AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Entries with Label: Randy Bohrer
Boston’s Missing Email Case Has Many People Asking Questions about Digital Forensics
Wednesday, September 16, 2009
On September 14, Massachusetts Secretary of State William Galvin ordered the city of Boston to seize computers and software used by Mayor Menino’s aide, Michael J. Kineavy. Under question is whether Kineavy may have violated state law by deleting emails. According to the news articles, Kineavy deleted emails from his inbox and trash folder every day, possibly before the city’s systems made a backup. Alan N. Cote, head of the public records division in Galvin’s office, ordered the city to hire “a qualified independent and competent technology expert to employ all reasonable means of recovering and restoring the missing records”.
A Boston Globe Article Ignites a Password Controversy - Why We Need Them, How to Make Them Effective
Wednesday, April 14, 2010
The article by Mark Pothier in the Sunday Boston Globe entitled “Please Do Not Change Your Password” has caused some controversy among IT staff members, security managers, and technology users. The article provides a compelling argument that the costs associated with frequent password changes outweighs the costs of security breaches caused by weak or static passwords. Although a position on either side of this debate may be supportable, the reality is that there are a number of standards that organizations (your employer for example) must follow including periodic password changes, password complexity requirements and password history requirements.
Compliance and Security Go Hand in Hand – How to Achieve Both
Friday, May 28, 2010
The buzzword “Compliance” has now overshadowed many of the previous popular terms in security discussions. Many equate “compliance” with “security,” but recent literature abounds with titles such as “Compliant Does Not Mean Secure” and “Information Assurance: The Difference between Secure and Compliant.” These articles make the case that it is possible to be compliant yet not secure. Most discussions focus on payment card industry (PCI) security, because of the high value of the data involved, the stringency of the compliance standards, and recent security breaches of major players. It is also useful for illustration purposes, since the typical PCI technical environment is usually confined, and the standards are very specific. However, it is important to expand the discussion beyond one security standard, especially since others are more comprehensive, although less specific.
