NIST/FISMA information security guidance is generally outstanding and more prescriptive than most other forms of guidance. However, there are limits to any standard’s ability to be prescriptive. These limits generally relate to differing technological architectures, the evolution of technology/assessment tools, and differing risk levels (which mandate different levels of testing).
These limits are well illustrated by a recent call that I had with a potential client. Our conversation began with him telling me: “This should be a pretty quick conversation – ...
Continue Reading →
18
JUN
JUN
0
One interesting thing about working in the banking industry is the evolution of the “annual security assessment” mandated by the FDIC. Each year we find that the auditors usually emphasize a different information security issue in addition to the fundamentals (e.g., external 
Risky Business Blog
Techno Blog
In The News
RSS Feed
