Harmer
ISACA Journal Article

Internet of Things Offers Great Opportunities and Much Risk

There are a number of definitions of Internet of Things (IoT), with all of them having slightly different meanings.

Authors: Marcelo Hector Gonzalez and Jana Djurica
ISACA Journal Article

HelpSource

What are the key controls that we must consider for assessing the third-party vendor?

Author: Ganapathi Subramaniam
ISACA Journal Article

IS Audit Basics: Successful Audits Do Not Just Happen

An online search for audit success criteria reveals few articles or books specific enough to be useful.

Author: Ed Gelbstein
Case Study

COBIT and the CPA Firm, Part 2

Last year, part 1 of this article outlined how CPA firm Yount, Hyde & Barbour was using COBIT to help build processes to allow its IT department to better serve the enterprise’s needs. While progress has been slow...

23 February 2015
ISACA Journal Article

Book Review: The Fifth Domain—Wake Up Neo

The Fifth Domain: Wake Up Neo, written by two chief information officers (CIOs), is an innovative experiment with the cybertechnology novel and is worth the attention of information security professionals.

Authors: Guiliano Pozza and John D. Halamka
ISACA Journal Article

Porters’ Elements for a Business Information Security Strategy

Hackers and negative social media hypes have proven able to bring proud organizations to their knees, yet many information and communications technology (ICT) security managers lack a strategy to anticipate and overcome such unpredictable challenges.

Author: Yuri Bobbert
ISACA Journal Article

Cybersecurity for Industrial Control Systems

In June 2010 a computer worm known as Stuxnet, designed to attack industrial programmable logic controllers (PLCs) in target areas, such as nuclear power plants in Iran,1 was discovered.

Author: A. Krista Kivisil
Article

Adopting COBIT 5 in a Government Entity

Imagine being on the ground floor of a new government agency in the United States, first conceived in 1994 and implemented in 2012, with the initial responsibility of developing an information system...

19 January 2015
ISACA Journal Article

Return on Security Investment—15 Things to Consider

Managers frequently request a return on security investment (ROSI) calculation. While this is a usual business practice for significant investments, the practice is not free from controversy when applied to information security.

Author: Ed Gelbstein
Podcast

Microwave Software

Outdated legacy software remains in many organizations and can pose a substantial risk. Security patches often do not exist for them, and many enterprises forget these old programs still have access to critical systems. In this podcast, we discuss how you can address the security challenges old software poses to your organization.

2 January 2015
ISACA Journal Article

Information Security Continuous Monitoring: The Promise and the Challenge

Combining an organization-applicable risk framework with an all-encompassing control set and an information security continuous monitoring (ISCM) methodology provides for a holistic approach to compliance and risk management by providing controls across a wide array of areas with a high level of detail and guidance on tailoring.

Author: Bill Hargenrader
ISACA Journal Article

Audit Accounting Data Using Excel Pivot Tables: An Aging of Accounts Receivable Example

Microsoft Excel’s pivot table options provide powerful tools for aggregating and analyzing accounting data, but so does alternate software such as ACL. So why use pivot tables?

Authors: Joshua J. Filzen and Mark G. Simkin
ISACA Journal Article

Auditing SQL Server Databases Using CAATs

The following approach to auditing MS SQL Server databases using computer-assisted audit techniques (CAATs) in conjunction with information taken directly from the MS SQL Server database offers a solution to the issues identified.

Author: Ian Cooke
ISACA Journal Article

Understanding Software Metric Use

In the early 1990s, the baggage claim system at Denver International Airport (Colorado, USA) was designed to automate baggage handling by using software to direct baggage contained in unmanned carts running on a track.

Authors: David Henderson, Steven D. Sheetz, and Linda Wallace
ISACA Journal Article

User Threats Vs. User Privacy: Striking the Perfect Balance

On the one hand, user-based attacks—whether from hackers using stolen credentials, careless third-party vendors, or negligent or even malicious insiders—represent the largest IT security threat to organizations.

Author: Dimitri Vlachos
ISACA Journal Article

Implementing an Information Security Continuous Monitoring Solution—A Case Study

The threats to government computer systems and networks continue to evolve and grow due to steady advances in the sophistication of attack technology, the ease of obtaining such technology, and the increasing use of these techniques by state and nonstate actors to gain intelligence and/or disrupt operations.

Author: Tieu Luu
ISACA Journal Article

Effective Cyberthreat Management Evolution and Beyond

Over the past few decades, cybersecurity has gained pivotal importance in the way businesses operate and survive in their value systems.

Author: Seemant Sehgal
ISACA Journal Article

Book Review: Cybersecurity and Cyberwar

Cybersecurity and Cyberwar: What Everyone Needs to Know is one of the few books that is completely up-to-date and analyzes the importance of cybersecurity beyond the realm of the Internet.

Authors: P. W. Singer and Allan Friedman
ISACA Journal Article

Cloud Computing: Are Your Data Secure in the Cloud

Enterprise architects have to build computing environments that support the general-use case of multiple, disparate business applications, also known as cloud computing.

Author: John Nye
ISACA Journal Article

IS Audit Basics: Perspectives From a Seasoned Practitioner

It was a bit of a surprise and a huge compliment to be invited to contribute to this column after many years reading the words of Tommie Singleton in this space. I shall do my best not to disappoint.

Author: Ed Gelbstein
ISACA Journal Article

The Network: Timo Heikkinen

Timo Heikkinen is a senior audit manager for Nordea Bank in Helsinki, Finland.

Author: ISACA
ISACA Journal Article

Guest Editorial: Monitoring From the Cloud—Insights on Demand

Using a computer to automate and implement continuous monitoring (CM) in IT has been around for decades. It was adopted early by IT auditors and IT security specialists, and later used to monitor transactions by operations and financial managers.

Author: Michael P. Cangemi
ISACA Journal Article

Information Security Matters: Microwave Software

Let me tell you about my microwave. When I bought it, it was called a microwave oven and I was going to roast turkeys in it in half an hour. I am sure it was white then, but it has turned a pale, sickly yellow.

Author: Steven J. Ross
ISACA Journal Article

HelpSource Q&A

Privacy is one area that has never been audited in my enterprise. Please provide your point of view on how privacy compliance can be assessed?

Author: Ganapathi Subramaniam
ISACA Journal Article

Book Review: Secure—Insights From the People Who Keep Information Safe

There is always a new information security issue to focus on, another area of key concern relating to IT security, data security or business continuity planning that security professionals need to be aware of to keep on top of the relevant risk.

Author: Mary Lou Heastings
ISACA Journal Article

Data Owners’ Responsibilities When Migrating to the Cloud

Understanding who owns data is not as simple as it appears at first. It is easy to say that all data belong to the organization. This is correct, but it does not identify accountability for such ownership.

Authors: Ed Gelbstein and Viktor Polic
ISACA Journal Article

How Zero-trust Network Security Can Enable Recovery From Cyberattacks

Managers looking for a strategy to comply with the US NIST Cybersecurity Framework requirements for response and recovery should give due consideration to Cyber DRaaS.

Author: Eric A. Beck
Case Study

Creating Value With COBIT 5 at a Tokio Marine Group Company

Tokio Marine & Nichido Systems (TMN Systems) recently implemented a governance, risk and compliance ( GRC) system based on COBIT 5, which enables the organization to create significant value for its stakeholders as well as optimize risk and resources for value creation.

ISACA Journal Article

Auditing Oracle Database

Data are a very decisive resource for any business due to shielding; regularly auditing the database should never be left to chance or patchwork solutions.

Author: Muhammad Mushfiqur Rahman
ISACA Journal Article

IS Audit Basics: The Core of IT Auditing

With the advent of the latest wave of information technologies such as big data, social media, technologies as a service and the cloud in general, it is worth taking the time to revisit the basics of IT audit.

Author: Tommie Singleton
ISACA Journal Article

Seven Mistakes Being Made in SIEM and How to Fix Them

Seven Mistakes Being Made in SIEM and How to Fix Them. A foundation for evaluating and implementing essential security control solutions against cyberattacks.

Author: Flint Brenton
Article

COBIT 5’s Flexibility Key to Success | ISACA

Nine executives (including the author) were in a conference room, and when the vice president of IT operations stated that due to recent issues within the organization.

ISACA Journal Article

IS Audit Basics: What Every IT Auditor Should Know About Computer-generated Reports

So many times, auditors of all types use a computer-generated report to perform some aspect of assurance. For example, financial auditors may pull a computer-generated list of accounts receivable ...

Author: Tommie Singleton
ISACA Journal Article

Manage What Is Known and What Is Not Known: A Road Map to Managing Enterprise Fraud Risk

Organizations should establish and implement an organization wide fraud risk management framework that integrates counter fraud capabilities through organization and governance.

Authors: Zhiwei Fu, John W. Lainhart IV and Alan Stubbs
Article

Improving the RFP and Contracts Process With COBIT 5 | ISACA

Changing IT service providers is especially difficult when the company is responsible for processing meter reads and supporting the billing of more than four million customers.

ISACA Journal Article

Assessing and Managing IT Operational and Service Delivery Risk

Service resilience has gained a lot of importance in recent years. A resilient service is one that is capable of withstanding major and minor disruptions caused by natural and man-made sources.

Authors: Upesh Parekh and Jonathan Copley
ISACA Journal Article

Carry On—Sound Advice From Schneier on Security

A pessimistic prediction for the future of the RSA Conference, the somehow unfair public judgment of security agencies, the possibility of hacking a papal election, how to become a security expert...

Authors: Bruce Schneier, reviewed by Maria Patricia Prandini
Case Study

Mapping COBIT 5 With IT Governance, Risk and Compliance at Ecopetrol

As part of an updated strategy, Ecopetrol S.A., a vertically integrated energy company, began a corporate transformation with the goals of growth and strengthening its internal control system.

1 July 2014
ISACA Journal Article

Law and Best Practice for a Sarbanes-Oxley Systems Review

Any organization would like to have an optimal approach to a Sarbanes-Oxley Act review, whether it is the process used or the Sarbanes-Oxley review team's composition.

Author: Frederick G. Mackaden
ISACA Journal Article

An Enhanced Risk Formula for Software Security Vulnerabilities

As enterprises increasingly rely on IT to succeed, effective IT risk management has become an essential component of IT governance.1 In conjunction with this, there are various studies to address risk through the software development life cycle,2 while others are interested in risk in the production environment.

Author: Jaewon Lee
ISACA Journal Article

Fire Protection of Computer Rooms—Legal Obligations and Best Practices Fire Protection of Computer Rooms—Legal Obligations and Best Practices

Considering that the issue of fire protection in computer rooms is not specifically addressed in many national regulations, the US National Fire Protection Association (NFPA) Standard for...

Author: Haris Hamidovic
ISACA Journal Article

Data Privacy and Big Data—Compliance Issues and Considerations

The big data1 craze has taken the industry by storm. With the advent of cost-effective technologies and solutions for longer-term storage of vast amounts of transaction data, more and more companies are investing in keeping more and more data for longer and longer periods.

Author: William Emmanuel Yu
ISACA Journal Article

Big Data Analytics for Sophisticated Attack Detection

The number and complexity of cyberattacks has been increasing steadily in recent years. The major players in today’s cyberconflicts are well organized and heavily funded teams with specific goals and objectives...

Authors: Nikos Virvilis, Oscar Serrano and Luc Dandurand
ISACA Journal Article

Data Privacy—Protecting This Asset Is a Priority

Over the past few years, there has been a shift in the business world pertaining to assets that need to be protected. The digital world has brought with it complexity in terms of...

Author: Horace McPherson
ISACA Journal Article

Reinspecting Password, Account Lockout and Audit Policies

Reinspecting Windows sounds like reinventing the wheel, but reviewing password policy, account lockout policy and audit policy proves that auditing is not a one-time exercise; rather, it, must be...

Author: M. Faisal Naqvi
ISACA Journal Article

Writing good risk statements

A fundamental part of an information systems (IS) audit and control professional’s job is to identify and analyse risk. Furthermore, risk factors need to be stated clearly and concisely to support effective management of risk.

Author: Benjamin Power
ISACA Journal Article

Selecting the Right Cloud Operating Model: Privacy and Data Security in the Cloud

Cloud-based services are on the rise. According to recent publications, the cloud is the future for the provision of a wide range of IT services.

Authors: Thomas Schaefer, Michael Hofmann, Peter Loos and Peter Fettke
Case Study

DuPont Drives Continuous Improvement With COBIT 5 Process Assessment Model

Over time, business has increasingly advanced the application of IT to meet ever-changing business needs and regulatory requirements.

April 2014
ISACA Journal Article

COBIT 5 Processes From a Systems Management Perspective

COBIT 5 establishes a governance layer and does a good job of capturing stakeholder needs, driving enterprise, IT and enabler goals. COBIT 5 fosters the use of balanced...

Authors: Myles Suer, Chane Cullens and Don Brancato
ISACA Journal Article

Critical Information Systems Processes

Organizations maintain their operations with the help of processes that differ according to their organizational structure, business objectives and working styles.

Authors: Tugba Yildirim and Bilgin Metin
ISACA Journal Article

Internal Audit’s Contribution to the Effectiveness of Information Security (Part 1)

The internal audit and information security functions should play complementary roles in an organization’s information security program.

Authors: Paul John Steinbart, Robyn Raschke, Graham Gal and William N. Dilla
ISACA Journal Article

Communicating IT Governance—Does It Matter?

IT governance is an area in which IT and non-IT executives need to communicate at least with a basic understanding of each other’s positions.

Author: Giuliano Pozza
ISACA Journal Article

SCADA Cybersecurity Framework

Supervisory control and data acquisition (SCADA) systems are rapidly changing from traditional proprietary protocols to Internet Protocol (IP)-based systems.

Author: Samir Malaviya
Case Study

Information Security Management at HDFC Bank: Contribution of Seven Enablers

HDFC Bank operates in a highly automated environment in terms of IT and communication systems. All of the bank’s branches have online connectivity, which enables the bank to offer speedy funds transfer facilities to its customers.

January 2014
Case Study

Middle East Bank Improves Information Security

As a result of its initiative to improve information security with the help of COBIT, a Middle East bank realized several benefits, including improved integration of information security within the organization.

1 January 2014
ISACA Journal Article

An Integrated Approach to Enterprise Risk

Today, most organizations continue to rely on a traditional approach to risk management. Such an approach is built on stovepipe-oriented risk management, in which the focus...

Author: Muhammad Mushfiqur Rahman
ISACA Journal Article

Integrating Security Analytics Into GRC Programs

Business and security teams alike have seen breathtaking changes over the last few years with the rise of a digital universe that is global, social, mobile and interconnected.

Author: Yo Delmar
ISACA Journal Article

Key Considerations in Protecting Sensitive Data Leakage Using Data Loss Prevention Tools

Protecting digital assets and intellectual property (IP) is becoming increasingly challenging for organizations. Looming patent challenges and court battles to claim ownership of IP illustrate the...

Author: Nageswaran Kumaresan
ISACA Journal Article

Importance of Forensic Readiness

Almost all organizations are now dependent, one way or another, on information technology. This has led to a great deal of development as well as associated risk.

Author: Dauda Sule
ISACA Journal Article

Privacy Audit—Methodology and Related Considerations

Auditors should consider key risk and control points when performing privacy audits. The following methodology draws heavily on concepts presented in ISO 31000:2009 Risk management—Principles and guidelines.

Author: Muzamil Riffat
ISACA Journal Article

Risk Management in 4G LTE

Fourth-generation Long Term Evolution (4G LTE) is a broadband wireless data technology designed to offer users access to technology-agnostic across carriers and geographic regions.

Author: Daksha Bhasker
ISACA Journal Article

JOnline: Embed With SFIA—Secrets From the Missing Framework

Why is value so hard to sustain? What is the secret to making best practices stick? How does an organisation make process improvement and good governance last when the consultants leave?

Author: Simon Roller
Case Study

COBIT and the CPA Firm

With the introduction of COBIT 5, the framework is moving toward a more global application to the enterprise. But, can a smaller organization still take advantage of COBIT 5 to help direct its IT function?

October 2013
Case Study

Information and Communications Technology Study of Public Health Institutions in Mexico

In Mexico, 44 percent of the people perceive the main problem of health services to be poor quality, with the affecting factors being timely care services, quality of diagnosis and treatment.

October 2013
Case Study

Use of COBIT 5 for ISACA Strategy Implementation

In 2009, ISACA developed a strategy focused on becoming the global leader in products and services that support trust in, and value from, information systems.

October 2013
ISACA Journal Article

A COBIT Approach to Regulatory Compliance and Defensible Disposal

The successful IT governance plan demands a modern and transparent approach to data retention and routine disposal. Today’s chief information officers (CIOs) face an unprecedented array of challenges...

Authors: Lorrie Luellig and Jake Frazier
ISACA Journal Article

How to Measure Security From a Governance Perspective

Good governance relies on reports or measures that either assess the adequacy of information security, the security program and the return on security investment (ROSI) or the progress toward fixed objectives.

Author: Andrej Volchkov
ISACA Journal Article

How to Measure Security From a Governance Perspective

Good governance relies on reports or measures that either assess the adequacy of information security, the security program and the return on security investment (ROSI) or the progress toward fixed objectives.

Author: Andrej Volchkov
ISACA Journal Article

JOnline: Mitigating Software Supply Chain Risk

Examination of risk related to software supply chains demonstrates that software supply chains are subjected to risk that is specific to software.

Author: C. Warren Axelrod
ISACA Journal Article

Key Elements of an Information Risk Profile

Information risk has become a top-of-mind issue for many business leaders and information risk management security (IRMS) professionals.

Author: John P. Pironti
Case Study

Risk Assessment Management Using COBIT 5

The IT organization enjoyed a membership with Info-Tech Research group to access its best-practices research and vendor-selection guidance. Engaging with Info-Tech to conduct a COBIT-based operations workshop on risk management was a natural next step.

22 July 2013
ISACA Journal Article

DDoS Attacks—A Cyberthreat and Possible Solutions

Distributed denial of service (DDoS) is one of the most diffused types of cyberattacks that represent a great concern for governments and institutions today.

Author: Ajay Kumar
ISACA Journal Article

Man in the Browser—A Threat to Online Banking

The popularity of online banking has been on the rise. In 2005, Bob Sullivan of MSNBC quoted research figures from the Pew Internet and American Life Project, which showed that 53 million US citizens were banking online in 2004, and that online banking was the fastest growing Internet activity.

Author: Ed Gelbstein
ISACA Journal Article

Quantifying Information Risk and Security

Conducting risk assessments and the calculation of a return on investment (ROI) on information security is challenging. ISACA’s Risk IT1 framework defines IT risk as “The business risk associated with the use, ownership, involvement, influence and adoption of IT within an enterprise.”

Author: Ed Gelbstein
ISACA Journal Article

Risk and Compliance—For Better or Worse?

In today’s business environment, many companies are required to comply with multiple industry and government mandates that govern IT security.

Author: Torsten George
ISACA Journal Article

IT Security Responsibilities Change When Moving to the Cloud

How will an organization’s information security staff be affected if the organization’s computer systems are moved to a cloud environment?

Author: Larry G. Wlosinski
ISACA Journal Article

JOnline: An Introduction to Auditing HP NonStop Servers—Review of User Access

For at least 35 years, HP NonStop (previously known as Tandem) has been a widely used operating system (OS) to support critical services such as automated teller machines (ATMs), stock exchanges and the airline industry.

Authors: David Ramirez and Nikos Zarras
ISACA Journal Article

What Is Big Data and What Does It Have to Do With IT Audit?

For many years, IT auditors have been able to rely on comparatively elementary data analysis tools to perform analyses to draw conclusions. With the recent explosion in the volume of data generated for business purposes (e.g., purchase transactions, network device logs, security appliance alerts), current tools may now not be sufficient.

Authors: Kumar Setty and Rohit Bakhshi
ISACA Journal Article

Common Myths of Service Organization Controls (SOC) Reports

In today’s dynamic environment, organizations face multiple challenges in terms of various standards and compliance requirements.

Author: Deepa Seshadri
ISACA Journal Article

How to Properly Audit a Client Who Uses a Service Organization—SOC Report or No SOC Report

The new standards from the American Institute of Certified Public Accountants (AICPA) on service organization controls1 have created a situation in which IT auditors, especially Certified Information Systems Auditors (CISAs), are particularly needed and useful.

Author: Tommie W. Singleton
ISACA Journal Article

IT Policy Framework based on COBIT 5

The COBIT 5 good-practice framework for governance and management of enterprise IT (GEIT) incorporates many widely accepted concepts and theories from general management and academic IT literature. Exploring how the core principles of the framework are derived from insights from theory and literature...

Authors: Steven De Haes, Roger Debreceny and Wim Van Grembergen
ISACA Journal Article

JOnline: Using Personal Mobile Devices in a Business Setting

Mobile devices refer to a wide variety of handheld computing devices that allow people to access and process data by running various types of application software (apps).

Authors: Pascal A. Bizarro, Andy Garcia and Jacob Nix
ISACA Journal Article

Lack of Privacy Awareness in Social Networks

Social networks have opened up a new avenue of communication for millions of people around the world. The major attraction of this technology is the ease with which people can share their personal information with their friends.
ISACA Journal Article

Using Scenario Analysis for Managing Technology Risk

In the world of market and credit risk, scenario analysis is used as a part of stress testing. Stress testing is mandated by national regulators and central banks, and takes the form of asking financial institutions to consider the effect of adverse scenarios on their capital and solvency.

ISACA Journal Article

What Every IT Auditor Should Know About Proper Segregation of Incompatible IT Activities

One element of IT audit is to audit the IT function. While probably more common in external audit, it certainly could be a part of internal audit, especially in a risk assessment activity or in designing an IT function.
ISACA Journal Article

Cloud Risk—10 Principles and a Framework for Assessment

Cloud Risk 10 Principles and a Framework for Assessment. Reviews cloud assessment road map of four principles: vision, visibility, accountability & sustainability.
ISACA Journal Article

Database Backup and Recovery Best Practices

Database data files should be backed up during cold backup as well as during online backup, using Oracle's Recovery Manager (RMAN) or, in Oracle Database.
ISACA Journal Article

Social Networks and Privacy—Threats and Protection

ISACA identifies, based on the motivations of Internet users visiting social networks, the risk of violating users’ privacy, and to analyze and evaluate the effectiveness of the control methods used.
ISACA Journal Article

JOnline: 10 Key Rules for Using the ITIL Framework Effectively

This article shares some of the practical challenges in IT service management (ITSM) and how the ITIL framework can be used to overcome those challenges.

ISACA Journal Article

Cloud Computing as an Integral Part of a Modern IT Strategy

Cloud Computing as an Integral Part of a Modern IT Strategy. Describes real cloud computing project case studies & important strategic decisions for IT managers.
ISACA Journal Article

Project Portfolio Management

A program or project portfolio explains how an organization is implementing its strategy with projects. If product management answers the question “Are we managing the projects correctly?,” then project portfolio management answers the question “Do we have the right projects?”
ISACA Journal Article

Fundamental Concepts of IT Security Assurance

Government and commercial organizations rely heavily on the use of information to conduct their business activities.

ISACA Journal Article

Testing Controls Associated With Data Transfers

There are several IT-related functions that inherently have a rather high degree of risk. Some of those include custom application development, logical access and data transfers. The latter has been growing in volume and risk recently.
ISACA Journal Article

Auditing Applications, Part 1

Auditing Applications Part 1. This two-part article describes one framework for performing effective audits of framework, plan, & objective applications.
ISACA Journal Article

Evaluating Access Controls Over Data

Evaluating Access Controls Over Data. This article offers some basic guidance to IT auditors in evaluating the access controls over relevant data files.
ISACA Journal Article

Information Risk Management for Supporting a Basel II Initiative

Effective January 2008, Basel II stipulates the minimum capital requirements that financial institutions must possess in order to manage their risks.
ISACA Journal Article

Key Issues, Challenges and Resolutions in Implementing Business Continuity Projects

Business continuity management (BCM) is a holistic process to ensure uninterrupted availability of all key business resources required to support critical business activities, whether manual or IT-enabled, in the event of business disruption.

Podcast

Growing a Cybersecurity Career: Questions for the Job Interview

All job seekers, but especially those in cyber, should try to work for an organization that supports their professional growth. In this podcast, we discuss some questions to ask on a job interview to help you determine the growth potential of a role and if you can thrive at that enterprise.

11 December 2018
ISACA Journal Article

Data Integrity—Information Security’s Poor Relation

Data Integrity Information Security's Poor Relation. GIGO - Data governance needs the same degree of attention as IT governance for weak link risks.
ISACA Journal Article

JOnline: Identity and Access Management—Its Role in Sarbanes-Oxley Compliance

JOnline Identity and Access Management Its Role in Sarbanes Oxley Compliance. Article aims at simplifying the IAM & uncovering roles in Sarbanes-Oxley 404 compliance.
ISACA Journal Article

What Every IT Auditor Should Know About Backup and Recovery

What Every IT Auditor Should Know About Backup and Recovery. Explains effective backup & recovery plans to provide guidance for conducting an IT audit.
ISACA Journal Article

A Framework for Estimating ROI of Automated Internal Controls

Organizations are information-driven and operate in an interconnected economy. With increasing automation of critical business processes, information has become the lifeblood of any business.
ISACA Journal Article

Auditing IT Risk Associated With Change Management and Application Development

Auditing IT Risk Associated With Change Management & Application Development. Provides the IT auditor with techniques to mitigate the risk associated with AppDev.
ISACA Journal Article

IT General and Application Controls: The Model of Internalization

IT General and Application Controls The Model of Internalization. Implementing in-house ITGC/ITAC for auditors to improve their knowledge for build IT governance.
ISACA Journal Article

The Three Lines of Defence Related to Risk Governance

The Three Lines of Defence Related to Risk Governance. Challenge is aligning expectations & perceptions of risk governance & the senior risk committee.
ISACA Journal Article

Analyzing IT Value Management at KLM Through the Lens of Val IT

Analyzing IT Value Management at KLM Through the Lens of Val IT. Provides insight to practitioners on how to introduce better value management approaches.
ISACA Journal Article

IT Governance and the Cloud: Principles and Practice for Governing Adoption of Cloud Computing

IT Governance and the Cloud - Principles and Practice for Governing Adoption of Cloud Computing. Strong governance & control are an essential part of cloud transition.
ISACA Journal Article

The Impact of Governance on Identity Management Programs

The Impact of Governance on Identity Management Programs. IDM has the potential to affect processes as roles, identities, & access to information security.
Case Study

Maitland Utilizes COBIT to Improve ICT Governance

Increasing business oversight and accountability for the information and communication technology (ICT) asset is a cornerstone of Maitland’s future ICT governance state.

15 July 2011
ISACA Journal Article

Cloud Computing Risk Assessment: A Case Study

Cloud Computing Risk Assessment A Case Study. This case study represents a one-time attempt at risk assessment of the cloud computing arrangement.
ISACA Journal Article

Planning for and Implementing ISO 27001

Planning for and Implementing ISO 27001. An organization certified against the ISO 27001 standard helps to provide confidence to their customer base.
ISACA Journal Article

JOnline: An Introduction to Information Security Incident Management Based on ISO/IEC TR 18044:2004

Incident management can be considered the emergency operations part of risk management. Poorly managed incidents have the capacity to become unmitigated disasters unless effectively managed.
ISACA Journal Article

JOnline: Impact of Security Awareness Training Components on Perceived Security Effectiveness

JOnline Impact of Security Awareness Training Components on Perceived Security Effectiveness. Help organizations implement effective security awareness training.
ISACA Journal Article

Questions That Must Be Addressed for a Successful IFRS Implementation

For IT auditors and IT professionals, IFRS should be a priority because the demand will be high for those with technical knowledge to interpret and translate IFRS into IT requirements.
ISACA Journal Article

Understanding and Applying Benford’s Law

Understanding and Applying Benford's Law. Article describes what Benford’s Law is, when it could apply, & what constraints to consider applying to an IT audit.
ISACA Journal Article

Understanding the New SOC Reports

With the transition from Statement on Auditing Standard (SAS) No. 70 reports to the new Service Organization Controls (SOC) reports, this issue’s column describes these reports to provide an understanding of them, and to explain the differences among them in order to prepare CISAs for the changes ahead.
ISACA Journal Article

What Is the Value of Security?

What Is the Value of Security? Security professionals should state the worth of their contribution in monetary terms to establish the rationale for their activities.
ISACA Journal Article

An Introduction to ICT Continuity Based on BS 25777

Disruptions to ICT can constitute a strategic risk, damaging the organization’s ability to operate and undermining its reputation.
ISACA Journal Article

IT Scenario Analysis in Enterprise Risk Management

IT Scenario Analysis in Enterprise Risk Management. Scenarios will not provide all the answers, but help executives ask better questions & prepare for risk.
ISACA Journal Article

A Young Professional’s Guide to Career Success Using Soft Skills

A Young Professional’s Guide to Career Success Using Soft Skills. This article examines the importance of soft skills & interview techniques for career success.
ISACA Journal Article

Auditing Security Risks in Virtual IT Systems

Virtualisation is a software technology that divides a physical resource, such as a server, into virtual resources called virtual machines (VMs).
ISACA Journal Article

An Introduction to Digital Records Management

The main objective of this article is to introduce the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition of records in an electronic environment, based on international standards ISO 15489.
ISACA Journal Article

Data Governance for Privacy, Confidentiality and Compliance: A Holistic Approach

It is important to point out that the proposed approach to data governance for security, privacy, confidentiality and compliance does not call for modifying or replacing the organization’s existing information security management systems or IT governance processes.

ISACA Journal Article

Use of the Balanced Scorecard for IT Risk Management

Risk management, in its essence, is subjective. Though it is a structured approach to determine whether to accept, mitigate, transfer or avoid a risk, it is based on a subjective assessment of the business impact of the exercise on organizational vulnerability.
ISACA Journal Article

An Approach Toward Sarbanes-Oxley ITGC Risk Assessment

The US Sarbanes-Oxley Act is an old bandwagon for most of the publicly listed companies, as they have been riding on it since its inception in 2002. But, most companies face newer challenges every day with the birth of newer technology, rapidly changing business conditions, and/or mergers and acquisitions.
ISACA Journal Article

Giving Sustainability to COBIT PO9

This example shows one of the benefits that COBIT’s management guidelines bring when a decision has to be made about the scope of applicability of a particular process—in this case, PO9.
ISACA Journal Article

Mitigating IT Risks for Logical Access

Unauthorized access can lead to devastating effects. Entities can become victims of malicious activities such as identity theft, financial fraud, theft of data and attacks on systems, which can be especially harmful for online businesses.
ISACA Journal Article

Achieving Data Warehouse Nirvana

Successful organizations expand the scope of information controls beyond the scope of the data warehouse by developing a companywide program for ensuring the enterprise information quality.
ISACA Journal Article

JOnline: Using Microsoft Office in Analyzing SAP SoD and Beyond

Evaluating SoD in a business application system is important when evaluating SoD in interrelated processes. Learn how to use Microsoft Office in analyzing SAP SoD.
ISACA Journal Article

Synthesizing SAS 70 Audits and PMI’s Project Management Process Groups

All projects at some point will come under fire, and in an uncertain economy, increased pressures to derive optimal value emphasize the need to deliver project success.
ISACA Journal Article

IT Audits of Cloud and SaaS

Auditing cloud computing in one sense is like auditing any new IT—understand the IT, identify the risks, evaluate mitigating controls and audit the risky objects.
ISACA Journal Article

Business Skills for the IT Audit and Assurance Professional

IT audit and assurance professionals bring valuable skills to audit, assurance and advisory assignments providing a perspective of technical issues, concerns, problems and solutions.
ISACA Journal Article

Top 10 Security and Privacy Topics for IT Auditors

IT auditors are reviewing their audit scope to ensure that the key risks facing the organization are being addressed. The following 10 topics should be on every IT auditor’s list for 2010-2011.
ISACA Journal Article

Developing an Information Security and Risk Management Strategy

Developing an Information Security and Risk Management (ISRM) strategy is a critical element in the maturation of information security capabilities. Learn more today!
ISACA Journal Article

JOnline: Application Security Using the Role-based Access Control Model

Proper RBAC model implementation provides adequate controls that will minimize the risk of continuous occurrence of security breaches and privacy violations from the inside.
ISACA Journal Article

Availability Risk Assessment—A Quantitative Approach

Increased corporate governance requirements are causing enterprises to examine their internal control structures closely to ensure that controls are in place and operating effectively.
ISACA Journal Article

Criteria and Methodology for GRC Platform Selection

GRC platforms provide a single, federated framework that integrates organizational processes and tools, supporting those processes for the purpose of defining, maintaining and monitoring GRC.
ISACA Journal Article

Environment JOnline: Service Integration in a Multivendor Outsourced IT Environment

The combination of the guardian role and the CSPs applies the principle of having a single point of accountability for any activity, ensuring accountability and responsibility.
ISACA Journal Article

Using Spreadsheets and Benford’s Law to Test Accounting Data

Accounting systems are popular targets of financial frauds because, in the words of bank-robber Willie Sutton, “that’s where the money is.”

ISACA Journal Article

Performing a Security Risk Assessment

The enterprise risk assessment methodology has become an established approach to identifying and managing systemic risk for an organization.

Risk Article

The Risky Business of Bots

There are numerous use cases across enterprises where the deployment of bots has resulted in improved efficiency and reduced costs.

8 November 2022
Podcast

Foco de la industria - Arnulfo Espinosa Dominguez, Parte II

El vicepresidente del Capítulo Monterrey de ISACA y Director de Auditoría y Fraude de TI de uno de los Grupos Financieros más grandes de México, Arnulfo Espinosa Domínguez, se une a Jocelyn Alcantar de ISACA para compartir muchas cosas que ha aprendido durante sus 20 años de experiencia profesional en la industria.

23 September 2022
Podcast

Foco de la industria - Arnulfo Espinosa Dominguez, Parte I

El vicepresidente del Capítulo Monterrey de ISACA y Director de Auditoría y Fraude de TI de uno de los Grupos Financieros más grandes de México, Arnulfo Espinosa Domínguez, se une a Jocelyn Alcantar de ISACA para compartir muchas cosas que ha aprendido durante sus 20 años de experiencia profesional en la industria.

21 September 2022
Security Article

The Impact of People on Today’s Information Security Landscape

There is much written about long lists of cybersecurity problems (most of which practitioners may already be aware) or even potential solutions, so perhaps it is beneficial to take a moment to reflect on how the state of information security has changed over the years.

22 April 2022
Blog Post

Understanding Third-Party Management

Outsourcing IT to a platform as a service (PaaS) is incredibly popular with organizations that want to focus on other essential business processes.

5 October 2021

Embedding Security and Continuity Culture

Even when an organization implements good policies, procedures, security setups and standards accreditations, without an organizationwide, positive information security and business continuity (IS&BC) culture, low effectiveness can be expected.

Author: Samuel Shanthan

Reskilling Internal Audit

So much has changed in 2020 for internal audit teams. The COVID-19 pandemic has forced teams to adopt new ways of working, caused change in the risk profiles of the organizations they serve and, for many, has resulted in pressure on resources that...

Authors: Kevin M. Alvero and Stefanie Sullivan
Language: 日本語
ISACA Journal Article

El rol de riesgos en época de COVID-19, cambiando la forma de trabajo a una versión “agile”

Desde el Lunes 16 de marzo del 2020, Perú viene afrontando una cuarentena obligatoria designada por el Gobierno, a raíz de la pandemia mundial por COVID-19, lo cual ocasionó que se declare “Estado de Emergencia” a nivel nacional.

Author: Pierina Guizado
ISACA Journal Article

Avoid Having to Run Somewhere From Ransomware, Part 2: Top 10 Steps to Stay Protected

Ransomware can be defined as a malware deployed for the specific purpose of denying access to a victim’s systems and/or files until something of value is exchanged. The primary motivating factor for most ransomware attacks is clearly in the name, a ransom. Part 1 of this article series reviewed several prominent examples of the damage caused by recent ransomwares attacks...

Authors: Syed Ishaq and Faizan Mahmood
ISACA Journal Article

Avoid Having to Run Somewhere From Ransomware, Part 1: Understanding Ransomware and the Criminals Who Spread It

An average of 4,000 ransomware incidents occur daily in the United States at an annual cost of US$1 billion. The number of ransomware attacks more than doubled in 2019, with the average payment per incident coming in at US$41,198 (up from US$6,733 in 2018). Insurance companies are forecasting...

Authors: Syed Ishaq and Faizan Mahmood

Article Sources

ISACA is the thought leader on security, risk, governance, privacy and audit. We've created these offerings below to get you the information you need.

Illustration of a blog post
ISACA Now Blog
Illustration of microphone and sound wave
Podcasts
@ISACA Newsletter
@ISACA
hand on a tablet - Industry News
Industry News
ISACA Journal
ISACA Journal