The Coalfire Blog

Welcome to the Coalfire Blog, a resource covering the most important issues in IT security and compliance. You'll also find information on Coalfire's insights into the unique cybersecurity issues that impact the industries we serve, including Cloud Service Providers, RetailFinancial Services, Healthcare, Higher Education, Payments, Government, Restaurants, and Utilities.

The Coalfire blog is written by the company's leadership team and our highly-credentialed security assessment experts. We look forward to your comments, so please join the conversation.


  • Detecting and Preventing Compromises in Retail Payment Systems

    January 14, 2014, Mike Weber, Vice President, Coalfire Labs

    Information Week’s Matthew Swartz published an article on the recently- confirmed payment card breaches at Target, Nieman Marcus and three other unnamed  retailers. This article and many others reveal that these attacks involve sophisticated malware and some even suggest it is the work of the same gang.  To be clear, Coalfire and the Coalfire Labs group that I lead are not involved in these investigations. But we do perform security audits and digital forensics investigations for many retailers. And based on that experience, we can confidently say this: all retailers are targets, and many retailers have already been compromised..

    Read more
  • Free and low-cost tools for PCI DSS Compliance

    December 12, 2013, Steven Weil, Senior Security Auditor

    Complying with the PCI DSS requires policies and processes plus implementing and managing a variety of software tools. As a QSA who has performed many PCI assessments for merchants and service providers, I’ve seen and assessed a variety of free and low-cost (under $200) software tools that help our customers comply with PCI DSS.

    Read more
  • A Proven Strategy for Implementing Vendor Management Programs

    December 10, 2013, Andrew Hicks, Managing Principal, Coalfire

    Every regulated industry includes a requirement for managing third-party risk.  Some industries are further along the path and have more mature processes than others.  However, there are tried and true methodologies and standards established by those early movers that we can utilize across other regulated industries.

    Read more
  • What every CIO should know about the new ISO 27001:2013 framework

    November 27, 2013, Karl Steinkamp, Director, PCI Product and Quality Assurance

    Originally released in 2005, the ISO 27001 standard has recently been updated with additional guidelines for assessing risks within information management systems. These changes constitute the first revisions to the standard in eight years and have major implications for organizational compliance. With greater focus on risk ownership and continuous improvement, ISO 27001:2013 will require companies to formulate new risk management processes that incorporate procedures to ensure compliance.  According to CSO magazine’s David Braue, these revisions in ISO 27001:2013 address the complex current security environment and incorporate necessary user feedback.

    Read more
  • The Ponemon Institute 2013 Cost of Cyber Crime Study is out

    November 26, 2013, Rick Dakin, CEO, Co-founder and Chief Security Strategist

    Before anyone else conjures up the image of Steve Martin (in the Jerk) running down the street with the new phone book and declaring the obvious to all around him, let’s put this study in perspective.  There is nothing new or unexpected in the 2013 study.  We have had it confirmed that cybercrime is still a big issue and it costs all of us a lot of time and money to combat a growing list of criminals and terrorists.

    Read more
  • Displaying results 221-225 (of 313)
     |<  <  41 - 42 - 43 - 44 - 45 - 46 - 47 - 48 - 49 - 50  >  >| 

Recent Posts

Post Topics

Archives

Tags