Resources

Blog

How “Smash and Grab” Compromises IBM i

During an audit a few years ago, I revealed to the client’s security team that corporate payroll information on every employee, including the CEO, was being archived in an output queue (called PAYROLL) for weeks at a time. Due to poor configuration, this information was accessible to every employee.
Blog

PCI Compliance Takeaways from the Target Data Breach

Smack in the middle of the holiday shopping season, Target was hit with a malware attack that infiltrated its point-of-sale systems and enabled the theft of credit card numbers and personally identifiable information from more than 70 million shoppers.
Blog

What is the Value of SIEM?

As is often the case in the technology industry, the details surrounding security information and event management can be a little unclear. While vendors may offer solutions of varying complexity, there is still a basic idea behind most SIEM products…
Blog

What to Know about the New NIST Cybersecurity Framework

Compiled with significant input from the private sector, the Cybersecurity Framework isn’t a prescriptive compliance document and instead gives companies significant leeway in how they use it to inform their security strategies. As a relatively new source of guidance, its implications for regulated industries aren’t clear yet.
Blog

Your Biggest Challenge to IBM i User Onboarding

As companies bounce back from recession and place a stronger emphasis on digitally-driven innovations, IT departments are finally receiving the funds they need to hire qualified, new colleagues who can lighten the workload. However, the first order of business will be getting these recent hires up to speed.
Blog

Your Biggest Threat Since Edward Snowden

When Edward Snowden leaked the details of the National Security Agency’s PRISM program to the media, it resulted in a large public outcry and lot of unwanted attention. This doesn’t mean that system administrators should treat all of their contractors as the next Snowden, but it highlights the importance of ensuring that contractors, as well as employees, are sufficiently monitored and aware of how they are allowed to use company data.
Blog

What's the Difference Between a Profile Swap and Adopted Authority?

Image Many organizations have the requirement to reduce the number of profiles to which special authorities—especially *ALLOBJ specially authority—have been assigned. In many cases, the excess capabilities can simply be removed because they aren't required for the person to perform their job functions. *SAVSYS special authority is a...
Blog

IT Risk Mitigation

It's a brave new world for IT. And it often seems impossible to predict future demand and guard against performance risks. You have mountains of data, scalable cloud infrastructures, and a complex web of IT environments. It's complicated, to say the least.  And it's matched by skyrocketing consumer demand for and reliance on online services. Bottom line: outages are more...
Blog

Three Reasons You Need an Updated Security Policy

If you still think creating and maintaining a security policy isn’t necessary, you could be setting up your organization for an unpleasant surprise. Check out the top three reasons businesses need an up-to-date security policy.