Categories
General IT Information Security

Authentication and Authorisation Royal Rumble – OpenID vs OAuth vs SAML

There are just as many ways to defend data as there are to attack it. When considering multi-factor authentication, single sign-on, firewalls, and various other controls, the options can be overwhelming. For security professionals (amongst others), the decisions on how to keep data and identities secure starts much earlier – choosing the correct standard to deploy to keep federated identity secure.

Categories
Free Resources Information Security

Free Download: Building Information Security Culture Presentation

This free presentation (with provided speaking points) provides an introduction to building an information security culture to a non InfoSec audience.

Many people see these topics as problems just for security – start talking about security and people’s eyes start to glaze over.

A cultural shift is required to drive change in the organisation and move the conversation of security away from a technology problem and into a conversation about how security is integrated into the company.

Security should be one of the first things people think about, not a last resort. Security is not an add on but rather an important part of how the organisation conducts its business.

You can find this free digital resource here.

Categories
General IT Information Security

Password Management Guidance

The primary objective of a theoretically sound password formulation policy is password diversity – we want our identity system to contain lots of different, hard to guess passwords.

There are several ways to achieve this but unfortunately most of the common approaches in use today, such as length requirements, complexity requirements, and change requirements, are far from helpful.

Categories
Information Security

Liability, Due Diligence, and Negligence

A short explanation on the meanings and differences between liability, due diligence, and negligence.

Categories
General IT Information Security

The CIA Triad

The CIA triad is a model designed to guide policies and procedures for information security within an organisation. Read on to find out more about the CIA triad and some of the common methods organisations implement to meet CIA requirements.

Categories
General IT Information Security

What is IAAA?

How does security in systems actually work? Well, security generally works on a principle called IAAA; Identification, Authentication, Authorisation, Accountability. Read on to find out what this principle looks like in the real world.