Day: May 13, 2016

Posted on

Networking in an Increasingly Stable Environment

The economy continues to improve, at least from an audit and IT audit perspective. Between 2011 and now, the job market strengthened significantly. Five years ago, within 48 hours of posting a job through search sites, I would have 5-15 viable candidates. Usually I never had to post on job search sites; someone in my professional network would ping me with interest. Now, I will post on searches and barely get a handful of candidates after a month. The economy has improved; maybe not to early 2000 numbers, but the market is doing very well.

The good job market can lull people into a networking slumber. When the recession hit 7+ years ago, I heard many candidates say, “I never thought I would be in this situation; I wish I had kept up with my network.” Every job market is cyclical, and you do not know when you might need to tap into your network, regardless of your field.

Networking Activities

Professional Associations:  Stay involved in all professional associations relevant to your career. It may be difficult to attend every meeting, but choose a few that pique your interest, put them on your calendar and commit to paying your membership. Additionally, take advantage of volunteer opportunities.

Key Contacts:  Schedule at least two business lunches/coffees per week, to keep in touch with the contacts most relevant to your success. Connect with that group at least twice a year.

Recruiters:  Do not ignore calls from executive recruiters. Good recruiters want to establish a relationship with you, regardless if you are looking or not. Pick a handful of recruiters you trust and stay abreast of the job market.

LinkedIn:  This is easily discounted when you are comfortable in your job. Staying active on LinkedIn expands your network and keeps you connected with professional contacts. Do this twice a day—put it on your calendar for 10 minutes first thing in the morning and 10 minutes after lunch.

  • LinkedIn Optimization
    LinkedIn is Facebook for professionals. If you are not on LinkedIn, your relevancy is minimized to everyone but your current role. Every professional must have a LinkedIn profile, know how to use it and understand how to optimize its effectiveness. Here are a few LinkedIn tips
  • What Is LinkedIn for?
    LinkedIn enables users to connect and share content with other professionals, including colleagues, potential employers and business partners. However, many users make LinkedIn personal, including birth announcements, surgery updates, marriage announcements, etc. Keep LinkedIn business-related and professional, which can be a fine line. Remember, the more professional you keep it, the less unprofessional you can look.
  • Professional Email Address
    Many people use a personal address as their main contact email, which is acceptable. However, people do not realize how unprofessional their email address may be. Unprofessional email addresses I’ve seen on Linkedin include transam2002, joshistheman and rocketsfan2661. As a recruiter, this is something I always look at. If someone cannot determine if their email address is unprofessional, I tend to scrutinize their profile in much more detail.
  • Customize Your Profile URL
    When my kids were born, I bought their namesake web sites and created their personal emails. At the time I thought it was a good idea, but as the kids have gotten old enough to use email, this has become a wonderful idea. The kids really like having a simple email address. The same is true for your LinkedIn URL. If you don’t have a profile, go claim it. If you do, make sure your URL is personalized and clean, like this:  https://www.linkedin.com/in/dannymgoldberg.LinkedIn is a wonderful social networking tool, even for introverts. Go claim your profile and start with the above steps.

All of these networking activities can expand your network and help you stay in touch with your industry. Remember:  you don’t want to ever have to say “I wish I would have….”

Danny Goldberg, CISA, CGEIT, CRISC, is founder of GoldSRD, a provider of high-quality, interactive internal audit training. Goldberg will present a free webinar titled, Becoming the Boss: 10 Key Steps for Advancing to Executive Management, 11AM (CDT), Thursday, 19 May. Sign up here.

Danny Goldberg, CISA, CGEIT, CRISC, founder, GoldSRD

[ISACA Now Blog]

Posted on

A Word on Endpoint Security (For Those In the Know)

Endpoint security is an essential element of any organization’s strategy for detecting and preventing damaging attacks. There has been a lot of discussion in the infosec world about how to use endpoint security tools to provide the best possible protection. At Palo Alto Networks, advanced endpoint protection is a core component of our strategy to provide a true next-generation security platform.

Traps, our endpoint security product, is a cornerstone of the automated breach prevention capabilities in our platform. Most endpoint security products are designed to detect and stop malware based on signatures or other known variables, but Traps instead focuses on preventing malicious programs from executing by detecting and preventing the exploitationtechniques leveraged by the attacker.

This means that Traps can block known and unknown (or “never before seen”) exploits. Tens of millions of individual exploits exist in the wild, but there are only two dozen or so known exploitation techniques. New exploitation techniques can take months, if not years of focused academic effort to develop. By focusing on these core techniques, Traps identifies the attacker’s path for exploitation, even when the exploit itself is not known. Combining Traps with our industry leading Next-Generation Firewall and WildFire’s unparalleled threat intelligence, we provide the most advanced, fully automated exploit and malware prevention capability available today.

Endpoint security technologies can appear similar, and recently there has been confusion around Traps functionality when compared with other exploit prevention software such as Microsoft’s Enhanced Mitigation Experience Toolkit (EMET). Both appear to share the same end goal of preventing exploits, but Traps prevention capabilities are far superior. Not only is the exploit prevention more effective, but it also applies to any application, whereas EMET addresses only a finite list of applications. We should also keep in mind that not every attack uses an exploit. Traps prevents both exploits and malware, known and unknown.

If you would like to see a side by side comparison of Traps and EMET in action, we’ve put together a short video highlighting our ability to detect and stop exploitation techniques where EMET falls short. Watch below:

For further reading, check out Advanced Endpoint Protection for Dummies, an ebook written specifically to educate newcomers on the core differences between legacy and next-generation endpoint protection. The book clears up common misunderstandings surrounding prevention of malware and exploit techniques.

You can also find additional information on Traps, as well as see a live demo, on our Traps resource page.

[Palo Alto Networks Research Center]

Posted on

Winning Together in the Commercial Market

At Ignite 2016, Joshua Hoffman, Vice President of Worldwide Inside Sales, and I sat down and recorded a video explaining one of our top global priorities: our commercial market strategy. It is abundantly clear to both Joshua and I that in order to win in the commercial segment we must work together with you, our partners, which is why we wanted to share the video with you.

Before you watch the video, allow us to provide you with a little bit of context. We define the commercial market segment as customers that spend less than $100,000 annually in the markets in which we compete. To put this opportunity into perspective, we believe this commercial market segment has more than 200,000 addressable customers worldwide. We have implemented this strategy in the United States, United Kingdom, Germany, Japan, Australia, New Zealand, and India and the early results are phenomenal as we are seeing better margins and higher services adoption. This is a massive opportunity for next-generation security innovators who can deliver solutions that address our mutual customer’s business needs.

This video highlights several of the key investments we have made in our Worldwide Inside Sales team to introduce you, our partners, to these mutual commercial customers so they can experience our combined value.

 

This is the first of many future commercial market segment communications, as it is our plan to continue to invest heavily in the commercial market in FY17. I encourage you to visit the campaigns portion of the Partner Portal on regular basis, as we will soon launch a new marketing campaigns page.

If you aren’t already please make sure you are working with our Territory Sales Representatives as alignment between partner and sales will be instrumental to our mutual success in the commercial market.

Good Selling,
Ron Myers and Joshua Hoffman

[Palo Alto Networks Research Center]

Posted on

Providing Trust and Assurance Through Cloud Certification and Attestation: A Complimentary CSA STAR Program Webinar by Schellman

In the last 24 months, the Cloud Security Alliance (CSA)has made great strides in enhancing theirCSA Security, Trust and Assurance Registry (STAR) Program.  In brief, the STAR Program is a publicly available registry designed to recognize assurance requirements and maturity levels of cloud service providers (CSPs).  Prior to issuing the guidance for STAR Certification and STAR Attestation, a CSP could only perform a self-assessment, which meant completing the Consensus Assessments Initiative questionnaire (CAIQ) and making the responses publicly available on the CSA Register.  The CAIQ was completed in several different ways and the content varied from short answers to full-page responses.  It was relevant information but not independently validated.  This created a path for the STAR Certification and STAR Attestation Programs.

Join Schellman during a complimentary webinar titled “CSA STAR Program: Attestation and Certification”.  The webinar will be held on May 13th from 12:00pm EST to 1:00pm EST and will provide one (1) hour of CPE.  Debbie Zaller, Schellman Principal, and Ryan Mackie, Practice Leader, STAR Program, will provide an in-depth discussion on the opportunities to undergo third party assessments, through the CSA STAR Programs, to validate maturity level or control activities.

Organizations, specifically cloud service providers, are continuously working to provide confidence to their customers regarding the security and operating effectiveness of their controls supporting the cloud and the STAR Certification and STAR Attestation options provided by the CSA allow for these organizations to further establish confidence in the market,” said Ryan Mackie.  “This webinar is a practical introduction to the STAR Level 2 offerings, outlining their benefits, requirements, and process, and how these types of third party validation can clearly compliment a cloud provider’s governance and risk management system.”

This informative webinar will provide:

  • An overview and journey of the CSA STAR Programs
  • A definition of the CCM framework
  • An overview of the Certification and Attestation purpose and scope
  • The process and preparations
  • A discussion of the common challenges and benefits

For more information and to register for the webinar, click here .  The event will also be recorded and available for on-demand viewing,. Click for more information.

ABOUT THE SPEAKERS
Debbie Zaller leads Schellman’s CSA STAR Attestation and SOC 2 services practice  where she is responsible for internal training, methodology creation, and quality reporting.  Debbie has performed over 150 SOC 2 assessments and Debbie also holds a Certificate of Cloud Security Knowledge (CCSK).

Ryan Mackie leads Schellman’s CSA STAR Certification and ISO 27001 certification services practice where he is an integral part of the methodology creation and the planning and execution of assessments.  Ryan has performed over 100 ISO 27001 assessments and is a certified ISO 27001 Lead Auditor trainer.

Avani Desai, Executive Vice President, Schellman

[Cloud Security Alliance Blog]

Posted on

Outdated Privacy Act Close to Getting an Upgrade

The outdated Electronic Communications Privacy Act (ECPA) may finally get a much-needed upgrade, but the reform can’t come soon enough for Microsoft, other cloud providers and privacy advocates. Here’s what you need to know:

The issues:
The ECPA was enacted in 1986, as electronic communication started to become more prevalent. The intent was to extend federal restrictions on government wiretaps from telephones to computer communications. But as we created other electronic communication devices and moved content to the cloud, the Act became outdated. The primary gripes are that it:

  • Allows government agencies to request emails more than 180 days old with just an administrative subpoena, which the agency itself can issue, vs. having to get a warrant from a judge.
  • Doesn’t require notifying affected customers when their data is being requested, giving them a chance to challenge the data demand. In fact, the Act includes a non-disclosure provision that can specifically prohibit providers from notifying customers.

The lobbying and lawsuits:
Plenty of wide-ranging groups have been advocating for ECPA reform, including the American Civil Liberties Union, the Center for Democracy & Technology, the Electronic Frontier Foundation, the Digital Due Process Coalition, the Direct Marketing Association and even the White House, in its 2014 Big Data Report.

On April 14, Microsoft added a little more weight to its argument. The company filed a lawsuit against the U.S. Justice Department, suing for the right to tell its customers when a federal agency is looking at their email. The lawsuit points out that the government’s non-disclosure secrecy requests have become the rule vs. the exception. In 18 months, Microsoft was required to maintain secrecy in 2,576 legal demands for customer data. Even more surprising, the company said, was that 68 percent of those requests had no fixed end date—meaning the company is effectively prohibited forever from telling its customers that the government has obtained their data.

The reform:
Two weeks after Microsoft filed its suit, the U.S. House voted 419-0 in favor of the Email Privacy Act, which would update the ECPA in these key ways:

  • Require government representatives to get a warrant to access messages older than 180 days from email and cloud providers.
  • Allows providers to notify affected customers when their data is being requested, unless the court grants a gag order.

The last step in the process is for the Senate to turn to the reform bill into law. While no timeline has been given, the Senate is getting a lot of pressure to act quickly.

Download The Guide to Modern Endpoint Backup and Data Visibility to learn more about selecting a modern endpoint backup solution in a dangerous world.

Susan Richardson, Manager/Content Strategy, Code42

[Cloud Security Alliance Blog]

English
English
Exit mobile version