Domain:

More Filters
Card List
Blog Post

Three Key Predictions for 2023: The Year of Risk

The rise in importance of internal risk assessments is among the key trends that could shape the risk landscape in 2023.

9 December 2022
Blog Post

The New, Emergent CISO

The CISOs of the future will have to combine a wide range of technical and business skills to rise to the many challenges they will face.

30 December 2022
Blog Post

The Main Challenges of Effective Risk Management

Risk management can be a tremendous asset for organizations when the right processes and methodologies are applied to overcome key challenges.

28 December 2022
Blog Post

Addressing Selective Compatibility

Today's methods of authentication are likely to become less reliable going forward, making selective compatibility all the more relevant.

22 December 2022
Blog Post

Top Cyberattacks of 2022: Lessons Learned

Major 2022 data breaches involving Optus, Uber and Neopets led to many lessons learned for security practitioners and business leaders.

21 December 2022
Blog Post

The Future of Skills: Preparing for Industry 4.0 and Beyond

Industry 4.0 brings great potential to transform the IT professional landscape.

16 December 2022
Blog Post

Quantifying the Qualitative Risk Assessment: Using Data to Inform Judgment

The technology field is ripe for quantification support for qualitative judgments.

15 December 2022
Blog Post

All systems are GO!

Enterprises need to shift their mindset from 'cyber incident' to 'crisis management,' especially in an era when ransomware and other threats are present dangers.

14 December 2022
Blog Post

Talent Transformation Strategies for Security Leaders to Address the Cybersecurity Workforce Challenges

Investing in a strong security culture and adopting a growth mindset are among the approaches that can help organizations transform their strategy for dealing with cybersecurity talent shortages.

12 December 2022
Blog Post

Five Actionable Success Tips for Risk Professionals in 2023

What organizational risks should risk management professionals be sure to keep in mind as we head toward 2023? Kerris Lee provides tips for the new year for risk practitioners.

8 December 2022
Blog Post

Five Actionable Success Tips for Privacy Professionals in 2023

More and more organizations are realizing that privacy programs must be appropriately prioritized and resourced, a reality that will only become more striking in 2023.

7 December 2022
Blog Post

Five Actionable Success Tips for Security Professionals in 2023

Creating a personal incident response plan is a good place to start when security professionals consider how they can thrive in 2023.

6 December 2022
Blog Post

Five Actionable Success Tips for Audit Professionals in 2023

Looking toward 2023, IT audit professionals will need to increasingly focus on cloud environments and privacy engineering to keep pace with the changing technology and regulatory environment.

5 December 2022
Blog Post

Dialing in the Data

Building cyber resilience can be an uphill battle for many organizations given the proliferation of data and the fast-evolving threat landscape.

2 December 2022
Blog Post

Achieving Resilience at ASEAN-Japan’s Cybersecurity Capacity Building Centre

Much can be learned from the way the ASEAN-Japan’s Cybersecurity Capacity Building Centre deployed several procedures to reduce the COVID-19 pandemic’s effects on operations.

1 December 2022
Blog Post

Identity and Access Management: The Nonhuman View

As digital transformation sweeps across organizations, the technologies that are the foundation of that transformation need access.

30 November 2022
Blog Post

Which Cybersecurity Roles Pay the Best?

Cybersecurity talent remains highly in-demand, leading to several roles that command high salaries.

29 November 2022
Blog Post

Five Mistakes to Avoid When Preparing for a Certification Exam

Avoiding some common mistakes can make for a more successful certification exam experience.

28 November 2022
Blog Post

What Do the ISO 27001 Updates Mean for Your Business?

"After nine years of certifications, ISO has released an updated version for one of the most popular frameworks in the cybersecurity environment."

23 November 2022
Blog Post

Digital Native Organizations Are Energizing Organizational Design

Digital native organizations are ahead of the curve when it comes to enabling digital transformation and modernization.

22 November 2022
Blog Post

5G Privacy Implications

Enterprises must consider the risk of 5G adoption on the front end and be proactive about working through potential privacy and security implications.

21 November 2022
Blog Post

How Knowledge Workers Can Convince Employers to Sponsor IT Certifications and Professional Growth

Employers can support their employees' professional development by sponsoring their professional certifications and providing ongoing training resources.

18 November 2022
Blog Post

Applying Enterprise Risk Management to Cyberrisk

The rise of ransomware has increased the stakes for enterprise risk management and cyber risk.

16 November 2022
Blog Post

‘Putting Out Fires’ and Maturing Your Privacy Compliance Program

As privacy regulations continue to take effect, enterprises must mature their privacy compliance programs.

15 November 2022
Blog Post

Audit Essentials for Driving Efficiency and Value

Each audit has a lifecycle, from planning to execution to conclusion, and each phase in the audit lifecycle requires multiple steps to be executed effectively.

14 November 2022
Blog Post

The Impact of a Hybrid Workplace on Security

Although the shift to the hybrid workplace has been a sea change for IT and security teams, new advances in security concepts and solutions hold the potential to smooth out the transition.

9 November 2022
Blog Post

Solving Security and Privacy Concerns in Emerging Technology

Personal data are more exposed than ever in the evolving emerging technology landscape but are often insufficiently protected from being stolen.

7 November 2022
Blog Post

Seven Key Steps to Build Digital Trust

The path to stronger digital trust includes key steps such as understanding customer expectations and going beyond checking boxes.

4 November 2022
Blog Post

Five Quick Tips for Taking ISACA Certification Exams

ISACA certification-holders share their tips and guidance for success on ISACA certification exams.

3 November 2022
Blog Post

A Pilot’s Lofty Goal of Building Trust Through Audit

ISACA member Osama Abbas is a champion for digital trust in his role as head of audit while finding time for his aviation passion in his free time.

2 November 2022
Blog Post

Keep Your Dream of Becoming a CISA Alive

Candidates who struggle on their first try to pass the CISA certification exam can still reach their goal with perseverance and some tweaks to their preparation.

1 November 2022
Blog Post

How to Safely Share Your Business’s Online Videos

Finding the right balance between security and convenience is key for businesses when it comes to sharing their videos online.

28 October 2022
Blog Post

Finding or Building the Right Framework for Your Organization

Organizations face a challenge in understanding which framework will deliver the most value in an era of increased regulatory and business challenges.

27 October 2022
Blog Post

Cyber Ratings as Measures of Digital Trust

As the profession of cybersecurity continues to mature, it inevitably will borrow from other disciplines that have developed mature practices. The credit rating profession has much to offer cybersecurity as it attempts to support the overarching need for the creation of digital trust.

26 October 2022
Blog Post

Smarter Testing Equals Safer Digital Experiences

Tighter alignment of testing with the software development lifecycle and better modeling of real-world adversary threats has allowed Adobe to become more DevSecOps-minded in its application security testing.

25 October 2022
Blog Post

Risk Appetite vs. Risk Tolerance: What is the Difference?

By demystifying the risk appetite and risk tolerance terms, it is easier to explain and integrate these concepts within enterprise risk management frameworks.

4 October 2022
Blog Post

How Risk Transformation Enables Enterprise Success

Risk expert Luma Badran recently led an ISACA Engage community discussion of topics including risk transformation, best practices for the three lines of defense, internal audit, operational risk management and cybersecurity insurance.

21 October 2022
Blog Post

‘Privacy Is Not Dead, But It Is Dying’

Menny Barzilay will be a keynote speaker for ISACA Conference Asia 2022, to take place virtually 16-17 November, presenting on “The Dark Future of Privacy.” Barzilay, an internationally recognized cybersecurity expert and CTO of the Interdisciplinary Cyber Research Center at Tel-Aviv University, recently visited with ISACA Now to discuss privacy mining, deep fakes, digital trust and more.

20 October 2022
Blog Post

Exploring the Relationship Between IT Certifications and Salaries

Certifications can have a big impact on IT professionals' salaries and career advancement opportunities.

19 October 2022
Blog Post

Cloud Governance and Security Imperatives

Organizations that can strike a balance between their strategic objectives and security needs will be well equipped for success in their cloud implementations.

18 October 2022
Blog Post

The Cybersecurity Skills Gap: Dispelling Misconceptions

The workforce challenge organizations often perceive as a cybersecurity skills gap is more accurately a failure to take advantage of the people and resources that should be better utilized.

17 October 2022
Blog Post

What is the ROI from Enterprise Training?

The return on investment from enterprise training extends well beyond the financial to areas such as mitigating risk and helping organizations become more agile and resilient.

14 October 2022
Blog Post

A COBIT 2019 Use Case: Financial Institutions in Georgia

The COBIT framework has some key applications in the financial sector as demonstrated by a recent use case in Georgia.

12 October 2022
Blog Post

How to Transition from General IT to Cybersecurity

For IT professionals looking to transition to a cybersecurity career, there are several promising pathways to position themselves for success in cybersecurity.

11 October 2022
Blog Post

Securing Patient Data Is Paramount in the Post-Pandemic Era

Securing patient data and complying with HIPAA laws may seem like a challenge, but there are several steps your organization can take to combat a cyber incident.

10 October 2022
Blog Post

The Social and Psychological Consequences of Ransomware Attacks

Organizations focus on the financial loss and disruption to services caused by ransomware attacks, but there are significant social and psychological effects that are often overlooked.

7 October 2022
Blog Post

How To Apply Process Mapping Synergy Gains for Business Continuity and Disaster Recovery

Process mapping from disaster recovery and business continuity planning can help improve enterprises' overall business resiliency.

6 October 2022
Blog Post

Navigating Privacy and Compliance Post-Dobbs Ruling

A variety of healthcare, data privacy and security issues have emerged since the recent Dobbs ruling that have impacted and will continue to impact both businesses and individuals in the United States.

5 October 2022
Blog Post

The Impact of Cybersecurity on Consumer Behavior

New ISACA data on consumer attitudes about cybersecurity reveal there is much work to be done for enterprises to earn the trust of customers and stakeholders.

3 October 2022
Blog Post

Five Major Auditing Challenges in Cloud Computing and How to Overcome Them

Top challenges for auditing the cloud start with identifying cloud usage and controlling and monitoring user access.

30 September 2022
Blog Post

Advancing Digital Trust on Capitol Hill, in Parliament and Beyond

ISACA leaders recently have taken their digital trust message to government officials from the UK, Ireland and the United States.

29 September 2022
Blog Post

A CISA Top Scorer’s Tips to Feel Prepared for the CISA Certification Exam

Angelina Kahn-Dubois, the top Certified Information Systems Auditor (CISA) certification exam scorer for 2021, offers tips for success on the CISA exam.

28 September 2022
Blog Post

‘Piecemeal Approach’ Insufficient to Create Digital Trust

Matt Chiodi, chief trust officer at Cerby and a member of ISACA's Digital Trust Advisory Council, and Karen Heslop, ISACA's vice president of content development, provide their perspectives on ISACA's State of Digital Trust 2022 report.

27 September 2022
Blog Post

The Importance of Organizational Resilience in an Age of Immense Change

Organizational resilience has become increasingly top-of-mind for enterprises in the era of The Great Resignation.

26 September 2022
Blog Post

Audit Approaches for Enterprise Databases

Ensuring enterprises can achieve their business objectives without concerns about sensitive data security is a value-add proposition for internal audit departments looking to perpetuate their role as trusted advisors to executive management.

23 September 2022
Blog Post

Deadly Cybersecurity Sins of Organizational Culture

Organizational leaders can stay one step ahead of damaging cybersecurity culture by being aware of organizational cybersecurity sins and using effective awareness programs to blunt the damaging aspects of prevailing culture.

22 September 2022
Blog Post

Five Key Takeaways from ISACA’s State of Digital Trust 2022 Report

Key takeaways from ISACA's State of Digital Trust report show how organizations must prioritize, measure and collaborate to make strengthening digital trust a reality.

20 September 2022
Blog Post

Giving Data Integrity Its Place on the Podium

Data integrity, one of the key technology risk factors identified in recent IT audit research conducted jointly by ISACA and Protiviti, is crucial to the decisions that enterprises make in the course of routine business.

19 September 2022
Blog Post

How MDDAP Improves Product Quality

By helping medical device manufacturers better understand and sharpen their capabilities, ISACA’s Medical Device Discovery Appraisal Program (MDDAP) is advancing device quality and patient outcomes by driving toward a culture of continuous improvement.

16 September 2022
Blog Post

Digital Trust: The Key to Successful Transformation

Today’s digital economy is driven by innovation. The companies that are able to find new ways to serve their customers, often enabled by implementation of emerging technologies, are the ones best positioned to thrive.

15 September 2022
Blog Post

How To Communicate Risk in a Way Leadership Can Understand

The key to effectively communicating risk is aligning risks to the company's business objectives.

13 September 2022
Blog Post

How Secure is Your Data? A New Way of Looking at Data Privacy Compliance

Recent data privacy compliance regulations, along with existing ones, present a whole new dimension in the world of regulatory compliance requirements for banks/financial services across the globe.

12 September 2022
Blog Post

The Customer’s Responsibility in the Cloud Shared Responsibility Model

The cloud shared responsibility model model can help relieve customers’ operational burdens as the cloud service provider operates, manages and controls the host operating system, infrastructure components and actual physical security of the facilities.

9 September 2022
Blog Post

Privacy: A Key Component of Building Digital Trust

The key relationship between privacy and advancing digital trust was explored in a recent ISACA Live episode with Safia Kazi and Betsie Estes.

7 September 2022
Blog Post

AI Ethics and eXplainable AI (XAI): Much Easier Said Than Done

More artificial intelligence (AI) proponents are proposing that integrating ethics with AI will result in better customer engagement with the technology

6 September 2022
Blog Post

A Fan of Diverse Experiences

ISACA member Varun Prasad works with tech companies of varying sizes to help build digital trust by addressing the security and privacy compliance requirements of customers and other stakeholders.

2 September 2022
Blog Post

Cloud Computing — What IT Auditors Should Really Know

Given the growing reliance on cloud computing, internal audit should adopt a proactive approach to cloud initiatives and position the department as a trusted advisor.

31 August 2022
Blog Post

ISACA Kenya Chapter to Support Vulnerable Children in CommunITy Day 2022

ISACA's annual CommunITy Day of global volunteering is coming up on 1 October, with chapters around the world preparing to make their impact at the local level.

30 August 2022
Blog Post

IT Audit Field Provides ‘So Many Options’ for Early-Career Professionals

Jeff Burke shares his experience as a new IT auditor and describes why IT audit is a promising career path for rising professionals.

29 August 2022
Blog Post

Mapping a Serial Rug Pull Scammer on Binance Smart Chain

Rug pull events can be detected and analyzed using publicly accessible blockchain explorers, online analytical tools and data repositories.

26 August 2022
Blog Post

Shifting the Paradigm to Protect Your Data

ISACA's new white paper, "Defending Data Smartly," goes beyond solutions for protecting your organization’s data, also exploring challenges across information technology, compliance, privacy and governance.

25 August 2022
Blog Post

International Standards: ISACA Update on ISO Governance and Management Standards Initiatives

ISACA recently participated in meetings to review and update several ISO governance and management standards.

24 August 2022
Blog Post

Breaking Into the IT Industry: IT Degree and Certification

Earning IT certifications can make a big difference in both salary and job opportunities for early-career professionals, and can also serve as a strong complement to IT degree programs.

23 August 2022
Blog Post

Ethical Artificial Intelligence and Machine Learning By Design: A New Standard to Doing Business

Several foundational steps can be taken for organizations by adopting an ethical artificial intelligence and machine learning lifecycle to move toward standardizing ethical technology implementations.

22 August 2022
Blog Post

Approach to Auditing a Core Banking System

Auditing core banking systems successfully requires due diligence on a wide range of control tests.

19 August 2022
Blog Post

A Five-Step Process to Help Organizations Achieve Operational Resilience

Operational resilience is far more than having business continuity planning in place and conducting disaster recovery drills; it requires strategic decision-making when planning, identifying, defining, working, testing, monitoring and re-defining multiple parameters.

18 August 2022
Blog Post

Title Bias – The New Form of Bigotry in The Workplace

Title bias occurs when someone treats another person differently because they don’t hold a specific title or position in an organization, and it can badly damage workplace culture.

17 August 2022
Blog Post

Burned Out: InfoSec Professionals Sound the Alarm

According to a recent survey, almost a third of infosec professionals want to quit the cybersecurity profession due to burnout within the next 12 months. Can we save our industry from a mass resignation before it’s too late?

15 August 2022
Blog Post

Creating, Not Predicting, the Future

ISACA Europe Conference keynote speaker Stefan Hyttfors visited with ISACA Now to discuss some of his favorite themes—the future, emerging technology and trends in globalization and sustainability.

12 August 2022
Blog Post

My CISM Exam Journey

Laura Tate Zannucci shares her experience preparing for the CISM certification exam, including tips and guidance on what proved to be successful tactics.

11 August 2022
Blog Post

Advancing Technology as a Human Right

Code Your Dreams was recognized with the ISACA Technology for Humanity Award for leadership in empowering the next generation of civic-minded technologists.

10 August 2022
Blog Post

My Path to a Career in Cybersecurity

Dr. Joseph J. Burt-Miller Jr. says experience, certifications and degrees form the "cyber triangle" to spark career growth in the cybersecurity field.

9 August 2022
Blog Post

Auditors in a ‘Perfect Position’ to Further Digital Trust

IT auditors are an important part of the digital trust equation since they are able to give organizations confidence in the processes and business relationships that they have in place.

8 August 2022
Blog Post

Eight Steps to Manage the Third-Party Lifecycle

Managing third parties is a relationship that must be managed throughout the third-party management lifecycle, from identification and screening to offboarding.

5 August 2022
Blog Post

Advancing Digital Trust Through Collaboration

To address the biggest challenges in the technology field, Priya Mouli, Director at PwC’s Cybersecurity Consulting practice yhinks there needs to be more collaboration and cooperation among the public and private sectors and groups globally.

4 August 2022
Blog Post

Sharpen Your Machine Identity Management

New technologies are regularly implemented into IT infrastructure in this era of digital transformation, placing increased importance on sound machine identity management (MIM).

3 August 2022
Blog Post

How Much Trust Should You Give Digital Identity Identification?

Digital identity is a necessity. It should be simple and accurate as well as easily eliminable. Users should be able to expect control over the dissemination of their personal data.

2 August 2022
Blog Post

How to Build a Data Science Team Within the Internal Audit Function

Data science is a growing and evolving force in different functional areas of business, and the internal audit function is no exception.

1 August 2022
Blog Post

Building Our Security Coordination Center (SCC) Hunting Program

When many companies think about network security, they usually think in terms of firewalls, anti-virus software, intrusion detection systems, and multi-factor authentication (MFA).

29 July 2022
Blog Post

Supply Chain Security: Where Do We Go from Here?

ISACA risk expert Paul Phillips and CEO of Risk Factor Richard Hollis discussed key challenges influencing supply chain security in an episode of ISACA Live last week. Their conversation was supported by insights from ISACA’s recent survey, Supply Chain Security Gaps: A 2022 Global Research Report.

28 July 2022
Blog Post

Data Resilience Is the Cornerstone of Digital Resilience

Digital resilience is the outcome of organizational action taken to rapidly deploy or modify digital technologies to address the negative impact of shocks—such as the pandemic—in the interests of maintaining organizational sustainability.

27 July 2022
Blog Post

Changes Needed to US Federal Privacy Proposal for Effective Implementation

My Privacy & Security Brainiacs team has been tracking US federal bills proposed by Congress that mention privacy in some way.

26 July 2022
Blog Post

Addressing Security Risks to Medical IoT Devices

The Internet of Things (IoT) enables millions of smart devices worldwide that are connected to the internet to collect, process and share data.

25 July 2022
Blog Post

Mea Clift: ‘A Force of Nature’

ISACA member Mea Clift advances digital trust in her work but also makes time for some old-fashioned personal pursuits.

22 July 2022
Blog Post

Know Your Risks – and Your Friends’ Risks, Too

In today’s globally connected world, organizations are finding themselves at a greater risk than ever of a supply chain compromise.

21 July 2022
Blog Post

Purple Teaming: The Next Gen Pen Test

It’s pen test time again. Time to get updated quotes from vendors and put something on the schedule ahead of the compliance deadline, but will this year’s results be any different than last time?

20 July 2022
Blog Post

Persevering Through a Seismic Industry Shift

Eventcombo was recognized this year with the ISACA Innovative Solutions Award “for enabling community connections and continuing education virtually during a global pandemic through innovative EventTech solutions.”

18 July 2022
Blog Post

What Can Internal Auditors Do to Increase Cybersecurity Audit Effectiveness?

Cybersecurity has topped the list of critical risk for organizations for the fifth time in both the European Confederation of Institutes of Internal Auditing’s (ECIIA’s) 2022 Risk in Focus report and the Institute of Internal Auditor’s (IIA’s) OnRisk 2022 report.

15 July 2022
Blog Post

Why You Can’t Afford to be Reactive About Cybersecurity and Compliance

There has been a very clear change in awareness and overall attitude toward cybersecurity and compliance in recent years.

14 July 2022
Blog Post

Characterizing System Security Engineering Using a Business Impact Analysis

As adversaries continuously seek to disrupt, cause harm and wreak havoc on complex digital assets, enterprises must strategically plan, design and build secure, trusted systems.

13 July 2022
Blog Post

Cyber Incident Reporting: From Guidance to Enforcement

Imagine a day when the stock markets suddenly begin to crash, contrary to market movements, and your equity holding nosedives from a healthy green to an alarm bells-blaring red.

12 July 2022
Blog Post

Digital IT Forensics Evolution Through Digital Transformation

According to the National Institute of Standards and Technology, “Digital forensics is the field of forensic science that is concerned with retrieving, storing, and analyzing electronic data that can be useful in criminal investigations. This includes information from computers, hard drives, mobile phones, and other data storage devices.”

11 July 2022
Blog Post

Cybersecurity Workforce Advancement

Cybersecurity education and training is important in the cybersecurity workforce and provides students and recent graduates with information on how to find what path to take. Paths include formal education from universities and institutions that provide programs to better equip the student who desires to be a cybersecurity professional (e.g., bachelor’s, master’s and doctoral degrees) and cybersecurity training such as boot camps, certifications preps and certificate programs.

8 July 2022
Blog Post

AI and Digital Ethics: ‘There Could Not Be More Overlap’

Véliz recently visited with ISACA Now to share her perspectives on AI, digital ethics and more.

7 July 2022
Blog Post

Quantum Computing and the Role of Internal Audit

Quantum computing is a very exciting discipline formed by the combination of computer science, physics and mathematics, which uses some of the mysterious aspects of quantum mechanics to enable unprecedented computational performances.

6 July 2022
Blog Post

Ensuring You Have the Right Governance in Place for Physical and Environmental Controls

Physical and environmental controls are more than gates, guards, generators and HVAC monitoring. Getting physical and environmental controls right is a big step forward in reducing your enterprise’s risk and protecting critical assets in an unpredictable world. So how do you determine that you have the proper controls and governance oversight in place?

5 July 2022
Blog Post

Arts vs. Sciences in IT: How UX Design Can Bridge the Gap

As professionals in IT-related fields, our jobs can seem very explicit: Binary 1s and 0s and Boolean true or false is baked into much of what we do. There are exceptions of course, but often there is a right answer or a wrong answer, and little space in between.

30 June 2022
Blog Post

MDDAP Helps Achieve Fast, Sustainable Solutions for Medical Device Quality

MDDAP’s successful development is due in part to the Case for Quality (CfQ) being launched from FDA’s own research with a wide variety of stakeholders, which revealed a problem in the industry: compliant manufacturers were still having similar types and frequency of issues as non-compliant manufacturers. While compliance was important, it alone wasn’t going to drive the desired quality outcomes.

29 June 2022
Blog Post

ISACA Member’s Impact in Nigeria Recognized on the Global Stage

Kashifu Inuwa Abdullahi, Chief Information Technology Officer, National Information Technology Development Agency in Nigeria, was recognized this year with the ISACA Inspirational Leadership Award “for leadership in bridging the digital divide by providing computers and other IT infrastructure to rural areas and schools and for providing virtual libraries.”

28 June 2022
Blog Post

How the Right Help Desk Processes Can Strengthen Security

The IT help desk might seem like a simple portal for helping end users manage their issues. But in reality, it represents one of the first (and best) filters for identifying potential cybersecurity problems that may arise.

27 June 2022
Blog Post

Next-Generation CISO: Business, Technical or Mix of Both?

Before we get to the answer to the question posed in the title, let’s look at the typical job responsibilities of a CISO.

23 June 2022
Blog Post

Lessons in Change and Leadership from ‘The UnLearning Lady’

Zanele Njapha recently visited with ISACA Now to discuss her quirky nickname, her views on entrepreneurship and organizational change, and more.

22 June 2022
Blog Post

Reach and Teach: An Effective Way to Market and Advertise Cybersecurity Services

Now is the time for cybersecurity professionals to get in front with their message.

21 June 2022
Blog Post

Introducing the Principle of Need to Have Available

The principle of need to have available can be summarized as having only the permissions you need for your next set of tasks.

21 June 2022
Blog Post

The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce

While much has been said and written about the difficult cybersecurity skills and hiring landscape, one key characteristic that is typically overlooked in cybersecurity professionals is empathy.

17 June 2022
Blog Post

Foundational Understanding of Databases Boosts Auditors’ Value

With all the areas under an IT auditor’s purview, it is challenging, perhaps impossible, to be as proficient as we would like to be in all areas.

16 June 2022
Blog Post

Perimeter-less Security

“Never trust, always verify” have been the buzzwords ever since the term “zero trust” was coined. According to Pulse, 87% of decision-makers believe that zero trust security strategy will simplify their organization’s security architecture.

15 June 2022
Blog Post

Reaching Objectives and Enabling Success: How CMMI Creates Habit Persistence

During ISACA Conference North America 2022, ISACA launched a new initiative focusing on the pursuit of digital trust, which means that this topic was present in several discussions throughout the conference.

14 June 2022
Blog Post

Making Continuous Controls Monitoring Work for Everyone

As a security assurance professional, you know the importance of controls testing. After all, only organizations that thoroughly test and prove their controls’ effectiveness can be confident that they’ve sufficiently mitigated their security and data privacy risks.

13 June 2022
Blog Post

Customs Goes Digital: Exploring the Latest Trends

It’s been amazing to watch how almost every aspect of global life has been digitized in some shape or form over the past several years – and customs is no different. The question is, which aspects are changing? And is it for the better?

10 June 2022
Blog Post

The Great Resignation & Employee Retention in Digital Trust Professions: Closing Critical Workforce Gaps

ISACA Conference North America 2022 last month featured the launch of ISACA’s new initiative focusing on the pursuit of digital trust, which was a recurring theme throughout many of the event’s presentations.

8 June 2022
Blog Post

Give Your IT Risk Program a Jump-start

I’m constantly fielding questions about how to start building a modern-day IT risk management program, and a quick Google search reveals that there are many differing opinions on the best approach.

7 June 2022
Blog Post

Supply Chain Risk Management: Where Do We Start?

Mea Clift examines how to climb the mountain of evaluating vendors to ensure they're meeting security standards.

6 June 2022
Blog Post

Demystifying China’s Personal Information Protection Law: PIPL vs. GDPR

On 20 August 2021, the National People’s Congress (NPC) passed the final version of the Personal Information Protection Law of the People’s Republic of China (PIPL), a comprehensive privacy law that covers multiple facets of personal information protection.

3 June 2022
Blog Post

How Best to Protect Your Assets

How do you typically protect a special or expensive piece of jewelry? You may keep it in a bank locker or in an electronic safe in your home.

1 June 2022
Blog Post

In a World of Technology, ISACA Makes the Difference

At the beginning of this year, ISACA took on a bold new vision for the future: Be the standard-maker for digital trust everywhere.

1 June 2022
Blog Post

The Governance, Assurance and Automation that Financial Services Organizations Need

In response to the recent Russian invasion of Ukraine, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a set of expansive economic measures designed to incapacitate the Russian financial system.

31 May 2022
Blog Post

The Future of Audit in the World of Interconnected Business

The COVID-19 pandemic had changed many things; one among them is the perception of the audit process as business processes have become more interconnected and interdependent.

27 May 2022
Blog Post

Five Cybersecurity Memes and What They Say About Cybersecurity Today

Cybersecurity memes on social media are often good for a laugh, but several of the more popular ones have gained resonance with security professionals for a reason...

26 May 2022
Blog Post

Separating Fact from Fiction: Debunking Myths Around CMMC 2.0

With more than 220,000 companies supporting the US Department of Defense, the defense industrial base presents an enticing target for hackers, nation-states, and cybercriminals.

25 May 2022
Blog Post

Cybersecurity and Consumers

As a cybersecurity leader and scientist, I find it interesting that as I observe events all around me that all are seemingly unconnected, they are in fact connected, at times with exciting and favorable outcomes.

24 May 2022
Blog Post

Combining the Risk Register and the Maturity Model to Increase Total Value

Communicating the results of business controls to top management is never an easy process, especially if we want to ensure concrete information based on risk and effectiveness of controls is communicated. Generally, risk and controls rely on different methodologies; this is not ideal. Instead, we need flexible methodologies, collaboration between business processes and adequate tools.

23 May 2022
Blog Post

Digital Trust Requires All Hands on Deck – But the Payoff Is Big

The fields in which ISACA’s professional community works – such as audit, risk, security, privacy and governance – feed into the more encompassing realm of digital trust.

20 May 2022
Blog Post

COVID-19: An Ignitor in Information Risk Management

This makes one think about risk subconsciously as we are uncertain about when pandemics will happen as well as how we should be prepared to contain and reduce their impact.

18 May 2022
Blog Post

The Great Wall of IT

Over time, the IT discipline has developed two giant silos: development and operations regimes. While the development team focuses on building software, introducing changes and fulfilling both internal and external customers' demands, the operations team focuses on stability, reliability and system performance.

17 May 2022
Blog Post

Three Reasons Your Third-Party Management Program is Struggling

Building trust throughout an organization requires working collaboratively across lines of the business and gaining interdepartmental, cross-functional visibility.

16 May 2022
Blog Post

Understanding the Full Digital Trust Ecosystem

A Google search of “digital trust” turns up 5.73 billion results, and hundreds of recent trade press articles have covered the topic.

13 May 2022
Blog Post

The Needed Societal Response to Cybersecurity Risk in the COVID Era

COVID-19 has transformed how business is conducted with the acceleration of cloud adoption and remote working. Organizations’ data is no longer kept within the perimeter of the office’s or data center’s boundary.

11 May 2022
Blog Post

Award Winner Weaves ISACA Into Academic Curriculum

Andre Pitkowski recently visited with ISACA Now for a Q&A interview, reflecting on his award. The following is a transcript of the interview.

10 May 2022
Blog Post

Zero Trust Does Not Imply Zero Perimeter

Typically, when we hear “zero trust” these days, folks generally hear the common example of remote employees not having to VPN (Virtual Private Network) back to their enterprise network to access the cloud resource.

9 May 2022
Blog Post

Should Information Systems Audit Evolve to Information Systems Continuous Monitoring?

Nothing in this world is static. Everything evolves, and improvements often happen when things evolve.

6 May 2022
Blog Post

2021 Annual Report Spotlights ‘Inspiring Work’ of ISACA Community

Through new learning and credentialing opportunities, enterprise resources and its ever-growing global community, ISACA was in pursuit of digital trust throughout 2021 on multiple fronts.

5 May 2022
Blog Post

Building a More Trustworthy Digital World

Technology is truly driving global innovation and the world economy.

3 May 2022
Blog Post

In 50 Years, the ISACA Journal Has Had and Seen it All

Congratulations to the ISACA® Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA® members, their organizations, the IT governance community and society at large.

3 May 2022
Blog Post

Practical Advice for Agile Audit

Agile audit is in right now, and it looks like even the people who were doing everything agile opposes are now ardent supporters and push for going agile.

2 May 2022
Blog Post

Failure to Patch and the Rare Case of the Java Crypto Hack

One of the often-accepted truisms in cybersecurity is to ensure that all systems supporting and protecting business operations are up-to-date and current.

29 April 2022
Blog Post

Living off the Land (LotL) Classifier Open-Source Project

In security, “Living off the Land” (LotL or LOTL)-type attacks are not new. Bad actors have been using legitimate software and functions to target systems and carry out malicious attacks for many years.

28 April 2022
Blog Post

Twenty Ways Information Security Has Become More Challenging in the Past 20 Years

To mark the anniversary of ISACA’s Certified Information Security Manager (CISM) we spoke with 20 CISM-holders to collect their commentary on the biggest challenges that have emerged in infosec since CISM came on the scene in 2002.

27 April 2022
Blog Post

Twenty Ways Information Security Has Changed for the Better in the Past 20 Years

ISACA’s Certified Information Security Manager (CISM) certification is now in its 20th year and to mark the anniversary, we spoke with 20 CISM-holders to collect their commentary on what has changed for the better.

26 April 2022
Blog Post

How CISOs Can Score Some Quick Wins

Brian Fletcher, recently visited with ISACA Now to discuss how chief information security officers (CISOs) can start off by achieving some quick wins for their organizations and how organizational cyber maturity enters the equation.

25 April 2022
Blog Post

Malicious Trends: What You Need to Know

According to the recent Cybersecurity Ventures 2022 “Cybersecurity Almanac,” organizations will spend approximately US$1.75 trillion on cybersecurity between 2021 and 2025.

22 April 2022
Blog Post

Supply Chain Security: Analysis of the Georgian Ecosystem

According to the European Union Agency for Cyber Security (ENISA): “In cybersecurity, the supply chain involves a wide range of resources (hardware and software), storage (cloud or local), distribution mechanisms (web applications, online stores), and management software.

21 April 2022
Blog Post

Proven Methodologies to Fight Ransomware

Though the topic of ransom and ransomware is extremely popular, a lot of discussions center around a few topics: prevention, insurance and recovery.

19 April 2022
Blog Post

Saluting Our Global Volunteers

When ISACA certification candidates take an exam, the content of that exam was created and reviewed by ISACA volunteers.

18 April 2022
Blog Post

Celebrating Women in Cybersecurity

Joanna Karczewska, a longtime ISACA member from Poland, recently visited with ISACA Now to discuss the book and her views on progress made by women in the cybersecurity field. The following is a transcript of the interview:

15 April 2022
Blog Post

The Evolution of GRC

Back in the day, manual processes were dominant, with telex and fax being the most common mode of communication. As a result, risk governance was also focused on these ways of business processing.

14 April 2022
Blog Post

The Trans-Atlantic Data Privacy Framework: A Significant Step Toward Reinforcing Transatlantic Cooperation, Setting a New Standard for Personal Data Protection

Global trade has been growing for decades, as most economies accelerated their globalization since the 1990s, using digital technology as a key catalyst that helped industries interconnect further and innovate.

13 April 2022
Blog Post

Level Up Your Governance to Drive Business Growth

When you search for the term “cybersecurity” online, you get approximately 17 billion images of padlocks and shields – but what is this trying to communicate?

12 April 2022
Blog Post

What Business Leaders Need to Know About Cybersecurity Preparedness

Many cybersecurity incidents occur when organizations think they’re doing the right thing.

8 April 2022
Blog Post

The Future of Complex Legacy Enterprise Transformation

The process of manual programming has never been a perfect or exact science, and the resulting defects that occur along the way have long plagued the software development lifecycle and are therefore perpetuated in legacy systems.

7 April 2022
Blog Post

Using SWIFT as a Lesson for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the Society for Worldwide Interbank Financial Telecommunication’s (SWIFT) communication system, were compromised.

6 April 2022
Blog Post

Addressing the Biggest Challenges in Cloud Security

Gartner has predicted that by 2026 the public cloud expenditure will exceed 45 percent of all enterprise IT.

5 April 2022
Blog Post

ISACA Seeks Input to Digital Trust Ecosystem Framework

If you do a Google search for digital trust, you’ll receive over 5.5 billion results; indeed, digital trust is a popular topic these days! Definitions of digital trust, however, vary widely.

4 April 2022
Blog Post

Technology and the Democratization of Opportunity

Silvina Moschini visited with ISACA Now to discuss digital transformation, cloud adoption, corporate social responsibility and more.

1 April 2022
Blog Post

Embracing the Possibilities of the Modern Business Landscape

Isabel Aguilera recently visited with ISACA Now to provide her perspective on technology’s role in shaping today’s business environment.

31 March 2022
Blog Post

The Pandemic Era: A Period of Business Resilience

COVID-19 has markedly impacted the mitigation measures for business continuity and IT disaster recovery adopted by businesses over the last two decades.

30 March 2022
Blog Post

What to Consider When Making the Step to the Cloud

Organizations that decide to take their entire IT landscape, or parts of it, to the cloud need to consider the different factors that need to be prioritized according to their needs.

29 March 2022
Blog Post

Edwards: From a Compliance Mindset to a Performance Mindset

Edwards was an early adopter of the MDDAP program. The company’s Draper, Utah facility completed its first MDDAP appraisal in 2017 as part of the program pilot.

25 March 2022
Blog Post

Using InfoSec Compliance Programs for Proactive IT Risk Management

Proactive IT risk management is crucial to maintain a successful business. This means implementing measures to identify and mitigate potential risks, continuously and reliably, before those risks can cause material (or worse, permanent) damage.

24 March 2022
Blog Post

Aligning Business Objectives and Human Outcomes in Digital Transformation

Kate O’Neill, recently visited with ISACA Now to provide her view of human-centric digital transformation, how data should be integrated into companies’ business models and more.

23 March 2022
Blog Post

Cyber Workforce: Out of the Ashes and Into the Fire

ISACA’s State of Cybersecurity 2022 report was published earlier this week, and it’s not looking too good for us good guys. For the third year in a row, the cybersecurity labor shortage looms large as the main focal point, casting its long, grim shadow across most of the report’s 40-plus pages.

23 March 2022
Blog Post

Essential Tips for Staying Current on Cybersecurity Terminology

Navigating the language of cybersecurity is like trying to win an argument with someone you love. You must be open-minded, kind-hearted and committed.

21 March 2022
Blog Post

Don’t Let Collaboration Tools Become a Red Carpet for Black-Hat Hackers

2020 was a unique year and most of us couldn’t wait to call an end to it for so many reasons, including the increased trends in cyberattacks – some of which targeted collaboration tools such as in the example I noted above.

18 March 2022
Blog Post

How Auditors Fit into the Zero Trust Journey

"Zero Trust” is one of those security buzzwords making the rounds on the inter-webs recently, but what does it mean and why should security or IT audits teams start caring about this term? Traditionally, enterprises concern themselves with forming a layered defensive...

17 March 2022
Blog Post

Evaluating Governance Over DevOps Practices

Auditors and related practitioners are always learning and prepared to pivot as new technologies and modes of software delivery are introduced.

16 March 2022
Blog Post

Improving Cybersecurity Incident Response

Incident response handling procedures could use some improvement. By utilizing and practicing incident response exercises, organizations can put in place a strong and integrated response to incidents of varying types.

15 March 2022
Blog Post

Embedding Digital Trust in Fintech: Seven Practical Steps

There has long been debate about whether innovation and risk management can coexist. For some digital pioneers, risk and compliance are synonymous with being a roadblock to innovation.

11 March 2022
Blog Post

Vulnerability Management: Addressing Your Weaknesses Before They Can Be Exploited

As businesses continue to extend their digital footprints to support remote workers and deliver the products and services customers demand, the risk of a breach grows exponentially.

10 March 2022
Blog Post

Exploring HackTown: A College for Cybercriminals

It’s becoming simpler for wannabe cybercriminals to catch a portion of the billions of dollars lost through fraud happening every year. All you really need is some Bitcoin knowledge, some free tools and no moral qualms taking from others.

9 March 2022
Blog Post

Taking a Clear-Eyed View of the Road Ahead for Women in Security

ISACA member Reshma Devi recently visited with the ISACA Now blog to discuss her mindset about volunteering, her views on progress for women in the security industry and more.

8 March 2022
Blog Post

My New Career Connection Through ISACA Mentorship Program

I have been a member of ISACA for over 10 years, and it has touched my life in many ways. When I first acquired the CISA certification in 2012, an avalanche of job offers followed!

7 March 2022
Blog Post

Good Enterprise Governance Needs CGEIT: My Journey to Pass the Exam

I earned ISACA’s CRISC and CISM certifications in 2019 and 2020, respectively. I always feel a professional obligation to give back to ISACA global community through sharing my lessons learned after passing each exam – hopefully providing practical guidelines will be beneficial to professionals who are preparing to obtain these industry-recognized credentials worldwide.

3 March 2022
Blog Post

Tensions Shine Spotlight on Protecting Critical Infrastructure

Given the tense security environment caused by Russia’s current attacks on Ukraine, threats to critical infrastructure are top-of-mind throughout the cybersecurity community.

2 March 2022
Blog Post

Volatile Times Call for Heightened Cybersecurity Preparedness

The recent attacks on Ukraine are a daunting reminder that today’s battles occur on two fronts: the physical world and the digital one.

28 February 2022
Blog Post

A Lesson for the Cybersecurity Community

With the numerous cyberattacks being reported in the news almost daily, I find it helpful to think of some words of wisdom from my grandfather.

25 February 2022
Blog Post

Getting Creative with Maturity Models and COBIT 2019

Maturity models have become an area of personal interest in my professional practice. Maturity models can act as a common language that serves as a bridge between the business and the IT function.

24 February 2022
Blog Post

Why Collecting the Right Metadata is Crucial for Scaling a Security Program

At Adobe, security is a critical priority for us, and we believe in defense-in-depth, which begins with monitoring — from collecting event logs and configuration data made available by public cloud providers, to logs from EDR systems and vulnerability scanning pipelines.

23 February 2022
Blog Post

Auditing in a Virtual Universe

The Industrial Revolution in the 18th and 19th centuries came with a lot of transformations and innovations that gave rise to the use of machines and fundamentally changed the ways humans live.

22 February 2022
Blog Post

Celebrating Five Decades of the ISACA Journal

The ISACA Journal is more than just a print and digital publication – for 50 years, it has served as a reflection of ISACA’s membership, in the view of Steven Ross.

18 February 2022
Blog Post

Drilling Down on Data Protection and DPO Reporting

Cat Coode, founder of Binary Tattoo and an expert in global privacy regulation compliance, recently participated in a privacy-themed Ask Me Anything thread on ISACA’s Engage platform.

17 February 2022
Blog Post

Addressing US Policy on the Use of Force in Cyberspace

The current US presidential administration is taking action following a wave of ransomware attacks that have targeted US critical infrastructure and organizations such as Colonial Pipeline, Nocona General Hospital and Wiregrass Electric Cooperative.

16 February 2022
Blog Post

How to Navigate the Perfect Storm: Cyberthreats and Skills Shortages

Over the past two years in particular, the importance of cybersecurity has been globally recognized, and sophisticated cyberattacks have made international headlines.

15 February 2022
Blog Post

Individual Behavior, Corporate Action and Sarbanes-Oxley

In recapping the history of the Sarbanes-Oxley Act (SOX) of 2002, discussions often include lists of the corporations whose actions led to enactment of this United States legislation. The terms “corporate scandal” and “corporate fraud” are used.

14 February 2022
Blog Post

A Workplace Sea Change: Sizing Up The Next Normal

The workplace in February 2022 looks drastically different than it did even a year ago and is likely to be reshaped even further in the year to come.

11 February 2022
Blog Post

Many Shades of a Common Problem: Privacy Rights Requests

DSARs, IRRs, Consumer Rights’ Requests, Derechos ARCO – if you broke out into a cold sweat reading any one of those, then this blog post is for you. Privacy requests are complex and burdensome in daily operations today, and only getting more prolific.

10 February 2022
Blog Post

Insights into Environmental, Social and Governance (ESG)

Are we prepared for the Environmental, Social and Governance (ESG) challenge? Organizations are facing heightened expectations from interested parties such as regulators, customers, consumers, investors, community activists and others when it comes to ESG.

8 February 2022
Blog Post

Leveraging Cybermaturity to Right-Size Cybersecurity

We hear the word “cybermaturity” tossed around quite often these days, but what does it mean? Cybermaturity is a state describing the sophistication, or rigor, of one’s cybersecurity capabilities and processes.

8 February 2022
Blog Post

Aggravating Circumstances for an RCE Vulnerability: A Log4j Retrospective and Risk Landscape Evaluation

Information security teams were forced to respond over the holiday as an Apache Log4j zero-day vulnerability was discovered and socialized across the infosec community.

7 February 2022
Blog Post

Understanding the Importance of Effective Board Communication

For any cybersecurity framework to be successful, it is essential that the chief information security officer (CISO) or equivalent figure be able to simply communicate with top management the state of security in the organization, present an improvement plan, justify it with the risk assessed and request the necessary resources.

4 February 2022
Blog Post

Simplify and Contextualize Your Data Classification Efforts

In the CISO Desk Reference Guide, I noted how critical the concept of “context” is to security programs. The same holds true for our organizations and their respective privacy programs.

2 February 2022
Blog Post

Achieving Workforce Diversity in Cybersecurity

In the current global landscape of near daily announcements of cyberattacks, organizations can no longer just sit back and wait for employees to find them; they must be proactive.

1 February 2022
Blog Post

The Weakest Link in the Cybersecurity Chain: Are You Aware of It?

Recently, there was a debate on our audit team regarding the increased amount of cybercrime during the pandemic and the best ways to handle it.

31 January 2022
Blog Post

My Guide to Passing the CISA Exam

Becoming CISA-certified in the first attempt is not an easy task, but it can be passed simply by following a dedicated and structured study plan.

28 January 2022
Blog Post

Plenty of Progress Still Needed on the Privacy Landscape

2021 was an eventful year for privacy with the emergence of new legislation such as the California Consumer Privacy Act, Brazilian General Data Protection Law and China Personal Information Protection Law.

26 January 2022
Blog Post

What Is a Risk Heat Map & How Can It Help Your Risk Management Strategy

In the early 2000s, pharmaceutical company GlaxoSmithKline (GSK) was facing a serious risk: One of its manufacturing plants did not meet the requirements of current good manufacturing practices (CGMP).

25 January 2022
Blog Post

Charting a Course for Digital Trust

As we begin this new year, we’re also in the early stages of executing on a new strategic plan that will shape ISACA’s focus in 2022 and the coming years.

24 January 2022
Blog Post

Enablers That Propelled Our Careers to a Higher Level

Undoubtedly, ISACA is cultivating the next generation of digital trust professionals as it is a one-stop-shop for top-notch industry-recognized credentials, pieces of training that bridge the gaps between what people learn in university and the practical skills required to perform tasks at work.

21 January 2022
Blog Post

Technology Control Automation: Improving Efficiency, Reducing Risk and Strengthening Effectiveness

A principal component of a sound risk management framework, particularly in highly regulated institutions, is an effective control testing program.

19 January 2022
Blog Post

Code of Conduct: An Effective Tool for GDPR Compliance

We are three+ years out from the EU General Data Protection Regulation (GDPR) taking effect. While many organizations are still new to or struggle with GDPR, a more recent milestone could shed light on this development for privacy practitioners and implementors.

18 January 2022
Blog Post

Is Agile Auditing a Sure Thing for Internal Audit?

Operational innovation. Business resilience. Operational disruption, possibly resulting from third-party management issues like suppliers’ solvency, compliance, service/product quality and even suppliers’ behavior (if your enterprise happens to be subject to the UK Bribery Act or similar legislation).

14 January 2022
Blog Post

Maintaining Your Compliance Strategy During (and After) CISO Turnover

Amidst the “Great Resignation,” employees across industries — and experience levels — are reconsidering their relationship with work.

12 January 2022
Blog Post

Foundation in Place for a Promising Year Ahead

Happy New Year, ISACA community! The year ahead holds great promise, but before we turn our attention to all there is to look forward to in 2022, let’s briefly reflect on how we’ve reached this point.

11 January 2022
Blog Post

A Bird’s Eye View of Cyberinsurance Plans

Most cyberattacks launched by hackers result in financial repercussions for the organization and cause disruption of its critical assets and services.

10 January 2021
Blog Post

Online Education From a Security Risk and Controls Perspective

The internet and the subsequent online revolution have led to the digitization of almost every aspect of human life; education is no different.

6 January 2022
Blog Post

Recognizing the Customer’s Responsibility in a Shared Responsibility Model

Every industry, regardless of size, is eager to realize the benefits of the cloud. The cloud providers’ ability to move from a Capital Expenditures (CAPEX) model to Operating Expenses (OPEX) is not all about upfront cost savings, which the cloud platforms offer.

5 January 2022
Blog Post

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

The idea of a risk register used in a practical and effective way is an expectation of the ISACA’s Certified in Risk and Information Systems Control® (CRISC®) certification.

4 January 2022

ISACA Now By Year

Check Mark
2024
Check Mark
2023
Check Mark
2022
Check Mark
2021
Check Mark
2020