Scott Wright’s Security Views

The latest free version of the AVG virus protection product is an example of how companies can still create great value, utilize free versions, and continue to be competitive.

The AVG suite of protection products is sold by Grisoft (click HERE). While the free version may not meet everyone’s needs, it is recommended and used by many security professionals. And if you require more features and additional protection such as anti-spyware and firewall products, they have reasonably priced product.

In the past, I have found it difficult to get support from vendors such as Symantec (Norton Anti-Virus). I expect to get better results from AVG.

Wouldn’t it be nice if you could just talk to a few colleagues in other companies or organizations to ask what they spend on security, and use that to set a rough budget for things like policy creation, personnel security, threat and risk assessments, audits, application security, penetration testing, incident response, education and awareness, etc.?

It sure would be nice. But that could be somewhat like using your sister’s soccer equipment costs to budget for your sailing hobby expenses (OK, that’s an extreme example). Unless you have a very similar business model and market, you will likely be comparing apples and oranges. Unfortunately, many security vendors and consultants will present a “standard” set of “typical” costs to simplify the situation in order to sell the business.

Continue Reading »

Without going too extreme, I believe it is often possible to have better security with fewer policies and rules. But don’t be fooled; simplifying is rarely “easy”. It’s like the writer telling the editor, “Sorry, I had to submit a 100 page story, but I didn’t have time to make it shorter.

My case studies to date have all focussed on breaches due to inadequate security policies, safeguards or human decisions. I would like to start dealing with success stories. I have a hunch that there are at least a few Security Managers or executives who have done a good job of crafting policies and keeping their staff educated about security issues.

Continue Reading »

You can view the archive of “The Practical Security News” and sign up for the automated e-mail distribution list by clicking HERE.

IN THIS ISSUE

1) For Executives -

What do you mean “Table Stakes”… I just want to do BUSINESS!

I was recently on the Security Catalyst Forums (HERE), where I was reminded of this quote from the lyrics of the song “Free Will” by the Canadian rock group, Rush (HERE):

“If you choose not to decide, you still have made a choice.”

This statement can be applied to a lot of different situations and philosophies. However, I think it is particularly relevant in the world of Risk Management.

Continue Reading »

Even people with the best of intentions can be fooled by SPAM e-mails, browser pop-ups or dialogs that try to scare them into doing something you wouldn’t otherwise do on the Internet.

This article in CNET’s “Spyware Horror Stories” series (click HERE) is an example of something that probably happens to a lot of people, and they don’t even know it.

Continue Reading »

Canada’s Privacy Commissioner recently issued a statement about the TJX breach of Personally Identifiable Information for millions of credit card holders. Click HERE for the news release. Continue Reading »