The National Institute of Standards and Technology is re-evaluating a set of its special publications because of concerns expressed by some leading cryptographers that the National Security Agency might have corrupted the guidance.
Organizations still have concerns about sharing too much data and threat intelligence to help thwart attacks. But EMC's Kathleen Moriarty says organizations' fears about intellectual property compromises are overblown.
Termination of an employee after a breach should be reserved for repeat offenders, individuals who show a total disregard for the rules, those who seek to harm another or the most egregious incidents, security expert Mac McMillan contends.
Apple's inclusion of a fingerprint scanner in its iPhone 5S is an important step toward bringing biometrics into the mainstream. But there's a long way to go before biometrics supplant passwords at the enterprise level.
Special Publication 800-101 Revision 1 is aimed to help organizations develop procedures to deal with the explosion of mobile devices and to prepare specialists to conduct forensically sound examinations.
Scientists are discovering ways to make quantum key distribution a more cost-effective and efficient way to securely share encryption keys, but there's still a long way to go before the methods can be practically applied.
Even with the latest disclosures of the efforts the National Security Agency goes through to decrypt Internet communications, enterprises can take specific steps to protect their information from prying eyes.
As the federal government ramps up deployment of continuous monitoring, agencies should significantly reduce the time to certify and accredit IT systems and detect vulnerabilities, says the Defense Department's Robert Carey.
Organizations incorporating social media into their daily operations tend to have gaps in policies, and key aspects are often an afterthought, says attorney David Adler, who pinpoints areas to address.
The National Institute of Standards and Technology has issued new guidance for designing cryptographic key management systems that describes topics designers should consider when developing specifications.