Steven F. Fox, CISSP, QSA, ASV is a Security Architecture and Engineering Advisor at the U.S. Department of the Treasury. He also serves on the Board of the Motor City ISSA chapter. Mr. Fox brings a cross-disciplinary perspective to the practice of information security; combining his experience as a security consultant, a Sr. IT Auditor and a systems engineer with principles from behavioral/organizational psychology to address security challenges. His core philosophy - security is about how people interact with machines and information. Mr. Fox holds an MS in Business Information Technology from Walsh College, an NSA recognize Center of Excellence. He contributes to McAfee's Security Connected blog, is a syndicated blogger, and produces/hosts the SecureLexicon information security podcast.
Listening to bad brand statements is like sitting through a bad movie or comedy skit. Well, not quite, since you can leave the theater in those cases without feeling too guilty. Yes, I am among those who stand politely as a vendor tries to sell me something without bothering to determine what I actually care Read more…
Tags: security branding
Hacker Halted 2012 was full of personalities; executives, technologists, students and security enthusiasts – each one with stories that fueled conversations and debate. Technical and business erudition dominated the speaker sessions and the hacking competitions at the heart of this annual conference. While comprised of distinct subcultures, a sense of community bonded the attendees. This Read more…
Tags: Business IT, Culture, Security Influence
In my first post on styles of influence, I discussed rationalizing – a style characterized by a logical perspective that does not account for emotional or political considerations. Its utility is limited to circumstances were quantifiable and verifiable metrics dominate the decision-making process. Unfortunately, the analysis of information security risk is handicapped by a lack Read more…
Last week I discussed how information security is broken at the relationship level. This was illustrated by highlighting some challenging outcomes from the dysfunctional communications between security teams and their business customers. While several remediation strategies were posed, the essential approach to enhancing the role of security professionals is to enhance their organizational influence. This Read more…
Tags: Business IT, Security Influence
Business people have a conflicted relationship with the IT security team. One the one hand, they concede the role the team plays to ensure compliance with regulatory mandates and the protection of corporate assets. On the other hand, the team is often perceived as overbearing and out-of-touch with business needs. When they don’t understand the Read more…
Tags: Business IT
In “Six Social Media Trends for 2012”, David Armano explores the evolution of social media into social business. “Social media,” says Armano, “continues to move forward towards business integration.” According to Forrester’s Stephen Mann, the increasing ubiquity of mobile devices in enterprise environments is facilitating this trend. A joint Booz Allen/Buddy Media study found that Read more…
Tags: 2012, mobile security, social business, social media
The impact of security breaches on Sony Corporation’s stock price has stimulated discussion as to the review of corporate security incidents in the investment decision process. In response to this incident and others like it, the Securities and Exchange Commission (SEC) has released guidance for the disclosure of security incident risk in corporate investor communications. Read more…
Tags: enterprise security, SEC Guidance
The EC-Council will host a gathering of public/private sector information security executives and thought-leaders at the CISO Executive Summit 2011 on December 5-6 in Las Vegas. The agenda features panel discussions addressing issues that emerge from the intersection between technology, people, and business. Below are three panels on which I was asked to contribute my Read more…
Wireless communication is inherently insecure. My consulting experience has confirmed that some organizations understand this fact when connecting to wireless networks with their laptops. However, their awareness falters when connecting their mobile devices to the same networks. According to a Echoworx study, 44% of the surveyed audience at London’s Infosecurity Europe 2011 conference transmitted sensitive Read more…
Your mobile device is an interface into systems that can store potentially sensitive information about you, your company or your employer. Given its ease of use and portability, one would expect to find unique, strong credentials to guard against unauthorized access to these resources. In practice, however, credentials tend to be reused – increasing the Read more…
Tags: Mobile, mobile security, OWASP
Posts by Steven Fox