Filters

Article Type

Domain

Credentials

Subjects

Product Type

Level

Language

15 of 4019 Results

Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

How to Measure and Prove the Value of Your AI Investments

Is your organization investing in artificial intelligence (AI) but not seeing the expected payoff?

3 March 2025
How to Measure and Prove the Value of Your AI Investments
@ISACA Article

SheLeadsTech Provides Growing Array of Resources, Opportunities

ISACA’s SheLeadsTech program continues to expand opportunity and impact for women throughout the technology workforce.

3 March 2025
Chidambaram Narayanan
Blog Post

When Harry Met SALY: A Love-Hate Story in Audit Risk Assessment

'Same As Last Year' does not cut it for IT auditors looking to successfully adapt to new risks and opportunities.

3 March 2025
Fene Osakwe
Audit Article

Control Considerations for a Data Privacy Audit

There are 5 key risk areas that could provide guidance for auditors in today’s evolving privacy landscape. By identifying and defining these key risk areas, auditors can ensure robust and comprehensive privacy oversight

3 March 2025
Isla Sibanda
Audit Article

The Role of Digital Transformation Audits: Transform While Upholding Governance Standards

Digital transformation is reshaping the landscape of industries globally. While the benefits are enormous, these transformations can also jeopardize an organization’s governance standards if not executed with rigorous oversight.

3 March 2025
A single green question mark cube stands out among numerous black question mark cubes on a dark surface
ISACA Journal Article

Information Security Matters: The Dark Arts of Managing Downtime

IT can be a sturdy midfielder and do some scoring, but businesspeople are the strikers, with security playing defense and tending the goal.

Author: Steven J. Ross
A hand holding a holographic image of a handshake, symbolizing global business partnerships and collaboration.
ISACA Journal Article

The Digital Trust Imperative: Building a Culture of Trust

If an organization wants to have a strong trust position within the digital ecosystem, it must invest in the culture to support such a position.

Author: K. Brian Kelley
Blue background, with white lines and dots scattered throughout, and in the center a bright white light is emanating from a circular object
ISACA Journal Article

The Governance Conundrum of Digital Twins

As organizations struggle to harness the power of digital twins, they face governance challenges that can undermine the technology's potential.

Authors: Yanyi Wu and Chenghua Lin
Hand interacting with a glowing network of interconnected nodes.
ISACA Journal Article

A Multilayered Framework for Assessing Trust in Cyberrisk Models

To integrate cyberrisk models into organizational decision making, stakeholders must trust in their accuracy, reliability, and transparency.

Author: Jack Freund
A pensive man wearing glasses contemplates data visualizations projected onto screen
ISACA Journal Article

Charting the Course of IT Governance

Understanding the various forces at play in IT governance is vital for organizations aiming to leverage technology effectively and achieve sustained success.

Author: Robert Putrus
Abstract illustration of a brain as a circuit board, highlighting the intricate connections of the human mind.
ISACA Journal Article

Guarding the Mind’s Frontier: The Unprecedented Challenge of Neurosecurity Governance

Governance frameworks must evolve to reflect the merging of human cognition and digital systems.

Author: Er. Kritika
Abstract digital illustration of a checkmark within a circuit board, signifying successful processing or verification
ISACA Journal Article

Accelerate AI and ML Governance With RPA Risk Management Principles

Organizations should look to RPA risk management principles to mitigate model development and data management risk associated with AI and ML.

Authors: Michael Ly and Yue Hong
Abstract digital tree symbolizing interconnectedness and technology, glowing on a dark green background.
ISACA Journal Article

Green IT and Environmental Economics Through an IT Governance Lens

Green IT should be subject to the same rigors of IT governance as regular IT to help ensure that it produces the anticipated value.

Author: Guy Pearce
Abstract digital art depicting streams of binary code flowing downwards, rendered in varying shades of blue
ISACA Journal Article

Consolidating Data Loss Prevention Tools: Good Idea, Bad Outcome

The reaction to shadow DLP is often to reduce the number of DLP tools in use. But the outcome may be a more fragmented DLP environment with higher operational costs.

Author: Dennis Sawatzki
A person's hands interact with a glowing digital network representing secure transactions
ISACA Journal Article

Case Study: Establishing a Strong Security Posture Without Sacrificing Developer Productivity

A company improved its security posture with a zero trust-based DevSecOps solution that used automation to reduce risk and increase compliance without slowing development.

Author: Mick Brady
Load More
A man's suit with a question mark in place of the head
ISACA Journal Article

The Role of the Identity Provider

Digital identity recognition demands a holistic approach that takes into account the real world as well as the digital one.

Author: Luigi Sbriz
Jeff Wade
Blog Post

Achieving Seamless Privacy by Design Through Secure by Design Practices

When organizations approach privacy as a design principle, it drives operational excellence and helps organizations to achieve regulatory compliance.

28 February 2025
Richard Beck
Blog Post

Financial Services Under Threat by Adversarial AI

Adversarial AI—the act of manipulating AI systems to function in unintended or harmful ways—is a growing, overlooked threat that will require updated frameworks in the financial sector.

27 February 2025
Gert Jan Koster
Security Article

Hybrid SAP IT Landscape: Security Challenges and Mitigations

Most organizations today have an IT environment that combines on-premises and cloud services. The preference to integrate these services has caught on widely, as it has proven flexible, scalable, and cost efficient.

27 February 2025
IT Supply Chain Cyberattacks Are About More Than the Weakest Link
ISACA Journal Article

IT Supply Chain Cyberattacks Are About More Than the Weakest Link

Supply chain management research often focuses on identifying the weakest link in the supply chain and trying to replace or repair it.

Authors: Gerald F. Burch, Jordan Burch and Joshua Brown
Cybersecurity and Sustainability: Safeguarding a Resilient Future in the Digital Age
ISACA Journal Article

Cybersecurity and Sustainability: Safeguarding a Resilient Future in the Digital Age

Organizations must recognize the role of cybersecurity in safeguarding the progress humanity has made toward a more sustainable future.

Author: Abdulrahman Alblooshi
David Sampa
Blog Post

ISACA Career Catalyst Stories: Sampa David Sampa, CISA, IGP

ISACA member Sampa David Sampa, an IT audit professional from Zambia, says ISACA continues to play a central role in shaping his career journey.

24 February 2025
Safia Kazi
Privacy Article

The Evolving Role of the Privacy Professional

The privacy profession is evolving to include multiple components of ethics, and privacy professionals must incorporate ethics-related considerations into their daily work.

21 February 2025
Subrat Mishra
Blog Post

From Theory to Practice: Real-World Risk Management, Starting with Ourselves

Training and development should be a non-negotiable element in developing an effective approach to risk management.

20 February 2025
The Rise of Deepfakes: A Deep Dive Into Synthetic Media and its Implications
ISACA Journal Article

The Rise of Deepfakes: A Deep Dive Into Synthetic Media and its Implications

Traditional approaches for detecting deepfakes are proving to be less practical and less effective, and laws and regulations have failed to keep pace with advancements in deepfake technology.

Author: Azad Mammadov
Jeff Wade
Blog Post

Accelerating Secure by Design by Meeting Teams Where They Are

By focusing on people, sharpening processes, and strategically integrating technology, organizations can achieve security by design and ensure security is embedded in their DNA.

18 February 2025
How Data Analytics is Making Traditional Audit Obsolete
@ISACA Article

How Data Analytics is Making Traditional Audit Obsolete

Data analytics are completely revolutionizing the approach to audit.

17 February 2025
Patience Ogunbona
@ISACA Article

Avoiding Career Stagnation: How to Effectively Take Inventory of Your Strengths and Weaknesses

Evaluating your strengths and weaknesses is not just an exercise in self-awareness; it is a strategic move for career advancement.

17 February 2025
How to Effectively Take Inventory of Your Strengths and Weaknesses
@ISACA Article

New ISACA White Paper Highlights COBIT’s Role in AI Governance

Organizations face mounting pressure to govern artificial intelligence (AI) systems responsibly.

17 February 2025
Eugene Leow
Blog Post

Automating Incident Response: Six Practical Steps for Faster, Smarter Cyber Defense

By prioritizing automation while also relying upon human capabilities, cybersecurity professionals can better contain incidents and reduce the time it takes to effectively respond to them.

17 February 2025
Grant Hughes
Blog Post

Developing a Cyber Strategy and the Seven Pillars of Cyber Resilience

An effective cybersecurity strategy that includes critical pillars of cyber resilience, such as embedding security into the design phase and prioritizing basic controls, can drive business success.

14 February 2025
Keri Bowman
Blog Post

SOX Audit-Ready in Minutes: Streamlined Compliance Reporting

By automating key aspects of the audit process, standardizing reports and producing actionable data, organizations' compliance efforts will go more smoothly.

12 February 2025
Refreshing IT Audit with LLMs
ISACA Journal Article

Refreshing IT Audit With LLMs

The audit process has drastically evolved over the years due to advances in technology and changes in the field.

Authors: Diego Suárez and Mario Piattini
Collin Beder
Emerging Technology Article

The Cost of Convenience: AI Adoption and Security Blind Spots

For the past few years, many believed that the race for artificial intelligence (AI) supremacy was firmly in the hands of established players such as OpenAI and Anthropic.

11 February 2025
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Just Call It a Security Incident

More honesty, accuracy and transparency is needed when it comes to organizations acknowledging and reporting security incidents.

10 February 2025
Chester Avey
Security Article

What to Know About EXIF Data, a More Subtle Cybersecurity Risk

Understanding what vulnerabilities exist, along with their potential severity and impact, can dramatically strengthen an organization’s cybersecurity posture and improve overall cyberreadiness.

6 February 2025
State of Privacy
Blog Post

Exploring the State of Privacy in 2025

ISACA’s State of Privacy 2025 report delves into the latest trends in staffing, budgets, training and obstacles from more than 1,600 global professionals.

5 February 2025
Mastering Cloud Asset Management
ISACA Journal Article

Mastering Cloud Asset Management

The transition from locally owned IT assets to more abstract cloud-based resources poses a challenge to how organizations classify and manage their inventory.

Authors: David Mazula, Casper Lamprecht, and Richard Simpson
Chasserae Coyne
Blog Post

COBIT: A Practical Guide for AI Governance

To keep up with the speed of business, organizations need to move fast to stay competitive and improve their market share.

4 February 2025
Safia Kazi
Emerging Technology Article

The Tangled Web of Executive Orders on AI

The rapid shifts in the way the US executive branch addresses AI under different administrations illustrates why organizations are better positioned if they approach emerging technologies from risk-based and ethical perspectives.

4 February 2025
CCOA
@ISACA Article

ISACA Introduces New CCOA Security Credential

Early-career cybersecurity professionals often struggle to demonstrate their technical skills and qualifications to prospective employers, a challenge that ISACA is addressing with its newly launched Certified Cybersecurity Operations Analyst credential.

3 February 2025
Chris Snyder
Security Article

Healthcare’s Growing Threat Landscape

In an era where technology is deeply embedded in every aspect of daily life, the healthcare industry is no exception—and cybercriminals have taken notice.

3 February 2025
Mary Carmichael
Blog Post

Five Ways for Risk Professionals to Work More Efficiently in 2025

Work smarter, not harder.” It’s a simple idea, but in risk management, it’s a game-changer.

31 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Guidelines for Operationalization of Web Client Runtime Security

This article includes seven suggested steps or activities that organizations may find useful in operationalizing their WCRS programs or capabilities.

31 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Traditional Security Solutions Fall Short in Protecting Against Web Client Runtime Risk

This article describes the limitations of traditional security solutions in addressing WCRS risk and proposes implementation options for purpose-built security solutions.

30 January 2025
Erik Prusch
Blog Post

Kicking off 2025 with a New Mission and Vision

Input from members and chapter leaders around the world are reflected in ISACA's new mission and vision statements, which includes emphasis on how members will be supported throughout their career journeys.

29 January 2025
New CCOA Fills Gap in Technical Cybersecurity Credential Offerings
Blog Post

New CCOA Fills Gap in Technical Cybersecurity Credential Offerings

The new Certified Cybersecurity Operations Analyst (CCOA) credential is designed for security professionals with two or three years of experience who aspire to be information security/cybersecurity analysts and related roles.

29 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

An Introduction to Web Client Runtime Security

The term Web Client Runtime Security (WCRS) was coined by the authors to highlight the security or possible malicious behavior of the code executed in users' browsers during their web interactions.

29 January 2025
Maman Ibrahim
Blog Post

Positioning DORA Compliance as a Strategic Advantage for Digital Trust and Operational Excellence

If approached properly, the Digital Operational Resilience Act (DORA) can be a strategic tool to help organizations solidify operational continuity and earn stakeholder trust.

28 January 2025
Melanie Wijeratna
Blog Post

ISACA Career Catalyst Stories: Melanie Wijeratna, CISM | PROSCI

ISACA member Melanie Wijeratna draws inspiration and motivation from her father's life as she advances her career journey in cybersecurity.

27 January 2025
Yakir Golan
Risk Article

Cyberrisk Quantification: A Strategic Imperative for Financial Resilience

As enterprise risk becomes increasingly intricate, the strategic execution of addressing multifaceted threats has grown more critical than ever.

24 January 2025
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100)
Blog Post

Don’t Let Excuses Hold You Back: Ten Reasons Why the CISM Certification is Worth the Effort

The Certified Information Security Manager (CISM) certification consistently ranks among the most sought-after credentials in cybersecurity.

23 January 2025
Artificial Intelligence’s Dual Role in Phishing Attacks
ISACA Journal Article

Artificial Intelligence’s Dual Role in Phishing Attacks

AI technologies, with the ability to personalize phishing messages and improve the effectiveness of attacks, are a game changer in the cybercrime landscape.

Author: Olu Adekoya
Duane Gran
Blog Post

Reframing the Way Organizations Think About Privacy

ISACA’s State of Privacy 2025 report highlights trends in the industry around staffing, collaboration and increasing demands on privacy teams.

21 January 2025
25v1-Vital_protection
@ISACA Article

How ISACA Professionals Can Start 2025 Strong

Beginning a new year presents somewhat of a reset for digital trust professionals, providing a great opportunity to reconnect with colleagues and embrace the clean slate of the flipped calendar.

20 January 2025
How ISACA Professionals Can Start 2025 Strong
@ISACA Article

Privacy Professionals Report Increasing Stress on the Job

Rapid advancements in technology, combined with an evolving regulatory environment, are leading to increasing stress levels for privacy professionals, according to new ISACA research.

20 January 2025
Julie Chatman
Blog Post

Words Matter: Why Zero Trust Needs a New Name

Zero Trust has become a leading cybersecurity approach but the term itself can be counterproductive in organizations' efforts to gain buy-in from business stakeholders.

17 January 2025
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

Leveraging AI for Enterprise Innovation

RV Raghu previews his ISACA Virtual Conference session in which he will explore ways in which enterprises can leverage artificial intelligence for innovation and how they can best approach their AI initiatives

16 January 2025
Vital Protection in Digital Healthcare
ISACA Journal Article

Vital Protection in Digital Healthcare

The sensitive information stored in health systems, coupled with inadequate security measures, makes the healthcare infrastructure appealing to cybercriminals.

Authors: Samuel Romanov and Marlien Varnfield
Jason Lau Blog
Blog Post

Artificial Intelligence in the Boardroom: ISACA’s Approach to AI and Cybersecurity

How ISACA’s board is providing oversight around artificial intelligence’s impact on ISACA and its global membership.

14 January 2025
Safia Kazi and Justin Rende
Podcast

Cybersecurity Predictions for 2025

Cybersecurity Predictions for 2025The prevalence of ransomware and the security concerns associated with AI have made the role of cybersecurity professionals vital for enterprise success.

10 January 2025
Megan Hall
Blog Post

Five Ways to Make Better Use of Emerging Technology in the New Year

When it comes to making better use of artificial intelligence and other emerging technology, having consistent processes for staying informed and measuring risk can go a long way.

10 January 2025
Neil Harper
Blog Post

Five Ways Security Professionals Can Start the New Year Strong

By enhancing engagement with enterprise leadership and better anticipating key cyber risks, security professionals will be on their way to a great year ahead.

9 January 2025
Onur Korucu
Blog Post

Five Ways Privacy Professionals Can Start the New Year Strong

Privacy professionals must embrace change in the evolving technology and regulatory landscape, turning risks and opportunities alike into drivers of their organizations' success.

8 January 2025
Addressing the rise of AI-Driven Cyberattacks
ISACA Journal Article

Addressing the Rise of AI-Driven Cyberattacks

The advent of artificial intelligence (AI) has transformed many industries, increasing productivity, speed of decision making, and innovation.

Author: Mathura Prasad
Ramona Ratiu
Blog Post

Five Ways Risk Professionals Can Start the New Year Strong

Identifying and leveraging reliable information sources is a useful starting point for risk professionals looking to solidify their good practices for the year ahead.

7 January 2025
Goh Ser Yoong
@ISACA Article

Securing Artificial Intelligence: Opportunities and Challenges

The involvement of cybersecurity teams in AI development is essential for organizations to harness the full potential of AI while mitigating the associated security risks that it would pose throughout its lifecycle.

6 January 2025
Justin Rende
Security Article

Cybersecurity Trends to Watch in 2025

There is no crystal ball to forecast the future; however, organizations can make informed predictions about cybersecurity in the coming year.

6 January 2025
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Five Ways Audit Professionals Can Start the New Year Strong

A fresh start for IT auditors in 2025 is possible, but closing out lingering loose ends from last year likely requires attention before embracing the clean slate.

6 January 2025
Rui Feng Isaac Lee
Blog Post

The Synergy Between Generative AI and IS Audit

Applying Generative AI to the audit profession can be done more effectively when the data involved is examined carefully to ensure its quality is reliable.

3 January 2025
Graphic of blocks
ISACA Journal Article

Information Security Matters: NIST CSF 2.0 and the Cybersecurity Hierarchy

NIST CSF 2.0 calls for a hierarchy of executives, managers, and practitioners not stated in the previous version.

Author: Steven J. Ross
Person typing on a keyboard
ISACA Journal Article

The Digital Trust Imperative: Assume Breach to Gain Advantage

A breach can happen at any time and it is not always a sophisticated attack. The recommendation within cybersecurity today is to assume a “breach mentality.”

Author: K. Brian Kelley
Circle with half a globe and a key
ISACA Journal Article

Privacy in Practice: Ethics vs. Compliance

Most consumers are not privacy experts; privacy is the responsibility of enterprises, not consumers.

Author: Safia Kazi
Graphic of streaming data
ISACA Journal Article

Cybersecurity Leadership Challenges in an Evolving Threat Landscape

Cybersecurity leaders are tasked with an additional undertaking that most leaders are not: thwarting bad actors.

Authors: Kevin M. Alvero and Robert Janecek
Person holding an important sign - triangle with exclamation point
ISACA Journal Article

The Hidden Threat of the Risk Manager

In today’s evolving landscape of organizational governance, the role of the risk manager is more crucial than ever.

Author: Subrat Mishra
Globe with overlapping icons
ISACA Journal Article

Winning the Cyber War With Leadership Lessons from Sun Tzu

In the high-stakes world of cybersecurity, effective leadership is more important than ever. In 2024, global cybercrime costs are projected to reach US$9.5 trillion, underscoring the escalating severity of cyberthreats.

Author: Abdelelah Alzaghloul
Finger pointing to circle with icons
ISACA Journal Article

Employing Automation for Incident Response Planning

The ever-growing complexity and frequency of cyberattacks have forced organizations to rethink their strategies for managing security incidents.

Author: Eugene Leow
Lock with a cybersecurity shield overlapping
ISACA Journal Article

Unlocking Lessons Learned From the 2023 Microsoft Exchange Online Intrusion

The cyberthreat landscape is evolving at an unforeseen pace as attacks increase in sophistication, velocity, and volume.

Author: Ninad Dhavase
Graphical brain with a finger pointing to it
ISACA Journal Article

A Neuroscience Perspective on AI and Cybersecurity

Insights can be gained by observing the similarities between the structure of the human brain and the learning function of AI.

Author: ER. Krtika
Cybersecurity shield with lock
ISACA Journal Article

Developing a Cyberstrategy With the Seven Pillars of Cyberresilience

There are seven pillars of cyberresilience that can help define a cybersecurity strategy that is concise, clear, and aligned to business objectives.

Author: Grant Hughes
Person pointing to gears
ISACA Journal Article

Transforming an Outdated Payment System Through Process Automation

When a medical equipment provider realized that its manual payment processing system was resulting in high error rates, the need to automate was clear.

Author: Mick Brady
Kushal Walia and Karthik Mahalingam
Blog Post

Leveraging Artificial Intelligence for Enhancing Security and Privacy in Modern Computing Systems

Artificial intelligence can play a significant role in enhancing the security and privacy disciplines, but governance and ethical implications must remain top-of-mind considerations.

31 December 2024
Ryan Standbridge
Security Article

Overreliance on Automated Tooling: A Big Cybersecurity Mistake

Automation and artificial intelligence (AI) have been a positive force multiplier in the cybersecurity industry. Improved time efficiency, resources, cost, and productivity are great strides in the field and should be celebrated.

30 December 2024
Timothy R. Mcilveene, Ph.D.
Blog Post

Shedding Light on Shadow IT: Aligning Goals for Organizational Success

A disconnect between the goals of the IT team and business units can open the door to the usage of more shadow IT solutions, opening the organization to increased risk.

27 December 2024
Ravikumar Ramachandran
Blog Post

Five Key Priorities for Governance Practitioners in 2025

In the modern technology environment, governance professionals have to be attuned to much more than traditional IT governance principles to stay on top of all that is within their scope.

26 December 2024
Muhammad Usman
Blog Post

Navigating AI in Aviation: A Roadmap for Risk and Security Management Professionals

Considering the especially high security and safety stakes in aviation, risk and security professionals play a crucial role in ensuring that AI technologies in the industry are responsibly deployed.

23 December 2024
Shingi Mushangwe
Blog Post

Four Strategic Priorities for C-Suite Leaders in Big Data Transformation

Data collection, data governance, data architecture and defining success metrics are four aspects to get right when it comes to big data transformation.

19 December 2024
VB Malik
Blog Post

Navigating the Complex Landscape of Large Language Model Security

A multi-faceted approach, including robust model training, is needed to effectively deal with large language model vulnerabilities.

18 December 2024
The Modeling of Risk Evaluation, Risk Appetite, and Risk Tolerance
ISACA Journal Article

The Modeling of Risk Evaluation, Risk Appetite, and Risk Tolerance

The search for practical methods to represent and evaluate risk is undoubtedly a topic of methodological interest.

Author: Luigi Sbriz
Donovan Cheah
Blog Post

Post-Quantum Cryptography Preparedness 101

Post-quantum cryptography efforts should focus on what is within practitioners' control to implement in preparing for the arrival of Q-Day.

17 December 2024
Five Ways to Enhance Your Career in 2025
@ISACA Article

Five Ways to Enhance Your Career in 2025

As we look ahead to 2025, you may be thinking of ways you can continue growing your career and nurturing your professional development in the new year.

16 December 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Is AI Hype an Enterprise Risk? How to Manage Shiny Object Syndrome

Artificial intelligence (AI) has been celebrated as a game-changer for its transformative potential across multiple sectors, offering a value proposition of increased efficiency, innovation, and a reshaping of business operations.

16 December 2024
Five Takeaways from ISACA’s Tech Workplace and Culture Survey
Blog Post

Five Takeaways from ISACA’s Tech Workplace and Culture Survey

Gender representation in tech, pay gaps, career advancement opportunities and more are explored in ISACA's new Tech Workplace and Culture findings.

16 December 2024
Prabha Anand
Blog Post

Integrating AI with CMMI: Cognizant’s Path to Elevating Excellence

Cognizant is one of the world's leading professional services companies, transforming clients' businesses and operating and technology models for the digital era.

16 December 2024
Gokhan Polat
Blog Post

It’s Time for the Financial Sector to Experience ISACA's Digital Trust Ecosystem Framework

Digital trust is especially critical in the financial sector, where the digital banking ecosystem is expected to operate as intended at all times.

13 December 2024
Chidambaram Narayanan
Blog Post

Batman’s Guide to Mastering Password Management: An IT Auditor’s Perspective

Password management, when handled diligently, is a master class in vigilance, with some parallels that can be drawn directly from the Batcave.

12 December 2024
Alaina Lawson
Blog Post

Security by Design or Default?

Secure-by-Design and Secure-by-Default are not mutually exclusive, and both are important elements in bolstering organizations' security posture.

11 December 2024
Brainstorming for Optimal Cybersecurity Controls Starting Stringent Ending Strong
ISACA Journal Article

Brainstorming for Optimal Cybersecurity Controls: Starting Stringent, Ending Strong

Cybersecurity is an ongoing battle, and it is crucial to craft the optimal set of controls for a winning strategy.

Author: Abhishek Kushwaha
Amit Patel
Security Article

Humans Are IT Security’s Weakest Link

When thinking about what makes up IT security, high-tech firewalls, robust encryption algorithms, and advanced threat detection systems are often the first things that come to mind.

10 December 2024
Neil Harper
Blog Post

How the ISACA Board and Executive Management Address Cyber Risk

The ISACA Board takes extensive action to understand and address cybersecurity risk while aligning cyber risk management with strategic business objectives.

9 December 2024
Pablo ballarin usieto
Blog Post

AI Ethics: Navigating Different Cultural Contexts

Artificial intelligence ethics comes with plenty of nuance for stakeholders to assess, as explored in a recent Ask Me Anything discussion on ISACA's Engage online community.

6 December 2024
Shamik Kacker
Blog Post

AI Governance: Key Benefits and Implementation Challenges

ISACA's Artificial InteIligence Governance Brief explores how AI governance must be in place throughout the AI lifecycle to achieve its benefits within the enterprise business strategy and to minimize AI risks.

5 December 2024
Data Abuse in Cyberwarfare: Dissecting the Attack Model
ISACA Journal Article

Steering LLMs Toward Desired Outputs With Prompt Engineering

Large language models (LLMs) have shown exceptional capabilities in understanding and generating human-like text, underpinning major advances in natural language processing (NLP).

Author: Lalit Chourey
John P. Pironti
@ISACA Article

Five Key Considerations for Crafting Board Presentations on Information Risk and Security

Developing and carrying out effective board of director (BoD) presentations is a crucial skill for information risk and security leaders and professionals.

2 December 2024
Maman Ibrahim
@ISACA Article

Proven Strategies to Boost the Effectiveness of Your Cyber Assurance Function

Cybersecurity often gets a bad rap. It’s widely perceived as an endless parade of threats, incidents and breaches.

2 December 2024
CPE Opportunities
Blog Post

CPE Credit Opportunities: How to Earn Your Annual Continuing Education

Webinars, conferences, volunteering and the ISACA Journal are just a few of the CPE opportunities available through ISACA to fulfil end-of-year requirements and plan ahead for 2025.

2 December 2024
Yuman Chau
Security Article

Ensuring Data Security: The Importance of Cloud Backups and Drill Testing

In the organizational IT environment, system and data backup is crucial. Data backup is the last defense against downtime if data is corrupted or lost.

2 December 2024
Abdul Qayyum Mohammed
Emerging Technology Article

Innovation Is Shaping the Future of Network Engineering

Quantum computing and blockchain bolster security measures, ensuring robust protection for sensitive data in cloud environments.

2 December 2024
John de Santis
Blog Post

The Role of the Chair vs. CEO

The Board Chair and CEO both have distinct responsibilities to drive ISACA forward yet extensive collaboration and communication between the two is critical.

27 November 2024
Data abuse
ISACA Journal Article

Data Abuse in Cyberwarfare: Dissecting the Attack Model

In cyberwarfare, data abuse is a potent weapon wielded by state actors, criminal enterprises, and hacktivist groups to achieve strategic objectives and create chaos.

Authors: Aditya K Sood and Sherali Zeadally
Rob MacDonald
Blog Post

The Arrival of CMMC: Positioning Your Company for Success

The long-awaited arrival of the Cybersecurity Maturity Model Certification (CMMC) presents an opportunity for professionals to position their organizations as go-to resources for CMMC guidance and compliance.

25 November 2024
CA. Ratan Singh Tanwar, CISA, DISA, FAFD, Managing Partner- Tanwar Ratan Singh & Associates CA. Firm, Chartered Accountant
Blog Post

User Access Review Verification: A Step-by-Step Guide

Conducting a User Access Review Verification ensures that only authorized individuals are able to access an organization's key systems and data.

21 November 2024
Chirag Joshi
Blog Post

ISACA Career Catalyst Stories: Chirag Joshi, Founder and CISO, 7 Rules Cyber

On his way to success as an author, entrepreneur and cybersecurity leader, Chirag Joshi has turned to ISACA for credentialing, community and thought leadership.

20 November 2024
Digital Age Auditing
ISACA Journal Article

Digital Age Auditing: The Synergistic Effect of Machine Learning on Auditing Practices

Machine learning (ML) is becoming a crucial asset in the field of auditing.

Authors: Kgodiso Chiloane, Fatih Isik and Eugene Zita
Ramsés Gallego, ISACA Evangelist and ISACA Hall of Fame inductee, and Megan Hall, CPA, CISA, CISA, Chief Information and Infrastructure Officer
@ISACA Article

Top Takeaways from ISACA AI Innovation Workshop

Just as the internet created a sea change on the technology landscape, so, too will artificial intelligence.

18 November 2024
Luigi Sbriz
Blog Post

Adding Value with Risk-Based Information Security

It is achievable to manage multiple control frameworks at the same time, with the effort of managing only one.

18 November 2024
Alex Mathew
Governance Article

Cloud Data Sovereignty: Governance and Risk Implications of Cross-Border Cloud Storage

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

18 November 2024
Jack Freund
@ISACA Article

Growing Cyber Defenses from Seed to System

There are many different ways to approach cybersecurity. One of the most effective ways to critically approach cybersecurity is by leveraging systems thinking.

18 November 2024
Krishan Bagla
Blog Post

A Simplified Approach to Cost-Effectively Boost Security Around Digital Crown Jewels

Cybersecurity teams can protect their crown jewels more effectively by following a few critical steps and by collaborating effectively with business units and enterprise leadership.

14 November 2024
Arun Gupta
Emerging Technology Article

Revolutionizing CRM: How AI-Enhanced Security is Transforming Customer Data Protection

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

14 November 2024
Maureen O’Connell
Blog Post

Inside the Audit Committee: Roles, Responsibilities and Qualifications

Our Notes from the Boardroom blog series continues with a detailed look at the role and responsibilities of ISACA's audit committee.

13 November 2024
The Impact of 5G: Unpacking Security and Privacy Concerns
ISACA Journal Article

The Impact of 5G: Unpacking Security and Privacy Concerns

5G, or the fifth generation of cellular networks, is expected to transform wireless communication with features such as highspeed data transfer capability, extremely low latency, and higher connectivity.

Author: Mahmoud Mohamed
CrowdStrike Panel Explores Lessons Learned from Massive Outage
Blog Post

CrowdStrike Panel Explores Lessons Learned from Massive Outage

An ISACA conference panel dissected the massive CrowdStrike incident, dissecting what went wrong and lessons learned to help avoid similar incidents in the future.

11 November 2024
Keith bloomfield deweese
Blog Post

Machine Learning Knowledge Looms Large at a Time of Accelerated AI Transformation

New ISACA courses in machine learning will prepare practitioners to better understand the lifecycle of machine learning projects, large language models, neural networks, and more,

8 November 2024
Brian Odian
Emerging Technology Article

Embracing the Future: The Quantum Computing Revolution Begins Now

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

7 November 2024
Donovan Cheah
Blog Post

How Geopolitics Affects Cybersecurity Risk: A Primer

The geopolitical landscape can have a major impact on cybersecurity risk and provide alternate motivations for cybercriminals to the financial ones for which defenders tend to be more attuned.

6 November 2024
Tatum Crisp
Blog Post

ISACA Career Catalyst Stories: Tatum Crisp, ISACA Auckland Chapter President

Tatum Crisp pursued ISACA chapter leadership to grow her communication and leadership skills, and the experience has paid even greater dividends than she anticipated.

5 November 2024
Chandra Sekhar Dash
Emerging Technology Article

The Importance of AI Safety in Customer Experience Automation

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

5 November 2024
EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners
@ISACA Article

EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners

While the adoption of artificial intelligence (AI) can help enterprises operate more efficiently, there is significant risk associated with it, including lawsuits, AI misuse and biased data.

1 November 2024
Adam Grant
@ISACA Article

Five Top Takeaways from Adam Grant’s Message to ISACA Members

Adam Grant, organizational psychologist and bestselling author, recently sat down with ISACA member and moderator R.V. Raghu for ISACA’s Member-Exclusive Speaker Series.

1 November 2024
Ulrika Dellrud
Blog Post

The EU AI Act is Here: What You Need to Know and Do

Many different layers of compliance requirements are taken into consideration within the EU AI Act, including various AI use cases and models.

1 November 2024
Tori Anderson and Tracy Bordignon
Governance Article

Autopilot on Copilot: Governance Considerations and Pitfalls When Implementing Generative Artificial Intelligence

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

1 November 2024
Person checking options on a digital screen
ISACA Journal Article

Information Security Matters: Raising Standards

CSF 2.0 has a new emphasis on governance, supply chains, and smaller enterprises.

Author: Steven J. Ross
Person looking at a digital screen, thinking
ISACA Journal Article

The Digital Trust Imperative: Risk in the Shadows

Shadow IT represents a growing threat to most organizations, especially those with a digital presence.

Author: K. Brian Kelley
Digital burst
ISACA Journal Article

The Bleeding Edge: Future Proofing With Situational Awareness

Trust professionals have a reputation for being averse to new and potentially disruptive change.

Author: Ed Moyle
An open hand with a digital solar system in it
ISACA Journal Article

IS Audit in Practice: Disruptive Technology—An ESG Enabler

There has never been such a promising time for technology and environmental change.

Author: Cindy Baxter
The Encrypted Truth is Already Out There
ISACA Journal Article

The Encrypted Truth is Already Out There

Quantum computing progress will alter the dependence on current classical cryptography to safeguard data and network transmissions.

Author: Eric H. Goldman
A hand holding a compass
ISACA Journal Article

Clearing a Path: Anticipating Disruptive Innovation With an Eye Toward Compliance

Innovation vs. compliance is one of the trickier balancing acts that any organization must attempt.

Author: Kevin M. Alvero
AI under a magnifier
ISACA Journal Article

Exploring Opportunities and Challenges: An IS Audit Perspective on Generative AI Adoption

Incorporating generative AI into IS audit engagements presents new opportunities and challenges.

Author: Rui Feng Isaac Lee
Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT
ISACA Journal Article

Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT

In the rapidly evolving digital age, enterprises are grappling with shadow IT.

Authors: Timothy D. Spivey and Timothy R. Mcilveene
A digital cube
ISACA Journal Article

Demystifying Quantum

Two key quantum developments have emerged in the cybersecurity space: post-quantum cryptography and quantum key distribution.

Author: Donavan Cheah
Securing LLMs: Best Practices for Enterprise Deployment
ISACA Journal Article

Securing LLMs: Best Practices for Enterprise Deployment

LLMs offer unprecedented capabilities in natural language processing, content generation, and decision support.

Author: Vaibhav Malik
Reassessing Risk:
ISACA Journal Article

Reassessing Risk: The Move to Third-Party Management

As global regulations evolve and reliance on third parties grows, today’s organizations find themselves navigating a complex risk environment.

Author: ISACA
Dhaval Deepak Joshi, CISA, CDPSE
Blog Post

Navigating the New Frontier: Mastering ESG Audits in Modern Business

Environmental stewardship, social responsibility and governance integrity represent three critical components of ESG audits.

31 October 2024
Adeleke Ayobami
Audit Article

How Blockchain Technology is Revolutionizing Audit and Control in Information Systems

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

31 October 2024
Patrick Barnett
Blog Post

What Type of Person Will Make a Good Cybersecurity Professional?

Beyond their technical know-how, effective cybersecurity professionals tend to have a range of other characteristics, such as adaptability, integrity and curiosity.

29 October 2024
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

Behind the Scenes with Adam Grant: The Opportunity of a Lifetime

A recent ISACA Member-Exclusive Speaker Event with Adam Grant presented new mindsets and approaches that can help professionals unlock more enjoyment and creativity in their work.

25 October 2024
Innocent Atasie
Audit Article

Eight facility zones to consider while Auditing for Information, Physical, and Environmental Security Compliance

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

25 October 2024
Safia Kazi, AIGP, CIPT, and Collin Beder, CET, CSX-P, Security+
Emerging Technology Article

Safely and Responsibly Using Emerging Health Technology

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

25 October 2025
Thomas Phelps
Blog Post

Approaching Risk, Compliance and Security Through a Consistent Lens with Enterprise Training

ISACA enterprise trainer Thomas Phelps shares his perspective on how group training can help brings teams together and collectively uplevel their knowledge and performance.

24 October 2024
Lalithkumar Prakashchand
Audit Article

Beyond the Blockchain Bubble: Distributed Ledger Technology for a Resilient Audit Landscape

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

23 October 2024
Untangling the Supply Chain Web With ISO 27001
ISACA Journal Article

Untangling the Supply Chain Web With ISO 27001

Enterprises are growing more concerned that they might be attacked via their supply chain.

Author: Hannah Hunt
Osman Azab
Blog Post

How the Emerging Technology Landscape is Impacting Cybersecurity Audits

Embracing continuous auditing and focusing on risk-based approaches are among the ways to effectively deal with the increasing complexity of cybersecurity audits as the emerging technology landscape continues to evolve.

22 October 2024
Integrating Psychological Safety into COBIT 2019
@ISACA Article

Five ISACA Members Earn Inaugural Chair Fellowships

Five ISACA members have been designated as the inaugural recipients of the ISACA Chair’s Fellowship Award for the 2024-2025 Board of Directors term.

21 October 2024
Luiz Claudio Diogo
@ISACA Article

Integrating Psychological Safety into COBIT 2019: A New Horizon in I&T Governance

In a world increasingly driven by technology, organizations must balance the need for innovation and efficiency with the well-being of their employees.

21 October 2024
John de Santis
Blog Post

Introducing the Chair’s Fellowship Program

ISACA's new Chair's Fellowship Program provides awardees with the opportunity to gain board leadership skills and become well-versed in best practices for a high-performing board.

21 October 2024
Karen Franklin
Blog Post

ISACA Career Catalyst Stories: Karen Franklin, Director, Compliance Analytics with Discover Financial Services

Karen Franklin, ISACA member and participant in the Mentorship Program, calls pursuing her CISA certification 'one of the most pivotal decisions' she made along her career journey.

18 October 2024
Chester Avey
Security Article

Comparing the MITRE ATT&CK and NIST Cybersecurity Frameworks

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

17 October 2024
Daniil Karp
Blog Post

A Proactive, Continuous Approach to Automated Compliance

Automation and a compliance by design approach can empower organizations to build a more secure, compliant and efficient IT environment.

16 October 2024
Celebrating ISACA’s Cybersecurity Month Scholarship Recipients
Blog Post

Celebrating ISACA’s Cybersecurity Month Scholarship Recipients

Recipients of the ISACA Foundation's Cybersecurity Month scholarships share their aspirations for making their mark on the cybersecurity profession.

14 October 2024
John de Santis
Blog Post

Our Day in Court

ISACA prevailed in a recent court ruling, which will free up more time and resources to put the focus back where it belongs: on delivering value for members and certification-holders.

14 October 2024
Gagan Koneru
Privacy Article

The Evolving World of Data Privacy: Trends and Strategies

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

14 October 2024
Isaac Lee
Audit Article

By The Importance of IS Audit: Lessons Learned from the Evergrande Crisis

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

11 October 2024
Christian Have
Blog Post

Is NIS2 In Danger of Becoming a Paper Tiger?

NIS2 is intended to improve cybersecurity resilience, but to reach its potential, there will need to be real consequences for organizations that are simply going through the motions.

10 October 2024
Patrick Barnett
Security Article

DarkAngels Strikes Big: Record-Breaking Ransom Secured

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

10 October 2024
Managing Cyberrisk With the Help of GRC
ISACA Journal Article

Managing Cyberrisk With the Help of GRC

Managing cyberrisk using GRC technologies can help align IT activities with business goals.

Author: Hemang Mehta
Jim Lamadrid
Blog Post

From Failure to Fulfillment: My Journey in Attaining the CRISC

Eight key takeaways that helped one CRISC-holder improve upon his first exam attempt and reach his goal of attaining CRISC certification.

8 October 2024
Jack Freund
@ISACA Article

Accelerating Cybersecurity Maturity by Quantifying Risk

Organizations should embrace the benefits of modernity and avoid the assumption that they must first implement a low-fidelity qualitative risk program before transitioning to a quantitative one.

7 October 2024
Stress Levels on the Rise for Cybersecurity Professionals
@ISACA Article

Stress Levels on the Rise for Cybersecurity Professionals

Cybersecurity professionals increasingly are feeling stress, primarily in response to an escalating threat landscape, new ISACA research shows.

7 October 2024
John de Santis
Blog Post

Ready to Be a Board Director? Here are 12 Things You Should Know

Being an ISACA board director is much more than an honorary role, and requires expertise in a range of areas, including a strong command of global strategy.

7 October 2024
Arun Gupta
Governance Article

The Crucial Integration of CRM and Corporate Governance: A Key to Better Business Outcomes

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

7 October 2024
Ejona Preci
Blog Post

ISACA Career Catalyst Stories: Ejona Preci, CISO, Lindal Group

Ejona Preci, a Germany-based CISO, says she has met 'true powerhouses' through ISACA that have helped accelerate and enrich her career journey.

3 October 2024
Alex Holden
Blog Post

Choosing Your Cybersecurity Path

Building a successful career in cybersecurity can be a smoother process by identifying organizations with healthy security culture, avoiding monotonous tasks, embracing continuing education and showing an ability to learn from failure.

2 October 2024
Jenai Marinkovic
Blog Post

The Hidden Culture Crisis and Human Burden Undermining Cybersecurity Resilience

The cybersecurity industry is facing a growing internal crisis that is not rooted in technology or external threats but in the culture underpinning our current workforce.

1 October 2024
Gaya Ratham
Risk Article

Navigating Risk When Transitioning to the Cloud

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

1 October 2024
Surya Prakash
Blog Post

The Importance of Establishing an Open-Source Ingestion Policy to Mitigate Threats

Open-source software can lead to many benefits while simultaneously introducing security risks, creating the need for a substantive open-source ingestion policy.

30 September 2024
Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel
Blog Post

Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel

The ISACA China Hong Kong Chapter recently featured a panel exploring how organizations can make artificial intelligence more trustworthy and more effective.

27 September 2024
Fene Osakwe
Audit Article

The Evolution of Tech Assurance: Restructuring the IT Audit Function

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

27 September 2024
Abdelelah Alzaghloul
Blog Post

Cyber Resilience: What Shawshank Teaches Us About Security

A focus on prevention alone was not sufficient in The Shawshank Redemption and it is similarly not going to do the job in building successful, modern security programs.

26 September 2024
Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust
Blog Post

Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust

ISACA just published its Vision Paper on “Empowering Europe’s Digital Future with Cyber Resilience, Competitiveness and Digital Trust.

26 September 2024
Sergio Tringali
Blog Post

Shaping the Future of Digital Trust and Cybersecurity Policy: How ISACA Contributes to the UK

ISACA’s UK Vision Paper 2024: A manifesto for bridging the UK’s digital skills gap and improving cyber resilience.

25 September 2024
Addressing Security Concerns in a Mobile Computing Environment
ISACA Journal Article

Addressing Security Concerns in a Mobile Computing Environment

Given the sensitive nature of information stored on mobile devices, the consequences of a breach can be severe.

Author: Rachit Gupta
Jack Freund
Blog Post

From Theory to Action: Building a Strong Cyber Risk Governance Framework

Knowing your organization's risk appetite is the first step toward effectively integrating cyber risk quantification into an organization's cyber risk governance.

23 September 2024
Erik Prusch
Blog Post

A Career Journey You Won’t Want to Miss

Joining ISACA means not only becoming better equipped to succeed in your current job, but also for future opportunities throughout your career journey.

18 September 2024
Yuman Chau
Security Article

From Hollywood to Hacking: Understanding Deepfake Scams

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

18 September 2024
Chris McGowan
Security Article

Centralized Services and Their Impact on Business Continuity

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

17 September 2024
Chris McGowan and Ivan Mans
Podcast

Addressing SAP Security Gaps

SAP systems are treated differently than many other enterprise applications from a cybersecurity perspective.

17 September 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Are You Technical or Non-Technical? Time to Reframe the Discussion

There is value in exploring the problematic nature of labeling someone as technical or non-technical and how this term is overly simplistic and potentially harmful.

16 September 2024
Donovan Cheah
@ISACA Article

Is There a Market Failure in Cybersecurity?

There has never been a better time to be in the governance, risk and compliance (GRC) sector with ever-changing cybersecurity regulation.

16 September 2024
Anthony Pacilio
Blog Post

Leveraging Neurodiversity: Strategic Advantages in GRC

Recruiting and nurturing neurodiverse talent is a winning strategy for organizations looking to enhance their GRC and cybersecurity capabilities.

16 September 2024
Isla Sibanda
Emerging Technology Article

Reidentifying the Anonymized: Ethical Hacking Challenges in AI Data Training

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

16 September 2024
Maria Koslunova
Blog Post

Data Governance for AI: It Starts and Ends with Data

Understanding the relationship between artificial intelligence and data is critical for organizations as they increasingly leverage AI in their business operations.

13 September 2024
Chidambaram Narayanan
Blog Post

The Curious Case of the Complacent Commercial Chief: An Internal Auditor's Challenge

Internal auditors are not always met with open-minded attitudes from key stakeholders, but they can break down resistance by taking the right approaches.

12 September 2024
Vaibhav Malik, Global Partner Solution Architect, Cloudflare
Blog Post

AI and Risk Management: A Strategic Guide for CIOs and CISOs in Financial Services

Artificial intelligence is having a large impact on the risk landscape in the financial sector, underscoring the need for AI governance frameworks and thorough AI risk assessments.

11 September 2024
Human Risk Management: A Practical Approach
ISACA Journal Article

Human Risk Management: A Practical Approach

Cybersecurity strategies must be based on the assumption that humans will continue to make mistakes.

Author: Grant Hughes
Mukta Sharma
Blog Post

Cybersecurity Compliance Essentials: Balancing Technical and Non-Technical Skills

Technical acumen can be valuable in working toward cybersecurity compliance, but non-technical elements also play a significant role in achieving compliance.

9 September 2024
Abigail Bada
Blog Post

ISACA Career Catalyst Stories: Abigael Bada – Founder, Fortini Tech

ISACA’s Career Catalyst Stories showcase how members have been supported by ISACA throughout all stages of their careers. Today, we profile Abigael Bada, founder, Fortini Tech.

6 September 2024
Jayakumar Sundaram
Blog Post

The Never-ending Quest: Why Continuous Monitoring is Crucial for Cybersecurity

Systematically analyzing threats from the beginning of the design phase enables practitioners to build security into systems in time to make a difference amid a difficult threat landscape.

4 September 2024
Sunil Arora
Risk Article

Persuasive Technology: The Technology That Connects and Controls Us

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

4 September 2024
Muhammad Mushfiqur Rahman
@ISACA Article

Emerging Technology: Key Challenges and Opportunities

Emerging technologies are those that are still under development or are just starting to be adopted on a large scale. They have the potential to significantly change the way we live, work and interact with the world around us.

3 September 2024
Emerging Technology: Key Challenges and Opportunities
@ISACA Article

Ramifications Far-Reaching for Companies that Don’t Prioritize Digital Trust

Maintaining compliance and having strong security and privacy programs in place is good, but only goes so far if it does not add up to strong trust between organizations and their stakeholders.

3 September 2024
muneeb-imran-shaikh-blog
Blog Post

Preventing the Storage Limitation Principle from Becoming an Elusive Dream

Strengthening approaches to retention of personal data can lead to more business resilience, reducing risk of personal data exposure and sharper operational efficiency.

3 September 2024
Patrick Barnett
Risk Article

A New Threat Actor Group Emerges: Understanding Lapsus$

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

3 September 2024
Cyber Impact Analysis
ISACA Journal Article

Information Security Matters: Cyber Impact Analysis

Whether it is a theft of data or an attack that renders systems inaccessible, cyberattacks are downright bad.

Author: Steven J. Ross
A digital network
ISACA Journal Article

The Digital Trust Imperative: When Risk Becomes Reality

Once trust is lost, business is often lost as well. Therefore, organizations must look closely at digital trust.

Author: K. Brian Kelley
Office boardroom
ISACA Journal Article

IS Audit in Practice: Managing the Practical Risk Assessment

All risk is not the same. Industry dynamics, enterprise culture, and department risk tolerance all have enterprise impact.

Author: Cindy Baxter
Digital overlay of person on a laptop
ISACA Journal Article

Data Risk is Enterprise Risk: Good Data Practices as Risk Controls

There is no question that data risk equates to enterprise risk.

Author: Guy Pearce
A shield hovering above a hand
ISACA Journal Article

Adding Value With Risk-Based Information Security

Effective IT security management system design must start with top management and include the entire perimeter of the supply chain, with special attention paid to ensuring compliance with all relevant laws.

Author: Luigi Sbriz
Dice with cyber locks
ISACA Journal Article

From Measurement to Management: Integrating Cyberrisk Quantification into Risk Governance

The inclusion of the governance domain was arguably the most notable addition to the NIST CSF 2.0.

Author: Jack Freund
Cyber networks
ISACA Journal Article

Cybersecurity Risk Management Governance: An Agency Theory Perspective

An agency theory approach allows enterprises to have open dialogues and make informed cyberrisk management decisions.

Authors: Gerald F. Burch, Jordan Burch, and Mike McGarry
Forms on a digital screen
ISACA Journal Article

Continuous Auditing and Risk Monitoring: Implementation With Credit Line Management

Credit line management presents unique complexities for auditors.

Author: Terrence Cai
A digital network
ISACA Journal Article

Building a Robust Third-Party Risk Management Program in a Connected Ecosystem

Third-party risk is an evolving problem characterized by steadily increasing complexities.

Author: Visveshwar Ramasubramaniam
People looking at a tablet
ISACA Journal Article

Case Study: Achieving Greater Financial Efficiency at ISACA

When it came time to upgrade their FMS, ISACA teams had to be carefully coordinated.

Author: Katie Teitler-Santullo
Alex Sharpe
Blog Post

The Often-Forgotten Organizational Dimensions of Resilience and Digital Trust

Bits don't know borders, meaning emphasis on building digital resilience and digital trust is paramount in this era to protect organizations and their reputations.

30 August 2024
Vaibhav Malik
Emerging Technology Article

Building a Secure and Compliant AI Infrastructure: Lessons from the Trenches

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

30 August 2024
Matthew Moog
Blog Post

DORA Compliance: Navigating the New EU Regulation

New regulations such as the Digital Operational Resilience Act (DORA) are intended to improve risk management and make operational resilience easier to attain.

28 August 2024
Collaborative Cybersecurity: Unifying Functions for a Secure Future
ISACA Journal Article

Collaborative Cybersecurity: Unifying Functions for a Secure Future

The complexity of cyberthreats often mirrors the fragmentation within a cybersecurity function. As threats evolve and diversify, cybersecurity functions cannot operate effectively in silos.

Author: Vishal Sharma
Terry Ray
Governance Article

Auditors are Asking Better Questions—Organizations Should Have Better Answers

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

27 August 2024
chris dimitriadis
Blog Post

NIS2 Directive: Strengthening Public Cybersecurity and Infrastructure Across Europe

The European Union’s NIS2 Directive will align key cybersecurity practices throughout the EU, increasing member-states' ability to prevent cyber incidents and lessen their impact.

26 August 2024
Richard Clapton
Blog Post

Top GenAI Success Stories for Risk and Assurance Professionals, and the Crucial Caveats You Need to Know

Generative AI comes with several promising applications for audits and risk professionals, who also must be mindful of the environment in which they are working and diligently steer clear of potential AI pitfalls.

22 August 2024
The Value of Diversity and Inclusion in Cybersecurity
ISACA Journal Article

The Value of Diversity and Inclusion in Cybersecurity

A strategy based on diversity and inclusion in the workforce will help address the challenges around building a strong security capability in organizations.

Authors: Yuri Bobbert, Morgan Djotaroeno and Bas Van Gils
Jay Hira Blog
Blog Post

ISACA Career Catalyst Stories: Jay Hira, Director, Cyber Security – Financial Services, KPMG Australia

ISACA member Jay Hira has moved from continent to continent for various job roles, but finds his relationship with ISACA to be a constant wherever his career has taken him.

20 August 2024
Mary Carmichael
@ISACA Article

Applying Risk Appetite and Risk Tolerance in the Age of AI

The adoption of artificial intelligence—from generative AI to computer vision—has become a competitive necessity, not merely an option.

19 August 2024
Jack Freund
@ISACA Article

Material Matters: The SEC's Cyber Disclosure Reality Check

Cyber disclosures to regulatory and capital markets have become increasingly relevant in the face of ongoing ransomware threats.

19 August 2024
C. Warren Axelrod
Blog Post

‘Cyberpandemic’ Strikes a Crowd

The recent Crowdstrike incident underscored the need to reduce complexity and limit risky interdependencies to avoid widespread outages.

19 August 2024
Daniil Karp
Blog Post

A Journey Through Integrated Risk Management

When assembling the elements needed for a successful integrated risk management program, organizations should start with their end goal in mind.

16 August 2024
Arun Mamgai
Emerging Technology Article

AI Security Risk and Best Practices

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

15 August 2024
Manoj Patel
Blog Post

The Role of AI & Generative AI in Integrated Risk Management

The risk management space is undergoing big changes driven by the rise of artificial intelligence, resulting both in promising advancements and significant potential pitfalls.

14 August 2024
Protecting Enterprises From AI-Generated Deepfakes
ISACA Journal Article

Protecting Enterprises From AI-Generated Deepfakes

In recent years, deepfakes have become a potent form of social engineering when used for exploitation and to disseminate misinformation.

Author: John Evans
Dorina Hamzo
Risk Article

Securing the Digital Landscape: Organizations Must Address Third-Party Risk Head-On

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

13 August 2024
Meghan Maneval
Blog Post

For Better AI Governance, Begin with Education

AI governance expert Meghan Maneval shared best approaches for more effective AI usage on the enterprise landscape in a recent Ask Me Anything discussion on ISACA's Engage platform,

12 August 2024
Chidambaram Narayanan
Blog Post

From Chapter Engagement to Global Inspiration: How ISACA Muscat Ignited My Spark

Engagement with local ISACA chapters can be a springboard to further success both within and beyond the ISACA professional network.

8 August 2024
Donovan Cheah
Blog Post

An Introduction to Post-Quantum Cryptographic Risks

Post-quantum cryptography algorithms will increasingly become a focal point for organizations as quantum computing makes strides forward.

7 August 2024
Cyber-ESG Synergy: Protecting the 4th Industrial Revolution
ISACA Journal Article

Cyber-ESG Synergy: Protecting the 4th Industrial Revolution

It is worth exploring the nuances of stakeholder vs. shareholder capitalism, the impact of ESG on corporate creditworthiness, and the specific methodologies used by rating agencies to assess ESG criteria, with a focus on governance.

Author: Jack Freund
John P. Pironti
@ISACA Article

Five Key Considerations for Defensible and Reasonable Risk and Security

Reasonability and defensibility are common themes in audits, legal contracts, regulations, and security assessments of information risk management and security (IRMS) programs, capabilities, and controls. The term “commercially reasonable” frequently appears in contractual agreements and regulatory guidelines, signifying common standards for security capabilities and controls.

5 August 2024
ISACA Releases AI Courses on Ethics Audit and Machine Learning
@ISACA Article

ISACA Releases AI Courses on Ethics, Audit, and Machine Learning

ISACA has released an online, self-paced introductory course to AI for auditors, alongside other new courses on ethics and machine learning for business enablement.

5 August 2024
Steven Sim
Blog Post

Overcoming the Shortcomings of Modern Authentication

An ISACA white paper examining authentication challenges in the deepfake era identifies challenges organizations face and methods that can overcome them.

5 August 2024
Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends
Podcast

Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends

Traditional security questionnaires just aren't cutting it anymore.

2 August 2024
Varun Prasad
Emerging Technology Article

AI Algorithm Audits: Key Control Considerations

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

2 August 2024
The Cyber Standard Podcast | Episode 3
Podcast

The Cyber Standard Podcast | Episode 3

Welcome to Episode 3 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the essential aspects of applying for and assessing candidates in the cybersecurity field.

2 August 2024
Brian Vasquez
Blog Post

Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success

Focusing on robust communication, keeping current with the regulatory landscape and aligning with key business objectives are among the approaches that can set modern CISOs up for success.

1 August 2024
What Enterprises Need to Know About ChatGPT and Cybersecurity
Podcast

What Enterprises Need to Know About ChatGPT and Cybersecurity

Many people are pondering whether generative artificial intelligence (AI) tool ChatGPT is a friend or a foe.

31 July 2024
Integrating Cybersecurity into Project Management A Comprehensive Approach Across SDLC Phases
ISACA Journal Article

Integrating Cybersecurity into Project Management: A Comprehensive Approach Across SDLC Phases

In an era when digital transformation is at the forefront of organizational strategies, the importance of incorporating cybersecurity into project management processes cannot be overstated.

Author: Rajanikanth Potturi
Jeimy J. Cano
Blog Post

How Boards of Directors Can Better Prepare to Lead on Cyberrisk

Board directors need to be aware of key cybersecurity-related strategies and investments and make sure they are aligned with the organization's risk appetite.

30 July 2024
Larry Marks
Blog Post

Cyber Resilience Through More Effective Design

There is a saying that I expect many have heard before: “How do you eat an elephant”? “One bite, one part at a time.”

26 July 2024
Geetha Murugesan
Blog Post

AI Ethics and Why It Matters

Artificial intelligence ethics considerations must be top-of-mind for organizations when leveraging AI as trust, bias, security, privacy and other important elements should not be overlooked.

24 July 2024
Developing Trustworthy AI: Understanding the Inputs
ISACA Journal Article

Developing Trustworthy AI: Understanding the Inputs

Bad AI training data leads to bad outputs, and these bad outputs lead to distrust and skepticism of AI systems. People may be more reluctant to use AI systems that they do not find trustworthy, decreasing the return on investment associated with AI.

Author: Safia Kazi
Sarah Katz
Blog Post

The Risk of Malicious Push Notifications in Augmented Reality Apps

Push notifications in augmented reality applications carry overlooked risks, and app developers should help mitigate them by working closely with privacy and legal experts

22 July 2024
Larry G Wlosinksi
Blog Post

How to Merge AI and Robots Responsibly

When it comes to merging AI and mobile robots, standards, guidance and testing are critically important to ensure that developers and other key players in the ecosystem are operating responsibly.

19 July 2024
Patrick Barnett
Risk Article

Can Hardening Reduce Cyberrisk?

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

19 July 2024
Shingi Mushangwe
Blog Post

Three Ways for Enterprise Leaders to Make Technology Transformations More Successful

Clear scope, vetting vendors carefully and retaining key resources can position organizations for success in technology transformation projects.

17 July 2024
Are AI BOMs the Future?
ISACA Journal Article

Are AI BOMs the Future?

The rapid adoption of AI has introduced new attack surfaces that many digital trust professionals are only beginning to understand. AI BOM can help organizations better understand the provenance of AI components used to assess related risk.

Author: Ed Moyle
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

Introducing The Evolving Auditor

The world of finance is undergoing a digital revolution, and the role of the auditor is no exception.

15 July 2024
Mark Bowling
@ISACA Article

Ransomware Attacks Are Noisy. Learn How to Listen for Them.

During the initial intrusion stage of a ransomware incident, the attacker has the advantage.

15 July 2024
anna-johannson
Blog Post

Why So Many Organizations Underestimate Insider Threats

Insider threats remain overlooked by many organizations even though they are potentially more devastating than many incidents coming from external attackers.

15 July 2024
Hakan Kantas
Blog Post

Unlocking the Power of Digital Trust: Exploring ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework provides organizations with the guidance needed to build and maintain trust with customers and other organizational stakeholders.

12 July 2024
Yuman Chau
Audit Article

The Importance of Independent IT Audit

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

12 July 2024
Zechariah Oluleke
Blog Post

The Looming Threat of Unsecured IoT Devices: A Deep Dive

A secure Internet of Things ecosystem demands a multi-faceted approach, including specialized security solutions and layered defense mechanisms.

10 July 2024
Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking
ISACA Journal Article

Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking

Within the complex modern financial system, banks are the guards that protect the assets and transactions of many people. Yet it is because of this status that they are the perfect victims of competent criminals.

Author: Maduabuchi Christopher Okonkwo
Abigail Bada
Blog Post

Empowering Women in Technology: ISACA’s Commitment to Bridging the Gender Gap

Through the ISACA Scholarship Program and the Digital Trust Workforce Inclusion Program, the ISACA Foundation helps to create equitable access to education, training, and career opportunities.

8 July 2024
Chidambaram Narayanan
Blog Post

Ten Pivotal Moments in an Internal Auditor's Career

Learning to navigate disagreements, adapting to emerging technology and keeping up to date on key regulations are among many pivotal factors in an internal auditor's career success.

3 July 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Examining the Risks of IT Hero Culture

The allure of the "IT hero" is compelling. IT heroes are individuals who, like the Avengers or Batman, seem to single-handedly save enterprises day after day.

1 July 2024
ISACA Announces 2024 Annual General Meeting
@ISACA Article

ISACA Announces 2024 Annual General Meeting

ISACA’s 2024 Annual General Meeting of the Membership will be conducted in person in Schaumburg, Illinois, USA on 24 July at 8 a.m. Central Daylight Time at the ASA Auditorium and virtually.

1 July 2024
Carving an Elephant
ISACA Journal Article

Information Security Matters: Carving an Elephant

Zero trust architecture is based on core principles including least privilege and network segmentation. But it is also based on certain assumptions.

Author: Steven J. Ross
Digital Trust: Automation and Its Impact
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—Automation and Its Impact

How we implement automation, the controls we establish, and the areas we choose for automation implementation, all influence the level of digital trust in our organizations.

Author: K. Brian Kelley
Orthopedics and Machines: It’s an Orchestra
ISACA Journal Article

IS Audit in Practice: Orthopedics and Machines—It's an Orchestra

Of all industries, medicine is a centerpiece for the hope fostered by technical innovation.

Author: Cindy Baxter
Should We Be Relying on AI-Driven Mobile Robots?
ISACA Journal Article

Should We Be Relying on AI-Driven Mobile Robots?

AI and robots were created to assist humanity in its evolution. But robots unchecked have the potential to pose a danger to humanity.

Author: Larry G. Wlosinski
When Computer Says No
ISACA Journal Article

When Computer Says No

The risk inherent in AI systems can exacerbate the phenomenon of users having blind faith in technology. As AI becomes increasingly complex and autonomous, there is greater potential for unforeseen errors, biases, or ethical lapses to occur.

Author: Richard Clapton
Beyond the Cell Walls: Cybersecurity Insights From The Shawshank Redemption
ISACA Journal Article

Beyond the Cell Walls: Cybersecurity Insights Form The Shawshank Redemption

Inspiration can be drawn from the timeless tale of perseverance in the film The Shawshank Redemption by exploring the parallels between the prison walls of Shawshank and the digital fortresses constructed to protect data.

Author: Abdelelah Alzaghloul
The Pivotal Role of AI in Navigating the Cybersecurity Landscape
ISACA Journal Article

The Pivotal Role of AI in Navigating the Cybersecurity Landscape

A holistic approach, merging AI with human expertise and robust governance, alongside continuous monitoring, is essential to effectively combat evolving cyberthreats.

Author: Robert Putrus
Security Challenges and Opportunities of Crowdsourcing for Data Annotation
ISACA Journal Article

What is Resilience and How Does It Promote Digital Trust?

Resilience means moving away from technology to mitigate cyberrisk, and this requires collaboration among technology, people, processes, and enterprises.

Author: Alex Sharpe
Security Challenges and Opportunities of Crowdsourcing for Data Annotation
ISACA Journal Article

Security Challenges and Opportunities of Crowdsourcing for Data Annotation

Many LLMs rely heavily on labeled data for training and have a high demand for annotated data, which crowdsourcing can help meet in a flexible and cost-effective manner. However, this approach also comes with several challenges.

Author: Pranav Kumar Chaudhary
Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors
ISACA Journal Article

Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors

The BoD assumes a pivotal role in the orientation and direction of organizations to select the best business strategies that not only allow them to challenge current business plans, but also inspire the necessary transformations in the executive teams.

Author: Jeimy J. Cano M.
System Overload
ISACA Journal Article

System Overload

Enterprises rely on systems, and systems sometimes fail. A system can either break down during one of its component processes or initiate processes that run smoothly but fail to produce the desired result/output.

Author: Kevin M. Alvero
From Humble Beginnings: How the CISO Role Has Evolved
ISACA Journal Article

From Humble Beginnings: How the CISO Role Has Evolved

The CISO role has undergone a considerable transformation, adapting to ever-changing technological advancements, regulatory requirements, emerging threats, and increasingly sophisticated threat actors.

Author: Brian Vasquez
CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success
Blog Post

CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success

ISACA's new Certified Cybersecurity Operations Analyst (CCOA) credential prepares early-career cybersecurity professionals for a range of in-demand roles in the field.

28 June 2024
Adeleke Ayobami
Emerging Technology Article

Leveraging AI for Information and Cybersecurity

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

28 June 2024
Jayakumar Sundaram
Blog Post

ISO 27001 Shines Bright As a Beacon of Trust

The ISO 27001 Risk Assessment is not just a standard or certification; it can serve as a beacon of trust for a range of stakeholders.

27 June 2024
AI Risk and Mitigation Tips and Tricks for Auditing in the AI Era
ISACA Journal Article

AI Risk and Mitigation: Tips and Tricks for Auditing in the AI Era

Inadequately controlled AI can make mistakes that are high-impact, yet subtle in their appearance. This can result in significant damage, especially if a human review is considered difficult or impossible.

Author: Spiros Alexiou
David Kliemann
Blog Post

Building an AI Risk Management Program: A Security & Audit Team Perspective

Implementing trustworthy artificial intelligence requires enterprises to put in place a solid governance structure and a comprehensive framework of controls.

25 June 2024
Poonam Gupta
Blog Post

European Union Artificial Intelligence Act: An Auditor’s Perspective

Organizations will need to identify the needed audit and governance resources and skill sets in order to make implementation of the EU AI Act successful.

24 June 2024
Ameet Jugnauth, Bryan Lillie, Peter Leitch
Podcast

The Cyber Standard Podcast: Episode 4

Welcome to Episode 4 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the world of cybersecurity standardization.

21 June 2024
Mathura Prasad
Blog Post

Navigating the Challenges of Cybersecurity in the Modern Data Landscape

With exponential growth in data, addressing the related privacy, risk and security implications on the data landscape needs to be a top priority for digital trust professionals.

20 June 2024
Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge
ISACA Journal Article

Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge

The transition to ISO/IEC 27001:2022 is a strategic process that requires careful planning and execution. 

Author: Jayakumar Sundaram
Megan Hall
Blog Post

Governance Key to Taming Evolving Risk Landscape

The risk landscape continues to transform, highlighting the need for cross-functional collaboration, leveraging of frameworks and effective third-party risk management.

18 June 2024
Yet Another Risk Depiction (YARD)
ISACA Journal Article

Yet Another Risk Depiction (YARD)

Whether risk presents in a new form or one that has already been observed, a precise formula for predicting it has not yet been discovered.

Author: Luigi Sbriz
Veronica Rose
@ISACA Article

How to Maintain Your ISACA Certifications

Attaining an ISACA certification is crucial to anyone’s career and, as such, you wouldn't want to lose that certification that you have worked so hard to achieve.

17 June 2024
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Integrating Climate Change Considerations into ISO Standards: A Paradigm Shift

In an era marked by growing environmental consciousness, organizations worldwide are reevaluating their business practices to align with sustainable principles.

17 June 2024
Alex Holden
Blog Post

Security Professionals Face Big Challenge in Evolving Ransomware Landscape

The shifting ransomware landscape places responsibility on security professionals to keep pace with new attack types and trends that are especially targeting vulnerable industries.

17 June 2024
Richard Marcus
Blog Post

Managing AI’s Transformative Impact on Business Strategy & Governance: Strategies for CISOs

Gain a firmer handle on AI risks, controls design, needed detection and monitoring capabilities, and best practices for AI implementations.

14 June 2024
Prabin Litto
Security Article

Cloud Security Challenges in the Pharmaceutical Industry

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

14 June 2024
Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors
ISACA Journal Article

Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors

Cybersecurity adds complexity for investors, financiers, and buyers in the acquisition market, necessitating more thorough due diligence regarding an enterprise’s technology stack. There are three methods proposed herein to relieve this burden.

Author: Yuri Bobbert
Chidambaram Narayanan
Blog Post

The Numbers Whisper, But Stories Captivate: Rethinking Audit Communication

Auditors need to go beyond the cold, hard facts and incorporate time-tested storytelling methods to make their reports resonate more deeply with stakeholders.

11 June 2024
Agile: The X Factor of Internal Auditing
ISACA Journal Article

Agile: The X Factor of Internal Auditing

There is a need to make internal audits more adaptable and iterative beyond what a linear waterfall approach allows. Enhancing the adaptability and iterative nature of audits is essential to moving beyond the constraints imposed by a linear waterfall approach.

Author: Thomas J. Bell III
Victor Fang
Blog Post

AI for Auditors: Challenges and Opportunities for Career Advancement

An ISACA training course on AI for auditors explores categories of AI algorithms that auditors will encounter, relevant regulations, how to audit third-party AI dependencies and more.

10 June 2024
Candice Jackson
Risk Article

Has the Digital Journey Added to the Risk of Using Third Parties?

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

7 June 2024
Chetan Anand
Blog Post

More Responsible Data Usage Through Privacy-Enhancing Technologies

ISACA's new white paper on privacy-enhancing technologies describes popular PETs, explores regulatory perspectives for using PETs for compliance and provides examples of how the technologies are being used.

6 June 2024
Person pointing at digital icons
ISACA Journal Article

Cryptographic Advancements Enabled by Diffie–Hellman

Symmetric key cryptography was enabled by concepts first proposed in 1976 in “New Directions in Cryptography.” The concepts proposed have evolved; however, the core ideas remain relevant and can provide valuable insights into how the research community can address security needs.

Author: Srikanth Ambatipudi
Wojciech Misiura
Blog Post

A Toolkit to Facilitate AI Governance

ISACA's AI Audit Toolkit helps auditors to verify that artificial intelligence systems meet needed benchmarks for governance and ethical responsibility.

4 June 2024
The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations
ISACA Journal Article

The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations

Enterprises must recognize and understand the virtuous circle of attackers, wherein adversaries generate asymmetries that create blind spots and enable cyberattacks, resulting in instability, uncertainty, and chaos across an organization.

Author: Jeimy J. Cano M.
State of Digital Trust 2024
@ISACA Article

Attaining Peace of Mind Under the Digital Trust Umbrella

Establishing digital trust with customers and stakeholders remains elusive for many organizations, as reinforced by new ISACA research.

3 June 2024
Biruk Worku, CRISC, Director, IT Security
@ISACA Article

Five Tips for Success on ISACA Certification Exams

Five strategies for tackling ISACA certification exams in one shot .

3 June 2024
George Goodwin and Karen Franklin
Blog Post

ISACA Member Finds Newfound Career Optimism Through Mentorship Program

ISACA member George Goodwin credits his ISACA Mentorship Program mentor, Karen Franklin, with giving him the confidence and encouragement he needed at a critical juncture of his career.

3 June 2024
Divya Aradhya
Blog Post

Security-as-Code: A Key Building Block for DevSecOps

Security-as-Code can ensure that key security protocols and good practices are automated and integrated directly into all components of the software development lifecycle.

31 May 2024
Patrick Barnett
Security Article

Understanding Sandworm, a State-Sponsored Threat Group

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

31 May 2024
Password Hygiene: The Present and Future State
Blog Post

Password Hygiene: The Present and Future State

Best practices for password hygiene remain fluid as many professionals eye a future where passwords will no longer be a fixture on the security landscape

30 May 2024
Breaking Down Operational Barriers Between IT, Information Security, and the Business
ISACA Journal Article

Breaking Down Operational Barriers Between IT, Information Security, and the Business

Effective collaboration, rooted in clear and open communication, is not only crucial for the seamless operation of the organization but also essential to instill a sense of fulfillment and the satisfaction of a job well done.

Author: Kenneth Abbott
Neil Lappage
Blog Post

Bridging the Digital Trust Gap: An Urgent Imperative

Organizations that do not prioritize building digital trust open themselves up to significant business and reputational risks, as underscored by ISACA's 2024 State of Digital Trust research.

29 May 2024
Five Key Takeaways from the 2024 RSA Conference
Blog Post

Five Key Takeaways from the 2024 RSA Conference

The growing influence of artificial intelligence on the security landscape was top of mind for many presenters and attendees at the recent 2024 RSA Conference.

28 May 2024
Finger pointing at digital globe
ISACA Journal Article

AI-Infused Foresight: Unveiling Megatrends for Strategic Adaptation

AI plays a significant role in shaping megatrends, guiding enterprises to incorporate AI into strategic planning for a competitive edge, effective risk management, and innovation potential.

Author: Robert Putrus
Rethinking Cybernetics: Why and How
Blog Post

Rethinking Cybernetics: Why and How

When it comes to the looming arrival of quantum computing, the creation of a new Turing machine will be the necessary starting point.

24 May 2024
C. Warren Axelrod
Blog Post

AI AIn’t Human

Many of the guardrails that exist in the context of human thinking are not in place for artificial intelligence, which presents a range of significant challenges.

23 May 2024
Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology
ISACA Journal Article

Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology

Secure platforms enabled by techniques such as secure multiparty computation (SMPC) allow partners to derive insights and optimize media campaigns without pooling or exposing raw data.

Author: Puneet Gangrade
Veronica Rose
Blog Post

Are We In Control of Our Digital Lives?

Technology is neither inherently good or bad, but it can be addictive, and digital trust professionals have a role to play in countering the harms that can result.

21 May 2024
Felix Muckenfuß, CIPM, CIPP/E
Governance Article

Reinforcing IT Governance in the Face of Constant Threats

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

21 May 2024
Resilience Challenges, Metrics, and Responses in Today’s Landscape
ISACA Journal Article

Resilience Challenges, Metrics, and Responses in Today’s Landscape

Although enterprises strive to take mitigating measures, the question remains: Will they be enough when—not if—a major disruption occurs?

Author: Spiros Alexiou
Artificial intelligence
@ISACA Article

ISACA Releases New AI Insights, AI Training Courses

Three in five respondents to a new ISACA survey on artificial intelligence are worried or very worried that bad actors will exploit generative AI, yet only 35 percent say AI risks are an immediate priority for their organization.

20 May 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

The 6 Key Questioning Methods for Internal Auditors

Internal auditors are vital guardians of organizational integrity, scrutinizing processes, identifying risks and suggesting solutions.

20 May 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

The Reason Why Cybersecurity is Still Everyone's Job

As a cybersecurity professional, I have sat through many years of boring, bare-bones and dry security awareness training in which I learned enough to meet compliance requirement and pass the annual training to meet business metrics.

20 May 2024
Chandrasai D.
Blog Post

Unlocking Digital Transformation in Pharma: A Least-Vendor Approach with the 3A-3C Framework

A least-vendor strategy can bring big benefits to organizations as they undergo digital transformation projects that otherwise can become complex and strain resources.

17 May 2024
Samuel Zaruba Smith, Ph.D.(c)
Blog Post

Solving the First Conversation Problem in AI

Solving The First Conversation Problem in AI can go a long way toward companies having greater impact in leveraging the promising technology.

16 May 2024
ISACA Journal Article

Future Ready: Utilizing OKR for Audit Engagement Planning

Embracing balanced management approaches can position internal audit as a key player in driving organizational innovation.

Author: Noam Koriat
Guy Pearce
Blog Post

The Benefits of National Digital Health in a Short Story

When properly designed and implemented, patient-centric digital healthcare brings transformative potential to healthcare patients around the world.

14 May 2024
Chidambaram Narayanan
Blog Post

Navigating the AI Maze: An IT Auditor’s Guide Utilizing ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework helps auditors and other digital trust professionals ensure that AI is implemented in a way that strengthens the organization and inspires trust with stakeholders.

13 May 2024
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

The $8,000 SOC 2 Conundrum

While the typical cost of a standard SOC 2 audit is going down, the skill level required for auditors to effectively perform them is increasing.

10 May 2024
Ivan Mans
Security Article

SAP Security Maturity: A Crash Course

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

9 May 2024
Meghan Maneval
Blog Post

A Pathway to an Actionable AI Governance Roadmap

A new ISACA course on artificial intelligence governance can help professionals learn to design, develop, implement and monitor trustworthy AI within their organization.

8 May 2024
ISACA Journal Article

Building a Resilient and Successful Enterprise: Key Attributes and How to Measure Them

A manufacturing enterprise recently experienced disruption and near collapse after a fire destroyed its main production facility.

Author: Mahmoud Mohamed
Meghan Maneval
Blog Post

A Better Path Forward for AI By Addressing Training, Governance and Risk Gaps

New ISACA survey data on artificial intelligence realities show that companies need to ramp up training and policies to deal with emerging risks from the powerful technology.

7 May 2024
Mary Carmichael
@ISACA Article

Eight Overlooked Emerging Tech Risks and How to Mitigate Them

Emerging technologies refer to rapidly evolving advancements that can transform industries and society by introducing unique capabilities, processes or products. However, these technologies.

6 May 2024
Jack Freund
@ISACA Article

The Role of the Risk Sin Eater

While cybersecurity professionals may be experts in cyberrisk and mitigation, business decision makers must weigh the pros and cons of the broader business interests against many forms of risk, of which cyber is only one.

6 May 2024
Gokhan Polat
Blog Post

Unlocking AI’s Potential: How COBIT Can Guide Your Business Transformation

The COBIT framework can help organizations implement artificial intelligence more responsibly and in ways that ultimately will create more value for the enterprise.

2 May 2024
Cybersecurity lock
ISACA Journal Article

AI and Automation in Cybersecurity: Future Skilling for Efficient Defense

The ever-evolving threat landscape poses significant challenges, requiring innovative approaches to defend against sophisticated attacks. One approach gaining traction is the integration of artificial intelligence (AI) and automation into cybersecurity practices.

Author: Singirikonda Manikanta
Zero Trust Architecture
ISACA Journal Article

Information Security Matters: The Inhibitors to Zero Trust Architecture

The essential premise of Zero Trust is that users must be verified every time they attempt to access information resources, not only at the point at which they sign in.

Author: Steven J. Ross
Building digital trust
ISACA Journal Article

The Digital Trust Imperative: To Build Digital Trust, Start With Resiliency

The ties between resiliency and both technical architecture and security make sense. So how does digital trust apply to resiliency?

Author: K. Brian Kelley
Digital Architecture
ISACA Journal Article

IS Audit in Practice: Resilient Architecture

Today resiliency still means the business continuity and backup plans, but the buzz has moved to environmental considerations when one thinks of resilience.

Author: Cindy Baxter
Person typing
ISACA Journal Article

The Bleeding Edge: Leveraging Application Service Architectures for Trust

There is often a disconnect between those of us chartered with fostering digital trust and optimizing risk and those tasked with building out the applications that service internal users, customers, partners, and other stakeholders.

Author: Ed Moyle
Cyber shield with lock
ISACA Journal Article

Overcoming Cyberresilience Design Challenge

From a risk perspective, cyberresilience is intended to help reduce the risk of dependence on cyber resources.

Author: Larry Marks
Person in a server room
ISACA Journal Article

Case Study: Building a Cyber Line of Defense and Empowering Team Members

Global competition, technological disruptions, economic fluctuations, geopolitical threats, and public health crises have created an imperative for enterprises to become more resilient and adaptive if they hope to survive and thrive.

Author: Katie Teitler
Digital Operational Resilience
ISACA Journal Article

European Financial Industry Shifts Toward Digital Operational Resilience

Digitalization is essential for financial institutions to remain competitive, meet evolving customer demands, and achieve sustainable growth in an increasingly digital environment.

Author: Kilian Trautman
Cyber network
ISACA Journal Article

Evaluating the Promise and Problems of Data Fabrics

The growing expanse of data makes it harder for analysts to find the right data, convert it, and archive it in a useful form using traditional database designs.

Authors: Nikos Orth and Gerald F. Burch
How to Build Digital Trust in AI
ISACA Journal Article

How to Build Digital Trust in AI With a Robust AI Governance Framework

The widespread adoption of AI brings forth multifaceted risk, including privacy breaches, data security vulnerabilities, and ethical dilemmas.

Authors: Carol Lee, Terence Law Tom Huang, and Lanis Lam
Mobile device with a security lock
ISACA Journal Article

User Susceptibility to Malicious Push Notifications in Augmented Reality at the Workplace

As studies of AR security have primarily explored privacy concerns rather than social engineering and other threats, the combined risk factors of push notifications within an AR setting warrant deeper investigation.

Author: Sarah Katz
PCI DSS Compliance in the AWS Cloud
ISACA Journal Article

Navigating PCI DSS Compliance in the AWS Cloud

PCI DSS v4.0 introduces significant changes that are particularly relevant to cloud computing. These changes reflect the standard’s adaptation to the evolving digital payment landscape and the growing use of the cloud for processing payment data.

Author: Vijay Kasibhatla
2023 Annual Report
Blog Post

2023 ISACA Annual Report Shows How ISACA is Fueling Future

The 2023 ISACA Annual Report provides updates on ISACA's finances, leadership and important progress made throughout the year by ISACA's global community.

30 April 2024
Han Jumashov
Blog Post

Three Reasons Why You Should Not Wait to Take the CISA Exam

There are several benefits for rising IT auditors to take the CISA exam even before they have the full years of experience required to complete their certification.

29 April 2024
Mathieu Gorge
Security Article

Navigating the Cyber Elephant in the Boardroom

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

29 April 2024
Aleksei Panov
Blog Post

Performing an ATM Security Audit

In preparing for an ATM security audit, auditors will need to prioritize understanding core governance and business processes impacting ATM management.

26 April 2024
Sushila Nair
Blog Post

ISACA Award-Winner Embraces Shared Vision for Safer Digital World

Sushila Nair, ISACA Technology for Humanity award-winner, sizes up the intersection of technology and humanity and what drew her to the cybersecurity field.

24 April 2024
The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century
ISACA Journal Article

The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century

In the fast-developing digital landscape of the 21st century, the deep web is a baffling hidden world where cybercriminals orchestrate a variety of illicit activities.

Author: Azad Mammadov
Prathibha Muraleedhara
Blog Post

The Need For AI-Powered Cybersecurity to Tackle AI-Driven Cyberattacks

Artificial intelligence can help security professionals counter the threats from cyberattacks that also are increasingly boosted by AI.

23 April 2024
Noelle Pickler
Blog Post

Volunteer Appreciation Week: ISACA Volunteers Share Their Stories

ISACA volunteers share their motivations and career benefits they have received through their volunteer activities.

22 April 2024
Daniel Liebau, Affiliate Faculty Member Singapore Management University and Roland Schwinn, Adviser
Blog Post

Vanity Gone Rogue: The Rise of Exploits Targeting Custom Blockchain Addresses

The Vanity Address Attack is an under-the-radar automation capable of confusing blockchain users and opening the door to digital fraud.

19 April 2024
Chidambaram Narayanan
Blog Post

Audit Career Insights: Letter to My Younger Self

Embracing change, drawing inspiration from others and staying curious are among the recipes for success and longevity in the audit profession.

18 April 2024
Art Poghosyan
Audit Article

Managing Compliance in 2024: Best Practices to Secure Cloud Access and Stay Audit-Ready

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

18 April 2024
Enabling Security Success Through IT Partnerships
ISACA Journal Article

Enabling Security Success Through IT Partnerships

Former US President Harry Truman once said, “It is amazing what you can accomplish if you do not care who gets the credit.

Author: Seth Earby
Ravikumar Ramachandran
Blog Post

Evolving Threats to Cloud Computing Infrastructure and Suggested Countermeasures

Cloud misconfigurations and insecure APIs are among the major threats to cloud computing infrastructure that need to be remediated.

16 April 2024
Policy Template Library Toolkit
@ISACA Article

ISACA Puts Forward New Policy Template Library

A policy template library from ISACA provides enterprises with the ability to build and customize the principles needed for their specific environments and compliance requirements

15 April 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100), ISACA Muscat Chapter Board Member
@ISACA Article

Navigating the Virtuous Path: Avoiding the 7 Deadly Sins of Internal Audit

Submitting incomplete work and auditing with an agenda are among the 'sins' that internal auditors should be sure to avoid.

15 April 2024
Brandon Burns
Blog Post

When it Comes to Controls, It’s the Little Things That Matter

Getting certain foundational, baseline control requirements right, including a tailored approach to risk management, benefits organizations of all types.

12 April 2024
Punit Bhatia
Blog Post

How Will AI Impact Our Jobs in Digital Trust Fields?

Artificial intelligence can be a constructive force on the jobs landscape, especially for those in digital trust professions, with the right approach and commitment to ongoing learning.

10 April 2024
Cybersecurity Risk of AI-Based Applications Demystified
ISACA Journal Article

Cybersecurity Risk of AI-Based Applications Demystified

The introduction of OpenAI’s ChatGPT was a tipping point in the field of artificial intelligence (AI) and, perhaps, a watershed moment in history.

Author: Varun Prasad
Mark Thomas
Blog Post

DTEF Takes Center Stage in ‘Ask Me Anything’ Conversation with ISACA Hall of Famer

Digital Trust Ecosystem Framework expert Mark Thomas recently shared his perspective on DTEF and digital trust during an Ask Me Anything conversation on ISACA's Engage community.

8 April 2024
Patrick Barnett
Security Article

Using a Functional Cybersecurity Exercise to Test Incident Response Plans

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

8 April 2024
Matthew Henshaw
Blog Post

Why You Should Get Your CRISC

The evolving risk and technology landscapes has made the knowledge and expertise of the CRISC credential all the more valuable for risk practitioners.

4 April 2024
Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement
ISACA Journal Article

Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement

Security is everyone’s responsibility. And although instilling a security culture in an organization is not always easy, it is essential.

Author: Jayakumar Sundaram
Luiz Claudio Diogo Reis, CISA, CRISC, CDPSE, COBIT 5 & 2019 Certified, Marcos Sêmola, CISM, CIPM, CDPSE, PCI/DSS, ISO27k LA, IAPP Vanguard Award LA 2023 and Paulo Sergio Pagliusi, Ph.D. in Information Security - RHUL, CISM, C|CISO, LA7799
Blog Post

Addressing Artificial Intelligence Threats and Risks from the Board of Directors Perspective Using COBIT 2019

The COBIT framework can be useful for enterprises as they look to responsibly operationalize and govern artificial intelligence.

2 April 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

Creative Approaches to Gaining Cybersecurity Experience

Volunteering, joining industry associations and finding creative ways to gain hands-on experience can all position those interested in breaking into cybersecurity for opportunities in the field.

1 April 2024
John P. Pironti
@ISACA Article

Five Key Benefits of Using a Third-Party Incident Commander for Security Incident Response

Third-party incident commanders are able to coordinate and govern incident response resources effectively, along with bolstering incident response plans and capabilities

1 April 2024
Tamim Ahmed
Blog Post

The Struggle of IT Risk Management in Micro, Small and Medium-sized Enterprises

Limited resources, misaligned priorities, lack of awareness, complexity of IT ecosystems and regulatory pressures are among the factors that make risk management especially challenging for small and medium-sized enterprises.

29 March 2024
Brian Gallagher
Blog Post

Shaping the Future with CMMI

The 2024 CMMI Conference will spotlight recent updates and improvements that position the CMMI community for increasingly high impact.

28 March 2024
Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance
Blog Post

Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance

The ISACA China Hong Kong Chapter contributed to a panel discussion with a focus on the potential impact of cyber commanders in the security governance ecosystem.

27 March 2024
A Proposed High-Level Approach to AI Audit
ISACA Journal Article

A Proposed High-Level Approach to AI Audit

Artificial intelligence (AI) has become ubiquitous in daily life, from healthcare and finance to virtual assistants and autonomous vehicles.

Author: Denis Piazzi
milova_omolara_shih_quinland-blog
Blog Post

Meet ISACA’s Women’s Month Scholarship Winners

ISACA Foundation Women's Month Scholarship Award winners share their motivations and future ambitions for making their mark on digital trust professions

26 March 2024
Isaac Kohen
Security Article

Five Steps to Secure an Enterprise Against Insider Threats

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

26 March 2024
keith-bloomfield-deweese
Blog Post

Get Grounded in AI

A new ISACA resource on artificial intelligence provides valuable insights applicable both to those beginning their journeys in AI as well as those with knowledge and experience.

25 March 2024
Maosen Cai
Blog Post

How to Instill a Culture of Data in Internal Audit Function

Asking the right questions and meaningfully addressing business challenges through analytics can set internal auditors on the right path toward establishing a culture of data

20 March 2024
Enhancing Collaboration to Improve Cybersecurity Practices
ISACA Journal Article

Enhancing Collaboration to Improve Cybersecurity Practices

The cyberthreat landscape is continually expanding as more enterprises and critical infrastructures increase their attack surfaces owing to their connectivity to the Internet.

Authors: Yasmin Nakhleh Jubran, Parsa Sadeghi, Kevin Melecio, Felipe Casabianca and Brian K. Ngac
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Quick Scoping: How to Easily Frame Your Environment from a Compliance Lens

Lessons learned from theft prevention in a retail environment have surprising relevance when it comes to compliance and access management.

19 March 2024
Varun Prasad
@ISACA Article

Best Practices for Auditable Security Controls

Strong identity and access management practices enable organizations to build a strong security posture, as cloud security expert Varun Prasad explains in this Q&A interview.

18 March 2024
Jack Freund
@ISACA Article

Common Sense Risk

Only by applying common sense can practitioners stop managing cybersecurity using the equivalent of mythology.

18 March 2024
Marcel den Hartog, CGEIT, Trend & Innovations Expert at Enable U in The Netherlands
Blog Post

Why AI Might Not Make the Best Coding Buddy

The information you upload in a public AI engine is public domain from the moment you press enter: what are the consequences for IT and corporate governance?

15 March 2024
Daniil Karp
Blog Post

How AI Is Transforming Audit, Risk and Compliance

Whether optimizing coverage in your compliance program, identifying similar risks across various business units or seeking more efficient risk management, AI-driven insight can help to connect the dots.

14 March 2024
Safia Kazi
Privacy Article

Optimize Enterprise Data and Uphold Privacy With ISACA’s DTEF

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

14 March 2024
The Ethical Challenge of IT Silos
ISACA Journal Article

The Ethical Challenge of IT Silos

Enterprise governance of information and technology (EGIT) and business-IT alignment are crucial to create value and achieve the goals and objectives of IT. 

Author: Rajesh Srivastava
Industry News
Privacy Article

Achieving Ethical Protection of Data Privacy

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

12 March 2024
BInita Patel
Blog Post

The Symbolic Dance: Exploring the Role of AI in Cloud Computing

The convergence of artificial intelligence and cloud computing offers big opportunities for organizations alongside potential security and privacy risks.

11 March 2024
Noelle Pickler
Blog Post

Refreshed Mission, Renewed Energy Around SheLeadsTech Program

ISACA's SheLeadsTech program has a refreshed focus and renewed commitment to offering expanded opportunities for women to make their mark on digital trust professions.

8 March 2024
Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships
@ISACA Article

Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships

A new framework from ISACA positions organizations to build more trustworthy relationships with customers while simultaneously operating more cost-efficiently and making better use of emerging technology.

6 March 2024
Do You Overthink? How to Avoid Analysis Paralysis in Decision Making
@ISACA Article

Do You Overthink? How to Avoid Analysis Paralysis in Decision Making

Establishing clear decision-making criteria can help organizations from becoming bogged down by regularly over-analyzing decisions.

6 March 2024
Tara Kissoon
Blog Post

Countering Identity Takeover Incidents

Protecting individuals' identities in the aftermath of a privacy incident begins with important communication from banking, credit, government and employment organizations.

5 March 2024
Mark Thomas, president of Escoute Consulting, Greg Witte, CISM, Security Engineer and Cybersecurity Instructor, and Rolf von Roessing, partner & CEO at Forfa Consulting
Blog Post

Digital Trust Ecosystem Framework a Valuable Complement to COBIT, Other Frameworks

The Digital Trust Ecosystem Framework and COBIT work well in tandem, with each playing a significant role in allowing organizations to build a stronger foundation for success.

4 March 2024
Connected network graphic
ISACA Journal Article

Assertion-Based Financial Audit Procedures Related to Crypto Assets

Auditors must learn practical approaches and procedures for auditing crypto assets to manage the audit risk associated with such assets effectively.

Author: Kilian Trautmann
Graphic with security symbol
ISACA Journal Article

Information Security Matters: Information Security Architecture—From Access Paths to Zero Trust

Zero Trust Architecture will not stop all cyberattacks, but it can ensure that organizations do not fall victim to the easiest of attacks or fail to discover a breach for months or even years.

Author: Steven J. Ross
Person in front of computer screens
ISACA Journal Article

IS Audit in Practice: How Managers Can Help Employees Thrive in Today’s Data Environment

No one faces the challenges of the data environment more than the front-line contributors in the audit and compliance professions.

Author: Cindy Baxter
Graphic of computer code
ISACA Journal Article

The Digital Trust Imperative: The Data Bare Minimum Is Not Enough

If an organization has competitors willing to show that they go beyond the bare minimum, the organization doing just enough to be compliant is going to find it hard to compete.

Author: K. Brian Kelley
Graphic of computer data network
ISACA Journal Article

The Bleeding Edge: Planning for the New Data Ecosystem

The rules of what we think we know about data are being rewritten. Several converging trends represent a seismic shift in our understanding of the technology ecosystem.

Author: Ed Moyle
Person working on a tablet with healthcare data
ISACA Journal Article

Data Interoperability: Addressing the Challenges Placing Quality Healthcare at Risk

The data interoperability challenge in global digital health, as experienced in the context of the variety of national electronic health record (EHR) deployments around the world, should have been avoidable.

Author: Guy Pearce
Laptop with overlying financial building and cloud graphics
ISACA Journal Article

Financial Clouds on the Horizon: Reassessing the Economics of Public Cloud Adoption for Financial Institutions

In an era characterized by rapid technological advancement and evolving customer demands, financial institutions face new challenges to remain competitive.

Author: Matthew Ryan
Light burst over computer code
ISACA Journal Article

Addressing the Privacy, Security, Risk, and Operations Aspects of the Data Ecosystem

Data privacy, security, risk management and operations are complex aspects of the global data ecosystem, and enterprises should address them with solutions based on research and best practices.

Author: Mathura Prasad
Graphic of globe
ISACA Journal Article

Building Compliance Resilience Amid a Patchwork of Data Protection and Privacy Laws

Organizations operating across multiple states or countries must contend with multiple privacy laws and regulations consisting of nuanced, divergent or even conflicting obligations and requirements.

Author: Corlane Barclay
Graphic with money symbols
ISACA Journal Article

Key Considerations To Effectively Plan And Determine The Scope Of An ATM Security Audit Based On PCI DSS

ATMs have become more evolved self-service platforms, helping people pay bills, transfer funds, and exchange currencies. The increase in the number of services offered by ATMs also increases their risk.

Author: Aleksei Panov
Computer code burst
ISACA Journal Article

Rethinking Cybernetics

The goal is by no means to reject the Turing machine, but rather to integrate it with a machine made more complex by the phenomenal advances in modern technology.

Authors: Jean Fayot,  Claude A. Laborde and Jean Claude Célestin
Finger pointing at network ring
ISACA Journal Article

Blockchain Smart Contracts, Part 4: How to Audit

Traditional financial auditing practices must evolve as blockchain technology and Web 3.0 technology become standard.

Authors: Samuel Zaruba Smith and Andy Garcia
Oleksii Baranovskyi
Blog Post

ISACA Award-Winner Stands at Crossroads of Theoretical and Practical

Oleksii Baranovskyi, of Ukraine, recipient of the ISACA Educational Excellence Award, is proud to simultaneously be a security professional and an educator.

29 February 2024
Jayakumar Sundaram
Blog Post

Harmony in Cyberleadership: Navigating the Gen Z Rhythm

Cybersecurity leaders should be mindful of the composition of their security teams, including common characteristics of Gen Z cyber professionals, when devising their approaches to leadership.

28 February 2024
A Factory Model Approach to Technology Control Testing
ISACA Journal Article

A Factory Model Approach to Technology Control Testing

Technology control testing is a comprehensive evaluation of an enterprise’s technological infrastructure, systems and processes.

Author: Michael Powers, PH.D., CRISC
Mukta Sharma
Blog Post

Third-Party Termination: Understanding Technology and Information Security Risks

Mitigating the technology and information security risks from terminating third parties calls for organizations to formulate nuanced security strategies.

27 February 2024
Aparna Agarwal
Security Article

The Top 5 Cybersecurity Threats and How to Defend Against Them

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

27 February 2024
Pablo Ballarin Usieto
Blog Post

Fallout from Viamedis, Almerys Attack Does Not End with the Data Leak

A major breach in France reinforces the need for sharpened security practices and the overarching imperative to drive toward strengthening digital trust.

26 February 2024
A Cybercriminal is Sentenced. Will It Make a Difference?
Blog Post

A Cybercriminal is Sentenced. Will It Make a Difference?

Ransomware often targets small-to-medium enterprises, so security teams need to take action to be more prepared for this potentially devastating line of attack.

23 February 2024
Ali Pabrai
Blog Post

CMMC: A Global, Resilient Cyber Supply Chain Standard

The Cybersecurity Maturity Model Certification standard helps businesses to examine their computing ecosystem and enhance capabilities for stronger supply chain resilience.

22 February 2024
Nandita Rao
@ISACA Article

Strategies to Prepare for US State Privacy Law Compliance

Absent a major breakthrough on a federal privacy law, more US states are likely to enact privacy laws that will add to an already complex policy patchwork.

21 February 2024
The Commoditization of Ransomware-as-a-Service
@ISACA Article

The Commoditization of Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) is posing new, difficult challenges for organizations and law enforcement organizations alike.

21 February 2024
The Skills Combination We Need to Address the Global Cybersecurity Skills Gap
@ISACA Article

The Skills Combination We Need to Address the Global Cybersecurity Skills Gap

Embracing the right blend of hard and soft skills can position professionals to find opportunity in the cybersecurity profession.

21 February 2024
Shini Menon
Blog Post

Broad, Regulatory Frameworks Needed to Responsibly Harness AI

As regulatory frameworks for the AI era continue to evolve, governments around the world will need to find a shared sense of purpose and collaborate on the best way forward.

21 February 2024
The Three Lines Model in Cybersecurity Governance and Risk Management
ISACA Journal Article

The Three Lines Model in Cybersecurity Governance and Risk Management

A solid cybersecurity governance structure (inclusive of cyberrisk management) should entail clear accountability for cybersecurity and unequivocal authority for cyber decision making within an organization.

Authors: Ivano Bongiovanni, PH.D., Sergeja Slapniičari, PH.D., CPA, Micheal Axelseni, PH.D., CPA and David Stockdalei, PH.D.
Ravikumar Ramachandran
Blog Post

The Key Steps to Successfully Govern Artificial Intelligence

Accounting for key characteristics of trustworthiness and considering perspectives from a range of stakeholders are among the needed ingredients to strengthen AI governance.

19 February 2024
Chidambaram Narayanan, Chartered Accountant, CISA, Azure Cybersecurity Architect Expert (SC-100)
Blog Post

Eight Things NOT To Do When Preparing for the CISA

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

16 February 2024
Jessica Burnett
Blog Post

The Digital Trust Game-changer: Get Ready for the Digital Trust Ecosystem Framework

Trust reigns supreme in this digital era. And as technologies like AI revolutionize industries, the importance of trust continues to skyrocket.

15 February 2024
Jagdish Mohite
Blog Post

The Surge in AI Development: Boon or Bane

Responsible development of artificial intelligence that recognizes the need for a balance between AI and human capabilities is the path to ensure the powerful technology's good outweighs the bad.

14 February 2024
Ricky Hamilton
Blog Post

Auditing Social Engineering: A Practical Approach

By asking the right questions around people, processes and technical controls, auditors can gather the evidence and documentations they need to successfully audit social engineering.

13 February 2024
Guy Propper
Security Article

Navigating the Shifting Ransomware Landscape

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

13 February 2024
Ramona Ratiu
Blog Post

Securing the Future: Enhancing Cybersecurity in 2024 and Beyond

Prioritizing comprehensive cybersecurity strategy in support of overarching enterprise goals can position enterprises for success, even amid challenging threat and regulatory environments.

12 February 2024
RV Raghu, Past Board Director, ISACA, and director of Versatilist Consulting India Pvt. Ltd
Blog Post

AI and Patents: More Questions Than Answers

Court rulings that AI cannot be granted patents provided needed short-term clarity but there are still many open questions about how AI should be viewed in legal, ethical and practical contexts.

9 February 2024
Board room setting
ISACA Journal Article

Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model

Organizations across a variety of industries can benefit from a well-planned GRC strategy.

Author: Robert Putrus
Derek Melber
Podcast

A View into CTEM Exposure Management: Reducing your Attack Surface 3x

Organizations can no longer rely on legacy vulnerability management solutions to protect against even basic attacks.

7 February 2024
Guy Pearce
Blog Post

Digital Proficiency: Not Only for Individuals

Technology-minded countries around the world can learn a lot from Rwanda, which, despite limited resources, has become a digital benchmark through an impressive set of initiatives and ingenuity.

6 February 2024
Goh Ser Yoong
@ISACA Article

Five AI Priorities for Digital Trust Professionals to Put on Their 2024 To-Do List

Greater awareness of potentially unethical AI usage and adapting to evolving AI regulations are some of the considerations that should be top-of-mind for digital trust professionals in 2024.

5 February 2024
US Congressman Visits ISACA for CMMI Update, AI Policy Discussion
@ISACA Article

US Congressman Visits ISACA for CMMI Update, AI Policy Discussion

A recent visit by a United States congressman to ISACA's office in Schaumburg included discussion of artificial intelligence policy and updates on how CMMI is sharpening enterprise performance.

5 February 2024
Divya Aradhya
Blog Post

Threat Modeling and Secure-By-Design Applications

Identifying the flows, assets and vulnerabilities are among the key building blocks when threat modeling for software applications.

5 February 2023
Jo Stewart Rattray
Blog Post

Taking Action to Create a Future Where AI Benefits Us All

Artificial intelligence is a human creation that reflects the people who developed it, meaning we must guard against humans' shortcomings and biases resulting in AI furthering inequality and other societal harms.

2 February 2024
Arun Mamgai
Security Article

How CISOs Can Take Advantage of the Balanced Scorecard Method

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

2 February 2024
Jay Hira
Blog Post

Global Experts Weigh in On Australia’s ‘Six Cyber Shields’ – Sharing Insights on Achieving a Safe Digital World

Global cybersecurity practitioners share their perspectives on Australia's new cyber shields strategy to provide more robust protection of digital assets in the coming years.

31 January 2024
Strengthening SIF Detection
ISACA Journal Article

Strengthening SIF Detection: Leveraging Social Media Footprints

SIF is a growing problem for financial institutions. At the same time, the monetary losses from SIF are difficult to quantify, with estimates ranging between US$20 billion and US$40 billion.

Authors: Mario Bojilov, PH.D, CISA, Kishore Singh, PH.D and Peter Best
Mike Boutwell
Risk Article

Navigating the Treacherous Waters of IT Risk

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

30 January 2024
ookeditse-kamau
Blog Post

‘Just for Control’: the True Power of Controls

Ill-designed controls can waste organizations' time and resources, so make sure implementing controls is more than just a power move.

29 January 2024
Nina Bryant and Susana Esteban
Blog Post

Responsible AI Governance in Traditional and Emerging Ecosystems

Organizations implementing artificial intelligence into their operations will need strong governance in place to ensure transparency and trust in their AI usage.

25 January 2024
Anthony Oteri
Blog Post

Executing A Well-Executed Risk and Control Self-Assessment

When executed properly, risk and control self-assessments become enablers for organizations to more effectively navigate the risk management landscape.

24 January 2024
Digital security shield
ISACA Journal Article

Securing the First Line of Defense

Cybersecurity awareness for employees is nonnegotiable. It helps protect both individuals and organizations by mitigating cyberthreats and protecting sensitive information, which strengthens the overall security posture of an organization.

Author: Hadi Manasrah
Jordan Kassing
Audit Article

Five Controls to Consider When Auditing a Vendor Management Program

Vendor management is a fundamentally critical function that impacts an organization's operational success, efficiency, reputation and risk exposure.

23 January 2024
Valerie Lyons
Blog Post

The Top 10 Things Every Cybersecurity Professional Needs to Know About Privacy

As the intersection between cybersecurity and privacy increases, security professionals can benefit from gaining a solid understanding of core privacy terminology and privacy principles.

22 January 2024
Nandita Rao Narla, Head of Technical Privacy and Governance at DoorDash
Blog Post

Privacy in Practice: Dissecting the Global Trends That are Shaping the Profession

Challenges on the privacy landscape can be successfully addressed through upskilling, privacy by design principles and solid training and awareness programs.

18 January 2024
New Timing for ISACA Newsletter
@ISACA Article

New Timing for ISACA Newsletter

The @ISACA newsletter will distribute on the first and third Mondays of the month in 2024, while a new monthly digest of top ISACA content will make its debut.

17 January 2024
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Projecting 2024 Cybertrends and C-Suite Responsibilities

Anticipated trends on the 2024 cybersecurity landscape provide opportunities for C-suite leaders to position their organizations to effectively and securely leverage emerging technology.

17 January 2024
Noelle Pickler
Blog Post

Mentorship: The Missing Ingredient in Your 2024 Goals?

The ISACA Mentorship Program has proven to be rewarding for mentors and mentees alike, allowing for valuable connections to propel ISACA members' careers to new heights.

17 January 2024
Cybersecurity locks
ISACA Journal Article

Increasing Security and Improving Performance With Network Managed Service Providers

Managing enterprise networks to meet increasing business requirements in the face of consistent cost reduction pressures can be demanding

Author: Oluwafemi Adeyemo Adeleke
Robin Lyons and Amanda Tucker
Podcast

Leveraging Agile Concepts for Neurodiverse Auditors

In this ISACA Podcast episode, we’ll explore how leveraging Agile concepts can mitigate common workplace challenges for neurodiverse auditors.

17 January 2024
Ravikumar Ramachandran
Blog Post

Post-Quantum Cryptography: Are We Ready for Q Day?

Focusing attention on understanding and building confidence in post-quantum cryptography now can save the security community major problems in the years to come.

16 January 2023
Ozman Azab
Audit Article

Six Benefits of a Cybersecurity Audit (and 6 Steps to Perform One)

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

16 January 2023
Sergio Tringali
Blog Post

Nurturing Responsible Innovation: ISACA’s DTEF Recognized for Advancing Trust in AI Environments

ISACA’s Digital Trust Ecosystem Framework (DTEF) empowers organizations to build and sustain digital trust in the age of artificial intelligence and other impactful technological advancements.

12 January 2024
Luigi Sbriz
Blog Post

Modeling Identity Trust

An identity system based on trust in a third party could better protect personal data and improve trust throughout the digital ecosystem.

10 January 2024
Computer room
ISACA Journal Article

Fog Computing and Edge Computing as Alternatives to the Cloud

Fog computing and edge computing have great potential to play major roles in the real-time processing of data.

Author: Kishan Sathyanarayanan
Fouad Mulla
Security Article

Building Cybersecurity Resilience With the Power of Habit

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

9 January 2024
Erik Prusch
Blog Post

ISACA’s Exciting 2024 is Underway

New ISACA digital trust resources, thought leadership, and upcoming events, both in-person and virtual, are among the coming attractions in 2024 for the ISACA community.

8 January 2024
Hakan Kantas
Blog Post

Workforce Resilience: A Critical Asset for Organizations in Today’s Dynamic World

Promoting a culture of ongoing learning and upskilling is part of the equation for organizations looking to develop a more capable and resilient workforce

5 January 2024
Grant Hughes
Blog Post

Building a Great Security Operations Center

Defining and articulating a clear strategy for a security operations center (SOC) will make it much more likely that organizational leaders and other key stakeholders will support the SOC on an ongoing basis.

4 January 2024
Cultivating Digital Trust and Sustainability in IoT Devices
@ISACA Article

Cultivating Digital Trust and Sustainability in IoT Devices

Explore strategies to secure your IoT devices in the aftermath of the holidays, in alignment with ISACA’s goal of ensuring digital trust.

3 January 2023
Jack Freund
@ISACA Article

Emotional Cyberrisk Management Decisions

Emotions can complicate or even impair organizations' need for rational approaches to cyberrisk but that does not mean there is no place for emotion in the equation.

3 January 2024
Carol Lee
Blog Post

The Intersection of Change Management and Cybersecurity: A Paradigm Shift in Protection

Given its focus on human behavior in an organizational change context, change management can lead to a fresh and valuable perspective on cybersecurity

2 January 2024
Minimizing Risk and Audit Requests
Podcast

Minimizing Risk and Audit Requests

With the increasing demand for audits and risk assessments, artifact requests will not be going away anytime soon. However, the burden these activities bring to the organization can be drastically reduced when audit and risk work together.

3 January 2024
Digital biometric fingerprint
ISACA Journal Article

Information Security Matters: Who Put the Zero in Zero Trust?

Zero trust is quite supportive of digital trust; they overlap to a great extent.

Author: Steven Ross
Digital micro chip
ISACA Journal Article

IS Audit in Practice: A Collaborative Approach to Assessing AI Risk

Ethical AI occurs when the business, risk and compliance teams not only evaluate the business opportunity that AI brings but carefully consider its impact by sitting in the shoes of users, policymakers and financial market managers.

Author: Cindy Baxter
Finger pointing to gears and a handshake
ISACA Journal Article

The Digital Trust Imperative: AI’s Impact on Digital Trust

Given the proliferation of AI/ML solutions, it is important to understand potential areas of concern, especially ones that affect the reputation and trustworthiness of organizations and individuals within the digital ecosystem.

Author: K. Brian Kelley
Person looking at their cell phone
ISACA Journal Article

The Bleeding Edge: Free Resources for Hardening AI and ML

If your organization is exploring ways to derive business value from AI and ML, even just maintaining an awareness of the space and becoming educated about the security, assurance, risk, and governance implications is helpful.

Author: Ed Moyle
Finger pointing at digital brain
ISACA Journal Article

Harnessing the Power of Large Language Models

Organizations must understand how to use these new large language models without creating negative societal impacts.

Authors: Meike Hofmann, Gerald Burch and Jana Burch
Security lock
ISACA Journal Article

Securing the Future: Mitigating Data Security Concerns in Artificial Intelligence Models

Although AI can save time and effort, many users remain unaware of the potential risk to an enterprise’s sensitive data.

Author: Sharad Verma
Network of digital neurons
ISACA Journal Article

Deploying Responsible AI

With the impending adoption of regulations such as the EU AI Act, organizations must adopt holistic responsible AI programs.

Author: Joshua Scarpino
Digital globe map
ISACA Journal Article

The Potential Impact of New AI Regulations

There is a need for impactful regulations as well as a general awareness on how these regulations can positively improve the field of AI.

Author: Shini Menon
Finger pointing at digital wave
ISACA Journal Article

Subverting AI's Intellect: How to Thwart Data Poisoning

As AI systems proliferate and gain more widespread adoption, safeguards to thwart data poisoning attacks and ensure decisions that reflect human values become more important.

Author: Prithiv Roshan Sudhakar
Digital globe
ISACA Journal Article

Filling AI’s Cybersecurity Best Practice Gap

There are fundamental considerations necessary to creating a security and privacy risk management baseline for any AI implementation or deployment.

Authors: Joe Cozzupoli and John Salomon
Finger pointing at biometric fingerprint
ISACA Journal Article

Help Wanted: Evolving Privacy Roles and the Widening Privacy Skills Gap

This growing importance of privacy in organizations has led to a shift toward more technical privacy roles, where demand for such roles exceeds talent supply.

Author: Nandita Rao Narla
Kristi Hedges
Blog Post

Cultivating a Culture of Inspiration: ISACA’s Member-Exclusive Speaker Series

Kristi Hedges, a Fortune 500 leadership coach and author, shared her perspective on how to inspire others during the ISACA Member-Exclusive Speaker Series.

29 December 2023
Greg Shieds
Blog Post

Supporting Privacy, Security and Digital Trust Through Effective Enterprise Data Management Programs

Organizational silos, poor data quality and improper data storage are among the challenges enterprises need to overcome to build effective data management programs and strengthen digital trust.

28 December 2023
ISACA Award Winner
Blog Post

ISACA Award Winner Advocates for ‘Life or Death’ Matter of Information Management

Castlepoint Systems, an Australian organization focused on data protection, compliance and risk management, was recognized with the 2023 ISACA Innovative Solutions Award.

27 December 2023
Globe with networking icons
ISACA Journal Article

Securing the AI-Enabled Supply Chain With Vendor Management

Securing the AI-enabled supply chain will enable organizations to gain a competitive edge by ensuring a secure and reliable supply chain ecosystem.

Author: Anuj Choudhary
Adam Kohnke
Blog Post

Top Management Considerations for Zero Trust

A new zero trust audit program from ISACA can help organizations transition from traditional network security architectures to ones that are better equipped to handle the modern threat landscape.

26 December 2023
Justin Rende
Security Article

Track These 7 Trends for Proactive Cybersecurity in 2024

As 2024 looms near, digital threats are expected to increase in sophistication. Consequently, the tools and strategies cyberprofessionals use to counter them must also adapt.

26 December 2023
Ravikumar Ramachandran
Blog Post

API Security: An Internal Auditor’s Quick Reference

Effective usage of Application Programming Interfaces (APIs) calls for diligence in related security controls and audit considerations.

21 December 2023
Jack Freund
@ISACA Article

Defective CISOs: Lock Them Up?

The possibility of legal exposure for CISOs in the current climate reinforces the perils of an already stressful and difficult role.

20 December 2023
Rahul Pandey
@ISACA Article

The Window of Exposure: A Critical Component of Your Cybersecurity Strategy

Understanding the nuances of the window of exposure when systems are at risk and is critical for security professionals to effectively protect their organizations.

20 December 2023
phoenix-defense-case-study
Blog Post

Significantly Improving Security Posture: A CMMI Case Study

Adopting CMMI has led to performance improvements across the board for Phoenix Defense, including a significant reduction in network attacks.

20 December 2023
Group of people around an office table
ISACA Journal Article

Understanding CISO Management Styles

CISOs and CIOs can adopt a variety of management styles, depending on the individual’s personality and personal preferences, leadership styles, the organizational culture and context, and the specific needs of the enterprise.

Author: Jayakumar Sundaram
Brian Levine
Blog Post

Protecting Your Organization from Cybersquatting

Registering and trademarking your internet domain, and monitoring for registrations with confusingly similar domain names, are among the ways organizations can protect themselves from cybersquatting.

19 December 2023
Chris McGowan
Security Article

Quishing: The Invisible Threat in QR Code Technology

When quishing occurs, unsuspecting individuals are lured into scanning malicious QR codes that link to fraudulent websites or malware downloads. Awareness surrounding this new threat must be raised to protect personal data and digital safety.

19 December 2023
How Business Leaders Can Responsibly Embrace Generative AI
Blog Post

How Business Leaders Can Responsibly Embrace Generative AI

A Forbes article by Phillimon Zongo lays out how enterprise leaders can help their organizations responsibly leverage generative artificial intelligence.

18 December 2023
Guy Pearce
Blog Post

Five Things for Governance Professionals to Put on Their 2024 To-Do List

In an era of increased complexity, formalizing data governance frameworks and data management protocols should be increasingly top-of-mind for governance professionals.

15 December 2023
Gary Carerra
Blog Post

Five Things for Privacy Professionals to Put on Their 2024 To-Do List

Gaining a better understanding of fast-evolving privacy regulations is a good starting point for privacy practitioners who are looking to position themselves for success in 2024.

14 December 2023
Serving Up Your 2024 To-do L
@ISACA Article

Serving Up Your 2024 To-do List

ISACA experts provide 2024 to-do lists for professionals looking to update their skill sets and expertise in the fields of IT audit, risk management, cybersecurity, privacy and IT governance.

13 December 2023
Sandeep Godbole
Blog Post

Five Things for Cybersecurity Professionals to Put on Their 2024 To-Do List

Incorporating artificial intelligence capabilities and sharpening the ability to architect security solutions in cloud settings can help cybersecurity professionals thrive in 2024.

13 December 2023
Person typing on a laptop
ISACA Journal Article

Using Security Controls to Mitigate Privacy Risk When Employees Use ChatGPT

If employees use generative AI, employers should implement effective information security controls and data protection measures and then monitor and assess the design and operating effectiveness of those controls to ensure compliance with security policies, contractual obligations and privacy regulations.

Author: Oluwafemi Adeleke
Mary Carmichael
Blog Post

Five Things for Risk Professionals to Put on Their 2024 To-Do List

Embracing the role risk management can play in supporting the strategic growth of the business is among the items risk professionals should place on their 2024 to-do lists.

12 December 2023
Sadiq Nasir
Security Article

Rethinking Cybersecurity Training to Build a Resilient Workforce

There is much to be gained by exploring various approaches to ensuring benefits realization for any cybersecurity training program.

12 December 2023
Veronica Rose
Blog Post

Five Things for Audit Professionals to Put on Their 2024 To-Do List

Prioritizing upskilling, participating in mentoring programs and authentic engagement with stakeholders are among the approaches that can get IT auditors off to a good start in 2024.

11 December 2023
Glenda Suarez Cabrera
Blog Post

Secure Software Development Lifecycle Cannot Achieve its Purpose Without Third-Party Risk Management

Treating security as a core element of the design, build and implementation of software products takes intentional action, and understanding the impact that third parties play in achieving the desired level of product security is a step that not everyone is prepared for.

8 December 2023
Vishal Sharma
Blog Post

Adapting Leadership for the Changing Technology and Cybersecurity Landscapes

The increasing prominence of technology in today's digital ecosystem calls for different approaches to organizational leadership, including creating an environment where innovative mindsets are encouraged.

7 December 2023
ISACA’s Top 10 Content Resources of 2023
Blog Post

ISACA’s Top 10 Content Resources of 2023

Discover 10 ISACA resources from 2023 that resonated at a high level with our professional community

6 December 2023
Caitlin McGraw
@ISACA Article

Lions and Tigers and Office Politics – Part 2: How to Successfully Join a New Organization, Team or Function

Insights on addressing the learning of politics of a new organization and how to ensure you don’t make mistakes.

6 December 2023
Liz Fosslien and Molly West Duffy
Blog Post

The Leadership Benefits of Emotional Fluency and Vulnerability: ISACA’s Member-Exclusive Speaker Series

A recent installment of the ISACA Member-Exclusive Speaker Series focused on vulnerability and managing emotions in a workplace and leadership context.

6 December 2023
Person typing on a laptop with a digital security overlay
ISACA Journal Article

Lessons Learned From the Bangladesh Bank Heist

This cyberheist serves as a reminder that financial institutions worldwide need to rethink their cybersecurity strategies, risk management protocols and collaborative efforts to protect against similar cyberthreats.

Author: Mohammad Sami A Kabir
Ramona Ratiu
Blog Post

The Essentiality of Cybersecurity for Small Businesses: Applying Zero Trust Principles

Applying zero trust principles can be every bit as essential for smaller businesses to protect themselves as for large enterprises.

5 December 2023
James Allman-Talbot
Security Article

The Grim Reality of a Cyberattack: From Probability to Certainty

The outlook is grim for organizations that wish to keep their data secure. It is necessary to understand practical methods for reducing the impact of suffering from an attack.

5 December 2023
John de Santis
Blog Post

Diverse, Experienced Board a Must for ISACA to Be at its Best

Nominations and applications are being accepted for the ISACA Board of Directors for the 2024-25 term

4 December 2023
Dalitso Tony Phiri
Blog Post

The Yellow Brick Road to Certifications: ISACA’s Mentorship Program and Exam Success

Finding a mentor through ISACA's Mentorship Program can help certification candidates on their path toward passing their exam, among a range of other benefits.

1 December 2023
How to Create a Healthy Security Culture
Blog Post

How to Create a Healthy Security Culture

Incentivizing reporting, collaborating on solutions and reframing teaching points in positive fashion are all elements that can improve an organization's cybersecurity culture.

30 November 2023
Andres Ricardo Almanza
@ISACA Article

Cybersecurity and Burnout: The Cybersecurity Professional's Silent Enemy

The demands on cybersecurity professionals can lead to mental health challenges, making it important that practitioners integrate mindfulness and proactively find ways to reduce burnout.

29 November 2023
Naomi buckwalter
Blog Post

The Benefits of Hiring Entry-level Cybersecurity Professionals

Many organizations are reluctant to hire relatively inexperienced people for cybersecurity roles but that approach is often misguided, according to recent ISACA Ask Me Anything expert Naomi Buckwalter.

29 November 2023
Wall of computers
ISACA Journal Article

How to Build a Great SOC

It is imperative for the purpose, scope and objectives of an SOC to be clearly defined and communicated from the start, otherwise the investment in the SOC can be difficult to demonstrate and the SOC may not support the organization’s objectives.

Author: Grant Hughes
Emily Bastedo and Sergio Tringali
Blog Post

ISACA Advocacy Partnering with Policymakers to Work Toward More Trustworthy Digital Ecosystem

The ISACA Advocacy team spent recent months engaging with influential policymakers, with a focus on bolstering the cybersecurity workforce and creating a healthier digital ecosystem.

28 November 2023
Michalis Kamprianis
Risk Article

Third-Party Risk Management: The Security Blind Spot No One Wants to Discuss

Third-party risk analysis services and customer security questionnaires are no longer sufficient for risk management. Trust professionals must explore alternative solutions for mitigating risk.

28 November 2023
Larry Alton
@ISACA Article

Three Proactive Measures to Prevent Accounts Payable Fraud

As businesses grapple with complex transactions and multiple vendor relationships, the risks of accounts payable fraud grow, threatening both financial health and organizational reputation.

22 November 2023
‘Tsunamis’ to Change Course of Security Workforce
@ISACA Article

‘Tsunamis’ to Change Course of Security Workforce

Emerging technologies, changes in the global economy and workforce transformations accelerated by the pandemic are reshaping the outlook for professionals in security and other digital trust fields.

22 November 2023
Karen Heslop
Blog Post

ISACA Advisory Groups Help Shape Programs

A range of volunteering opportunities through ISACA provide professionals meaningful opportunities to strengthen the profession while also earning CPE credits.

22 November 2023
Alex Townsend
Blog Post

My Journey to Cybersecurity and My Route to ISACA’s ITCA Certification

A journey to prepare for ISACA's ITCA credential was not without its challenges but ultimately proved to be transformative.

22 November 2023
Person working at a laptop
ISACA Journal Article

The Risk and Control Self-Assessment

Risk and control self-assessments offer a vital framework for organizations to proactively identify, assess and mitigate risk.

Author: Anthony Oteri
Arunava Banerjee
Risk Article

Optimizing Risk Transfer for Systematic Cyberresilience

As security professionals navigate the present cyberthreat horizon, it is crucial to understand the emerging dangers and fortify digital defenses with cyberinsurance to ensure a secure digital future.

21 November 2023
Susan Snedaker
Blog Post

Renovating Healthcare IT (or any IT): Building the Foundation for Digital Transformation

Modern systems, architectures and technologies, in addition to staff expertise in cloud, hybrid and on-premise solutions, are all important for organizations aiming to digitally transform, but getting there often requires an IT renovation.

20 November 2023
Carol Lee, CISM, CRISC, CDPSE, C|CISO, CCSP, CEH, CIPM, CSSLP; Terence Law, CISA, CFA, CISSP, CPA, Certified Banker; Tom Huang, CISA, PMP, Prince2; Lanis Lam, CISA, AWS (SAP), CPA
Blog Post

New Measures in Mainland China for Generative AI and Implications for Global AI Governance

New measures on generative AI in Mainland China have substantial implications for the evolution and use of generative AI not only in China but elsewhere around the world.

17 November 2023
Noam Koriat
Blog Post

Incorporating Agile Audit: Practical Tips

Establishing clear expectations and customizing the approach are among the steps that can facilitate a successful Agile audit implementation.

16 November 2023
Lauren Strope
Podcast

Scaling Your Threat Modeling Program

Understanding product security risk starts before a single code line is written. Teams can discover threats to the architecture of a system early in the development life cycle with Threat Modeling.

16 November 2023
Abstract squiggles on blue background
ISACA Journal Article

The Benefits of Achieving Workforce Resilience

Organizations would benefit from focusing on how to use relevant frameworks and upskill their teams to build a resilient workforce.

Author: Hakan Kantas
Tak Wah Kwan
Blog Post

Navigating Security Threats with IT Inventory Management

An efficient, current IT inventory is a foundational component of effective IT management and puts an enterprise in position to better leverage threat intelligence.

14 November 2023
Fene Osakwe
Audit Article

Three Skills for Succeeding as an IT Auditor in the 21st Century

There are 3 skills that a modern IT auditor must possess to add value to the technology teams being audited and to avoid being seen through a negative lens by senior leadership.

14 November 2023
Wilson Tang
Blog Post

Using Machine Learning to Help Detect Sensitive Information

Leveraging machine learning has enabled Adobe to detect categories of sensitive documents and put in place automated real-time detection and response to properly flag any detected documents.

13 November 2023
abigael-bada
Blog Post

Sustainability in Emerging Technologies: A Focus on Blockchain, AI

Implementations of artificial intelligence, blockchain and other emerging technologies should be done with sustainability considerations in mind.

10 November 2023
Vanessa Revilla
Blog Post

Raising Security Awareness in Cross-Cultural Work

In an increasingly complex and global security landscape, chief information security officers need to be in regular contact with the board and other key enterprise stakeholders to drive effective security culture and collaboration.

9 November 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 2

Log management, malware defense, data recovery, security training and incident response are among the security areas for which organizations have to have solid approaches in place.

8 November 2023
Anna Johannson
@ISACA Article

How to Build Trust in a Distrustful Digital Era

Consistent and transparent communication, remaining committed to your brand values, and promoting the good things your company is doing can all help create trust in a distrustful digital era.

8 November 2023
Digital globe with hand pointing at target
ISACA Journal Article

Modeling an Identity Trust System

Basing digital identity recognition on trust is possible if the actors who request access and those who provide a service have the availability of a usable, secure and transparent mechanism.

Author: Luigi Sbriz
Luigi Sbriz
Blog Post

Is the CIO Just an IT Manager?

In a time when the rapidly evolving technology landscape is recalibrating business models, the CIO must balance internal IT activities with those that are outsourced, and map the needed controls accordingly.

7 November 2023
Sunil Arora
Security Article

From Chaos to Confidence: The Indispensable Role of Security Architecture

Similar to a high-rise building, a cybersecurity defense needs a solid foundation to avoid putting long-term stability at risk.

7 November 2023
Anuj Choudhary, Risk and Forensics Professional, CA, CFE, CISA, CISM, CS and Mary Carmichael, CRISC, CISA, CPA, Member of ISACA Emerging Trends Working Group
Blog Post

DogeRAT: The Disturbing Malware Disguised as Your Favorite Apps

DogeRAT malware reinforces the growing sophistication and multi-faceted nature of cyberthreats, through its camouflage techniques, social engineering components, and its ability to imperil privacy and financial security.

6 November 2023
Meghan Maneval
Privacy Article

What the Past Tells Us About the Future of Privacy in the United States

Because information can be replicated, exfiltrated or deleted in a matter of seconds, consumers and organizations need to implement steps to prevent, detect, respond to and remediate data breaches.

6 November 2023
Scott Fogarty
Blog Post

Cyber Advisors, Security Services Providers Can Use Zero-Sum Game Theory Framework to Benefit Clients

The zero-sum game theory is worth considering for organizations, who should rethink the costs they face relative to the cybercriminals that often inflict damage without taking on any real risk.

3 November 2023
Benjamin Bartz
Blog Post

IT Risk and IT Audit: A Partnership

Providing leadership with pertinent data can go a long way toward building support for the cross-functional collaboration between the audit and risk functions that can put organizations in a much stronger position to succeed.

2 November 2023
Jack Freund
Security Article

What Is Considered a Material Cyberrisk Under the New US SEC Rules?

The cyberevent disclosure rules introduced by the US SEC in July 2023 have sparked a wave of concern among cybersecurity professionals and BoDs.

2 November 2023
Learning while earning - person working in front of computers
ISACA Journal Article

Learning While Earning: A New Way to Upskill the Workforce

Organizations must prioritize training and reskilling their workforces by implementing learning and development initiatives.

Author: Arjun Gopalakrishna
Mary Carmichael
@ISACA Article

Key Considerations for Developing Organizational Generative AI Policies

Few organizations have comprehensive policies in place on the usage of generative AI, which could prove perilous with increasing usage of the powerful and popular technology.

1 November 2023
Caitlin McGraw
@ISACA Article

Lions and Tigers and Office Politics – Oh My

The term 'office politics' often makes people think about toxic or unethical workplace behavior, but office politics are actually a necessity that, if handled artfully, can boost people's careers and help drive progress.

1 November 2023
Digital Trust World
Blog Post

ISACA's Digital Trust World Europe Conference

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more.

1 November 2023
Finger pointing at cyber galaxy
ISACA Journal Article

Three Top Cybersecurity Trends for the Next Decade

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more

Author: Shankar Nishant
Security - A person typing on a laptop with overlaying security symbols
ISACA Journal Article

Information Security Matters: A Little Security

Small enterprises need to adopt security at scale, consiering minimum security requirements first and additional tactics commensurate with level of risk.

Author: Steven J. Ross
Future Skills - person typing on laptop
ISACA Journal Article

IS Audit in Practice: Future Skills Needed in Audit, Cybersecurity, Privacy and Emerging Technology

Technology advances rapidly and practitioners must adopt a learning mentality to keep pace with change.

Author: Cindy Baxter
SDLC - gears
ISACA Journal Article

The Bleeding Edge: Embracing SDLC Controls and the Inevitability of Automation

Acceleration and automation of software development and release processes necessitates changes to how practitioners assure and secure the output of these processes.

Author: Ed Moyle
Skill training - peg board
ISACA Journal Article

The Digital Trust Imperative: Skills Training—A Prerequisite for Digital Trust

One often overlooked aspect of digital trust is the appropriate skilling of staff and whether they are poised to succeed in an ever-changing technology landscape.

Author: K. Brian Kelley
Lifelong Learning - person typing on laptop with overlaying symbols
ISACA Journal Article

Lifelong Learning: An Essential Attitude for Career and Life Success

The seeds and roots of lifelong learning should be planted and established so that people at all stages of their careers can embrace the lifelong learning journey.

Author: Grace Johnson
Lifelong learning - digital brain
ISACA Journal Article

Developing Lifelong Learners to Ride the AI Wave

Taking advantage of the AI revolution benefits will require organizations to provide the necessary culture and resources that encourage individuals to become self-directed lifelong learners.

Authors: Katharina Schlembach, Norman Csavajda, Gerald Burch and Jana Burch
Emotional Intelligence - wood blocks with IEQ
ISACA Journal Article

Emotional Intelligence Outweighs Technology Skills for Cybersecurity Teams

Prioritizing emotional intelligence over technology skills can help organizations identify the right talent for the right job and thus gain better visibility into their threat landscape.

Author: Christine Whichard
Optimizing a career - hand drawing steps
ISACA Journal Article

Optimizing a Career Trajectory Through Personal Accountability

GRC and cybersecurity professionals must demonstrate strength with regard to personal accountability to effectively manage their careers and ensure that they keep pace with technological advancements, associated risk factors and new techniques employed by bad actors.

Author: Adam Kohnke
To fear or not - person writing on a tablet with security symbols
ISACA Journal Article

To Fear or Not to Fear: How to Create an Optimal Security Culture

It is important to understand the different levels of employee fear, the factors that contribute to it at each level and the implications for security to effectively manage fear to create a culture of security within an organization.

Authors: John Batchelor, Timothy Spivey and Timothy McIlveene
Future Ready - digital hand writing
ISACA Journal Article

Future Ready: Toward a Sound Agile Audit Framework

Agile is an essential practice to adopt and a critical competency that cultivates digital business agility, enabling internal audit to be highly aware, make informed decisions and act promptly.

Author: Noam Koriat
Launching an SOC - two people working in front of computers
ISACA Journal Article

Case Study: Launching an SOC to Improve Cyberthreat Detection

Raython Missiles and Defense needed to build out a security operations center (SOC) alongside the technology used to prevent physical threats, with RMD’s cybercapabilities matching the level of security required for physical assets.

Author: Katie Teitler
Safeguarding enterprises - person writing on a tablet with security symbol
ISACA Journal Article

Safeguarding Enterprises from Cyberrisk with ESG

Cybersecurity is a critical element of ESG and can be used to measure the maturity of the governance of an organization; thus, cybersecurity must be added to the ESG reporting framework.

Author: Rima Bose
Gamify - person typing on laptop with overlaying graduation cap and book graphics
ISACA Journal Article

How to Gamify Cybersecurity Learning on a Budget

Gamification makes cybersecurity learning more interactive and enjoyable because it adds elements of competition, rewards and progression, which can enhance motivation and engagement.

Author: an Soon Chew
Intricate Web - person typing on laptop with overlaying security symbols
ISACA Journal Article

The Intricate Web of Third-Party Cybersecurity Risk

IT security and risk management professionals must prioritize cybersecurity within their organizations by constantly advising management on best practices for protecting their organizations’ sensitive information and strategies to manage risk effectively.

Author: Jacob Peng
Aaron Turner IANS Faculty, and Shannon Lietz Founder and CEO of ThirdScore
Blog Post

Sizing Up Some of the Spookiest Cybersecurity Incidents of 2023

2023 has been another frightful year on the cybersecurity landscape - explore some of the most perilous incidents and what security professionals can learn from them

31 October 2023
Oliver Kling
Security Article

The Importance of Security Logistics in Software Development

Organizations must understand how security measures work, are implemented and behave—and under which circumstances they fail.

31 October 2023
Safia Kazi
Privacy Article

Legally Permissible Does Not Mean Ethical

Treating compliance as an aspiration and collecting excessive amounts of information is harmful to consumers; privacy professionals must help their enterprises’ privacy practices be more ethically focused.

30 October 2023
mwangi-bunde-rajarathna
Blog Post

Saluting ISACA Foundation's Cybersecurity Month Scholarship Winners

ISACA Cybersecurity Month Scholarship recipients share what motivated them to pursue careers in cybersecurity and how they see their futures in the field taking shape.

27 October 2023
realigning-goals-enterprise-training
Blog Post

Re-aligning Employees to Strategic Goals with Enterprise Training

An ISACA enterprise training instructor provides insights on some of the main benefits of team trainings and how enterprise training can enable organizations to elevate their performance.

26 October 2023
How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech
Emerging Technology Article

How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech

Companies increasingly are on the lookout for new professionals with skills and background in emerging technologies and how to implement them in the enterprise setting.

26 October 2023
Raef Meeuwisse
Blog Post

ISACA AI Survey Results: What Do Infosec Professionals REALLY Need to Know?

It is quite hard to find quality information about artificial intelligence (AI) right now, especially when it comes to how AI should and is being approached in the field of cybersecurity. Thankfully, ISACA has just completed a survey of thousands of members of the global infosec and digital trust community.

25 October 2023
person working on a laptop
ISACA Journal Article

Improving Information Security Through Organizational Change

To effectively combat cybercrime, CISOs must report to the highest level of the organizations they serve to ensure they are heard and their message is taken seriously by all stakeholders.

Author: Scott Rosenmeier
Alan Gouveia
Blog Post

Risk Quantification 101: The Fundamentals to Getting Started

Tapping into existing risk data can enable organizations to build the needed infrastructure to put in place an effective cybersecurity risk management process.

24 October 2023
Collaborative Mindset Change from Compliance to Risk
Blog Post

Collaborative Mindset Change from Compliance to Risk

Transitioning from a compliance-based focus to a risk-based approach is useful as enterprises aim to best align resources in the modern business and regulatory environments.

23 October 2023
Ignatius Ravi
Blog Post

Best Practices for Navigating Emerging Technologies: My Journey as an Auditor

Proactively learning about emerging technologies and understanding them in a business context can go a long way toward making auditors more effective in their engagements.

20 October 2023
Ranjit Bhaskar
Blog Post

In Cybersecurity, to Err Is Human, But to Err for No Reason Is a Shame

Organizations would be well-served to be more intentional about designing systems and processes with human factor engineering in mind, lessening the probability of people making mistakes that lead to cybersecurity incidents.

19 October 2023
Ravikumar Ramachandran
@ISACA Article

Internal Auditors as Catalysts in DevSecOps

Internal auditors have an important part to play for organizations to implement DevSecOps successfully.

18 October 2023
Abdul Rafeq
@ISACA Article

Using COBIT and Google Maps to Integrate Any Framework, Standard or Model With Enterprise Apps

Mapping the functionality of popular applications can allow organizations to better understand how to make frameworks, standards and models support their apps and improve user experience.

18 October 2023
Hakan Kantas
Blog Post

Proactive IT Risk Management in an Era of Emerging Technologies

As emerging technologies and new business models transform the business landscape, the need for proactive risk management practices should be top of mind for enterprise leaders.

17 October 2023
Zachary Folk
Security Article

What Enterprises Need to Know About ChatGPT and Cybersecurity

It is the responsibility of security professionals to act now to determine how to safely leverage AI—if they wish to do so at all.

17 October 2023
Joseph Cortese
Blog Post

How Cybersecurity Best Practices are Evolving to Manage Ongoing Threats

Regular penetration testing and a culture of proactive threat analysis and management can help organizations evolve their cybersecurity programs in a difficult climate for cyber defenders.

16 October 2023
Arun Mamgai
Emerging Technology Article

Generative AI With Cybersecurity: Friend or Foe of Digital Transformation?

Generative AI requires significant training and cultural change to ensure confidential data is not compromised, and the security data model training infrastructure requires significant investment and strong business support.

16 October 2023
Steven Sim Kok Leong
Blog Post

Quantum-Resistant Cryptography Not a Matter of ‘If’ but ‘Right Now’

Establishing crypto-agility should be a major priority for organizations as advancing quantum computing capabilities are changing the paradigm of the threat landscape.

13 October 2023
Guy Pearce
Blog Post

Data Management Proficiency: Practical Insights for Quality, Security and Trust

Evaluating quality, security and trust in the context of emerging technologies and current business practices is critical for organizations to have effective data management and governance.

12 October 2023
Esanju Maseka
@ISACA Article

Artificial Intelligence: Privacy and Information Security Risk Considerations

Gaining business benefits from artificial intelligence while also mitigating the related risks requires a holistic, multidisciplinary approach that draws upon the expertise of professionals from several disciplines.

11 October 2023
Jack Freund
@ISACA Article

The Value of Near Misses in Risk Management

Like it or not, sometimes it takes a harrowing near miss for enterprises to learn what can become highly valuable lessons in risk management.

11 October 2023
Simona Rollinson
Blog Post

CMMI Offers New Credentialing Pathway and Enhanced Flexibility, Resources

New CMMI credentialing pathway aligns with ISACA’s tools, systems and best practices.

11 October 2023
Raising Security Awareness in Cross-Cultural Work and Collaboration
ISACA Journal Article

Raising Security Awareness in Cross-Cultural Work and Collaboration

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Vanessa Britt Perez Revilla
Scott Fogarty
Blog Post

Victory by Surveillance Isn’t Possible—To Win, Engage the Adversary

Traditional approaches to cybersecurity have not been enough to protect companies, so it's time to make attackers face real consequences for their malicious behavior.

10 October 2023
Ivan Mans
Security Article

Profiling a SAP Hacker

To mitigate the risk of cyberattacks, organizations must keep their SAP systems up-to-date with the latest security patches and updates.

10 October 2023
jenai-marinkovi
Blog Post

The Shifting Importance of Soft Skills in a Time of AI Systems, Large Language Models and Global AI Regulations

Integrity, decision-making capabilities, communication and other so-called 'soft skills' should not be overlooked in organizations' ongoing efforts to bolster their cybersecurity teams.

9 October 2023
Mary Carmichael
Blog Post

Beyond Barbie’s Dreamhouse: Navigating Glass Barriers in the Tech Workforce

Many of the themes that made the Barbie movie so resonant are also relevant to the tech workforce, where underrepresentation from women and minority groups remains a major liability.

6 October 2023
information security
Emerging Technology Article

The Human and AI Partnership: Collaborating for Enhanced Cybersecurity

Both generative AI and precision AI hold promise in helping organizations defend against ever more sophisticated cyberattacks.

6 October 2023
Adobe logo
Podcast

Secure your Supply Chain with an Effective Vendor Security Program

Security risks introduced by vendors have become a top-of-mind concern for executives today, driven by recent supply chain incidents that have exposed organizations to operational and reputational risks.

6 October 2023
Future of Technology
Blog Post

IT Certification: A Powerful Career Catalyst

IT, cybersecurity, privacy, risk, audit and related digital trust professionals are looked to for the latest knowledge and insights on the impacts of emerging technology; however, they must have reliable resources to ensure they have updated and accurate information about these topics.

5 October 2023
Sarantos Kefalas
Blog Post

How To Comply with Multiple Security Standards and Frameworks

Complying with every standard or requirement in the current regulatory environment is no easy task, but implementing a global information security management system can provide a sound foundation.

4 October 2023
Reducing Barriers to Adoption of CCM Through Alarm Management
ISACA Journal Article

Reducing Barriers to Adoption of CCM Through Alarm Management

Continuous controls monitoring has the potential to save time and free internal audit teams to undertake more strategic and value-adding audits, and a key component of this is the management of alarms.

Authors: Peter Best, Kishore Singh, Ph.D., and John Halliday
Kristi Hedges and Megan Moritz
Podcast

Cultivating Inspired Leaders with Kristi Hedges

In this ISACA Podcast, Kristi Hedges, executive coach, and leadership development consultant, speaker, and author, gives a sneak peek of her upcoming member-exclusive 'Cultivating Inspired Leaders, a CPE-eligible event. At the event, Kristi Hedges will provide a roadmap for building an inspired mindset for leaders, teams, and individuals.

4 October 2023
State of Cybersecurity 2023
@ISACA Article

ISACA’s State of Cybersecurity 2023 Report Pinpoints Pressing Workforce Gaps

ISACA's 2023 State of Cybersecurity Report spotlights the skills most needed to strengthen the cybersecurity workforce and the extent to which hiring and retention remain a challenge across the industry.

2 October 2023
Caitlin McGraw
@ISACA Article

Protecting and Improving Your Career: Time for A Career Check-up!

Performing periodic career check-ups through simple steps such as updating goals and professional profiles can go a long way toward sustaining career success over the long-haul.

2 October 2023
Kane Porter
Blog Post

Common Privacy Dark Patterns and Ways to Improve Digital Trust

ISACA’s Eliminating Deceptive Privacy Practices white paper explores what dark patterns are in a privacy context and what organizations should do to address these trust-eroding tactics.

2 October 2023
Jason Lau
Blog Post

State of Cybersecurity 2023: Navigating Current and Emerging Threats

ISACA's 2023 State of Cybersecurity report shows substantial workforce challenges remain and brings into focus the skills and backgrounds that are most heavily in demand.

2 October 2023
Forensic Investigations and Computer Forensics in the Age of Blockchain
ISACA Journal Article

Forensic Investigations and Computer Forensics in the Age of Blockchain

As more enterprises adopt blockchain technology, these professionals must stay up to date with the latest developments and create new tools and techniques to investigate crimes committed on blockchain.

Author: Anuj Choudhary
Jon Brandt, Rex Johnson and Tony Angelo
Podcast

Exploring the Benefits of Neurodiversity within Cybersecurity

Neurodiversity within cybersecurity offers many benefits but requires organizations and hiring managers to re-evaluate hiring practices and job descriptions typically structured for neurotypical applicants.

29 September 2023
Naomi buckwalter
Blog Post

Six Things DevOps Wants from InfoSec

By working more openly and intentionally with developers, information security professionals can build a strong relationship that will be a win-win situation for all involved.

28 September 2023
Where Does Zero Trust Fall Short? Experts Weigh In
@ISACA Article

Where Does Zero Trust Fall Short? Experts Weigh In

Security experts weigh in on potential shortcomings in zero trust security, whether real or perceived, and what enterprises should keep in mind if implementing zero trust approaches.

27 September 2023
The Career-Elevating Impact of CISA
Blog Post

The Career-Elevating Impact of CISA

CISA credential-holders share how becoming CISA-certified has shaped their career advancement and made them more effective in their roles

27 September 2023
Assessing the Shortfalls of DeFi Platforms
ISACA Journal Article

Assessing the Shortfalls of DeFi Platforms

Considering the significantly increasing crimes and scams targeting DeFi platforms, financial services regulators should start enforcing exclusive financial crime prevention controls and coding standards.

Author: Vimal Mani
Binita Patel
Blog Post

Lessons Learned from Microsoft’s Massive Data Exposure Incident

The need for meticulous cloud configurations was among several key takeaways in the aftermath of the recent data breach involving Microsoft AI researchers.

26 September 2023
Deneen Richard, CISA, CRISC, CRMA
Audit Article

Internal Audit Data Analytics for Beginners

There are 2 phases and associated steps that auditors can take to begin the journey of utilizing data analytics.

26 September 2023
David Sampa
Blog Post

Are AI Chatbots a Weak Security Link?

Enterprises increasingly are making use of AI chatbots, but related security risks and the potential to undermine customer trust when they do not function as intended must be accounted for.

25 September 2023
Tarnveer Singh
Blog Post

How to Mitigate Emerging Technology Risk

Understanding the business strategy and conducting risk assessments are among the building blocks for successfully mitigating enterprise risk from emerging technology.

21 September 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 1

Implementing a cybersecurity framework is a useful starting point for enterprises seeking to establish a sturdier foundation on which to build their cyber defenses.

20 September 2023
The Promise and Peril of the AI Revolution
@ISACA Article

Organizations Need Sense of Urgency in Dealing with AI Risks

A new ISACA white paper provides analysis of the risks and opportunities stemming from artificial intelligence and why enterprises need to gain swift alignment on their AI goals and policies.

20 September 2023
Dina Numan, Head of Advanced Governance and Management Services, ScanWave C.T.S. COBIT Lead Assessor, ITIL, CDPSE, CRISC, and Dr. Ramzi Sunna, Chairman, Founder, ScanWave C.T.S. PCI DSS QSA, BSI ISO LA, LI, ISACA CRISC, ISACA CDPSE ISACA COBIT Lead Assessor
Blog Post

Achieving Digital Trust Through IT Governance and Cybersecurity

Developing a cybersecurity strategy and governance program that supports digital trust provides a solid starting point for organizations seeking to strengthen their trustworthiness.

20 September 2023
Harnessing the Potential of Blockchain and AI - graphical AI brain
ISACA Journal Article

Harnessing the Potential of Blockchain and AI for Process Performance Management With COBIT

Blockchain offers a secure and transparent way of managing IT transactions, and AI can automate routine IT processes, improve decision-making and predict potential IT risk.

Author: Ahmet Efe
Salary Premiums Reflect IT Skills in Hot Demand
Blog Post

Salary Premiums Reflect IT Skills in Hot Demand

Skills associated with ISACA's Information Technology Certified Associate credential are in-demand, as reflected by pay premiums for several of the skills covered by the certification.

19 September 2023
James Huang
Security Article

Improving Security While Enabling Market Access With a CCF

Cloud service providers should consider creating a common cloud controls framework—a central information security compliance and certification methodology that can include certifications such as SOC 2, ISO 27001, C5, ENS, ISMAP, IRAP, and more.

19 September 2023
Scott Gould
Blog Post

The Secrets to Successful Engagement: ISACA’s Member-Exclusive Speaker Series

In a recent installment of ISACA's Member-Exclusive Speaker Series, Scott Gould shared insights on audience engagement, creating a welcoming community and more.

18 September 2023
ShanShan Pa
Blog Post

Balancing the Risks and Rewards of AI

Many enterprises understandably are taking a cautious approach when it comes to establishing their approach toward artificial intelligence, but delaying on meaningful action comes with its own set of risks.

15 September 2023
Kayne Mcgladrey
Blog Post

What to Know About the SEC’s New Disclosure Requirements

New disclosure requirements from the Securities and Exchange Commission likely will leave cybersecurity, risk and compliance professionals in the US with some key questions that need to be addressed.

14 September 2023
Safia Kazi
Privacy Article

The Privacy Pros and Cons of Anthropomorphized AI

There are privacy-related pros and cons to anthropomorphized AI, and certain considerations need to be made for enterprises that leverage consumer-facing generative AI.

14 September 2023
Larry Alton
@ISACA Article

The Importance of Connections in the Tech Industry

The complexity of today’s technology landscape dictates that technology professionals should look to a variety of sources to become better prepared for the evolving challenges that they will face.

13 September 2023
Alina Archibald, CISA, CITP, CPA, and Josh Ditto, CC, CISSP
Blog Post

Subservice Organization Controls Management

Not all vendors are subservice organizations, whose operations have a clear impact on the organizations with which they collaborate.

13 September 2023
Understanding Top Cybersecurity Technology Trends
ISACA Journal Article

Understanding Top Cybersecurity Technology Trends

By analyzing the status of existing technology as it is developed and deployed, future trends in technology development can be predicted.

Author: Yunchuan Wei
Examining the Effectiveness of Recent Privacy Laws on Big Tech
Blog Post

Examining the Effectiveness of Recent Privacy Laws on Big Tech

While the United States does not have a comprehensive privacy regulations like the EU does with GDPR, there are signs that more mature privacy policy is beginning to take shape that could limit the harms from data misuse by big tech companies.

12 September 2023
Patrick Barnett
Security Article

Seventy Questions to Assess Cybersecurity Risk on a Rapidly Changing Threat Landscape

There are 70 questions that can be asked to determine whether an enterprise has most defensive principles covered and has taken steps to reduce risk (and entropy) associated with cybersecurity.

12 September 2023
Thomas Bell
Blog Post

Internal Auditing with an Agile Scrum Approach

By utilizing an Agile Scrum approach to internal audit, organizations can empower the audit function for more effective performance.

11 September 2023
Luigi Sbriz
Blog Post

Using Near-Miss Incidents as Risk Indicators

Oftentimes organizations fail to give risks the proper consideration until it is too late.

8 September 2023
Yoshimasa Masuda
Blog Post

Driving Digital Transformation Through Innovative Solutions and a Practical Framework

Yoshimasa Masuda, Ph.D., CISM, CGEIT, shares the history of his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation from innovative solution to practical framework, and its connections across industries, healthcare and academia.

7 September 2023
Anand Venkatraman and Sabiha Hetavkar
@ISACA Article

Are We Ready for a World Without Passwords?

The degree of ease with which cybercriminals are able to swipe online credentials brings into focus a future in which passwords will no longer be a routine method of authentication.

6 September 2023
Caitlin McGraw
@ISACA Article

New Job. Red Flags. How Long Do You Give It?

Starting a new job is often challenging, but how can new job-starters determine whether the unease is part of the normal adjustment period or if legitimate red flags exist that might mean it's time to move on quicker than they had planned?

6 September 2023
Noam Koriat
Blog Post

Nine Practical Tips for Using Internal Audit to Drive Organizational Innovation

Internal auditors can help to spur innovation at their organizations by taking a forward-looking mindset, embracing agile culture and keeping up to date on evolving forces on the technology landscape.

6 September 2023
Jai Sisodia
Governance Article

Understanding the EU AI Act

By examining the nuanced details of the EU AI Act, IT auditors and other information security professionals can better understand how it might affect their future work.

6 September 2023
Measuring and Evaluating the Effectiveness of Security Awareness Improvement Methods
ISACA Journal Article

Measuring and Evaluating the Effectiveness of Security Awareness Improvement Methods

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Eszter Diána Oroszi
Allen Ari Dziwa
Blog Post

Governance and Board Oversight Do Matter

Boards of directors have a growing set of responsibilities in today’s business climate, including keeping abreast of evolving technology trends and how the organization is preparing for a growing set of cybersecurity risks.

5 September 2023
Alex Holden
Blog Post

Contending with Artificially Intelligent Ransomware

Artificial intelligence is already impacting the ransomware landscape, with greater potential for AI to significantly impact the pace and complexity of ransomware threats in the near future.

1 September 2023
Erik Prusch
ISACA Journal Article

Letter From the CEO

It is rare to find a group of people as connected, involved, passionate and dedicated as this one.

Author: Erik Prusch
Organizing for Cyberresilience - people reviewing chart on tablet
ISACA Journal Article

Information Security Matters: Organizing for Cyberresilience

There is a need for a committee to oversee both the development and execution of plans to keep an organization going should it be attacked.

Author: Steven J. Ross
Outsourcing vs. In-House Getting the Most Out of the Business Case and RFP - hand with pen
ISACA Journal Article

IS Audit in Practice: Outsourcing vs. In-House Getting—the Most Out of the Business Case and RFP

How do you find a trusted vendor and build the monitoring steps that will ensure a successful project?

Author: Cindy Baxter
Digital Trust and an Eye on Reliable Operations - laptop with AI infographic
ISACA Journal Article

The Digital Trust Imperative: Digital Trust and an Eye on Reliable Operations

Any operational issue can affect an organization’s digital trustworthiness; therefore, neglect operations at your own peril.

Author: K. Brian Kelley
Digital Trust and Adopting Generative AI - cloud icon
ISACA Journal Article

The Bleeding Edge: Digital Trust and Adopting Generative AI

Large Language Models and other AI tools have tremendous promise and potential, but care and forethought are required to ensure that organizations optimize risk while maximizing value.

Author: Ed Moyle
Future Fitting Operational Compliance - illustration of servers
ISACA Journal Article

Future Fitting Operational Compliance

By embracing technology, fostering a forward-looking compliance culture and building a diverse team, operational compliance can ensure it is well positioned to handle emerging regulations, work collaboratively with operations teams and stay critical contributors to its success.

Author: Kevin Alvero
A Risk-First Approach to Setting an Information Security Budget - Security lock
ISACA Journal Article

A Risk-First Approach to Setting an Information Security Budget

Information security managers can use a risk-first approach to make informed decisions based on where the organization's greatest risk lies.

Authors: Peter Grosser and Gerald Burch
Extended Accountability of the CIO - hands typing on keyboard
ISACA Journal Article

Extended Accountability of the CIO

If the CIO's role is limited to compliance with technology objectives and cost containment, not all current business expectations will be appropriately or sufficiently addressed.

Author: Luigi Sbriz
IT Risk and IT Audit Working Together to Reduce the Burden on the Business - people reviewing document
ISACA Journal Article

IT Risk and IT Audit Working Together to Reduce the Burden on the Business

To decrease duplication of efforts and let the business do what it does best, the third line of defense (internal audit) and the second line (risk) must work together.

Author: Benjamin Bartz
Incident Response Automation Through IRP Implementation - security lock
ISACA Journal Article

Case Study: Incident Response Automation Through IRP Implementation

To improve incident response and, thus, cybersecurity and risk management, IT asset management, localization automation and incident repsonse platform functionality were implemented.

Authors: Katie Teitler and Aleksandr Kuznetcov
How to Elevate the SOC to the Next Level - hallway with servers
ISACA Journal Article

How to Elevate the SOC to the Next Level

SOC analysts must enhance their skills in these emerging technologies, integrate them into the SOC framework and establish specific detection methods to effectively identify and counter threats to this diversified infrastructure.

Author: Shweta Kshirsagar
Harmonizing Cybersecurity Practices - security lock
ISACA Journal Article

Harmonizing Cybersecurity Practices: The Requirements and Challenges of the EU NIS2 Directive

Enterprises in the eurozone must understand the NIS2 Directive challenges and be proactive in complying with the incident notification requirements to enhance their cybersecurity posture and protect critical infrastructure and digital services.

Authors: Antonio Villamor and Yianna Danidou
Avoiding a Compliance-First Mindset and Choosing a Risk-First Attitude - Person typing on keyboard
ISACA Journal Article

Avoiding a Compliance-First Mindset and Choosing a Risk-First Attitude

Moving from a focus on compliance to developing a risk-first attitude results in improved security, better decision-making and senior management support and investment in security controls that reduce risk.

Author: Karen MacDougall
Muhammad Ali Malik
Blog Post

A Cybertransformation Program to Secure Broadcast Media Networks

Fixed start dates, a skills shortage and insufficient security maturity of broadcast devices are key challenges that broadcast media networks face in securing high-profile broadcasts.

31 August 2023
Blueprint for Ransomware Defense
@ISACA Article

ISACA Offers Blueprint for Ransomware Preparations and Defense

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Sandra Whitehead
Blog Post

Sustainability, Inclusivity and Team Bonding Through Volunteering: CommunITy Day 2023

ISACA’s 2023 CommunITy Day is upcoming on 7 October, and the Auckland, New Zealand, chapter, has a pair of events in its sights, with a focus on sustainability and nature.

30 August 2023
Three Lessons From 100 Years of Data Management
ISACA Journal Article

Three Lessons From 100 Years of Data Management

Ninety-three percent of enterprises believe that collecting, managing, storing and analyzing data must improve, confirming that major efforts are needed to address the global state of data management.

Author: Guy Pearce
Busting the Top 5 CMMI Myths
@ISACA Article

Busting the Top 5 CMMI Myths

Separate fact from fiction when it comes to ISACA's CMMI model and how it helps organizations identify gaps in maturity and drive toward higher and more reliable performance.

29 August 2023
Erik Prusch
Blog Post

Ramping Up for Greater Impact

A laser focus on the products, programs and resources the ISACA community finds the most value from is coming into sharper focus.

29 August 2023
Eric Peck
Risk Article

Tools and Best Practices for Improving IT Issue Management

It is worth exploring the importance of IT issue management and highlighting best practices and tools that organizations can use to understand, measure and mitigate IT risk.

29 August 2023
Dooshima Dapo Oyewole
Blog Post

Four Mistakes to Avoid When Taking Your First Certification Exam

By avoiding some common mistakes, certification exam-takers can increase their chances for success on exam day and smooth their path to attaining valuable industry credentials.

28 August 2023
Anuj Choudhary
Blog Post

Cyber Fraud on the India Business Landscape: A Growing Threat

A recent escalation of cyber incidents in India highlight the urgent need for comprehensive, updated cybersecurity strategies on the Indian business landscape.

25 August 2023
anna-johannson
Blog Post

Six of the Best Cybersecurity Blogs

Regularly reading industry blogs can be an entertaining and useful way to keep up to date on the latest happenings and defense techniques on the cybersecurity landscape.

24 August 2023
Five Ways to Fund Your Information Technology Certifications Journey
@ISACA Article

Five Ways to Fund Your Information Technology Certifications Journey

Certifications are a worthwhile career investment, and there are several ways certification candidates can make the costs associated with gaining their credential more affordable.

23 August 2023
Abdul Rafeq
@ISACA Article

Seven Steps to Empowerment With Data Analytics

Data analytics is becoming a must-have capability for technology professionals, enabling them to be more efficient and impactful with their time, knowledge and skills.

23 August 2023
Diana Calderon
Blog Post

Building a Strong Security Culture for Resilience and Digital Trust

Cultivating a robust security culture can enable organizations to mitigate cyber risk, strengthen trust with customers and sharpen organizational compliance posture.

23 August 2023
The Role of Human Factors Engineering in Cybersecurity
ISACA Journal

The Role of Human Factors Engineering in Cybersecurity

Incorporating human factors engineering early into the design process of systems and processes will lead to fewer errors in the use of the product in the field.

Author: Ranjit Bhaskar
ChatGPT and IT Auditing: Opportunities, Threats and Challenges
Blog Post

ChatGPT and IT Auditing: Opportunities, Threats and Challenges

ChatGPT presents opportunities for IT auditors to be more efficient and productive, but a variety of security, privacy and ethical considerations should be addressed as part of auditors' approach

22 August 2023
Industry News
Security Article

An Executive View of Key Cybersecurity Trends and Challenges in 2023

To more effectively defend against attacks, it is important for cyberprofessionals to understand current trends and challenges that exist in the field of cybersecurity.

22 August 2023
Robin Lyons
Blog Post

Digital Trust Enhancing Identity Access Management in Cloud Environments

ISACA's Google Cloud Audit Platform Program explores issues of identity and access management, and connection points between cloud audit and digital trust.

21 August 2023
Ron Lear
Blog Post

Four New CMMI Adoption Pieces Available for Community

Several new adoption pieces will enable CMMI to be even more effective at helping organizations across numerous industries rapidly and effectively build capability and improve their performance.

18 August 2023
Jay Hira
Blog Post

You Made the Team, But Are You Really in the Game? Exploring Differences Between Diversity and Inclusion

Diversity, equity and inclusion, when properly prioritized and implemented, can be a major difference-maker in cybersecurity and other fields that struggle with underrepresentation, both in terms of performance and the ability to attract and retain talented professionals.

17 August 2023
Safia Kazi
Privacy Article

Lessons Learned From a Controversial Terms of Service Update

Enterprises are obligated to have clear and up-to-date terms of services in place.

17 August 2023
Robin Lyons and Thomas Bell
Podcast

Internal Audits That Create Stakeholder Value Adopting an Agile Mindset

Agile Scrum is a lightweight framework that promises to significantly improve internal audits by creating a mindset that generates stakeholder value through adaptive solutions for complex auditing problems.

17 August 2023
Nandita Rao
@ISACA Article

Balancing Privacy with Businesses’ Need for Data

Nandita Rao Narla provides her perspective on timely trends and challenges on the privacy landscape, including the need to strike a balance between supporting businesses' need for data with implementing sound privacy practices.

16 August 2023
Jack Freund
@ISACA Article

The Risk of Quantifying Cyberrisk

Cyberrisk quantification is designed to alleviate communication problems and translate technology for executives but leveraging it effectively can be a challenge for many organizations.

16 August 2023
The Business Benefits of Becoming an ISACA ATO
Blog Post

The Business Benefits of Becoming an ISACA ATO

By becoming an ISACA Accredited Training Organization, enterprises gain access to a robust community of global learners seeking highly in-demand certifications in fields such as security, risk, IT audit, privacy and governance.

16 August 2023
Subservice Organization Management—IT Controls for Peace of Mind
ISACA Journal Article

Subservice Organization Management— IT Controls for Peace of Mind

Enterprises must address the minimum controls an enterprise and subservice organization should consider implementing; these can then be customized to better suit specific operational needs.

Authors: Alina Archibald and Josh Ditto
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

Compliance and Information Security: Collaborating to Enable the Business

Compliance and information security functions can each make the other stronger, including by collaborating on making business cases and shared budgetary priorities.

15 August 2023
Amanda Tucker
Audit Article

How IT Auditors Can Embrace Neurodiversity in the Workplace With Agile

With the right environment and a handful of changes, neurodivergent individuals can be assets to any audit team.

15 August 2023
Robin Lyons and Dr. Elena Klevsky
Podcast

Strategies for Avoiding Burnout

Chronic workplace stress can lead to burnout, which poses a significant risk to the mental health of busy professionals, such as auditors. But how can these professionals protect themselves from burnout? And how can their employers help them do so?

15 August 2023
Sumedha Adavade
Blog Post

How to Assess Workplace Culture

Workplace culture can be difficult to measure, but factors such as the organization's risk habits, the tone at the top, attrition rates and employee feedback can provide useful indicators for those charged with assessing culture.

14 August 2023
Carol Lee, Terence Law, Tom Huang and Lanis Lam
Governance Article

Navigating Regulatory Trends and Best Practices for Ethical AI Governance in Mainland China

It is essential for organizations and technology risk professionals to understand the evolving AI regulatory landscape shaping the future of AI in Mainland China.

14 August 2023
Wanbil W. Lee
Blog Post

Is ESG Auditable?

Auditing ESG transcends the traditional dimensions of financial efficiency, legal matters and technical effectiveness to deal with increasingly recognized areas of importance such as environmental protection, corporate social responsibility and governance of business behavior.

11 August 2023
Elena Klevsky, Ph.D., CPA, and Melissa Walters, Ph.D.
Blog Post

How Organizations Can Help Auditors Avoid Burnout

Organizations have several measures they can take to help auditors avoid burnout on the job and improve their mental health, including allowing them to focus on the parts of the job that add the most value.

10 August 2023
Google Cloud Platform Audit Program
@ISACA Article

New Audit Program Focuses on Google Cloud Platform

A new audit program from ISACA sets up auditors who are tasked with assessing the Google Cloud Platform for success.

9 August 2023
Caitlin McGraw
@ISACA Article

New Job? Here’s How to Start Off On the Right Foot

The ISACA community provides a wealth of tips for new hires on how they can better acclimate and build strong relationships when starting their new job.

9 August 2023
Masosen Cai
@ISACA Article

Supercharging Internal Auditors with Data Science: Lessons and Takeaways

Auditors and data scientists interested to make the best use of data science in internal audit can benefit from deeper and more intentional collaboration between the areas.

9 August 2023
Neil Lappage
Blog Post

The Role of Deepfake Technology in the Landscape of Misinformation and Cybersecurity Threats

Deepfake technology creates new urgency to revisit and reinforce security protocols, including multi-factor authentication and behavioral biometrics, which can be challenging to replicate.

9 August 2023
Jeimy J Cano
Blog Post

Embracing the ‘Pedagogy of Error’ in Cybersecurity Education

Jeimy J. Cano, the 2023 ISACA Educational Excellence Award for his educational work that empowers students to pursue careers advancing technology, shares his story and motivations in this Q&A interview.

8 August 2023
Lisa Levy
Privacy Article

Afraid of Leaking Business Data? Sit Down. We Need to Have "The Talk" About Data Management and Access Control

Data management and access control measures should be integrated into every aspect of an organization's operations, creating robust defenses against data leaks.

8 August 2023
Josh Hamit
Blog Post

Top 3 Cyberthreats Facing the Financial Sector

Ransomware, supply chain threats and phishing attacks are among the leading cybersecurity challenges faced by organizations in the financial sector.

4 August 2023
Person typing on keyboard - Addressing Emerging Audit Challenges
ISACA Journal Article

Addressing Emerging Audit Challenges

Traditional audit methods may no longer be adequate; auditors must keep up with new developments and challenges and adapt their audit approach as needed.

Author: Ignatius Ravi
Erik Prusch
Blog Post

The More I Learn, the More Excited I Am to be at ISACA

In his first 50 days, new ISACA CEO Erik Prusch has been doing a lot of studying, listening and preparing to gain a deeper understanding of how to best serve the ISACA community in the months and years to come.

3 August 2023
Collin Beder and Sarah Katz
Podcast

The Danger of Distraction in Augmented Reality

While users of technology are becoming more educated in how to avoid cyberattacks such as phishing, a distracted user might be more prone to missing signs of social engineering.

3 August 2023
Larry Alton
@ISACA Article

Eight Ways to Streamline IT Ops Despite Staffing Challenges

There are numerous ways to improve your IT operation that are not time-intensive but could make a big difference in improving the IT department's efficiency and productivity.

2 August 2023
Patrick TrierWeiler
@ISACA Article

Steps New IT Audit Professionals Can Take Before Earning a CISA

Newcomers to the IT audit field have an array of steps they can take to advance their careers as they accumulate the needed professional experience to pursue the CISA.

2 August 2023
Erika Hamden
Blog Post

Building a New Way to Look at the Universe

Dr. Erika Hamden, the closing keynote speaker at GRC Conference 2023, visits with the ISACA Now blog to share stories from her career, and her passion for science and innovation.

2 August 2023
Decoding Log4j Vulnerability Lessons Learned
ISACA Journal Article

Decoding Log4j Vulnerability Lessons Learned

Organizations and vendors alike struggled to discover where they used Log4j, and hackers compounded the problem by combining vulnerabilities, which contributed to confusion and response fatigue.

Author: Ninad Dhavase
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA, Part 3: 6 Months Forward and the Continuous Game

Having a plan and communicating it to others can set up early-career professionals for success as they prepare to accelerate their career development.

1 August 2023
Chris McGowan
Emerging Technology Article

Generative AI and the Potential for Nefarious Use

Organizations must be aware and ready to combat the possibility of generative AI being used to conduct cyberattacks.

1 August 2023
Bassel Kablawi
Risk Article

Reviewing the 2023 OWASP API Top 10

To ensure that enterprises are not subjected to the nightmare that is an API security breach, the updated OWASP API Top 10 list is worth examining.

1 August 2023
david-mazula_casper-lamprecht
Blog Post

How to Conquer Your Cloud Governance Maturity Journey

The speed of cloud adoption is continuing to increase. Organizations worldwide are rapidly migrating on-premise IT infrastructure, software and other technology to cloud services. In addition, software solution providers are building native cloud systems and converting existing offerings to the cloud.

31 July 2023
Navigating Digital Transformation While Cultivating a Security Culture
Blog Post

Navigating Digital Transformation While Cultivating a Security Culture

Scott Reynolds, senior director of enterprise cybersecurity at ISACA, and John Richards, head of developer relations at Paladin Cloud, explore the cloud landscape and its impacts on digital transformation.

28 July 2023
Lisa Cook and Chris Madeksho
Podcast

Managing Human Risk Requires More Than Just Awareness Training

This podcast discusses the comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

28 July 2023
Renu Bedi
@ISACA Article

Navigating Supply Chain Challenges in Audit, Risk and Governance

Supply chain attacks are top-of-mind for organizations, and professionals in audit, risk and governance have important parts to play in mitigating growing threats throughout the supply chain.

26 July 2023
Top Benefits Upskilling
@ISACA Article

Top Benefits of Upskilling and Training Your Team

Enhancing your team's credibility with key stakeholders and strengthening organizational alignment are among the major benefits enterprises can reap from group training.

26 July 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

What We Can Learn from Australia’s 2023-2030 Cybersecurity Strategy

New cybersecurity policy being implemented in Australia provides several useful insights for the global security community.

26 July 2023
John de Santis
Blog Post

ISACA: The Right Place to Do the Right Thing

ISACA’s network of digital trust professionals is uniquely positioned to help organizations around the world do the right thing at a time when “the right thing” is much easier said than done.

26 July 2023
Safia Kazi
Privacy Article

Protecting Children and Privacy Is Not a Zero-Sum Game

Privacy professionals who can be advocates for privacy and encourage people to think more critically about what is posted online can help create an online experience that protects children and preserves privacy.

26 July 2023
Privacy lock
ISACA Journal Article

Analyzing Privacy Policies as Data

Text mining allows enterprises to improve controls related to privacy policies by considering the proper use of privacy terms, developing a common vocabulary for a particular industry or sector and observing the use of relevant terms prescribed by regulators.

Author: Thiago De Oliveira Teodoro
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA Part 2: Setting Up Your Foundation for Success

Engaging with a local ISACA chapter, seeking out a professional mentor and pursuing the IT Audit Fundamentals Certificate are among the steps early-career audit professionals can take while waiting until they meet the experience requirements for the CISA.

25 July 2023
Hollee Mangrum-Willis and guest
Podcast

Preparing for Interruptions, Disruptions and Emergence Events

This podcast speaks about how an Information Systems (IS) Auditor can prepare for the Interruptions, Disruptions and the Emergence events that happen to the business and to technology.

21 July 2023
Grant Hughes
Blog Post

The Value of Following a Methodical Approach for SIEM Implementation

Despite many organizations having invested in SIEM solutions, data breaches and other cybersecurity impacts continue to wreak havoc on the enterprise landscape.

24 July 2023
Shawn Kanungo
Blog Post

GRC Keynote Speaker: Time to Go Bold

Shawn Kanungo, author and opening keynote speaker at GRC Conference 2023, shares his views on disruptive technologies, innovation and the importance of being bold in this Q&A with the ISACA Now blog.

21 July 2023
Binita Patel
Blog Post

Emerging Cloud Security Threats: Fileless Attacks on the Rise

A sharp climb in fileless attacks has added to the challenge enterprises face in securing their cloud environments.

20 July 2023
David Sampa
@ISACA Article

ChatGPT and Digital Trust: Navigating the Future of Information Security

The rise of ChatGPT gives information security professionals even more to account for while also underscoring critical connection points between security and the overarching need for digital trust.

19 July 2023
CMMI-case-sudy
Blog Post

The Commitment to Continuous Improvement: A CMMI Case Study

ISACA's CMMI maturity model practices have helped Avantare focus on capabilities like ensuring quality, delivering and managing services, sustaining habit and persistence, and more, as a recent case study illustrates.

19 July 2023
A Candid Look at the Shifting Landscape of Change Management for Audit
ISACA Journal Article

A Candid Look at the Shifting Landscape of Change Management for Audit

For automated systems to operate effectively and achieve the desired outcomes, it is essential to have more sophisticated change management controls.

Author: Kishan Sathyanarayanan
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

What to Do While You Wait for Your CISA: Part 1, Understanding the CISA and Its Requirements

ISACA’s Certified Information Systems Auditor (CISA) certification requires several years of experience, but there are several steps newcomers to the IT audit and assurance field can take to position themselves for success in the meantime.

18 July 2023
Chris Madeksho
Risk Article

Managing Human Risk Requires More Than Awareness Training

A comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

18 July 2023
Ramona Ratiu
Blog Post

Strengthening Collaboration for Cyber Resilience: The Key to a Secure and Resilient Organization

Ongoing communication and strong relationships between the security and audit functions can lay an important foundation in an organization's efforts to strengthen its cyber resilience.

17 July 2023
Guy Pearce
Blog Post

From Sci-Fi to Reality: AI At All Stages of Your Career

Artificial intelligence is not just impactful for rising professionals in digital trust fields: AI has an increasingly important part to play at all levels of the career cycle.

14 July 2023
Alex Tray
Blog Post

Top Effective 10 Data Governance Tools

Effective data governance software helps businesses guarantee the availability and safety of their data. However, most data management tools are complex and can require rigorous training to use.

13 July 2023
Hollee Mangrum-Willis and Cindy Baxter
Podcast

IS Audit in Practice: Data Integrity On Demand

On this podcast, ISACA's Hollee Mangrum-Willis and special guest Cindy Baxter discuss the disparities between American communities and access to electronic health records.

13 July 2023
Lisa Mckee
@ISACA Article

The Challenges and Rewards of Zero Trust Privacy

Privacy expert Lisa McKee lays out the rationale for zero trust privacy implementation while sizing up related challenges and the need for cross-functional support.

12 July 2023
Stephanie Oyler-Rankin & Shayna Davitt
Blog Post

Compliance Tips for SaaS Startups

SaaS organizations getting started with compliance can benefit from some key tips that will help them successfully navigate the compliance landscape.

12 July 2023
Chris McGowan
Security Article

The US SEC’s Proposed Cybersecurity Crackdown

The SEC has proposed amendments aimed at bolstering and standardizing the disclosure requirements related to cybersecurity risk management, strategy, governance and incident reporting for public companies.

12 July 2023
Person holding a phone - Mitigating Emerging Technology Risk
ISACA Journal Article

Mitigating Emerging Technology Risk

To mitigate the risk associated with the speed of technological change, organizations can invest in technology foresight and monitoring efforts to stay informed about emerging technologies and their potential risk.

Author: Tarnveer Singh
Future of CyberSecurity Assessments
Blog Post

The Future of Cybersecurity Assessments

Data-driven security assessments are gaining momentum and are shaping up to become a valuable component in the future of security assessments.

11 July 2023
Raef Meeuwisse
Blog Post

Decoding AI: Insights and Implications for InfoSec

Artificial intelligence is reshaping the cybersecurity landscape, but considering the technology is clueless in some important ways, humans' capacity for intuition, empathy and understanding remain key components of the equation for effective security.

10 July 2023
Adeline Chan
Governance Article

The EU AI Act: Adoption Through a Risk Management Framework

The AI Act is an important step in the development of an effective and responsible regulatory framework for AI in Europe.

10 July 2023
Yunique Demann
Blog Post

A New Way to Keep Pace with Privacy

ISACA's Privacy Regulatory Lookup Tool can help practitioners keep pace with a privacy landscape that increasingly is being shaped by new regulations taking effect around the globe.

6 July 2023
Keri Bowman
Governance Article

The Interplay of IGA, IAM and GRC for Comprehensive Protection in Cloud Transitions

It is critical that organizations pay attention to the significance of governance, risk and compliance in their identity and access management journey.

6 July 2023
Caren Shiozaki
@ISACA Article

Achieving Digital Trust in an AI Economy

Businesses operate over long waves of innovation cycles. In each cycle, companies must reckon with disruptions brought about by the technologies of the time.

5 July 2023
ISACAs New Privacy Regulatory Lookup Tool
@ISACA Article

ISACA’s New Privacy Regulatory Lookup Tool

In a quickly evolving regulatory environment, it is important that privacy professionals stay abreast with the latest legislation that may affect them and their businesses.

5 July 2023
Caitlin McGraw
@ISACA Article

Resume Ethics in Digital Trust

How do hiring leaders perceive a lapsed certification that is not identified as such; the inclusion of a degree that isn’t quite finished without that additional detail; experience that is not what it is stated to be; and other untruths?

5 July 2023
Simon Backwell
Blog Post

What Do Cybersecurity Analysts Do?

Cybersecurity analysts work in security operations centers, where they review alerts and logs in search of suspicious activities, among many other tasks to protect the enterprise.

5 July 2023
Chris McGowan
Risk Article

Where Data and Behaviors Meet: The Internet of Behaviors

As is the case with any new technology, IoB has both benefits and risk

5 July 2023
Person typing on a laptop
ISACA Journal

Log Management as an Enabler for Data Protection and Automated Threat Detection

A proposed framework can be used to fast-track a log management program, which will ultimately improve the overall security and risk posture of any organization.

Author: Grant Hughes
Selling Security’s Value Proposition - person typing on computer
ISACA Journal Article

Information Security Matters: Selling Security’s Value Proposition

We have been valuing and evaluating security based on the absence of breaches. A much more positive approach is to project the value of security in terms of quality, reliability and value to the customer.

Author: Steven Ross
John De Santis
ISACA Journal Article

The Network: Balancing Risk and Innovation

As the incoming chair of the ISACA Board of Directors, how do you see ISACA growing and adapting to the constantly changing workplace and needs of its constituents over the next year?

Author: John De Santis
Digital Trust, An Enterprise Approach
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—An Enterprise Approach

The DTEF spans all parts of the enterprise, as can be clearly seen by examining either the Culture or Architecture domains.

Author: K. Brian Kelley
Making the Software Supply Chain Practical - hands typing on keyboard
ISACA Journal Article

The Bleeding Edge: Making the Software Supply Chain Practical

A look at the software supply chain through the lens of an SBOM—what it is, how it can help you, and how you can adapt your own program to practically incorporate it.

Author: Ed Moyle
Effective Governance and Board Oversight in a Globalized Information Environment - people sitting at conference table
ISACA Journal Article

Effective Governance and Board Oversight in a Globalized Information Environment

Board committees focused on technology and cybersecurity, when properly constituted, have a better ability to provide effective governance and critical scrutiny, which guides management in identifying and mitigating cyberrisk.

Author: Allen Ari Dziwa
Solving Standards Implementation Issues With a Global ISMS - security lock
ISACA Journal Article

Solving Standards Implementation Issues With a Global ISMS

To make compliance efficient and effective, all neccessary requirements must be combined, baselines established and one global information security management system developed.

Author: Sarantos Kefalas
Internal Audit as a Driver of Innovation - person in front of laptop
ISACA Journal Article

Internal Audit as a Driver of Innovation

To remain innovative, the internal audit function needs to adjust its activities and value propositions to align with the demands of the 4IR era.

Author: Noam Koriat
An Evolutionary Strategy for Leveraging Data Risk-Based Software Development for Data Integrity
ISACA Journal Article

An Evolutionary Strategy for Leveraging Data Risk-Based Software Development for Data Integrity

Updating the traditional software development methodology to include data risk-based development enables organizations to avoid any penalties that may be imposed due to a lack of controls and noncompliance with regulations and laws.

Author: Sasidhar Duggineni
Cooperating With Fear - digital lock
ISACA Journal Article

Cooperating With Fear

By acknowledging the complexities of security and cooperating with the element of fear, enterprises are empowered to focus on their most critical sources of risk.

Author: Jacob Zwicki
Bank’s CyberOps Team Wins EDR Buy-In - person touching icon on screen
ISACA Journal Article

Case Study: Bank’s CyberOps Team Wins EDR Buy-In

The Israeli government’s new demands on financial institutions tasked a cyber operations manager employed at one of the largest financial institutions in Israel with establishing a new cyberops team within the infosec department to develop a plan for achieving compliance, among other responsibilities.

Author: Mick Brady
Using Near Miss Incidents as Risk Indicators - security lock
ISACA Journal Article

Using Near Miss Incidents as Risk Indicators

Performance and risk indicators are essential sources for measuring the effectiveness of the protection measures adopted.

Author: Luigi Sbriz
The Digital Twin Advantage in Automotive Manufacturing Systems
ISACA Journal Article

The Digital Twin Advantage in Automotive Manufacturing Systems

Digital twin technology using AI and ML in the automotive industry can enhance the overall design and efficiency of automotives; however, these technologies pose cybersecurity risk.

Authors: Karthik Trichur Sundaram and Divya Karthik
Rebecca Herold
Blog Post

Protecting Phones, Data, and Your Business from Juice Jacking Risks

Recent warnings about the security risks of using public charging stations, such as at airports, hotels and hospitals, reinforces the value of juice jack blockers and using personal charging devices.

29 June 2023
Hands holding a digital globe
ISACA Journal Article

Convergence of the Physical and Digital Worlds: The Metaverse and AR/VR for Training and Education

The education sector has embraced new technological advancements such as AR and VR technologies as they can be used to change teaching and learning methodologies to improve learners’ understanding.

Author: Brigitte Collier
Chiaka Ben-Obi
Blog Post

Laying the Groundwork for the Future of Girls and Women in STEM

Chiaka Ben-Obi, who earned the 2023 ISACA Technology for Humanity Award for serving as a mentor for young women seeking careers in STEM fields, shares her motivation and vision for a more equitable tech workforce.

29 June 2023
John P. Pironti
@ISACA Article

Five Ways AI is Likely to Change How Organizations Approach Information Risk and Security

Existing and emerging AI technology will recalibrate the enterprise risk and security landscapes in some promising ways

28 June 2023
Auditing the Unauditable - person typing on laptop
ISACA Journal Article

Auditing the Unauditable: Ethics and Culture

Internal audit functions can play a role in evaluating several factors that are indicative of presence and proper implementation of good organizational policies related to work ethics and culture.

Author: Sumedha Adavade
leveraging-technology
Blog Post

Leveraging Technology to Help Enhance Trust in Internal Controls Amid Rising Material Weaknesses and Resource Constraints

The rise of material weaknesses leads to significant risks for enterprises and can diminish trust from key stakeholders. Understanding the causes of material weaknesses is an important precursor to developing the needed mitigation strategies.

27 June 2023
Rachel Botsman
Blog Post

Trust is Not Being Destroyed – Just Changing Form

ISACA Europe Conference: Digital Trust World keynote speaker Rachel Botsman explains why she thinks trust is not being destroyed but rather changing form.

26 June 2023
Ashok Kumar Padmaraju CISM, CCSK, AWS Security Specialist and Six Sigma Blackbelt
Blog Post

Fortifying Zoom Phone Security: A Comprehensive Threat Modeling Analysis

Zoom Phone has emerged as a robust communications tool but utilizing threat modeling and arriving at a better understanding of the attack surface is needed for the tool to reach its potential.

23 June 2023
Megan Moritz and Scott Gould
Podcast

Processes of Engagement with Scott Gould

Scott Gould is the author of 'The Shape of Engagement: The Simple Process Behind how Engagement Works.' In this podcast, Scott will discuss the essential frameworks for understanding and operationalizing engagement and building enduring connections with your networks and communities.

23 June 2023
Building effective defenses
Blog Post

Building Effective Defenses Against Social Engineering

By understanding how social engineering works and developing targeted defenses, cybersecurity practitioners can mitigate this perennially damaging threat.

22 June 2023
Jean Carlos
@ISACA Article

Switching the Blame for a More Enlightened Cybersecurity Paradigm

Placing blame on users for security mistakes can be both unfair and counterproductive - it's time to embrace a new cybersecurity paradigm

21 June 2023
David Foote
Blog Post

Pay for ISACA Certifications is on the Rise

Pay for several ISACA certifications in 2023 tells a promising story for certification-holders, according to recent salary data from Foote Partners LLC.

21 June 2023
Internal Audits That Create Stakeholder Value - person typing at laptop with overlying checkmark
ISACA Journal Article

Internal Audits That Create Stakeholder Value

The Agile Scrum mindset places a strong emphasis on stakeholder engagement by actively involving stakeholders in the internal audit process and seeking feedback, which can improve communication and collaboration, resulting in better audit outcomes.

Author: Thomas J. Bell III
The Top 5 Benefits of Becoming an ATO
Blog Post

Top Benefits of Becoming an ISACA Accredited Training Organization

ISACA Accredited Training Organizations provide a range of benefits, including increased credibility and access to unique training materials and programs.

20 June 2023
Rethinking IT Asset Valuation
Risk Article

Rethinking IT Asset Valuation, Risk Assessment and Control Implementation

Risk management and evaluation are critical to every enterprise’s strategic planning for information security.

20 June 2023
Anuj Choudhary
Blog Post

Ransomware Attacks on the Rise in India: The Need for a Global Culture of Crisis Management

Growing instances of ransomware attacks in India are instructive both of the extent of this threat around the world and the measures that organizations need to put in place to mitigate the risks.

16 June 2023
Nandita Rao Narla, Head of Technical Privacy and Governance at DoorDash
Blog Post

TSA’s Plans to Expand Facial Recognition at Airports: A Privacy Perspective

The advancement of facial recognition technology raises an array of privacy concerns, as underscored by the recent expansion of a program through the US Transportation Security Administration.

15 June 2023
Chris McGowan and Gurpartap “GP” Sandhu
Podcast

Delivering Security Value to Product Teams Using the Power of Data

In security, aligning with product teams has never been more important, especially when outmaneuvering adversaries.

15 June 2023
Lisa R. Young
@ISACA Article

Getting More Value from Risk Assessments

Conducting IT risk assessments is valuable for enterprises but the variance in how frequently enterprises conduct them shows more awareness-building is needed about how they fit into the risk management equation.

14 June 2023
Abdul Rafeq
@ISACA Article

Seven Steps for Digital Trust Professionals to Develop Analytical Thinking

Exploring different angles and dimensions of a problem and learning to ask the right questions are solid starting points for digital trust professionals to take to develop analytical thinking skills.

14 June 2023
Luigi Sbriz
Blog Post

Using Agile Practices for Internal Audit

The value in modern audit is timely data that can be leveraged to improve operating processes and business continuity, tied heavily to the enterprise risk lifecycle

14 June 2023
two people working in front of laptops
ISACA Journal Article

Mitigating Auditor Burnout With an Energy Management Mindset

Auditors need to change their mindsets and focus on managing energy rather than time to avoid burnout.

Authors: Elena Klevsky and Melissa Walters
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

IT Risk Assessments: A Process Your CIO or CISO Will Thank You For

Identifying and quantifying risk can be made more straightforward by following six key steps for IT risk assessments.

13 June 2023
Beatrice Nepoti and Cristiano Passerini
Emerging Technology Article

AI Systems Training Pause Sought

The decision of the GPDP to inhibit the use of an innovative tool based on generative AI, such as ChatGPT, may seem questionable; therefore, it is important to understand the motivation.

13 June 2023
Michael Rebultan
Blog Post

Common Cybersecurity Risks to ICS/OT Systems

Organizations need to protect their industrial control and operational technology systems from cyberthreats, including through regular vulnerability assessments, network segmentation and providing ongoing training on cybersecurity best practices.

12 June 2023
Erik Prusch
Blog Post

Join Me in Welcoming ISACA CEO Erik Prusch!

Erik is the right person to lead ISACA into the future. It is clear that he has a values-driven approach, a steady presence, the right vision and a clear focus to take us forward.

12 June 2023
How ATO and Chapter Training Can Help You Pass Your Certification Exam
Blog Post

How ATO and Chapter Training Can Help You Pass Your Certification Exam

ISACA's chapters and Accredited Training Organizations (ATOs) offer prime opportunities for certification candidates to prepare for success on their certification exams.

8 June 2023
Aaron Turner
@ISACA Article

A Security Globetrotter’s Lessons Learned from Boots on the Ground in Over 100 Countries

Aaron Turner has investigated and researched security incidents on the ground in more than 100 countries during his career.

7 June 2023
Caitlin McGraw
@ISACA Article

How to Manage Job Offers Like a Pro

Landing a job offer is naturally the goal of candidates who are engaged in the hiring process, but when it's offer time, there's much more to the back and forth between candidate and prospective employer than just saying yes or no.

7 June 2023
An MDDAP Use Case: How a Medical Device Manufacturer Increased Production by 62% and Reduced Staff Turnover by 70%
Blog Post

New Use Case Highlights Promising MDDAP Results

A new case study demonstrates a successful, real-life application of ISACA’s Medical Device Discovery Appraisal Program (MDDAP).

7 June 2023
Securing Next-Generation Broadcast Media Enterprises Against Cyberthreats
ISACA Journal Article

Securing Next-Generation Broadcast Media Enterprises Against Cyberthreats

It is essential for broadcast media enterprises to develop a cyberresilience strategy when broadcasting high-profile live events and determine what are cybersecurity challenges the enterprise faces specifically related to core broadcast business services.

Author: Muhammad Malik
Disaster Recovery and Business Continuity Preparedness for Cloud-based Start-ups
Blog Post

Disaster Recovery and Business Continuity Preparedness for Cloud-based Start-ups

Business continuity plans for start-up companies prepare them for unexpected events that may disrupt operations and can protect critical data, as well as the company's reputation.

6 June 2023
Laura Zannucci
Audit Article

The Increasing Importance of IT Audits to the BoD

How can the BoD ensure that it is adequately meeting requirements? One of the best ways to identify gaps in what an organization is doing vs. what it is expected to do is to conduct a thorough IT audit.

6 June 2023
Mary Carmichael
Blog Post

ChatGPT’s ‘Perfect Storm’: Managing Risk and Eyeing Transformational Change

Organizations looking to make ChatGPT implementations successful need to be mindful of interdisciplinary collaboration that taps technological expertise, regulatory compliance, risk management and operational understanding of the powerful AI chatbot.

5 June 2023
Gopikrishna Butaka
Blog Post

Understanding and Implementing Digital Trust Effectively

As the world has become more hyperconnected and digital interactions between systems, devices and people become more complex and complicated, digital trust has become an increasingly discussed concept.

2 June 2023
Chris McGowan and Ray Payano
Podcast

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

Organizations today struggle with vulnerability management. More specifically, remediating vulnerabilities in a timely manner poses a challenge.

1 June 2023
Europe Sets the Stage for AI Regulations
@ISACA Article

Europe Sets the Stage for AI Regulations

While the topic of regulating artificial intelligence is gaining traction around the globe, Europe is showing leadership in this area with a new proposal that could become the global standard

31 May 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Unpacking the World’s First AI Act

The European Union's proposed Artificial Intelligence Act takes a risk-based approach toward AI systems and applications while establishing legal requirements for high-risk AI systems.

31 May 2023
Digital Trust as a Differentiator: Insights from ISACA Digital Trust World
Blog Post

Digital Trust as a Differentiator: Insights from ISACA Digital Trust World Panel

A recent ISACA conference panel in Boston explored how digital trust can become a competitive advantage and how the entire organization must rally around the concept for trust to be delivered.

31 May 2023
Man typing in front of computers
ISACA Journal Article

Risk in the Digital Era and the Skills Required for a New Environment

Creating a specialized safety and security culture is essential to protect customer data and develop plans to prevent and mitigate IT and cybersecurity risk.

Author: Pierina Guizado
Matthew J Scott
Blog Post

Defensive Programming for Industrial Control Systems

Modern industrial control systems are exposed to the internet, making a proper code environment, defining rule sets and conducting verification increasingly important to protect these critical systems.

30 May 2023
Chandrasai D.
Blog Post

The 3A-3C Approach to Digital Solutions in the Pharmaceutical and Healthcare Sector

The digital health market is expanding, and cost, compliance and user comfort are essential elements to ensure related digital transformations are going to plan.

26 May 2023
Naomi buckwalter
Blog Post

Digital Trust World Conference: A Fabulous Convergence of Security, Emerging Tech and Lobster Rolls

ISACA's Digital Trust World conference in Boston left me excited about the future of the security profession despite many open questions about how AI and other emerging tech will reshape the profession.

25 May 2023
Meng Fai Chan
Emerging Technology Article

Navigating the Hype and Risk of Emerging Technologies

By taking a risk-informed approach, security and risk professionals can navigate the path forward in a way that balances the potential benefits of emerging technologies with the risk they may pose.

25 May 2023
Identity as a New Security Perimeter
@ISACA Article

Identity as a New Security Perimeter

The rapid shift towards global digitalization has brought inherent risk to people, things and systems that traditional security perimeters cannot keep up with, which is why embracing identity as a new security perimeter is crucial.

24 May 2023
Improving Governance at a National Bank With COBIT
ISACA Journal Article

Improving Governance at a National Bank With COBIT

Employees organizationwide can harness the potential of I&T for value creation—not merely the IT department.

Author: Bruno Horta Soares
Anamika Roy
Blog Post

Identity as a Service Audit Implications and Best Practices

Identity as a Service can have major implications for audit by dictating the way that organizations manage user identities and access their applications and IT workloads.

23 May 2023
Varun Prasad
Blog Post

Securing an AI Ecosystem: The Next Big Cybersecurity Challenge

As artificial intelligence becomes an increasingly prominent part of our professional and personal lives, security and control protocols must keep pace with the evolving ecosystem.

24 May 2023
Daniel Dobrygowski
Blog Post

Where Does Digital Trust Begin? An AMA with World Economic Forum’s Daniel Dobrygowski

Daniel Dobrygowski, the head of governance and trust for the World Economic Forum, was featured in a recent Ask Me Anything discussion on ISACA's Engage community, with a focus on building digital trust and its key implications in business and civil society.

22 May 2023
Denise Owens
Audit Article

Managing Data Privacy and Information Security With IT Audits

Ensuring that data are protected and secured in the most efficient and economical manners possible are constant battles due to the increasing sophistication of cybersecurity threats and the amount of data protection regulations.

23 May 2023
Safia Kazi, Natalie Jorion and Jack Freund
Podcast

The True Cost of a Data Breach

Guests Jack Freund and Natalie Jorion discuss the need for additional data for quantitative risk analyses and methods to derive that data when it does not exist. They cover how this was done in the past and their updated method for interpolation of such data from record losses and other firmographic data.

23 May 2023
Jon Stanford
@ISACA Article

The AI Revolution is Already Here

The artificial intelligence revolution is already here, meaning enterprises that are strategic in their use of AI and diligent about mitigating related risks and navigating ethical concerns will be well-equipped for this new era of business.

17 May 2023
Jack Freund
@ISACA Article

The Role of Hanlon’s Razor in Cybersecurity

The Hanlon's Razor adage, 'Never attribute to malice that which can be adequately explained by stupidity,' might be more applicable to the world of cybersecurity than you think.

17 May 2023
Chris Fraker
Blog Post

Five Tips to Prepare for ISACA’s CDPSE Exam

Top CDPSE exam scorer Chris Fraker shares his tips for success and how the certification benefits privacy professionals and their organizations.

17 May 2023
Understanding the Risk of Robotic Process Automation
Blog Post

Understanding the Risk of Robotic Process Automation

Reviewing vendor-provided scripts and testing systems in contained environments are important measures in dealing with risk stemming from robotic process automation.

17 May 2023
A Framework for SIEM Implementation - person typing on a laptop
ISACA Journal Article

A Framework for SIEM Implementation

An SIEM solution consumes information in the format of event logs from many different source systems and provides a consolidated view of security activities within an enterprise.

Author: Grant Hughes
Welland Chu
Blog Post

Maintaining Sovereignty in the Cloud: Controlling Your Digital Future

Cloud users' desire for for control over their data calls for digital sovereignty measures in collaboration with cloud providers.

16 May 2023
Lisa Cook and Kayne McGladrey
Podcast

2023 IT Compliance and Risk Benchmark Report

This podcast asks, are you wondering about the ever-changing landscape of IT compliance and risk management? Look no further. Hyperproof, a leading SaaS compliance operations provider, conducts an annual survey of over 1,000 IT risk, compliance, and security professionals to uncover their top challenges.

16 May 2023
Todd Harper
Blog Post

Using Tabletops and Simulations to Build Better Incident Responders

Incident simulations can be highly effective at pinpointing gaps in monitoring and detection processes, and better understanding how to go about catching bad actors.

15 May 2023
Chris McGowan and Jonathan Tomek
Podcast

What Is Your IP Address Cybersecurity IQ? The Role of IP Address Data in a Digital World

There are literally thousands of VPN services on the market. Some are undeniably benign, but others offer a slate of features that are friendly to cyber criminals.

15 May 2023
Steven Sim Kok Leong
Blog Post

Credential Hacking: The Dark Side of Artificial Intelligence

Artificial intelligence is capable of helping cybercriminals crack passwords, but the good news is cybersecurity professionals can leverage AI to fight fire with fire.

11 May 2023
Lisa Cook and Megan Maneval
Podcast

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

In this episode, we’ll assess risk management myths and discuss how to establish scalable, quantifiable, and always-on risk management for the future.

11 May 2023
ISACA Board Approves 2023 24 Board Slate De Santis to be Board Chair
@ISACA Article

ISACA Board Approves 2023-24 Board Slate; De Santis to be Board Chair

The upcoming slate for the 2023-24 ISACA Board of Directors was recently approved by the board, with John De Santis to become ISACA's next board chair.

10 May 2023
ISACA’s New Report Reveals Value, Benefits of Digital Trust
@ISACA Article

ISACA’s New Report Reveals Value, Benefits of Digital Trust

ISACA's State of Digital Trust 2023 research explores how organizations view digital trust, its top benefits, major obstacles, how it is measured and more

10 May 2023
Jon Brandt
Blog Post

Digital Trust: Focus on the Forest Rather Than the Trees

Digital trust does not come about through any one product or technology but increased transparency in how technology is being developed and deployed would be a good starting point to strengthening trust in the digital ecosystem.

10 May 2023
BCP and Corporate Social Responsibility in the Event of Union Strikes
ISACA Journal Article

BCP and Corporate Social Responsibility in the Event of Union Strikes

In the event of a union strike, it is essential to not only have a business continuity plan, but to have one that balances with corporate social responsibility .

Author: Jason Jiao
Mark Thomas
Blog Post

Taking Digital Trust from a Lofty Goal to a Measurable Reality

Organizations can turn digital trust into an important competitive advantage, as reinforced by the major takeaways from ISACA's State of Digital Trust 2023 report.

9 May 2023
Diego Fratus, CISA, CIA, CCSA, CRMA and Cedric Blotin, CISA
Audit Article

What the Post-Pandemic Future Holds for IT Auditors

COVID-19 acted as a catalyst that accelerated digital transformation, modified how brands interact with their customers and disrupted IT audit practices.

9 May 2023
Marc Randolph
Blog Post

ISACA Virtual Conference Keynoter: Never Lose the Spark of a Startup

Marc Randolph, a national bestselling author, executive mentor, angel investor, and the co-founder and first CEO of Netflix, will be the opening keynote speaker at the ISACA Virtual Conference: Digital Trust World.

8 May 2023
Chris McGowan and Pat Barnett
Podcast

How Organizations Can Consistently Reduce Cyberrisk

Cyber threats are now a “clear and present danger” to most organizations, companies and governments of the world. A good cyber defense involves many, intricate layers. You can never have enough layers, just like you can never remove all the risk.

8 May 2023
Kilian Truatmann
Blog Post

The Evolution of Cloud Computing and Distributed Ledger Technology

Enterprises need to have significant trust before they can move forward with delegating data control, storage and application execution to cloud providers.

5 May 2023
Embarking on the Journey Toward Digital Trust
Blog Post

Embarking on the Journey Toward Digital Trust

Dealing with adversity in a trustworthy and transparent way can turn a problem into a big opportunity for a company to strengthen its relationship with customers.

4 May 2023
Jon Brandt
Emerging Technology Article

Generative AI: The Future Is Now, and It’s Risky

Far too many users are starstruck by AI capabilities and are putting enterprises at substantial risk.

4 May 2023
2022 Annual Report
@ISACA Article

Annual Report Dives into ISACA’s Growth, Digital Trust Impact

ISACA's newly released 2022 annual report spotlights the organization's growing focus on digital trust as well as other highlights from the year, plus a recap of ISACA's finances.

3 May 2023
Chris St Clair
@ISACA Article

Cyber Versus IT Security in a Permanently Connected World

Before there was cybersecurity, there was IT security: contrasting the two terms reinforces the importance of going back to the security basics.

3 May 2023
Caitlin McGraw
@ISACA Article

It’s Personal: You Define What Success and Work-Life Balance Mean for You

Finding work-life balance can be challenging, especially in demanding digital trust fields, but there are several tactics that can help professionals find the right blend of personal and professional.

3 May 2023
Devharsh Trivedi
Blog Post

Privacy-Preserving Security Analytics

Preserving privacy while outsourcing is a challenge, especially when factoring in considerations such as how to preserve the security and privacy of data at rest.

3 May 2023
Robin Lyons and Sandra Kuyengwa
Podcast

Key Considerations for Conducting Remote IT Audits

Conducting adequate preparation including risk assessments, assessing resource requirements and ensuring ongoing communication to harness both the benefits and to address the potential challenges faced when conducting hybrid or fully virtual audits.

3 May 2023
Mary Carmichael
Blog Post

Developing Collective Risk Leadership Through CRISC

The interconnected nature of risks in today's environment calls for a holistic approach to risk management, which can be reinforced through the principles of the CRISC credential.

2 May 2023
2022 Annual Report
Blog Post

ISACA’s Digital Trust Vision Highlighted in 2022 Annual Report

ISACA's newly released 2022 annual report highlights the digital trust resources that the organization put forward along with other key organizational progress from the year.

1 May 2023
Cybersecurity lock shield
ISACA Journal Article

Information Security Matters: CISOs at Risk

Many of the readers of this Journal are or may someday be IT directors or chief information security officers. Sadly, your jobs may be on the line, should there ever be a cyberattack on your watch.

Author: Steven Ross
Laptop and man looking at papers
ISACA Journal Article

IS Audit in Practice: Advantages of Technology in Achieving Diversity

The CIO was convinced not only that technology could drive diversity in positive ways, but that the process itself could foster better collaboration from the team.

Author: Cindy Baxter
Infinity symbol
ISACA Journal Article

The Bleeding Edge: Advancing Sustainability Goals With DevOps

There are multiple things that we can do to support, either directly or indirectly, sustainability goals in and through the controls, procedures, processes and countermeasures that we work with every day.

Author: Ed Moyle
Several security locks
ISACA Journal Article

The Digital Trust Imperative: Cybersecurity Is Still Critical

Cybersecurity is not all there is to digital trust, but it is a key component that should not be ignored or undervalued.

Author: K. Brian Kelley
Person working in front of computer
ISACA Journal Article

Navigating the New Distributed Enterprise

Now that a hybrid or distributed workforce has become the new normal, it is imperative to ensure the digital trust, security and integrity of users, devices and assets, no matter where they physically reside.

Author: Timothy Liu
Cloud
ISACA Journal Article

Redefining Enterprise Cloud Technology Governance

Cloud computing is a key enabler of digital transformation and is an important consideration in digital governance; therefore, it is important that greater emphasis is placed on cloud governance to ensure that it is aligned with future business requirements.

Authors: David Mazula and Casper Lamprecht
Security lock graphics over people pointing at a laptop
ISACA Journal Article

Building Cyberresilience From Collaborative Culture

Overall, collaboration allows enterprises to better understand the threat landscape, effectively deploy resources to deter threats, respond to attacks more effectively and recover more quickly.

Author: Joseph Cheng
Cyber security lock
ISACA Journal Article

The Illusion of Control and the Challenge of an Adaptable Digital Enterprise

Enterprise risk management should be positioned to address uncertainties by shifting attention from avoiding failure to understanding control as a dynamic balance between decreasing uncertainties and amplifying novel emerging behaviors.

Author: Jeimy Cano
Cyber brain
ISACA Journal Article

Reducing Human and AI Risk in Autonomous Systems

To mitigate risk attributed to semiautonomous and fully autonomous systems, it is necessary to ensure that autonomous systems are designed and built to allay such fears by considering biases, ethics, fairness and trustworthiness as they apply to AI systems.

Author: C. Warren Axelrod
Ecommerce connectedness over cityscape
ISACA Journal Article

Case Study: Pivoting to Ecommerce During COVID-19 With SAP Commerce Cloud

For an organization to be successful in its business and become a leader in the market, it needs to be willing to use technology to initiate an effective digital transformation.

Author: Dhruv Aggarwal
Digital data
ISACA Journal Article

Data Are the Lifeblood of Business: To Thrive Governance Must Drive Insight

This new reality of data as the lifeblood that flows through all aspects of an organization presents an unprecedented opportunity to create new business benefits, innovate and work more effectively.

Authors: Nina Bryant and Susana Esteban
Robin Lyons, Frans Geldenhuys and Gustav Silvo
Podcast

Seven Things to Know Before Automating IT General Control Audits

This podcast is a practical discussion with two IT Internal Auditors, Frans Geldenhuys and Gustav Silvo, that have automated IT General Controls across their highly diversified and decentralized group.

2 May 2023
Ravikumar Ramachandran
Blog Post

The Science of Cybersecurity and its Future Challenges

Cybersecurity is a sub-discipline of computer science and a rigorous scientific approach should underpin the work of cybersecurity leaders and practitioners.

28 April 2023
Adeline Chan
Emerging Technology Article

Can AI Be Used for Risk Assessments?

To produce risk assessments with more accuracy, artificial intelligence (AI) can be used because one of its core competencies is data aggregation and interpretation.

28 April 2023
Kayne Mcgladrey
Blog Post

How the Relationship Between CISOs and Legal Teams is Changing

A closer relationship between CISOs and enterprise legal teams can help CISOs deal with increasing regulatory burdens, how to approach cybersecurity insurance and addressing liability in the event of data breaches.

27 April 2023
Tim Wallen
@ISACA Article

How Security Leaders Should Approach a Challenging Budgeting Environment

Tim Wallen, Regional Director, UKI & BeNeLux, for Logpoint, shares his perspective on current budgeting priorities and challenges for security leaders, AI security tools and more in this Q&A interview.

26 April 2023
Tan Soon Chew
Blog Post

Risk Assessment for Technical Vulnerabilities

Regardless of local regulations, risk assessment for technical vulnerability should supplement an organization’s existing comprehensive security risk assessment, not serve as a substitute.

26 April 2023
The Future of Cybersecurity Assessments Is Here
ISACA Journal Article

The Future of Cybersecurity Assessments Is Here

Data-driven security assessments are the next generation of cybersecurity assessments that organizations need to adapt to augment existing, traditional security assessments.

Authors: Karthik Sridharan, Jyothsna Chalasani and Pradeep Sekar
Chris McGowan
Blog Post

Pentagon Leak Case Shows that Insider Threats Remain a Prominent Risk

The recent high-profile Pentagon leak in the United States underscores the importance of defending against insider threats.

25 April 2023
Kurt Markley
Risk Article

Data Recovery Pitfalls to Avoid

There are 4 common false beliefs that should be dispelled to better protect organizations and their data.

25 April 2023
Jo Stewart Rattray
Blog Post

United Nations Meeting on the Status of Women Reveals True Gender Parity is Centuries Away

Women across the globe are finding ways to fast-track change and counteract concerning projections for how long it will take to truly erase gender disparities in the tech workforce and society as a whole.

24 April 2023
Sunil Bakshi
Blog Post

Gaining More Than I’ve Given Through ISACA Volunteering

Sunil Bakshi, of India, has relished sharing his expertise and exchanging ideas with members of ISACA's global community through his ISACA volunteer activities.

21 April 2023
Joyce Chua
Blog Post

ISACA Volunteer Starts Slow, Seizes Opportunities to Grow

A self-described introvert, Joyce Chua, of Singapore, says her volunteer activities with ISACA helped her build her speaking and collaborating skill set.

20 April 2023
Sophia Bekele
Emerging Technology Article

Breaking Through the Barriers of Leadership

Although traditional gender dynamics and systemic inequality create substantial obstacles that are preventing women from achieving parity in leadership roles within the metaverse, there are also ways for women to break through barriers.

20 April 2023
Celebrating ISACA Volunteer Appreciation Week 2023
@ISACA Article

Celebrating ISACA Volunteer Appreciation Week 2023

ISACA’s global community is made up of digital trust professionals and highly engaged volunteers who enable ISACA to be responsive to rapidly evolving industry trends.

19 April 2023
Abdul Rafeq
@ISACA Article

Seven Tips for Achieving Dynamic Professional Transformation with Framework Modeling

Combining micro and macro perspectives and developing an architect's mindset are among the keys to becoming proficient at framework modeling.

19 April 2023
Chetan Anand
Blog Post

Volunteer Finds Resources He Needs ‘All Under One Roof’

Chetan Anand says ISACA has provided many of the knowledge resources he is looking for "all under one roof," and he gives back through extensive volunteering.

19 April 2023
ENISA’s Threat Landscape and the Effect of Ransomware
ISACA Journal Article

ENISA’s Threat Landscape and the Effect of Ransomware

The blurred lines between cyberespionage and cybercrime, especially if state-sponsored actors carry out the attack, confirm that ransomware is a national security issue.

Author: Antonio Villamor
Julia Hermann
Blog Post

Volunteer Work Provides Fresh Perspectives for InfoSec Professional

Germany-based ISACA volunteer Julia Hermann says her volunteer work with ISACA has exposed her to new perspectives that have furthered her professional growth.

18 April 2023
Han Jumashov
Blog Post

Volunteering Pays Quick Dividends for Recent University Graduate

Han Jumashov has become an active ISACA volunteer after relocating to the United States from Turkmenistan to pursue his university degree and the beginning of his professional career.

17 April 2023
Ramona Ratiu
Blog Post

Award-Winner Creates a Culture of Innovation, Adaptability and Inclusion

ISACA Chicago Chapter President Ramona Ratiu reflects on her recent ISACA Inspirational Leadership Award and shares her leadership goals going forward.

14 April 2023
Chris McGowan and Justin Rende
Podcast

Eight Cybersecurity Trends to Watch for in 2023

With the start of a new year, it is a key time for all organizations, small through enterprise, to examine their IT infrastructure and review cybersecurity policies.

14 April 2023
Mike Hughes
Blog Post

Why Team Training Leads to Big Business Benefits

Enterprise training can ensure team members are aligned in their decision-making and approaches for more effective team performance and communication with stakeholders.

13 April 2023
John P. Pironti
@ISACA Article

Five Key Considerations When Developing a Collaboration Strategy for Information Risk and Security

The key to success for CISOS, their organizations, and their information risk and security programs is collaborating with leaders, stakeholders, and individuals on common goals.

12 April 2023
Patrick Sullivan
Blog Post

How Automation Can Streamline Your Compliance Journey

Usage of compliance automation technology is rising as organizations that implement it experience a range of benefits.

12 April 2023
The Impact of Blockchain Technology on Accounting and Auditing
ISACA Journal Article

The Impact of Blockchain Technology on Accounting and Auditing

If the adoption of new technologies such as blockchain changes the process of conducting transactions, accountants and auditors should understand the changes to correctly reflect them in their work.

Author: Mohammad K. Elshqirat
Julia Kanouse and Amanda Raible
Podcast

Industry Spotlight - Julia Kanouse

Get to know Chief Membership and Marketing Officer Julia Kanouse as she sits down with childhood best friend and ISACA VP Amanda Raible. The duo discuss everything from leadership to motherhood while competing in Mario Kart! Tune in!

12 April 2023
Gina Yarcone
Blog Post

Interactive Tabletop Scenarios: A Comprehensive Approach to Strengthen and Assess Your Incident Response Strategy

Interactive tabletop scenarios, incorporating gamification, can make a big difference in sharpening organizations' incident response preparedness.

11 April 2023
Patrick Barnett
Security Article

How Organizations Can Consistently Reduce Cyberrisk

Cyberrisk is an ever-changing parameter that requires constant analysis and is difficult to quantify.

11 April 2023
Ron Lear
Blog Post

CMMI Updates Take Performance Improvements to the Next Level

The latest iteration of the CMMI model includes security, safety, data management, people management, and managing virtual workforce best practices.

10 April 2023
Auditing and Digital Transformation Are at a Crossroads - zeros and ones digital graphic
ISACA Journal Article

Auditing and Digital Transformation Are at a Crossroads

To help organizations sustain this fast-paced growth, the performance and resilience of enterprises‘ IT systems and controls must be assured through internal and external audit and assurance partners.

Author: Vimal Mani
Michael Rebultan
Blog Post

Introduction to ICS/OT Systems and their Role in Critical Infrastructure

Industrial Control Systems/Operational Technology must be understood and secured effectively to avoid potentially disastrous impacts on critical infrastructure.

6 April 2023
Caitlin McGraw
@ISACA Article

How to Help a University Student Excel on the Internship Front

University students interested in internships need to be proactive to position themselves for the experiences they need to effectively jump-start their careers.

5 April 2023
Guy Pearce
@ISACA Article

What Detrimental Outcomes Might ChatGPT and AI-Powered Bing Unleash?

While ChatGPT and Bing AI have both been prominent examples of promising technology based on OpenAI, the related risks will require vigilance from digital trust professionals.

5 April 2023
Brian Fletcher
Blog Post

How CMMI Cybermaturity Platform (CCP) can help your organization implement Zero Trust

ISACA's new eBook is a free resource to guide you on how to simplify the implementation of a Zero Trust strategy in your organization with the CMMI Cybermaturity Platform (CCP).

5 April 2023
Combatting Social Engineering - cloud network connected graphic
ISACA Journal Article

Combatting Social Engineering

Although ransomware, data breaches and other large-scale cyberattacks are frequently in the headlines, it is too easy to overlook the common thread that runs through many of these incidents: social engineering.

Author: Chun Li
Kim Kaplan
Blog Post

The Exciting Benefits of ISACA’s MDDAP VIP Portal

ISACA's Medical Device Discovery Appraisal Program (MDDAP) Voluntary Improvement Program (VIP) Portal launched to collaborators and stakeholders with exciting features and updates.

4 April 2023
Security Awareness
Blog Post

Security Awareness Training: A Critical Success Factor for Organizations

Reducing chances of a data breach, supporting existing systems and increasing customer confidence are among the leading benefits of effective security awareness training programs.

31 March 2023
Frances Haugen
Blog Post

‘There is Hope’: Facebook Whistleblower Takes On Misinformation, Addresses Digital Trust

Facebook whistleblower Frances Haugen, who will be a keynote speaker at ISACA's upcoming Digital Trust World Boston conference, addresses misinformation and digital trust.

30 March 2023
Conference Chats with Chelsey & Robyn
Podcast

Conference Chats with Chelsey & Robyn

Tune in to listen to ISACA’s very own Chelsey Byrd and Robyn Franko as they discuss the upcoming fun at ISACA Conference North America 2023: Digital Trust World. 

30 March 2023
Tracking the Evolving Cybersecurity Jobs Landscape for 2023
@ISACA Article

Tracking the Evolving Cybersecurity Jobs Landscape for 2023

Given a challenging economic environment, hiring in the cybersecurity field might focus more on strategic and critical roles in the coming months.

29 March 2023
Samuel Zaruba Smith
Blog Post

Crypto Collapse and Democratizing Auditing

The proliferation of emerging technologies across domains and throughout all layers of an organization is leading to a democratization movement that is not yet well-understood, with IT audit playing a significant part.

29 March 2023
User Susceptibility to Social Engineering in AR Environments - hand holding an AR phone
ISACA Journal Article

User Susceptibility to Social Engineering in AR Environments

The cutting-edge technology augmented reality has seen increasing use but the potential cybersecurity risk facing users of this technology remains a point of concern.

Author: Sarah Katz
Michelle Dennedy
Blog Post

Insights from a Privacy Jedi

Privacy expert Michelle Dennedy recently shared her insights on emerging privacy trends and key industry challenges in an Ask Me Anything session through ISACA's Engage platform.

28 March 2023
Chris McGowan
Risk Article

Social Media as a Growing Threat to the Workplace

Failing to prioritize the security and privacy of a social media account can result in negative consequences spanning both the personal and professional worlds.

28 March 2023
Belinda Mueller
Emerging Technology Article

Understanding and Mitigating the Risk of AI vs. Traditional Software

It is crucial to understand what makes AI so different from traditional rule-based systems and how to address these differences.

27 March 2023
Raef Meeuwisse
Blog Post

The Biggest AI Moment Ever for Cybercrime Just Happened

Cybersecurity professionals, beware: the theft and repurposing of powerful AI models is within cybercriminals' reach, and it could be a game-changer.

24 March 2023
Safia Kazi and Steven Ross
Podcast

Advertising Information Security

In this episode, executive principal at Risk Masters International’s Steven Ross discusses why vendors of IT products and services are advertising information security...

24 March 2023
Richard Marcus, CISA, CRISC, CISM, TPECS and VP, Information Security, AuditBoard and John Volles, CISA, Director of Information Security Compliance at AuditBoard
Blog Post

Compliance Automation Journey: Five Steps to Streamline Efforts, Identify Risks, and Improve Team Workflows

When implemented effectively, compliance automation can make a big difference in allowing teams to dedicate their time toward more impactful priorities.

23 March 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 2

The updated versions of the ISO/IEC 27001 and ISO/IEC 27002 standards mean organizations have work to do to align their methods, protocols and workflows with the latest guidelines.

22 March 2023
Rahul Pandey
@ISACA Article

The Urgent Need for AI in GRC and Security Operations: Are You Ready to Face the Future?

The growing prominence of artificial intelligence is surfacing new opportunities for GRC and security professionals but also calls for specialized technical expertise.

22 March 2023
Luigi Sbriz
Blog Post

Solutions for Digital Identification

While a universal solution for digital identification of internet users might not be realistic, finding solutions that are suitable in various situations is realistic and a worthwhile goal.

22 March 2023
Agile Manifesto - hands in front of a laptop
ISACA Journal Article

Agile Manifesto for Internal Audit

The internal audit process must be responsive to internal enterprise changes to easily align with the evolution of the business and guarantee the effectiveness of audit operations.

Author: Luigi Sbriz
C. Warren Axelrod
Blog Post

A Collaborative Approach to Cybersecurity

Since attackers often benefit from cooperative measures, it only makes sense for organizations to collaborate in their efforts to thwart cyberthreats, even if that has historically proven to be challenging.

21 March 2023
Jeff Champion and Beth McKenney
Podcast

The Future of Technology Risk: 4 Ways to Build Stakeholder Trust in the Technology Risk Imperative

Today, the pace of change across industries is quicker than ever before. Economic, political, and social unrest and a global climate crisis have placed unprecedented disruption and pressures on organizations looking to navigate a rapidly changing environment.

21 March 2023
Patrick Trierweiler, A-LIGN Senior Consultant
Blog Post

Five Habits to Make Compliance Smoother for Lean Teams

Smaller organizations might find keeping on top of compliance activities to be challenging but there are several key habits that can help lean teams meet compliance responsibilities without feeling overburdened.

20 March 2023
Guy Pearce
Blog Post

As in Life, Digital Trust Is a Two-Way Street

It is not only organizations that have eroded trust – people have played a role, also, and both people and organizations need to be a part of fixing what is broken.

17 March 2023
Karthik Kaligotla
Blog Post

Software-Defined Networking: The Future of Networking

Software-defined networking provides a modern solution to evolving access challenges that can be problematic for network administrators.

16 March 2023
Adobe logo
Podcast

Measuring Security Resilience from the Lens of the Adversary Community

In a world where adversaries are constantly adapting to improve tactics, techniques, and procedures (TTPs), it is crucial to understand the unique traits and goals of various types of adversaries that actively seek to cause harm to an organization.

16 March 2023
Jack Freund
@ISACA Article

Yes, Business Process Maps Are Boring

Documenting business processes and how money flows through the organization might not be glamorous but it is well worth the effort for security teams.

15 March 2023
Veronica Rose
@ISACA Article

IT Audit Buzzwords That Have Become Buzzkills to Clients and Process Owners

IT auditors can manage their engagements more effectively by ditching common buzzwords in favor of less combative language.

15 March 2023
Person writing on electronic tablet
ISACA Journal Article

Application of the Nudge Theory for Improving Information Security Awareness Campaigns

Study findings provide strong evidence for the applicability of the nudge theory in improving the effectiveness of information security awareness posters.

Author: Sudeep Subramanian
Top Risks and Rewards of Moving to the Cloud
Blog Post

Top Risks and Rewards of Moving to the Cloud

Enterprises increasingly are moving to the cloud and seeing major benefits along the way, but it is important to weigh those gains against numerous cloud risks that need to be managed.

14 March 2023
Paul Philips
Risk Article

A Road Map to Breaking Down Zero Trust Barriers

Zero trust provides an enterprise the opportunity to create a more robust and resilient security posture, simplify security management, improve the end user experience and enable modern IT practices.

14 March 2023
Maria Sommerhalder
Emerging Technology Article

Standardization and Audit in the Blockchain Space

Standardization and audits play a crucial role in in mitigating the risk that organizations potentially face when implementing blockchain emerging technology.

14 March 2023
Astrid-Bailey
Blog Post

Influencing Security Decisions with Effective Communication

Effective communication makes a big difference in bolstering leadership buy-in for security programs.

13 March 2023
Yunique Demann
Privacy Article

Separating Privacy Awareness From Security Awareness Training

Having a privacy and security awareness training program is better than not having one at all, but having two focused programs addressing high-risk topics is beneficial to not only organizations, but employees as well.

13 March 2023
Mark Tarallo
Blog Post

Assessing Culture With Help From the US Surgeon General

The importance of organizational culture is now understood to be a major factor in an organization’s overall success.

9 March 2023
Jon Brandt and Ryan Cloutier
Podcast

Risky Business – Jon Brandt

For the average person, life moves quickly. But for business leaders and anyone involved in any aspect of IT, the pace at which technology is changing is overwhelming.

9 March 2023
Abby Zhang
@ISACA Article

‘Dream Big and Dare to Try’

ISACA Auckland Chapter board member Abby Zhang shares her perspectives on her role as a SheLeadsTech ambassador, needed progress for women in the digital trust fields and her areas of interest as a security researcher.

8 March 2023
Masood Ahmed
@ISACA Article

Key Security Features for SAP Analytics Cloud

SAP Analytics Cloud offers a wide range of security features and best practices to ensure the protection of data and functionality from unauthorized access.

8 March 2023
ISACA Foundation
Blog Post

ISACA Foundation Takes Equity Message to White House Office of National Cyber Director

ISACA Foundation recently took its message of equity and inclusion to the White House.

8 March 2023
RPA Is Evolving but Risk Still Exists - robotic hand and gears
ISACA Journal Article

RPA Is Evolving but Risk Still Exists

There are many benefits and uses of robotic process automation, and the newest addition of command-and-control centers; however, implementing these tools can also lead to risk.

Author: Larry Wlosinski
Muneeb Imran Shaikh
Blog Post

Data Privacy: A Public Policy Challenge

Data privacy is not just about information security, governance or customer trust - it also is a public policy challenge.

7 March 2023
Industry news
Governance Article

Why Are Regulations Demanding SBOM Adoption?

With the rise of software-based products, regulators have quickly implemented new standards to help manage the complexities of the software supply chain.

6 March 2023
Jouke Albeda
Blog Post

Improved IT Frameworks

Frameworks and IT general control guidance should be reviewed periodically to keep up with industry best practices.

3 March 2023
Frank Downs
Blog Post

LastPass Hack Highlights Importance of Applicable Acceptable Use Policies.

The recent LastPass breach reinforces that Acceptable Use Policies should not be overlooked or underestimated.

2 March 2023
Artificial Intelligence The Future of Information Security Awareness
@ISACA Article

Artificial Intelligence: The Future of Information Security Awareness | ISACA

Artificial intelligence will be the wave of the future when it comes to effective information security awareness training.

1 March 2023
Caitlin McGraw
@ISACA Article

Interviews. Pitch. Audition. Marathon! (Part 2)

A thoughtful, strategic approach to interviews will dramatically improve a candidate's chances to land job offers.

1 March 2023
Mohamed Sadat
Blog Post

Five Factors That Turn CISOs into Firefighters

Chief information security officers often find themselves doubling as firefighters - can it be avoided?

1 March 2023
Considerations for Developing Cybersecurity Awareness Training - woman writing on a note pad
ISACA Journal Article

Considerations for Developing Cybersecurity Awareness Training

it is important to implement effective cybersecurity awareness training to help employees understand proper cyberhygiene, recognize the security risk factors associated with their actions and identify cybersecurity incidents they may encounter in their work.

Author: Tan Soon Chew
Who Leads Cyberresilience?
ISACA Journal Article

Information Security Matters: Who Leads Cyberresilience?

Resilience is an enterprisewide undertaking and all functions must work together to achieve it.

Author: Steven Ross
Applying Lessons Learned From Election Processes to Data Integrity for Business Innovation
ISACA Journal Article

IS Audit in Practice: Data Integrity On Demand

As a risk manager or audit professional, how does one assess data integrity for new and innovative business when time is of the essence?

Author: Cindy Baxter
API Sprawl and Emergence
ISACA Journal Article

The Bleeding Edge: API Sprawl and Emergence

Unforeseen outcomes represent a blind spot in our ability to plan and can undermine security or privacy, make it harder to provide validation, or decrease the effectiveness of governance.

Author: Ed Moyle
The Impact of Relationships on Trustworthiness
ISACA Journal Article

The Digital Trust Imperative: The Impact of Relationships on Trustworthiness

An organization's relationships, and the quality of those relationships, may be the keys to surviving an unexpected disruption.

Author: K. Brian Kelley
Is Detrimental Unexpected - security locks
ISACA Journal Article

Is Detrimental Unexpected IT Emergence Inevitable?

Given the increasing pace of global IT development, it is important to understand if detrimental, unexpected IT emergence is in organizations’ control.

Author: Guy Pearce
The Potential Impact of the European Commission’s Proposed AI Act on SMEs
ISACA Journal Article

The Potential Impact of the European Commission’s Proposed AI Act on SMEs

The use of artificial intelligence (AI) technology has been consistently growing in popularity; therefore, many countries are designing and implementing policy frameworks to address the use of AI with regard to its ethical and security-related impacts.

Authors: Jakob Gassauer and Gerald Burch
Identifying and Preparing for Interruptions, Disruptions and Emergence
ISACA Journal Article

Identifying and Preparing for Interruptions, Disruptions and Emergence

It is important for information systems auditors to understand the nature of these interruptions, disruptions and emergence events to help their organizations to mitigate the adverse impact.

Author: Anantha Sayana
Cloud Computing Evolution - warning sign
ISACA Journal Article

Cloud Computing Evolution and Regulation in the Financial Services Industry

It is crucial for financial institutions to understand the role played by cloud computing in the increasingly digitized banking world, how to mitigate the risk of depending on cloud services and the further development that may materialize through the rise of distributed ledger technology.

Author: Kilian Trautmann
Taming Unruly Data to Improve Compliance
ISACA Journal Article

Case Study: Taming Unruly Data to Improve Compliance

Through a very modest investment and reliance on the ingenuity of its problem-solving team, the on the ingenuity of its problem-solving team, the bank prevented its fictitious records problem from morphing into a big data disaster.

Author: Mick Brady
Digital Trust and the Audit Function
ISACA Journal Article

Digital Trust and the Audit Function

With the ever-increasing use of and reliance on the Internet, big data and disruptive technologies, digital trust has become a necessity due to its ability to measure confidence in an organization's ability to protect, store and secure data and personal information.

Author: Gopikrishna Butaka
Protecting ICS Software
ISACA Journal Article

Protecting Industrial Control System Software With Secure Coding Practices

The best way to ensure secure ICS software is to apply a security perspective throughout the software development life cycle—from design to code development through verification and operation.

Author: Matthew Scott
Future of Technology
Blog Post

The Future of Technology Risk

Consider four ways to build stakeholder trust in the technology risk imperative.

28 February 2023
Mary Carmichael
Privacy Article

The Difference Between Data Privacy and Data Security

When it comes to data privacy, most people think about recent events such as TikTok’s data harvesting activities, Cambridge Analytica’s use of Facebook data without consent and new privacy regulations being introduced globally.

28 February 2023
Patrick Barnett
Security Article

Prepare for Success by Planning for Threat Actor Eviction

Before returning to business as usual after a breach, enterprises must ensure that all threat actors have been evicted from the network and are not able to enter again

28 February 2023
Five Powerful Quotes on the Black Experience in IT
Blog Post

Five Powerful Quotes on the Black Experience in IT

Despite historically being underrepresented in many IT fields, Black professionals have made a huge impact on digital trust disciplines.

27 February 2023
The Competitive Advantages of Privacy and Trust
Blog Post

The Competitive Advantages of Privacy and Trust

Sound practices in managing privacy and emerging technology implementations pays off for enterprises in creating trust with customers.

24 February 2023
Anastasiia Konoplova
Blog Post

Mindfulness Amid the Chaos

Anastasiia of the ISACA Kiev Chapter reflects on the difficult last year and the support the chapter has received from ISACA's global community.

23 February 2023
ISACA Ukraine Community Standing Strong
@ISACA Article

One Year Later: ISACA Ukraine Community Standing Strong

One year after their country went under attack, members of the ISACA Kyiv (Ukraine) Chapter continue to show great resiliency and garner support from ISACA chapters around the world.

22 February 2023
Abdul Rafeq
@ISACA Article

Seven Habits of Highly Skilled Digital Trust Professionals

The same habits that are associated with highly successful people can be applied to successful digital trust professionals, with a few additional twists to consider.

22 February 2023
The True Cost of a Data Breach
ISACA Journal Article

The True Cost of a Data Breach

For chief information security officers looking to convey how serious data breaches could be to their organizations, translating them into economic impact is critical.

Authors: Natalie Jorion and Jack Freund
Lisa Cook and Alex Bovee
Podcast

Rethinking Identity Governance

SaaS is eating the world even more than we think. Companies are dealing with SaaS sprawl: hundreds of apps distributed across different owners that store sensitive data and which are used to orchestrate critical business workflows.

21 February 2023
Patrick Offor
Blog Post

Examining Information Privacy Realities Contradiction Theory

Allowing our information privacy violation tendency to outweigh our protection tendency because of our self-interests can prove problematic to ourselves and others.

21 February 2023
Mary Carmichael
Blog Post

Making Risk Management for Agile Projects Effective

ISACA’s Incorporating Risk Management into Agile Projects white paper provides guidance for conducting risk assessment in an agile project context.

20 February 2023
Five Overlooked Benefits of Having an IT Certification
Blog Post

Five Overlooked Benefits of Having an IT Certification

Some benefits to attaining certifications are obvious but there are many other benefits beneath the surface.

17 February 2023
Tracey Dedrick
Blog Post

Smoothing the Path for an Even Brighter Future for ISACA

ISACA continues to deliver on its digital trust vision while finding new ways to serve its global community.

16 February 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Guide to the Updated ISO/IEC 27002:2022 Standard, Part 1

IT auditors and security practitioners should familiarize themselves with the updated ISO/IEC 27002:2022 Standard.

15 February 2023
Agile Methodologies Require Adjustments to Risk Management
@ISACA Article

Agile Methodologies Require Adjustments to Risk Management

A new ISACA white paper explores how Agile methodologies can benefit and help shape enterprise risk management.

15 February 2023
Beyond the Buzzwords: Specific Controls You Can Use: Ricky Hamilton
@ISACA Article

Beyond the Buzzwords: Specific Controls You Can Use

Industry buzzwords are commonplace, but what are the actual controls that audit professionals need to be familiar with to excel in their roles?

15 February 2023
Hakan Kantas
Blog Post

Building Resilience with ISACA

Resilience has become top-of-mind throughout the digital trust fields since the pandemic. The ISACA community can be a great place to sharpen resilience on a number of fronts.

15 February 2023
NIST’s Privacy Framework for Proposed US Federal Privacy Law
ISACA Journal Article

NIST’s Privacy Framework for Proposed US Federal Privacy Law

Governments around the world are enacting data security and data privacy rules and regulations at an increasing pace that is forcing enterprises to react, respond and realign their businesses to meet these challenges.

Author: Valdez Ladd
Jeff Champion and Kayne McGladrey
Podcast

2023: The Year of Risk

A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation-state APTs.

15 February 2023
Rupert Brown
Blog Post

Data Protection and Its Impact on the Older Population

Impacts of GDPR and other data protection policies on the elderly population should not be overlooked.

14 February 2023
Jannie Wentzel and Elissa Mckinley
Risk Article

Integrated Risk Management in an Interconnected World

In this integrated world, it is no longer enough for an enterprise to manage risk strictly within its own borders.

14 February 2023
Tony Bai
Blog Post

FedRAMP for ISVs: How Out-of-Scope Organizations Can Demonstrate Federal Compliance

Some software vendors don’t fall within the scope of FedRAMP and must identify alternate paths to compliance.

13 February 2023
Safia Kazi and Caitlin McGaw
Podcast

Career Coach Advice: How to Launch Your IT Audit Career

Career coach Caitlin McGaw will share her top tips for young professionals and career changes on how to launch a successful career in IT audit—from acing your first interview and landing your first job to career resources to help your career continue to grow and thrive.

10 February 2023
Paul Phillips and Linda Thielova
Podcast

How to Mature Your Privacy Compliance Program: A Conversation With OneTrust DPO Linda Thielova

Compliance with the world’s ever-increasing list of privacy laws can be a tricky undertaking for any organization, but by taking a few simple steps...

10 February 2023
Chris McGowan, Rex Johnson and Hamlet Khodaverdian
Podcast

Improving Cyber Resilience in an Age of Continuous Attacks

We live in the age of continuous compromise. This podcast dives into why so many organizations continue to be breached even after spending money on cybersecurity point solutions.

10 February 2023
Brian Fletcher
Blog Post

Governance, Processes and Planning: Three Significant Countermeasures to Being Hacked

Governance, processes and planning are three components of cybersecurity management that can address the people vulnerability.

9 February 2023
Kayne McGladrey
Blog Post

Three Key Predictions for 2023: The Year of Risk

The rise in importance of internal risk assessments is among the key trends that could shape the risk landscape in 2023.

9 December 2022
Implementing an Emerging Risk Analysis Process
@ISACA Article

Implementing an Emerging Risk Analysis Process

Emerging risk analysis is an area more enterprises should prioritize, and it might be less difficult to implement than many realize.

8 February 2023
The Future of Cryptography
ISACA Journal

The Future of Cryptography: Performing Computations on Encrypted Data

Fully homomorphic encryption allows organizations to ensure their customers' privacy without undermining their ability to gain insights from their data.

Author: Devharsh Trivedi
Ray Payano
Risk Article

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

By calculating vulnerability risk, enterprises can prioritize vulnerabilities based on risk level to help determine the order in which vulnerabilities are addressed.

7 February 2023
Tamim Ahmed
Blog Post

Major Challenges Ahead for GRC Professionals in 2023

GRC professionals will need to remain attuned to changes impacting the technology, regulatory and security landscapes to be effective in the year to come.

2 February 2023
Caitlin McGraw
@ISACA Article

Interviews. Pitch. Audition. Marathon!

Digital trust professionals typically remain in-demand even at times when economic conditions are not ideal.

1 February 2023
IT Certifications That Are Best for Beginners
@ISACA Article

IT Certifications That Are Best for Beginners

Credentials aimed at boosting early-career professionals can equip digital trust professionals to successfully break into IT fields.

1 February 2023
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Projecting Cybersecurity in 2023

2023 shapes up as another challenging - and interesting - year for security professionals

1 February 2023
Sai Mohan and Ranganath Lyengar
Blog Post

Data Protection in Enterprises

Data protection is maturing toward a more holistic approach, with emphasis on meaningful datasets to enterprises and regulations.

1 February 2023
HelpSource
ISACA Journal Article

Help Source Q&A

How can the effectiveness of security awareness programs be measured?

Author: Sunil Bakshi
Meghan Maneval
Risk Article

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

The beginning of a new year is the perfect time to reflect on the past year and assess any industry trends or upcoming events that could impact organizations.

31 January 2023
Charles Cresson Wood
Blog Post

Third Party Audit Reports as the New Trust Currency

The compliance audit process can give third parties confidence in an organization’s ability to manage and govern information security and privacy.

30 January 2023
Michael Kelly
Blog Post

Assessing the Risk of Emerging Technology: Will Early Assessments Match Reality?

Implementation of emerging technologies requires organizations to rethink their approaches to risk assessment.

26 January 2023
Entering a New World of Digital Trust
@ISACA Article

Entering a New World of Digital Trust

A new conference series from ISACA will bring digital trust professionals together in 2023 in the US, Europe and virtually.

25 January 2023
The Intersection of Trust and Employee Productivity
@ISACA Article

The Intersection of Trust and Employee Productivity

New research from Cerby suggests that by adopting zero trust principles and trust-positive initiatives, organizations can build digital trust with employees and consumers.

25 January 2023
Ron Lear
Blog Post

CMMI Performance Continues to Impress, Improve

The CMMI Performance Report captures encouraging insights in business capability and performance objectives.

25 January 2023
Blockchain Smart Contracts, Part 3
ISACA Journal Article

Blockchain Smart Contracts, Part 3: Deployment and Integration With Existing Information Technology Systems

It can be challenging to integrate blockchain smart contracts with existing (legacy) IT systems.

Authors: Samuel Smith and Andy Garcia
Neha Sharma
Blog Post

Categorizing and Handling Sensitive Data

Organizations need to be intentional and diligent about how they classify and handle both regulated and unregulated sensitive data.

24 January 2023
Patrick Barnett
Security Article

Common Misconceptions About Modern Ransomware

There are many misconceptions about ransomware attacks, often due to enterprises’ failure to adapt to changes in threat group tactics, techniques and procedures (TTPs).

24 January 2023
Wanbil W. Lee
Blog Post

Recognizing the Hidden Risk and Quantifying Ethical Analysis When Governing Data

Data bias is a hidden risk in data governance. It can creep in during data collection, storage and use, and via applications used by a human or in an AI algorithm created by a human.

23 January 2023
Komitas Stepanyan
Blog Post

Modern Complexities of Cybersecurity

Can an organization be 100% protected against cyberattacks? While trying to answer this question, former US FBI Director Robert Mueller’s words can be considered: “There are only two types of companies: those that have been hacked and those that will be.”

20 January 2023
Betsie Estes and Kevin Keh
Podcast

ISACA Live: Advancing Digital Trust Through IT

On National IT Professionals Day, ISACA's Kevin Keh explains how IT professionals can advance digital trust in their organizations and in their industries.

19 January 2023
Privacy in Practice 2023
@ISACA Article

New ISACA Report Spotlights Privacy Benefits, Challenges

A new ISACA privacy report highlights key challenges and opportunities for practitioners in 2023.

18 January 2023
Abdul Jaleel
Blog Post

ChatGPT and Leveraging Artificial Intelligence in Auditing

ChatGPT is the latest example of how artificial intelligence can make a substantial impact for IT audit professionals.

18 January 2023
Why Enterprises Need Trust Assurance
ISACA Journal Article

Why Enterprises Need Trust Assurance

To ensure that quality services and products are being delivered and to identify any partners who may be behaving unethically, enterprises need trust assurance.

Author: Vimal Mani
Safia Kazi and Dr. Patrick Offor
Podcast

Information Privacy Contradiction: Interest-Based Posture of Compliance and Violation?

Why do individuals, organizations, institutions, nations, or responsible agents work hard to preserve their personal and enterprise data, personnel information, trade secrets, intellectual properties...

18 January 2023
Noelle Pickler
Blog Post

ISACA Mentorship Program Galvanizing Connections

The ISACA Mentorship Program is leading to new connections and professional growth around the globe.

17 January 2023
Guy Pearce
Blog Post

Sizing Up the Global State of Privacy

ISACA's Privacy in Practice 2023 report showcases areas for improvement when it comes to executive support, skills and staffing in the privacy field.

17 January 2023
Antonio Rocha
Blog Post

Where Privacy Stands Five Years After GDPR

Five years after the GDPR regulation came onto the privacy scene, there is still much progress to make on the people, process and technology fronts for enterprises to be on sturdier ground.

17 January 2023
Sandra Kuyengwa
Audit Article

Key Considerations for Conducting Remote IT Audits

While remote auditing is nothing new, the COVID-19 pandemic and resulting need for social distancing fast-tracked the adoption of remote and hybrid audits.

17 January 2023
Hakan Kantas
Blog Post

How to Ensure Your IT Objectives Align with Organizational Goals

Aligning IT initiatives to overarching enterprise business goals is important and measurable.

12 January 2023
Deep Seshadri
@ISACA Article

How to Resource the CISO

The CISO position is challenging enough. It must be resourced properly to set up the CISO for success.

11 January 2023
Jack Freund
@ISACA Article

Learning From Other People’s Mistakes

Sharing information about what is working and what is not working can be an overlooked ingredient for success for risk management professionals.

11 January 2023
Five Reasons to Make 2023 the Year to Pursue a Certification
Blog Post

Five Reasons to Make 2023 the Year to Pursue a Certification

Validation of knowledge and keeping pace with the fast-moving technology landscape are among the leading motivations to pursue an IT certification in 2023.

11 January 2023
Mitigating Technical Vulnerabilities With Risk Assessment
ISACA Journal Article

Mitigating Technical Vulnerabilities With Risk Assessment

A risk assessment can prioritize which technical vulnerabilities are most critical, allowing an enterprise to allocate the appropriate resources to fix or patch these vulnerabilities in a timely manner.

Author: Tan Soon Chew
Billy Anglin
Blog Post

Ransomware Looms Large on Third-Party Risk Landscape

Due diligence and sound risk management are essential to help enterprises prepare for ransomware and other threats involving third-party relationships.

10 January 2023
Justin Rende
Security Article

Eight Cybersecurity Trends to Watch for in 2023

As 2023 approaches, it is an opportune time for organizations of all sizes to examine their IT infrastructure and review their cybersecurity policies.

10 January 2023
Saravanan Gurumurthy
Blog Post

The Importance of Embedding a Culture of Privacy by Design

Organizations can gain a competitive advantage by taking deliberate measures to implement privacy by design.

9 January 2023
Gaelle Koanda
Blog Post

How I Survive Imposter Syndrome

Dealing with imposter syndrome can be even more challenging for those living and working in countries in which they are not native speakers.

6 January 2023
Guy Pearce
Blog Post

In Search of Great Data Candidates

Identifying the best candidates for data-focused roles can go a long way toward improving an organization's risk profile.

5 January 2023
Candidates Beware: Red Flags to Avoid when Preparing for and Taking an ISACA Exam
@ISACA Article

Candidates Beware: Red Flags to Avoid when Preparing for and Taking an ISACA Exam

Creating trust in the exam process and results is crucial for certification candidates to demonstrate their accomplishments.

4 January 2023
Ransomware Readiness Audit Program
@ISACA Article

ISACA Puts Forward Ransomware Audit Program | ISACA

ISACA’s ransomware audit program provides foundational information, practical guidance and approaches to preparing for and recovering from a ransomware-related incident.

4 January 2023
Caitlin McGraw
@ISACA Article

The Perennial New Year’s Question: Should I Stay or Should I Go?

The start of a new year for some professionals means time to think about whether they intend to stick with their current job or pursue a new opportunity.

4 January 2023
Jamal Elmella
Blog Post

How Cyber Pathways Can Help Your Career

The Cyber Pathways Framework could have a significant impact in resolving the ongoing skills crisis in the cybersecurity field.

4 January 2022
Understanding, Assessing, Aligning and Transforming Organizational Culture
ISACA Journal Article

Understanding, Assessing, Aligning and Transforming Organizational Culture

Culture is crucial for nearly every enterprise; a strong culture can lead to a successful organization and a lack of culture can cause an organization to be unsuccessful.

Author: Mark Tarallo
Jonathan Tomek
Security Article

What Is Your IP Address Cybersecurity IQ?

Now more than ever, security professionals need a thorough understanding of the IP addresses that seek to access their networks.

3 January 2023
Lisa Villanueva and Guy Pearce
Podcast

Beware the Traps of Data Governance and Data Management Practice

Guy Pearce joins ISACA’s Lisa Villanueva for a conversation about the traps of Data Governance and management.

3 January 2023
Robin Lyons and Mike Tomaselli
Podcast

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Numerous laws and regulations have been passed to protect sensitive information, both at the federal and state level, creating a patchwork of requirements for companies to comply with.

3 January 2023
Rinki Sethi
ISACA Journal Article

Guest Editorial: Dear Readers

As a long-time member, I am excited to see ISACA commit to digital trust to help organizations and individuals build and benefit from a safer and more secure digital world.

Author: Rinki Sethi
Information Security Matters: Advertising Information Security
ISACA Journal Article

Information Security Matters: Advertising Information Security

I am concerned that people at large will come to believe that information security can be achieved simply by buying it. Yes, tools are important, but the program that chooses and uses those tools is paramount.

Author: Steven Ross
IS Audit in Practice: Building Digital Trust Through Advocacy
ISACA Journal Article

IS Audit in Practice: Building Digital Trust Through Advocacy

Growing skills through formal programs in hopes of increasing the talent pool of qualified professionals would institutionalize consistent learning for the profession and assist in standard and repeatable digital trust attributes.

Author: Cindy Baxter
The Bleeding Edge: Infrastructure as Code—Digital Trust Enabler?
ISACA Journal Article

The Bleeding Edge: Infrastructure as Code—Digital Trust Enabler?

In situations where there is new technology in the offing, it is incumbent upon the practitioner to both objectively analyze that risk and also evaluate that technology for its potential in reduction of risk and to help enable trust.

Author: Ed Moyle
The Digital Trust Imperative: Defining, Establishing and Measuring Digital Trust
ISACA Journal Article

The Digital Trust Imperative: Defining, Establishing and Measuring Digital Trust

Given that digital trust is an abstract concept, we do need to define it as clearly as possible. We also need some means of determining how trustworthy an organization is in the digital ecosystem.

Author: K. Brian Kelley
Reality Check: The Use of Big Data and Predictive Data Models
ISACA Journal Article

Reality Check: The Use of Big Data and Predictive Data Models

The power, precision and affordability of predictive models are increasing based on the increasing volume and availability of data in general and the computing power of the cloud.

Author: Kevin Alvero
Toward Rebuilding Data Trust
ISACA Journal Article

Toward Rebuilding Data Trust

Poor data management in general, and poor data quality in particular, can have negative impacts on data trust and, thus, on digital trust.

Author: Guy Pearce
How to Digitally Verify Human Identity: The Case of Voting
ISACA Journal Article

How to Digitally Verify Human Identity: The Case of Voting

The excess of information used for identification is contrasted with the need to respect the fundamental rights and freedoms of people’s privacy and in particular their right to protect their personal data.

Author: Luigi Sbriz
Extending Zero Trust to the End User Ecosystem
ISACA Journal Article

Extending Zero Trust to the End User Ecosystem

There are significant gaps in current approaches to achieving digital trust, and to address these gaps, organizations need to expand security perimeters to fit into a digital trust framework.

Author: Gideon Hazam
Looking Inside the Magical Black Box
ISACA Journal Article

Looking Inside the Magical Black Box: A Systems Theory Guide to Managing AI

With the widespread use of AI, this technology affects most of humanity; therefore, it may be time to take a systemwide view to ensure that this technology can be used to make ethical, unbiased decisions.

Authors: Simona Aich and Gerald Burch
Case Study: Performing a Cybersecurity Audit of an Electric Power Transmission Systems Operator
ISACA Journal Article

Case Study: Performing a Cybersecurity Audit of an Electric Power Transmission Systems Operator

Most countries in the world consider electricity transmission and distribution infrastructure and services fundamental parts of their critical infrastructures. 

Authors: Bostjan Delak and Miroslav Kranjc
Business and Technology Drivers for Decentralized Cloud Systems
ISACA Journal Article

Business and Technology Drivers for Decentralized Cloud Systems

Decentralized cloud systems offer a remedy for lack of data ownership and control, data breaches and security risk, increasing storage costs and low transmission speed.

Author: Robert Putrus
Ravikumar Ramachandran
Blog Post

The New, Emergent CISO

The CISOs of the future will have to combine a wide range of technical and business skills to rise to the many challenges they will face.

30 December 2022
David Adams
Blog Post

The Main Challenges of Effective Risk Management

Risk management can be a tremendous asset for organizations when the right processes and methodologies are applied to overcome key challenges.

28 December 2022
Are IT General Controls Outdated?
ISACA Journal Article

Are IT General Controls Outdated?

When testing IT general controls, additional controls related to security assessments, data asset protection, secure data transit, endpoint protection, vulnerability monitoring, security monitoring and secure disposal should be considered for the relevant application, database, operating system and network components in the IT environment.

Author: Jouke Albeda
Information Security
Blog Post

Addressing Selective Compatibility

Today's methods of authentication are likely to become less reliable going forward, making selective compatibility all the more relevant.

22 December 2022
Chris McGowan and Cindy Baxter
Podcast

Do Data Go To Waste

The Impact of SOX on the Industry 20 Years Ago and Today. Opponents of Sarbanes Oxley, (SOX) contend the law is too costly for companies to operationalize given the small benefit that SOX regulation provide.

22 December 2022
Facial Recognition Technology and Privacy Concerns
@ISACA Article

Cybersecurity: What is Changing and What Isn’t

ISACA member Sourya Biswas shares his perspective on how the cybersecurity and risk professions are evolving, the role security can play in advancing digital trust and what challenges the future will present.

21 December 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Facial Recognition Technology and Privacy Concerns

Privacy and security risks need to be addressed as facial recognition technology becomes more prevalent and usages for the technology expand.

21 December 2022
Raef Meeuwisse
Blog Post

Top Cyberattacks of 2022: Lessons Learned

Major 2022 data breaches involving Optus, Uber and Neopets led to many lessons learned for security practitioners and business leaders.

21 December 2022
When Data Protection Is a Hindrance Rather Than a Facilitator
ISACA Journal Article

When Data Protection Is a Hindrance Rather Than a Facilitator

Data protection has become a catch-all excuse for poor service—a problem that can only be solved with a mixture of transparency (both governmental and organizational) and regulatory initiatives.

Author: Rupert Brown
Frans Geldenhuys and Gustav Silvo
Audit Article

Seven Things to Know Before Automating IT General Control Audits

There are 7 major takeaways from an audit automation process.

20 December 2022
Ravikumar Ramachandran
Blog Post

The Future of Skills: Preparing for Industry 4.0 and Beyond

Industry 4.0 brings great potential to transform the IT professional landscape.

16 December 2022
Julie Ebersbach and Michael Powers, Ph.D., CRISC
Blog Post

Quantifying the Qualitative Risk Assessment: Using Data to Inform Judgment

The technology field is ripe for quantification support for qualitative judgments.

15 December 2022
50 Years and an Impactful Future for the ISACA Journal
@ISACA Article

50 Years and an Impactful Future for the ISACA Journal

The ISACA Journal is wrapping up its 50th anniversary year while remaining committed to providing key guidance for the ISACA community in the future.

14 December 2022
Sunil Bakshi
@ISACA Article

Addressing Professional Ethical Dilemmas

Stakeholders prefer to do business with reputable enterprises that conduct themselves ethically, meaning digital trust professionals must keep ethical considerations top-of-mind as they conduct their work.

14 December 2022
How Digital Trust Professionals Can Thrive in a Challenging 2023
@ISACA Article

How Digital Trust Professionals Can Thrive in a Challenging 2023

2023 shapes up as a challenging year for digital trust professionals, who can face a dynamic and fast-changing set of circumstances in fields such as IT audit, risk management, privacy and cybersecurity.

14 December 2022
Sean Renshaw
Blog Post

All systems are GO!

Enterprises need to shift their mindset from 'cyber incident' to 'crisis management,' especially in an era when ransomware and other threats are present dangers.

14 December 2022
The Information Privacy Contradiction
ISACA Journal Article

The Information Privacy Contradiction

Information privacy policies, regulations and enforcement mechanisms would better serve society if information privacy realities contradiction considerations were integral to policy formulation and legislative enactment from the onset.

Author: Patrick I. Offor
Rex Johnson and Hamlet Khodaverdian
Security Article

Improving Cyberresilience in an Age of Continuous Attacks

It is now more important than ever to constantly develop and mature cybersecurity readiness. A holistic and integrated approach with the right tools can provide a better chance of surviving a cyberattack.

13 December 2022
Safia Kazi and Christina Luttrell
Podcast

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation, and a looming recession, it is clear that the world has entered a new era of risk.

13 December 2022
Information Security
Blog Post

Talent Transformation Strategies for Security Leaders to Address the Cybersecurity Workforce Challenges

Investing in a strong security culture and adopting a growth mindset are among the approaches that can help organizations transform their strategy for dealing with cybersecurity talent shortages.

12 December 2022
Kerris Lee
Blog Post

Five Actionable Success Tips for Risk Professionals in 2023

What organizational risks should risk management professionals be sure to keep in mind as we head toward 2023? Kerris Lee provides tips for the new year for risk practitioners.

8 December 2022
ISACA Fielding 2023-24 ISACA Board of Directors Nominations
@ISACA Article

ISACA Fielding 2023-24 ISACA Board of Directors Nominations

ISACA is seeking new directors for upcoming board term.

7 December 2022
Rahul Pandey
@ISACA Article

The Unheard Story of Lost Anonymity

If there are so many benefits of removing anonymity from the internet, then why not do so? The answer to this question is directly related to the meaning of the internet itself.

7 December 2022
Lisa Mckee
Blog Post

Five Actionable Success Tips for Privacy Professionals in 2023

More and more organizations are realizing that privacy programs must be appropriately prioritized and resourced, a reality that will only become more striking in 2023.

7 December 2022
Using FLOSS to Implement COBIT for I&T Governance
ISACA Journal Article

Using FLOSS to Implement COBIT for I&T Governance

Free/libre open source software (FLOSS) can be used to achieve greater freedom along with vendor independence and financial benefits in enterprise software portfolios.

Authors: Laura Jaime and João Barata
Samantha Hart
Blog Post

Five Actionable Success Tips for Security Professionals in 2023

Creating a personal incident response plan is a good place to start when security professionals consider how they can thrive in 2023.

6 December 2022
Jai Sisodia
Audit Article

AI Ethics and the Role of IT Auditors

It is critical that ethics be given careful consideration when designing, operating and auditing AI systems.

6 December 2022
Varun Prasad
Blog Post

Five Actionable Success Tips for Audit Professionals in 2023

Looking toward 2023, IT audit professionals will need to increasingly focus on cloud environments and privacy engineering to keep pace with the changing technology and regulatory environment.

5 December 2022
Paul Thompson
Blog Post

Dialing in the Data

Building cyber resilience can be an uphill battle for many organizations given the proliferation of data and the fast-evolving threat landscape.

2 December 2022
Adobe logo
Podcast

Meeting Attackers Where They Are

The world's largest software companies leverage modern-day Red Teams to protect against real-world attacks. Many companies focus on vulnerability management, compliance, and patching to secure themselves, but this is only a tiny part of the big picture.

2 December 2022
Information Security
Blog Post

Achieving Resilience at ASEAN-Japan’s Cybersecurity Capacity Building Centre

Much can be learned from the way the ASEAN-Japan’s Cybersecurity Capacity Building Centre deployed several procedures to reduce the COVID-19 pandemic’s effects on operations.

1 December 2022
Preventing Privacy by Design from Becoming a Privilege
@ISACA Article

Preventing Privacy by Design from Becoming a Privilege

Privacy risks are on the rise due to the proliferation of data, putting greater emphasis on privacy by design.

30 November 2022
Robin Lyons
Blog Post

Identity and Access Management: The Nonhuman View

As digital transformation sweeps across organizations, the technologies that are the foundation of that transformation need access.

30 November 2022
Establishing Enterprise Roles for Data Protection
ISACA Journal Article

Establishing Enterprise Roles for Data Protection

There are clear challenges associated with how specific types of data need to be safeguarded, stored and shared on a need-to-know basis, and data governance mechanisms provide guidelines for these practices.

Authors: Sai Krishnan Mohan and Ranganath Iyengar
Information Security
Blog Post

Which Cybersecurity Roles Pay the Best?

Cybersecurity talent remains highly in-demand, leading to several roles that command high salaries.

29 November 2022
Patrick Barnett
Security Article

How Cyberprofessionals and Threat Actors Have Changed Over the Decades

As threat actors get bolder and more creative, cybersecurity professionals must attempt to stay 1 step ahead.

29 November 2022
Brian Fletcher and Tim Liu
Podcast

Taking Security Strategy to the Next Level: The Cyber Kill Chain vs. MITRE ATT&CK

In an era of rampant ransomware and other malicious cyberattacks, it’s mandatory to double down on cybersecurity analysis and strategy to ensure an optimal security posture and the protection of critical assets and data.

29 November 2022
Ashief Ahmed
Blog Post

Five Mistakes to Avoid When Preparing for a Certification Exam

Avoiding some common mistakes can make for a more successful certification exam experience.

28 November 2022
John P. Pironti
@ISACA Article

Five Key Components of an Application Security Program

An effective application security program can significantly reduce the presence of new vulnerabilities, which, in turn, enhances application security.

23 November 2022
The Board’s Role in Advancing Digital Trust
@ISACA Article

The Board’s Role in Advancing Digital Trust

Board role in digital trust article: Digital trust is a topic that requires ongoing tone-setting, backing and direction from the board of directors.

23 November 2022
Cliff Huntington
Blog Post

What Do the ISO 27001 Updates Mean for Your Business?

"After nine years of certifications, ISO has released an updated version for one of the most popular frameworks in the cybersecurity environment."

23 November 2022
Adding a New KPI to Determine Whether Directors and Officers Have Met Their Legal Duties
ISACA Journal Article

Adding a New KPI to Determine Whether Directors and Officers Have Met Their Legal Duties

Information security and privacy teams need an easy-to-adopt, readily deployed, inexpensive and fully scripted compliance audit process to arrive at a new key performance indicator.

Author: Charles Cresson Wood
Guy Pearce
Blog Post

Digital Native Organizations Are Energizing Organizational Design

Digital native organizations are ahead of the curve when it comes to enabling digital transformation and modernization.

22 November 2022
Patrick Barnett
Risk Article

How to Use Cyberthreat Intelligence to Proactively Reduce Cyberrisk

The ability to proactively learn about the tactics and capabilities of an attacker provides an excellent opportunity to prevent the attacker from entering the fort or doing any damage to the fort’s walls.

22 November 2022
Robin Lyons and Steve Jackson
Podcast

Auditee Buy-In—A Key Component of Effective Audits

As you plan and execute your audit, do you take time to invest in the stakeholder relationship? This can be an often-overlooked element but essential in an effective audit.

23 November 2022
Dr. Blake Curtis, Sc.D, CISA, CRISC, CISM, CGEIT, CDPSE, COBIT
Blog Post

5G Privacy Implications

Enterprises must consider the risk of 5G adoption on the front end and be proactive about working through potential privacy and security implications.

21 November 2022
Ravikumar Ramachandran
Blog Post

How Knowledge Workers Can Convince Employers to Sponsor IT Certifications and Professional Growth

Employers can support their employees' professional development by sponsoring their professional certifications and providing ongoing training resources.

18 November 2022
ISACA Certification Referral Program Underway
@ISACA Article

ISACA Certification Referral Program Underway

ISACA's certification referral program allows certified professionals to earn rewards while also helping to strengthen digital trust professions.

16 November 2022
5G Privacy: Addressing Risk and Threats
@ISACA Article

ISACA White Paper Highlights 5G Privacy Landscape

Privacy threats related to 5G must be addressed to ensure the technology's transformative potential is not counterbalanced by unintended problems.

16 November 2022
Tom Schneider
Blog Post

Applying Enterprise Risk Management to Cyberrisk

The rise of ransomware has increased the stakes for enterprise risk management and cyber risk.

16 November 2022
Benefits and Challenges of Implementing Cross-System SoD Monitoring Using SAP GRC
ISACA Journal Article

Benefits and Challenges of Implementing Cross-System SoD Monitoring Using SAP GRC

Cross-system user-level segregation of duties risk analysis between SAP and non-SAP systems provides insight into the access risk that prevails in the user base and helps remediate it through appropriate mitigation controls or the removal of conflicting access.

Author: Snedhal D. Pandya
How to Mature Your Privacy Compliance Program
Blog Post

‘Putting Out Fires’ and Maturing Your Privacy Compliance Program

As privacy regulations continue to take effect, enterprises must mature their privacy compliance programs.

15 November 2022
Deepa Seshadri
Security Article

What Makes a Good Cybersecurity Professional?

A shift into a cyber career can be part of an impactful journey into helping protect the world around us.

15 November 2022
Sushma Uniyal
Blog Post

Audit Essentials for Driving Efficiency and Value

Each audit has a lifecycle, from planning to execution to conclusion, and each phase in the audit lifecycle requires multiple steps to be executed effectively.

14 November 2022
What is the Connection Between IT Certifications and Salaries?
@ISACA Article

What is the Connection Between IT Certifications and Salaries?

IT certifications can help digital trust professionals qualify for a job with a higher salary across IT audit, cybersecurity, risk management, data privacy and related fields.

9 November 2022
Tim Liu
Blog Post

The Impact of a Hybrid Workplace on Security

Although the shift to the hybrid workplace has been a sea change for IT and security teams, new advances in security concepts and solutions hold the potential to smooth out the transition.

9 November 2022
Optimum Security Cognizance Through People, Process and Behavior Transformation
ISACA Journal Article

Optimum Security Cognizance Through People, Process and Behavior Transformation

The importance of cybersecurity in enterprise ecosystems is constantly being communicated to the workforce to create awareness, which helps enterprises reduce their attack surfaces.

Author: Vimal Mani
Tony Anscombe and Collin Beder
Podcast

Breaking Down the ESET T2 2022 Threat Report

In this ISACA Podcast episode, ESET’s Chief Security Evangelist, Tony Anscombe, joins ISACA’s Principal, Emerging Technology Professional Practices, Collin Beder to discuss ESET’s recently released T2 2022 Threat Report.

9 November 2022
Caitlin McGraw
@ISACA Article

Generosity: Good as Gold, in Your Life and Career

Being generous with your time and talent can lay the foundation for a successful and rewarding career.

7 December 2022
Shini Menon
Blog Post

Solving Security and Privacy Concerns in Emerging Technology

Personal data are more exposed than ever in the evolving emerging technology landscape but are often insufficiently protected from being stolen.

7 November 2022
Mark Thomas
Blog Post

Seven Key Steps to Build Digital Trust

The path to stronger digital trust includes key steps such as understanding customer expectations and going beyond checking boxes.

4 November 2022
Safia Kazi and Mary Carmichael
Podcast

Enabling Digital Trust through Canada's Digital Charter

Data are the lifelines of a digital economy. They drive innovation, enabling cutting-edge research and next-generation technologies, including artificial intelligence (AI)...

4 November 2022
Information Security
Blog Post

Five Quick Tips for Taking ISACA Certification Exams

ISACA certification-holders share their tips and guidance for success on ISACA certification exams.

3 November 2022
Jack Freund
@ISACA Article

Building (or Improving) a Risk Assessment Program

There are essential considerations with which a risk assessment program must be designed to help an enterprise achieve its security posture goals.

2 November 2022
Using Risk Tolerance to Support Enterprise Strategy
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

A new white paper from ISACA provides guidance on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

2 November 2022
Caitlin McGraw
@ISACA Article

Plan to Make 2023 Your Best Career Year Yet

Now is the time to begin planning in earnest for career success in 2023.

2 November 2022
Osama Abbas
Blog Post

A Pilot’s Lofty Goal of Building Trust Through Audit

ISACA member Osama Abbas is a champion for digital trust in his role as head of audit while finding time for his aviation passion in his free time.

2 November 2022
Rowdha Mohammed
Security Article

Cybersecurity Strategies to Enable Digital Trust

Cybersecurity is an enabler of digital trust and a key success factor of the digital transformation journey.

2 November 2022
Trustworthy Tactics for Unlocking the Value of Genetic Data
ISACA Journal Article

Trustworthy Tactics for Unlocking the Value of Genetic Data

An enterprise that manages a large amount of sensitive information is subject to a complex patchwork of laws and regulations, including privacy regulations, laboratory regulations, human subject protection requirements and ethical considerations.

Author: Mick Brady
Collin Beder and Steven Ross
Podcast

It's About (Down) Time

In this ISACA Podcast episode, Risk Masters International's Steven Ross tells ISACA's Collin Beder that organizations should start focusing on hours of unavailable systems and data when measuring the cost of a cyber-attack.

2 November 2022
Veronica Rose
Blog Post

Keep Your Dream of Becoming a CISA Alive

Candidates who struggle on their first try to pass the CISA certification exam can still reach their goal with perseverance and some tweaks to their preparation.

1 November 2022
Bassel Kablawi
Privacy Article

Preparing Organizations for Saudi Arabia’s New Data Protection Law

Technologies are constantly evolving, more devices are being connected to the worldwide network, data are becoming more important than ever, and countries are taking data privacy more seriously, putting data into consideration in jurisdiction strategies.

1 November 2022
DAVID SAMUELSON
ISACA Journal Article

Letter From the CEO

As the ISACA Journal concludes its 50th anniversary year, it is a great time to both reflect on the past and get excited about the future...

Author: David Samuelson
Information Security Matters: Convergence: Where Next?
ISACA Journal Article

Information Security Matters: Convergence—Where Next?

Does this convergence of specialties enhance or vitiate the effectiveness of each of them individually? The answer depends on whether IT control is a zero-sum...

Author: Steven J. Ross
IS Audit in Practice: Do Data Go to Waste?
ISACA Journal Article

IS Audit in Practice: Do Data Go to Waste?

Data management is built on accuracy and relevance, and both characteristics are the mainstay of an IS auditor’s inspection criteria.

Author: Cindy Baxter
Innovation Governance: Balancing Innovation With Data Protection
ISACA Journal Article

Innovation Governance: Balancing Innovation With Data Protection

Innovation does not give license to bypass the usual questions that are asked when we have more time. It requires us to answer or evaluate them more quickly.

Author: K. Brian Kelley
Essential Assumptions for Effective Data Security
ISACA Journal Article

Essential Assumptions for Effective Data Security

For data security efforts to be effective, it is critical that people in all areas and levels of the enterprise operate under five key data security-related assumptions.

Authors: Kevin Alvero and Brian Alvero
Scaling the Future of Collecting Internal Audit Interview Evidence
ISACA Journal Article

Scaling the Future of Collecting Internal Audit Interview Evidence

New technology offers the potential to cost effectively collect large interview data sets using an automated auditing interview process with virtual interviewers.

Authors: Matthew D. Pickard and David A. Wood
Beware the Traps of Data Governance and Data Management Practice
ISACA Journal Article

Beware the Traps of Data Governance and Data Management Practice

Data-driven decision-making can never entirely be about making decisions based on hard data as opposed to intuition, observation or guesswork because most data are never in a perfect state...

Author: Guy Pearce
The Future of Privacy: Insights From the EU Digital COVID Certificate
ISACA Journal Article

The Future of Privacy: Insights From the EU Digital COVID Certificate

The development of the EU Digital COVID Certificate (EUDCC) offers some insights into what the future may hold for managing individual privacy while supporting the effective use of information.

Authors: Till Mueller and Gerald F. Burch
To Stay Relevant, InfoSec Must Strengthen Its Business Partnerships
ISACA Journal Article

Sponsored: To Stay Relevant, InfoSec Must Strengthen Its Business Partnerships

To effectively manage digital risk, InfoSec professionals and business leaders must work in tandem to increase their mutual risk understanding and mitigation efforts.

Author: John Wheeler
An Ethics-Based Algorithm for Governing Data
ISACA Journal Article

An Ethics-Based Algorithm for Governing Data Ethics

Data quality is a crucial issue to data protection, and data bias is a hidden nuance to protecting that quality—data governance is needed.

Author: Wanbil W. Lee
Case Study: Driving Digital Transformation Through COBIT
ISACA Journal Article

Case Study: Driving Digital Transformation Through COBIT

Based on a foundation of COBIT, CBN has achieved synergy across the organization as it relates to IT projects and their place in enterprise risk and strategy as a direct result of improvements and...

Author: Katie Teitler
Performing Risk Assessments of Emerging Technologies
ISACA Journal Article

Performing Risk Assessments of Emerging Technologies

Emerging technologies represent a major source of risk, and their complexities make those risk areas especially difficult to assess.

Authors: Michael Kelly and Adeline Chan
Larry Alton
Blog Post

How to Safely Share Your Business’s Online Videos

Finding the right balance between security and convenience is key for businesses when it comes to sharing their videos online.

28 October 2022
Mike Tomaselli
Blog Post

Finding or Building the Right Framework for Your Organization

Organizations face a challenge in understanding which framework will deliver the most value in an era of increased regulatory and business challenges.

27 October 2022
Kevin Keh and Allen Dziwa
Podcast

How Social Engineering Bypasses Technical Controls

We are subjected to phishing scams almost daily, and even the most seasoned professional must examine an email to ensure the links included are safe.

27 October 2022
Jon Brandt and Naomi Buckwalter
Podcast

ISACA CyberPros – Naomi Buckwalter

Executive Director of Cybersecurity Gatebreakers Foundation, Naomi Buckwalter, joins ISACA’s Jon Brandt to discuss burnout.

27 October 2022
Podcast
Podcast

What Makes Risk Assessments So Unpleasant and How to Change That

Ryan Cloutier's child came home from school one day and told him that he had figured out the staff Wi-Fi password. Frustrated that the security wasn't better for a school network, Ryan decided to do something about it.

27 October 2022
Anna Johannson
@ISACA Article

Top Three Mistakes IT Security Teams Still Make

Common mistakes that limit security teams' effectiveness include piecemeal patch management, a lack of incident response plans and insufficient monitoring.

26 October 2022
Jack Freund
Blog Post

Cyber Ratings as Measures of Digital Trust

As the profession of cybersecurity continues to mature, it inevitably will borrow from other disciplines that have developed mature practices. The credit rating profession has much to offer cybersecurity as it attempts to support the overarching need for the creation of digital trust.

26 October 2022
Graciela Braga
Governance Article

How Responsible for IT Governance Is the BoD?

With a fresh look at the importance of the role of the BoD and other stakeholders in IT governance, it is time for boards to take advantage of the opportunity offered by IT governance to create value in their organizations.

26 October 2022
The Changing Information Systems Landscape Creates New IT Risk
ISACA Journal Article

The Changing Information Systems Landscape Creates New IT Risk

Audit needs to evolve to address the technological advances and changes in the information systems landscape.

Author: Sriram Balalsubramanian
Audit and Assurance
Blog Post

Smarter Testing Equals Safer Digital Experiences

Tighter alignment of testing with the software development lifecycle and better modeling of real-world adversary threats has allowed Adobe to become more DevSecOps-minded in its application security testing.

25 October 2022
Mary Carmichael
Blog Post

Risk Appetite vs. Risk Tolerance: What is the Difference?

By demystifying the risk appetite and risk tolerance terms, it is easier to explain and integrate these concepts within enterprise risk management frameworks.

4 October 2022
Eszter Diána Oroszi
Risk Article

Taking a Risk-Based Approach to Pen Testing

The results of penetration (pen) tests are also worth examining using a risk-based approach.

24 October 2022
Luma Badran
Blog Post

How Risk Transformation Enables Enterprise Success

Risk expert Luma Badran recently led an ISACA Engage community discussion of topics including risk transformation, best practices for the three lines of defense, internal audit, operational risk management and cybersecurity insurance.

21 October 2022
Menny Barzilay
Blog Post

‘Privacy Is Not Dead, But It Is Dying’

Menny Barzilay will be a keynote speaker for ISACA Conference Asia 2022, to take place virtually 16-17 November, presenting on “The Dark Future of Privacy.” Barzilay, an internationally recognized cybersecurity expert and CTO of the Interdisciplinary Cyber Research Center at Tel-Aviv University, recently visited with ISACA Now to discuss privacy mining, deep fakes, digital trust and more.

20 October 2022
Sri Mallur
Security Article

How to Create an Enterprise OT Cybersecurity Program

As the importance of cybersecurity grows in the public eye, many organizations are considering leveling up their security postures with operational technology (OT) cybersecurity programs.

20 October 2022
Veronica Rose
@ISACA Article

A Proactive Plan to Shore Up the IS Audit Talent and Skills Gap Early

Effectively addressing the skills gap among IT auditors will require new approaches on the part of HR teams, hiring managers and across the organization.

19 October 2022
Sunil Bakshi
@ISACA Article

How Important Is Source Code Escrow?

When escrow is required, organizations should ensure that system documentation and source code are comprehensively covered.

19 October 2022
Top Five Reasons to Upskill Your Team Together
@ISACA Article

Top Five Reasons to Upskill Your Team Together

Across the digital trust professions, organizations can upskill their teams, improve retention and demonstrate to employees that they value their professional development by participating in enterprise training programs.

19 October 2022
Exploring the Relationship Between IT Certifications and Salaries
Blog Post

Exploring the Relationship Between IT Certifications and Salaries

Certifications can have a big impact on IT professionals' salaries and career advancement opportunities.

19 October 2022
5G Innovations and Cybersecurity Risk
ISACA Journal Article

5G Innovations and Cybersecurity Risk

It is critical for practitioners to understand 5G’s risk factors such as unique identifiers, software-defined networking (SDN) vulnerabilities, and interoperability’s impact on strong access control.

Author: Blake Curtis
Tulika Ghosh
Blog Post

Cloud Governance and Security Imperatives

Organizations that can strike a balance between their strategic objectives and security needs will be well equipped for success in their cloud implementations.

18 October 2022
Jeff Champion, Julie Ebersbach and Mike Powers
Podcast

Quantifying the Qualitative Risk Assessment

In this ISACA podcast episode, IT Risk Director and Senior Vice President Mike Powers and IT Segment Risk Manager Julie Ebersbach discuss using the qualitative risk assessment as part of an organization's enterprise risk framework, focusing on using data to inform subjective judgments.

18 October 2022
Michael Argast
Blog Post

The Cybersecurity Skills Gap: Dispelling Misconceptions

The workforce challenge organizations often perceive as a cybersecurity skills gap is more accurately a failure to take advantage of the people and resources that should be better utilized.

17 October 2022
Mark Thomas
Blog Post

What is the ROI from Enterprise Training?

The return on investment from enterprise training extends well beyond the financial to areas such as mitigating risk and helping organizations become more agile and resilient.

14 October 2022
Kathleen Martin
Risk Article

Higher Education, the Pandemic and the Need to Strengthen the Risk Framework

There is a need for oversight and controls to be revisited in certain higher education institutions.

13 October 2022
Adobe logo
Podcast

Gaining More Actionable Intelligence Using a Smarter Security Data Lake

In today’s dynamic world of distributed computing and cloud-scale systems, traditional security data platforms and tools such as SIEM typically fall short of actually delivering the intelligence needed to better adapt to the rapidly changing threat landscape.

13 October 2022
Using Risk Tolerance to Support Enterprise Strategy
@ISACA Article

ISACA Sizes Up Enterprise Risk Tolerance Protocols

New guidance from ISACA provides context on how enterprises can understand, communicate and apply risk terms to better manage risk tolerance.

12 October 2022
Caitlin McGraw
@ISACA Article

Mentor Magic: How To Make Mentorship Work for Your Career

Mentorship can play a valuable role in advancing digital trust professionals' careers, but being mentored effectively is not as simple as just showing up to have coffee.

12 October 2022
Shifting the Paradigm for Women in Tech
@ISACA Article

Shifting the Paradigm for Women in Tech

ISACA member Esanju Maseka recently attended a Women in STEM conference organized by the Zambia National STEM Foundation. Maseka visited with the @ISACA newsletter to recap what she learned and provide her perspective on efforts to address the gender disparity in the tech workforce.

12 October 2022
David Shavgulidze
Blog Post

A COBIT 2019 Use Case: Financial Institutions in Georgia

The COBIT framework has some key applications in the financial sector as demonstrated by a recent use case in Georgia.

12 October 2022
Michael Williams and Babur Kohy
Privacy Article

Detecting Insider Threat Behaviors Using Social Media Platforms

It is important for IT professionals to understand the availability of social media data and methods that can be used to identify possible insider threats using machine learning and the privacy and policy implications pertaining to it.

12 October 2022
A Step-by-Step SoD Implementation Guide
ISACA Journal Article

A Step-by-Step SoD Implementation Guide

Segregation of duties is central to achieving compliance with laws and regulations and assuring shareholders that proper governance is applied, and it is included as an activity in COBIT.

Author: Stefano Ferroni
Information Security
Blog Post

How to Transition from General IT to Cybersecurity

For IT professionals looking to transition to a cybersecurity career, there are several promising pathways to position themselves for success in cybersecurity.

11 October 2022
Vikram Venkateswaran
Security Article

Cybersecurity Is a Top Priority for Pharmaceutical Organizations

The pharmaceutical industry is taking critical measures to enhance its cybersecurity posture.

11 October 2022
Hollee Mangrum-Willis and Ali Pabrai
Podcast

Industry Spotlight with Ali Pabrai

There is no denying the passion that ecfirst's CEO, Ali Pabrai has for cybersecurity. In this ISACA Podcast, Ali tells ISACA's Hollee Mangrum-Willis that after all his years in the industry, he is still more excited than a two-year-old at the entrance to Disneyland.

11 October 2022
Blaise Woo
Blog Post

Securing Patient Data Is Paramount in the Post-Pandemic Era

Securing patient data and complying with HIPAA laws may seem like a challenge, but there are several steps your organization can take to combat a cyber incident.

10 October 2022
Joao Souza Neto
Governance Article

How to Conclude Governance System Design

The dynamics of the external and internal effects on organizations demand a flexible and customized governance system adapted to the specific needs of the organization.

10 October 2022
Joseph Cheng
Blog Post

The Social and Psychological Consequences of Ransomware Attacks

Organizations focus on the financial loss and disruption to services caused by ransomware attacks, but there are significant social and psychological effects that are often overlooked.

7 October 2022
Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat
Audit Article

Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat

As a purposeful partnership with internal or external resources, co-sourcing simultaneously meets enterprise objectives and facilitates upskilling.

7 October 2022
Alonzo Longshore
Blog Post

How To Apply Process Mapping Synergy Gains for Business Continuity and Disaster Recovery

Process mapping from disaster recovery and business continuity planning can help improve enterprises' overall business resiliency.

6 October 2022
Robin Lyons and Cindy Baxter
Podcast

Audit in Practice - Auditing Culture

What’s The Risk LLC’s Cindy Baxter sits down with ISACA’s Robin Lyons to discuss auditing culture, which can be one of the most interesting areas to audit.

6 October 2022
Managing Cybersecurity Risk as Enterprise Risk
Podcast

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity incidents like ransomware can potentially bring operations to a standstill. Recent regulatory changes by the FTC and proposed changes by the SEC show that both agencies are drafting cybersecurity rules similar to ERM concepts.

6 October 2022
The Great Resignation: Business Challenges and Sustainable Solutions
@ISACA Article

ISACA Provides Guidance for More Sustainable Workforce

A volatile workforce, accelerated by the COVID-19 pandemic, has made operational resilience a rising priority for enterprise leaders.

5 October 2022
Audit and Assurance
@ISACA Article

Top ISACA Cybersecurity Content from 2022

October is Cybersecurity Month and a great time to catch up on some of the top cybersecurity content ISACA has produced so far in 2022.

5 October 2022
Rebecca Herold
Blog Post

Navigating Privacy and Compliance Post-Dobbs Ruling

A variety of healthcare, data privacy and security issues have emerged since the recent Dobbs ruling that have impacted and will continue to impact both businesses and individuals in the United States.

5 October 2022
Addressing the Complexities of Cybersecurity at Fintech Enterprises
ISACA Journal Article

Addressing the Complexities of Cybersecurity at Fintech Enterprises

Fintech organizations can become significant players impacting the entire financial system, and regulators cannot afford to let them fail.

Author: Komitas Stepanyan
Collin Beder and Ivy Munoko
Podcast

Implementing Artificial Intelligence: Capabilities and Risk

University of Florida's Ivy Munoko is passionate about AI and has plenty to share regarding implementation and usage, but ISACA's Collin Beder asks, "is it ethical"?

4 October 2022
Collin Beder and Relebohile Kobeli
Podcast

Incident Report & Continuous Control Monitoring

This episode of the ISACA Podcast is all about incident reporting. Lesotho Postbank's Relebohile Kobeli talks to ISACA's Collin Beder about mitigating risk, minimizing losses from events, and good communication.

4 October 2022
New ISACA Paper Enables Enterprises to Use Cyberrisk Quantification to Improve Approach to Cybersecurity Risk
Blog Post

The Impact of Cybersecurity on Consumer Behavior

New ISACA data on consumer attitudes about cybersecurity reveal there is much work to be done for enterprises to earn the trust of customers and stakeholders.

3 October 2022
Kim Pham
Blog Post

Five Major Auditing Challenges in Cloud Computing and How to Overcome Them

Top challenges for auditing the cloud start with identifying cloud usage and controlling and monitoring user access.

30 September 2022
David Samuelson
Blog Post

Advancing Digital Trust on Capitol Hill, in Parliament and Beyond

ISACA leaders recently have taken their digital trust message to government officials from the UK, Ireland and the United States.

29 September 2022
Paul Phillips and Lisa Young
Podcast

Industry Spotlight with Lisa Young

Netflix's Lisa Young started as a bank teller that learned tech by fixing and servicing ATMs, which transitioned to her joining the network ops field and leading her to...

29 September 2022
Jeff Costlow
@ISACA Article

Internet-Exposed Protocols Remain Easy Entry Point for Attackers

To help IT leaders assess their risk posture and attack surface visibility, new research has been conducted about network protocols that are exposed to the public internet.

28 September 2022
Angelina Kahn-Dubois
Blog Post

A CISA Top Scorer’s Tips to Feel Prepared for the CISA Certification Exam

Angelina Kahn-Dubois, the top Certified Information Systems Auditor (CISA) certification exam scorer for 2021, offers tips for success on the CISA exam.

28 September 2022
Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design - image of lock
ISACA Journal Article

Stop Using the Privacy Paradox as an Excuse to Avoid Privacy by Design

Organizations should take the lead to follow the privacy by design approach by proactively embedding privacy into the design and operation of technology systems, infrastructure and business practices.

Author: Saravanan Gurumurthy
‘Piecemeal Approach’ Insufficient to Create Digital Trust
Blog Post

‘Piecemeal Approach’ Insufficient to Create Digital Trust

Matt Chiodi, chief trust officer at Cerby and a member of ISACA's Digital Trust Advisory Council, and Karen Heslop, ISACA's vice president of content development, provide their perspectives on ISACA's State of Digital Trust 2022 report.

27 September 2022
Podcast
Podcast

Defending Data Smartly

Some industry watchers estimate that by 2025 the collective data of humanity will reach 175 Zettabytes. ISACA's Jon Brandt invites Dr. Chase Cunningham (aka Dr. Zero Trust) to discuss how to defend the ever-growing amount data...

27 September 2022
Kevin Keh
Blog Post

The Importance of Organizational Resilience in an Age of Immense Change

Organizational resilience has become increasingly top-of-mind for enterprises in the era of The Great Resignation.

26 September 2022
audit and assurance
Blog Post

Audit Approaches for Enterprise Databases

Ensuring enterprises can achieve their business objectives without concerns about sensitive data security is a value-add proposition for internal audit departments looking to perpetuate their role as trusted advisors to executive management.

23 September 2022
Ivan Mans
Security Article

Addressing SAP Security Gaps

SAP requires high-level consideration, or critical elements of the business will be vulnerable to malicious cyberactors—with no apparent response.

22 September 2022
Safia Kazi
Privacy Article

Privacy Considerations During Mergers and Acquisitions

When news was announced that Amazon acquired iRobot, the enterprise that makes Roomba robot vacuums, many privacy advocates expressed concern.

22 September 2022
Podcast
Podcast

Ethical AI Shifting the Conversation Left

Many organizations prioritize goals such as gains and profits, which often require rich data sets, but fail to consider the eventual impact of their data handling methodologies on foundational social justice issues.

22 September 2022
Ed Moyle
@ISACA Article

The Three Lines of Defense as a Means to Foster, not Inhibit, Collaboration

To the extent that digital trust practitioners draw upon the three lines of defense as a support or discussion point, we need to be ready to explain it in a way that doesn’t make others feel like their role in the risk management equation is diminished.

21 September 2022
Addressing Intentional Threats picture of lock
ISACA Journal Article

Addressing Intentional Threats Using Risk Assessment

Cyberspace must be considered a hostile environment. Although it has enormous potential, threats are always present, even in the most protected virtual worlds or within home networks.

Author: Luigi Sbriz
State of Digital Trust 2022
Blog Post

Five Key Takeaways from ISACA’s State of Digital Trust 2022 Report

Key takeaways from ISACA's State of Digital Trust report show how organizations must prioritize, measure and collaborate to make strengthening digital trust a reality.

20 September 2022
Podcast
Podcast

Why (And How to) Dispose of Digital Data

Bassel takes us on a deep dive into digital data with ISACA's Safia Kazi on the five stages of data disposal in this ISACA podcast episode.

20 September 2022
governance
Blog Post

Giving Data Integrity Its Place on the Podium

Data integrity, one of the key technology risk factors identified in recent IT audit research conducted jointly by ISACA and Protiviti, is crucial to the decisions that enterprises make in the course of routine business.

19 September 2022
MDDAP
Blog Post

How MDDAP Improves Product Quality

By helping medical device manufacturers better understand and sharpen their capabilities, ISACA’s Medical Device Discovery Appraisal Program (MDDAP) is advancing device quality and patient outcomes by driving toward a culture of continuous improvement.

16 September 2022
David Samuelson
Blog Post

Digital Trust: The Key to Successful Transformation

Today’s digital economy is driven by innovation. The companies that are able to find new ways to serve their customers, often enabled by implementation of emerging technologies, are the ones best positioned to thrive.

15 September 2022
Richard Hollis
Security Article

The Circle of Failure: Why the Cybersecurity Industry Does Not Work

The cybersecurity industry has failed. The evidence is everywhere and overwhelming. Anyone who understands that the industry was founded on the fundamental objective of preventing IT systems from breaches and data theft can surely agree that it has failed. Those who do not agree are not paying attention.

15 September 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Johann Dettweiler, Part II

In part 2 of this ISACA podcast episode, we connect with TalaTek Director of Operations Johann Dettweiler to discuss his almost two decades of experience across multiple industry fields, his involvement in FEDRAMP compliance, and why the next generation should focus on adding certifications to their resumes.

15 September 2022
Yunique Demann
@ISACA Article

Digital Trust: The Convergence of Privacy and Security

ISACA's recent State of Digital Trust survey reinforces that privacy and security should complement each other to help organizations advance digital trust.

14 September 2022
Person working on a laptop
@ISACA Article

ISACA Foundation Scholarship Program to Help Bridge Talent Gap

ISACA Foundation is helping support underrepresented professionals in digital trust fields through its scholarship program.

14 September 2022
Steve Jackson
Audit Article

Auditee Buy-In—A Key Component of Effective Audits

In business, auditors are often portrayed as the bad guys. From an external audit perspective, auditors enter an organization with no true relationship with, or connection to, the auditee. The

14 September 2022
Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts
ISACA Journal Article

Decentralized Finance—Opportunities, Challenges and Auditing of Smart Contracts

The rapid development of blockchain technology and cryptocurrency has influenced the financial industry by creating a new crypto economy, which has been compounded by next-generation decentralized applications that do not involve a trusted third party.

Author: Pinkal Shah
Courtney Chatterton
Blog Post

How To Communicate Risk in a Way Leadership Can Understand

The key to effectively communicating risk is aligning risks to the company's business objectives.

13 September 2022
Premkumar Subramanian Subha
Blog Post

How Secure is Your Data? A New Way of Looking at Data Privacy Compliance

Recent data privacy compliance regulations, along with existing ones, present a whole new dimension in the world of regulatory compliance requirements for banks/financial services across the globe.

12 September 2022
Jai Sisodia CISA, CCP, ITIL V3, and Mohammed Khan, CISA, CRISC, CDPSE, CIPM, Six Sigma Certified Green Belt
Blog Post

The Customer’s Responsibility in the Cloud Shared Responsibility Model

The cloud shared responsibility model model can help relieve customers’ operational burdens as the cloud service provider operates, manages and controls the host operating system, infrastructure components and actual physical security of the facilities.

9 September 2022
Caitlin McGraw
@ISACA Article

Rookie Success Factors: Career Advice from the ISACA community

Career Corner columnist Caitlin McGaw compiles a treasure trove of early-career tips and guidance for rising digital trust professionals.

7 September 2022
Abdul Rafeq
@ISACA Article

Strategies to Customize and Implement COBIT Best Practices

The COBIT framework is often most valuable for organizations when it is customized to address the specific business challenges the user is addressing.

7 September 2022
Safia Kazi
Blog Post

Privacy: A Key Component of Building Digital Trust

The key relationship between privacy and advancing digital trust was explored in a recent ISACA Live episode with Safia Kazi and Betsie Estes.

7 September 2022
Mary Carmichael
Risk Article

Enabling Digital Trust With Canada’s Digital Charter

Data are the lifelines of a digital economy. They are driving forces for innovation, enabling cutting edge research and next generation technologies including artificial intelligence (AI), robotics and the Internet of things (IoT).

7 September 2022
Managing Cybersecurity Risk as Enterprise Risk
ISACA Journal Article

Managing Cybersecurity Risk as Enterprise Risk

Cybersecurity risk is a critical enterprise concern. Cybersecurity incidents such as ransomware have the potential to bring an organization’s operations to a standstill.

Author: Tom Schneider
Guy Pearce
Blog Post

AI Ethics and eXplainable AI (XAI): Much Easier Said Than Done

More artificial intelligence (AI) proponents are proposing that integrating ethics with AI will result in better customer engagement with the technology

6 September 2022
Podcast
Podcast

Achieving Effective Cloud Risk Management

Cloud is ubiquitous now. From small enterprises to large companies, all are moving a part of their technology operations to cloud. Initial reluctance is now nowhere to be seen.

6 September 2022
Varun Prasad
Blog Post

A Fan of Diverse Experiences

ISACA member Varun Prasad works with tech companies of varying sizes to help build digital trust by addressing the security and privacy compliance requirements of customers and other stakeholders.

2 September 2022
Information security
Security Article

Taking Security Strategy to the Next Level

In an era of rampant ransomware and other malicious cyberattacks, it has never been more important to double down on cybersecurity analysis and strategy.

2 September 2022
Shannon Donahue
ISACA Journal Article

Letter From the SVP of Publishing

The ISACA Journal is consistently cited by ISACA members as one of the most valued benefits of their membership package.

Author: Shannon Donahue
Information Security Matters: It’s About (Down) Time
ISACA Journal Article

Information Security Matters: It’s About (Down) Time

It is important that we stop measuring the cost of cyberattacks only in the number of records breached and start focusing on hours of unavailable systems and data.

Author: Steven J. Ross
IS Audit in Practice: Auditing Culture
ISACA Journal Article

IS Audit in Practice: Auditing Culture

Is there a way that the risk management and audit professions can get through the soft, unquantifiable information to produce actionable recommendations?

Author: Cindy Baxter
HelpSource
ISACA Journal Article

Help Source Q&A

What are the essential personal skills IS auditors should possess to effectively carry out audit work?

Author: Sunil Bakshi
It Is Time to Stop Haunting the Ghost in the Machine!
ISACA Journal Article

It Is Time to Stop Haunting the Ghost in the Machine!

Digitally native enterprises have found that there are better ways to organize their people than the haunted and dated organizational design paradigms that were first practiced long before the rise of the modern...

Author: Guy Pearce
Auditing Your Organizational Culture
ISACA Journal Article

Auditing Your Organizational Culture

How does an internal audit team conduct a culture audit, especially when the subjectivity of culture can take auditors out of their comfort zones?

Author: Kevin M. Alvero
How Social Engineering Bypasses Technical Controls
ISACA Journal Article

How Social Engineering Bypasses Technical Controls

When the widespread availability of information is enhanced by the excessive compulsion by some people to engage in excessive sharing on social media, social engineers can have a field day.

Author: Allen Ari Dziwa
Case Study: Adopting RiskOps to Streamline Governance and Risk Management
ISACA Journal Article

Case Study: Adopting RiskOps to Streamline Governance and Risk Management

This case study provides insight into Highmark Health’s transition to RiskOps and highlights some of its immediate process improvements, including capacity creation to address emerging risk...

Authors: Chuck Donina and Kathleen S. Hartzel
Against the Quantum Threat: Selective Compatibility
ISACA Journal Article

Against the Quantum Threat: Selective Compatibility

Selective compatibility is achieved through a set of technical tools, processes and protocols that allow a conditional connection between several information systems...

Authors: Jean Jacques Raphael, Jean Claude Célestin, and Eric Romuald Djiethieu
Quantifying the Qualitative Technology Risk Assessment
ISACA Journal Article

Quantifying the Qualitative Technology Risk Assessment

Some risk assessments may be entirely quantitative, but most enterprises find an exclusively mathematical approach flawed and subject to manipulation and bias.

Authors: Julie Ebersbach and Michael Powers
Should Cybersecurity Be Subject to a SOX-Type Regulation?
ISACA Journal Article

Should Cybersecurity Be Subject to a SOX-Type Regulation?

Could cybersecurity implementation benefit from a US Sarbanes-Oxley Act of 2002 (SOX)-type approach?

Author: Mike Tomaselli
Building Resilient Security in the Age of the Great Reshuffle
ISACA Journal Article

Building Resilient Security in the Age of the Great Reshuffle

Enterprises should revisit their strategies for managing the cybersecurity workforce and build resilient environments with a focus on learning and development, job rotation, security culture and investment in people.

Authors: Prakash Renduchintala, Rohitha Chowdhary and Pradeep Sekar
Industry Spotlight Podcast
Podcast

Industry Spotlight with Dr. Blake Curtis, Part II

In part 2, author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

1 September 2022
Defending Data Smartly
@ISACA Article

Better Approaches for Protecting Data

A new ISACA white paper provides guidance on how organizations can evolve their approach to data protection to keep up with the threat landscape.

31 August 2022
Kim Pham
Blog Post

Cloud Computing — What IT Auditors Should Really Know

Given the growing reliance on cloud computing, internal audit should adopt a proactive approach to cloud initiatives and position the department as a trusted advisor.

31 August 2022
Faith Wawira
Blog Post

ISACA Kenya Chapter to Support Vulnerable Children in CommunITy Day 2022

ISACA's annual CommunITy Day of global volunteering is coming up on 1 October, with chapters around the world preparing to make their impact at the local level.

30 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Dr. Blake Curtis, Part I

Author, editor, speaker, and educator, Dr. Blake Curtis is joined by Red Cross’s Senior Internal Auditor Niki Gomes to talk about everything from growing up in a small town to completing his master’s degree in 10 weeks...

30 August 2022
Jeff Burke
Blog Post

IT Audit Field Provides ‘So Many Options’ for Early-Career Professionals

Jeff Burke shares his experience as a new IT auditor and describes why IT audit is a promising career path for rising professionals.

29 August 2022
Roderick Chambers
Governance Article

GRC Programming: The Third-Party Security Web

Governance, risk management and compliance (GRC) are growing disciplines with continuously changing identities.

29 August 2022
Bias and Ethical Concerns in ML
ISACA Journal Article

Bias and Ethical Concerns in Machine Learning

Artificial intelligence (AI) has evolved rapidly over the past few years. A decade ago, AI was just a concept with few real-world applications, but today it is one of the fastest-growing technologies, attracting widespread adoption.

Author: Niral Sutaria, CISA, ACA
Tuan Phan and Chad Friedman
Blog Post

Mapping a Serial Rug Pull Scammer on Binance Smart Chain

Rug pull events can be detected and analyzed using publicly accessible blockchain explorers, online analytical tools and data repositories.

26 August 2022
Risk
Risk Article

The Key(s) to Writing Good Risk Statements

To effectively manage risk at an organization, risk must be identified and analyzed by an information systems professional.

26 August 2022
Brian Fletcher
Blog Post

Shifting the Paradigm to Protect Your Data

ISACA's new white paper, "Defending Data Smartly," goes beyond solutions for protecting your organization’s data, also exploring challenges across information technology, compliance, privacy and governance.

25 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part II

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry. Having realized the value of information at an early age, Arnulfo has forged his path within the IT community.

25 August 2022
The Quantum Computing Threat: Risks and Responses
@ISACA Article

The Quantum Computing Threat: Risks and Responses

An ISACA expert panel shares their views on quantum computing threats and the related implications for cybersecurity practitioners.

24 August 2022
Max Shanahan
Blog Post

International Standards: ISACA Update on ISO Governance and Management Standards Initiatives

ISACA recently participated in meetings to review and update several ISO governance and management standards.

24 August 2022
ASEAN’s Resilience in Capacity Building
ISACA Journal Article

ASEAN’s Resilience in Capacity Building

In 2018, the Government of Japan and the Association of Southeast Asian Nations (ASEAN), agreed to establish the ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC)1 to train at least 700 cybersecurity personnel to counter cyberthreats and close the cybersecurity skills gap.

Authors: Thongchai Sangsiri, Araya Sawasdichai, Issara Amornkraisee and Kamonchanok Chaiyakun
Career and Leadership
Blog Post

Breaking Into the IT Industry: IT Degree and Certification

Earning IT certifications can make a big difference in both salary and job opportunities for early-career professionals, and can also serve as a strong complement to IT degree programs.

23 August 2022
Josh Scarpino
Blog Post

Ethical Artificial Intelligence and Machine Learning By Design: A New Standard to Doing Business

Several foundational steps can be taken for organizations by adopting an ethical artificial intelligence and machine learning lifecycle to move toward standardizing ethical technology implementations.

22 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Arnulfo Espinosa Dominguez, Part I

Vice President of the ISACA Monterrey Chapter and IT Audit & Fraud Director of one of the largest Financial Groups in México, Arnulfo Espinosa Dominguez, joins ISACA’s Jocelyn Alcantar to share some of the many things he has learned over his 20 years of professional experience in the industry.

22 August 2022
Veronica Rose
Blog Post

Approach to Auditing a Core Banking System

Auditing core banking systems successfully requires due diligence on a wide range of control tests.

19 August 2022
Information Security
Risk Article

Does Your Organization Need a Security Risk Assessment?

The enterprise risk assessment and enterprise risk management processes comprise the heart of the information security framework.

19 August 2022
Sumedha Adavade
Blog Post

A Five-Step Process to Help Organizations Achieve Operational Resilience

Operational resilience is far more than having business continuity planning in place and conducting disaster recovery drills; it requires strategic decision-making when planning, identifying, defining, working, testing, monitoring and re-defining multiple parameters.

18 August 2022
Alex Sharpe
@ISACA Article

Digital Trust Takes a Village

Digital trust is a team sport, requiring engagement throughout the organization at all levels. Digital trust also extends outside of the organization to business partners and vendors.

17 August 2022
Mentorship Program Making Valuable Connections
@ISACA Article

Mentorship Program Making Valuable Connections

The ISACA Mentor Program facilitates one-to-one mentorship connections and brings together ISACA members at all stages of their careers who want to give or receive professional development support.

17 August 2022
Bruce R. Wilkins
@ISACA Article

The Evolution of Bots and How to Defend Against Them

Bots have become more sophisticated over time, upping the degree of difficulty for practitioners to ensure they do not undermine digital trust.

17 August 2022
Dr. Blake Curtis, Sc.D, CISA, CRISC, CISM, CGEIT, CDPSE, COBIT
Blog Post

Title Bias – The New Form of Bigotry in The Workplace

Title bias occurs when someone treats another person differently because they don’t hold a specific title or position in an organization, and it can badly damage workplace culture.

17 August 2022
Jeffrey Champion
Security Article

Improved Visibility Means More Effective Security Tools

When it comes to evaluating the efficacy of security tools, the first question many people ask is “How do I know if my enterprise’s security tools are protecting sensitive data?”

17 August 2022
Matching Microsoft Security Tools With the Cyber Kill Chain
ISACA Journal Article

Matching Microsoft Security Tools With the Cyber Kill Chain

Among the many security tools and products Microsoft provides, there are a number of mechanisms that are built into the operating systems and enterprise software.

Author: Aleksandr Kuznetcov
Podcast
Podcast

Current State of Cybersecurity in K12

ISACA's Director of Professional Practices and Innovation Jon Brand hosts Doug Levin, co-founder and National Director of K12 Security Information eXchange (K121 SIX), a national non-profit dedicated solely to helping schools protect themselves from emerging cybersecurity threats.

16 August 2022
Naomi buckwalter
Blog Post

Burned Out: InfoSec Professionals Sound the Alarm

According to a recent survey, almost a third of infosec professionals want to quit the cybersecurity profession due to burnout within the next 12 months. Can we save our industry from a mass resignation before it’s too late?

15 August 2022
Stefan Hyttfors
Blog Post

Creating, Not Predicting, the Future

ISACA Europe Conference keynote speaker Stefan Hyttfors visited with ISACA Now to discuss some of his favorite themes—the future, emerging technology and trends in globalization and sustainability.

12 August 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Todd Fitzgerald

Cybersecurity leader, author, and host of the CISO Stories podcast, Todd Fitzgerald sits down with ISACA’s Chelsey Byrd to discuss his extensive career journey in security...

12 August 2022
Laura Zannucci
Blog Post

My CISM Exam Journey

Laura Tate Zannucci shares her experience preparing for the CISM certification exam, including tips and guidance on what proved to be successful tactics.

11 August 2022
ISACA live tile
Podcast

ISACA Live: Advancing Digital Trust Through Audit and Assurance

A strong audit and assurance function is critical to achieving digital trust in an organization. This conversation spotlights audit's role in digital trust and outlines key priorities. It also shares new ISACA resources for auditors.

11 August 2022
Jack Freund
@ISACA Article

Cyberinsurance Is Still Expensive

There are certain immutable laws of economics, though not all of them are well received. One such law is the mechanism by which organizations price their products and services.

10 August 2022
Man standing in front of wall of computers
@ISACA Article

New Credential Prepares Early-career IT Audit Professionals

A new credential from ISACA gives those seeking a strong foundation in IT audit knowledge the chance to accelerate their early-career prospects.

10 August 2022
Code Your Dreams
Blog Post

Advancing Technology as a Human Right

Code Your Dreams was recognized with the ISACA Technology for Humanity Award for leadership in empowering the next generation of civic-minded technologists.

10 August 2022
Blockchain Smart Contracts, Part 2
ISACA Journal Article

Blockchain Smart Contracts, Part 2: Applications and Recommendations

Media attention on blockchain exploded in 2021, with major news outlets reporting on governments’ adoption of blockchain and associated smart contract systems such as central bank digital currencies (CBDCs) and egovernment

Authors: Samuel Zaruba Smith and Andy Garcia
Joseph Burt-Miller
Blog Post

My Path to a Career in Cybersecurity

Dr. Joseph J. Burt-Miller Jr. says experience, certifications and degrees form the "cyber triangle" to spark career growth in the cybersecurity field.

9 August 2022
Christina Luttrell
Risk Article

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation and a looming recession, it is clear that the world has entered a new era of risk.

9 August 2022
Podcast
Podcast

Managing Security Across Disparate Database Technologies

We usually think about the most efficient way to do things while working in production environments. Still, often employees forget about an insecure environment once the work has been completed and they have moved on to another project.

9 August 2022
Auditors in a ‘Perfect Position’ to Further Digital Trust
Blog Post

Auditors in a ‘Perfect Position’ to Further Digital Trust

IT auditors are an important part of the digital trust equation since they are able to give organizations confidence in the processes and business relationships that they have in place.

8 August 2022
Matt Moog
Blog Post

Eight Steps to Manage the Third-Party Lifecycle

Managing third parties is a relationship that must be managed throughout the third-party management lifecycle, from identification and screening to offboarding.

5 August 2022
Priya Mouli
Blog Post

Advancing Digital Trust Through Collaboration

To address the biggest challenges in the technology field, Priya Mouli, Director at PwC’s Cybersecurity Consulting practice yhinks there needs to be more collaboration and cooperation among the public and private sectors and groups globally.

4 August 2022
Podcast
Podcast

Implementing Emerging Technologies: Agile SDLC Still Works

AI is a part of our everyday life. What's The Risk LLC's Cindy Baxter gives ISACA's Kevin Keh examples of modern media like the movies Free Guy, Ron’s Gone Wrong and The Matrix...

4 August 2022
Caitlin McGraw
@ISACA Article

Rocket Fuel for Your Career: Stories that Inspire, Influence and Build Your Brand

“My boss tells amazing stories. I could listen to her for hours.” I was talking with an IT audit manager at a global pharma company when she made that comment.

3 August 2022
Veronica Rose
@ISACA Article

Do Your Policy Documents Represent Current Practices?

Process owners are subject matter experts who understand processes, procedures and controls in place, whether documented or not. However, auditors usually go by the maxim that “If it’s not documented, it does not exist.”

3 August 2022
Risk Scenarios Starter Pack
@ISACA Article

New Member Benefit: Risk Scenarios Starter Pack

Well-developed risk scenarios providing a realistic and practical view of risk that may prevent an enterprise from achieving its business objectives are especially valuable in today’s fast-moving and often volatile business landscape.

3 August 2022
Tammy Moskites
Blog Post

Sharpen Your Machine Identity Management

New technologies are regularly implemented into IT infrastructure in this era of digital transformation, placing increased importance on sound machine identity management (MIM).

3 August 2022
Blockchain Smart Contracts, Part 1
ISACA Journal Article

Blockchain Smart Contracts, Part 1: Introduction for Accounting and Auditing Professionals

Blockchain smart contract technology is having and will continue to have a significant impact on accounting and auditing.

Authors: Samuel Zaruba Smith and Andy Garcia
Luigi Sbriz
Blog Post

How Much Trust Should You Give Digital Identity Identification?

Digital identity is a necessity. It should be simple and accurate as well as easily eliminable. Users should be able to expect control over the dissemination of their personal data.

2 August 2022
Maosen Cai
Blog Post

How to Build a Data Science Team Within the Internal Audit Function

Data science is a growing and evolving force in different functional areas of business, and the internal audit function is no exception.

1 August 2022
Mark Thomas, Sr. Cybersecurity Analyst & Threat Hunter, and Sandeep Bachhas, Sr. Cybersecurity Analyst & Threat Hunter
Blog Post

Building Our Security Coordination Center (SCC) Hunting Program

When many companies think about network security, they usually think in terms of firewalls, anti-virus software, intrusion detection systems, and multi-factor authentication (MFA).

29 July 2022
ISACA live tile
Podcast

ISACA Live: Managing Supply Chain Risk with Richard Hollis

ISACA's risk expert Paul Phillips and Richard Hollis, CEO of Risk Factory and an ISACA Conference Europe speaker, examine top cyber risks impacting the supply chain, steps organizations...

29 July 2022
Paul Phillips and Richard Hollis
Blog Post

Supply Chain Security: Where Do We Go from Here?

ISACA risk expert Paul Phillips and CEO of Risk Factor Richard Hollis discussed key challenges influencing supply chain security in an episode of ISACA Live last week. Their conversation was supported by insights from ISACA’s recent survey, Supply Chain Security Gaps: A 2022 Global Research Report.

28 July 2022
Frank Wei
Security Article

The Power of Provenance

While next-generation firewalls, extended detection and response (XDR) and other security solutions do a great job of detecting and thwarting cyberattacks, it is all too common for a sneaky or camouflaged threat to slip through into the network.

28 July 2022
Sunil Bakshi
@ISACA Article

Insider Threats: What Needs to Be Done?

In the information and cybersecurity domain, it is well-documented and much discussed that the most significant threat to an organization often stems from its own employees.

27 July 2022
Mark Bowling
@ISACA Article

The Midgame Could Be Beginning of End for Ransomware Perpetrators

The growing impact of ransomware attacks on organizations has been staggering in recent years.

27 July 2022
Guy Pearce
Blog Post

Data Resilience Is the Cornerstone of Digital Resilience

Digital resilience is the outcome of organizational action taken to rapidly deploy or modify digital technologies to address the negative impact of shocks—such as the pandemic—in the interests of maintaining organizational sustainability.

27 July 2022
Governance of Key Aspects of System Patch Management
ISACA Journal Article

Governance of Key Aspects of System Patch Management

When a pop-up notification prompts a user to update their system with the latest patch, the response is often to click on the Remind Me Later option.

Author: V. J. Srinivas
Rebecca Herold
Blog Post

Changes Needed to US Federal Privacy Proposal for Effective Implementation

My Privacy & Security Brainiacs team has been tracking US federal bills proposed by Congress that mention privacy in some way.

26 July 2022
Ejona Preçi and Peter H. Gregory
Security Article

SaaS Security Risk and Challenges

The hybrid work model imposed by organizations during the height of the COVID-19 pandemic triggered many enterprises to accelerate moves to cloud-based services for better resilience and efficiency.

26 July 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Pam Nigro

On this episode of Industry Spotlight, ISACA's outgoing Board Chair, Greg Touhill, introduces the 2022-23 Board Chair, Pam Nigro.

26 July 2022
Ejona Preçi and Curtis Simms
Blog Post

Addressing Security Risks to Medical IoT Devices

The Internet of Things (IoT) enables millions of smart devices worldwide that are connected to the internet to collect, process and share data.

25 July 2022
Mea Clift
Blog Post

Mea Clift: ‘A Force of Nature’

ISACA member Mea Clift advances digital trust in her work but also makes time for some old-fashioned personal pursuits.

22 July 2022
Ryan Cloutier
Risk Article

What Makes Risk Assessments So Unpleasant and How to Change That

“I would love to complete a security risk assessment,” said no one, ever. Many people would agree that performing and reviewing security risk assessments are not particularly enjoyable, especially for IT and security teams that are already overworked, understaffed and burned out.

22 July 2022
Podcast
Podcast

The Impact of People on Information Technology Landscape

In this episode, ISACA’s Jon Brandt chats with Thomas Lenzenhofer, Business Development Manager at Cisco, about his new ISACA article titled, “The Impact of People on Today’s Information Security Landscape.”

22 July 2022
Paul Thompson
Blog Post

Know Your Risks – and Your Friends’ Risks, Too

In today’s globally connected world, organizations are finding themselves at a greater risk than ever of a supply chain compromise.

21 July 2022
Chris Clements
Blog Post

Purple Teaming: The Next Gen Pen Test

It’s pen test time again. Time to get updated quotes from vendors and put something on the schedule ahead of the compliance deadline, but will this year’s results be any different than last time?

20 July 2022
Rob McDonald
@ISACA Article

Stop Losing Cyber Talent and Start Leading with Why

At a time when 60 percent of cybersecurity firms report difficulty retaining cyber talent, I would like to introduce a new method for increasing employee engagement and retention. In this article, you’ll learn to apply techniques from agile to guide your organization in connecting their work to the company’s overall purpose.

20 July 2022
The Top-Five Audit Essentials for Driving Efficiency and Value - people in front of a computer
ISACA Journal Article

The Top-Five Audit Essentials for Driving Efficiency and Value

Audit teams often struggle to determine why projects get delayed, and they fail to understand resulting client concerns

Author: Sushma Uniyal
Podcast
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

20 July 2022
Career and Leadership
Blog Post

Persevering Through a Seismic Industry Shift

Eventcombo was recognized this year with the ISACA Innovative Solutions Award “for enabling community connections and continuing education virtually during a global pandemic through innovative EventTech solutions.”

18 July 2022
Podcast
Podcast

GRC for Intelligent Ecosystems (GRCIE): An Innovative Approach to Workforce Enablement

Executive Director for GRC for Intelligent Ecosystem (GRCIE) Jenai Marinkovic joins ISACA Director of Professional Practices and Innovation Jon Brandt to address key findings in ISACA's 2022 State of Cybersecurity report...

18 July 2022
Audit and Assurance
Blog Post

What Can Internal Auditors Do to Increase Cybersecurity Audit Effectiveness?

Cybersecurity has topped the list of critical risk for organizations for the fifth time in both the European Confederation of Institutes of Internal Auditing’s (ECIIA’s) 2022 Risk in Focus report and the Institute of Internal Auditor’s (IIA’s) OnRisk 2022 report.

15 July 2022
Piyush Bajpai
Emerging Technology Article

Mitigating Cryptocurrency’s Carbon Footprint

In today’s rapidly evolving finance industry, organizations can either change and thrive or fall behind the market competition. One of the most discussed evolving trends in finance is cryptocurrency.

15 July 2022
Petar Besalev
Blog Post

Why You Can’t Afford to be Reactive About Cybersecurity and Compliance

There has been a very clear change in awareness and overall attitude toward cybersecurity and compliance in recent years.

14 July 2022
Podcast
Podcast

Smarter Testing = Safer Digital Experiences

Application testing is a critical component of a software development lifecycle. A complete testing battery for any application includes not only functionality and usability testing but security and reliability testing as well.

13 July 2022
John Pironti
@ISACA Article

Five Key Considerations When Developing a Security Strategy for IoT and OT

The Internet of Things (IoT) and operational technologies (OT) significantly expand the threat and vulnerability landscape for organizations that choose to adopt them. The notion of “You are only as strong as your weakest link” took on a new meaning when IoT and OT devices and capabilities were introduced.

13 July 2022
A host at the International Cybersecurity Challenge with a bunch of contestants behind him
@ISACA Article

ISACA Sponsors the First International Cybersecurity Challenge

The European Union Agency for Cybersecurity (ENISA), together with sponsors including ISACA, created and hosted the first International Cybersecurity Challenge (ICC) in Athens, Greece from 14-17 June this year. This challenge was designed to attract young talent in the cybersecurity community and to bring global attention to the education and skills needed in cybersecurity professions.

13 July 2022
Dr. Lisa McKee
@ISACA Article

Stop Passing the Privacy Hot Potato

The privacy function remains relatively new at most organizations. While the implementation of major regulations such as GDPR and CCPA in recent years helped elevate privacy’s stature, many organizations are still in the mode of, “I have to do this thing, but I don’t really know what this thing is, or how it will impact my organization.”

13 July 2022
Hunter Sekara
Blog Post

Characterizing System Security Engineering Using a Business Impact Analysis

As adversaries continuously seek to disrupt, cause harm and wreak havoc on complex digital assets, enterprises must strategically plan, design and build secure, trusted systems.

13 July 2022
Biju Nair
Audit Article

The Evolution of Internal Audit in a Digital-First Environment

When leaders at a new digital bank were putting together a job description for their first chief audit executive (CAE), they knew they were looking for more than a candidate who could perform conventional internal audit functions.

13 July 2022
A Standardized Approach for Peer Review of Internal Audit
ISACA Journal Article

A Standardized Approach for Peer Review of Internal Audit

The quality of enterprise governance and the questionable judgment and roles of internal auditors have resulted in some financial reporting irregularities, fraud and various forms of malpractice such as insider trading.

Authors: Gaurav Priyadarshi, Abhishek Anand and Ishika Shukla
Deepa Seshadri
Blog Post

Cyber Incident Reporting: From Guidance to Enforcement

Imagine a day when the stock markets suddenly begin to crash, contrary to market movements, and your equity holding nosedives from a healthy green to an alarm bells-blaring red.

12 July 2022
Curtis Simms and James Paul Kakembo
Blog Post

Digital IT Forensics Evolution Through Digital Transformation

According to the National Institute of Standards and Technology, “Digital forensics is the field of forensic science that is concerned with retrieving, storing, and analyzing electronic data that can be useful in criminal investigations. This includes information from computers, hard drives, mobile phones, and other data storage devices.”

11 July 2022
Relebohile Kobeli
Risk Article

How Enterprises Can Leverage Incident Reporting

Incident reporting plays a vital role in strengthening the internal controls necessary for an organization to operate properly. An incident is defined as “[A] nonstandard operation which causes interruption or reduction in quality of service.”

11 July 2022
Fortune Onwuzuruike
Blog Post

Cybersecurity Workforce Advancement

Cybersecurity education and training is important in the cybersecurity workforce and provides students and recent graduates with information on how to find what path to take. Paths include formal education from universities and institutions that provide programs to better equip the student who desires to be a cybersecurity professional (e.g., bachelor’s, master’s and doctoral degrees) and cybersecurity training such as boot camps, certifications preps and certificate programs.

8 July 2022
Podcast
Podcast

Cyber Decisions Only Executives Can Make

One of ISACA’s most popular Journal columnists joins us to discuss his most recent release, “Cyber Decisions Only Executives Can Make.” Steven Ross chats with ISACA’s Safia Kazi about cyber recovery plans...

8 July 2022
Carissa Veliz
Blog Post

AI and Digital Ethics: ‘There Could Not Be More Overlap’

Véliz recently visited with ISACA Now to share her perspectives on AI, digital ethics and more.

7 July 2022
Chetan Anand
Audit Article

Preparing Your First Supplier Audit Plan

Organizations outsource processes and services for a variety of reasons: to cut costs, preserve resources, make room for growth and remain competitive in their industries.

7 July 2022
Ravikumar Ramachandran
Blog Post

Quantum Computing and the Role of Internal Audit

Quantum computing is a very exciting discipline formed by the combination of computer science, physics and mathematics, which uses some of the mysterious aspects of quantum mechanics to enable unprecedented computational performances.

6 July 2022
ISACA CEO - David Samuelson
@ISACA Article

Digital Trust: Atop the Technology Pyramid

I recently attended an IDC analyst presentation analyzing emerging trends in the cybersecurity realm, and one slide in particular caught my attention.

6 July 2022
Caitlin McGraw
@ISACA Article

Job Descriptions Falling Down on the Job: What Hiring Managers Can Do to Fix This Calamity

Most hiring managers never thought they would have to master the art of copywriting. Documentation – yes. Report writing – yes. Ad copy – not so much.

6 July 2022
Fiber optic cables
@ISACA Article

Top Takeaways from New IT Audit Technology Risks Survey

Cybersecurity is the leading risk area for IT audit departments, with related risks such as privacy and data also ranking among the top concerns, according to a new study from ISACA and Protiviti.

6 July 2022
Quantum Disruption for Defensive and Offensive Cybersecurity
ISACA Journal Article

Quantum Disruption for Defensive and Offensive Cybersecurity

Since the idea of applying the principles of quantum physics to classical computing originated in the early 1980s, many prototypes, simulations and research efforts have been carried out in attempts to put the idea into practice.

Author: Balaji Swaminathan M.
Brian Fletcher
Blog Post

Ensuring You Have the Right Governance in Place for Physical and Environmental Controls

Physical and environmental controls are more than gates, guards, generators and HVAC monitoring. Getting physical and environmental controls right is a big step forward in reducing your enterprise’s risk and protecting critical assets in an unpredictable world. So how do you determine that you have the proper controls and governance oversight in place?

5 July 2022
Michael Podemski
Audit Article

Now Is the Time for IT Auditors to Perform Advisory Pre-Implementation Reviews

Demand for digital transformation is increasing as enterprises endeavor to offer more innovative products or services and modernize legacy IT environments.

5 July 2022
Podcast
Podcast

Real-World Data Resilience

Join ISACA's Lisa Villanueva as she talks with Guy Pearce about his recently released ISACA Journal article "Real-World Data Resilience". Guy has a deep knowledge of the movement of data and says "it’s about change and nothing is stable."

5 July 2022
Kevin E. Jackson
Emerging Technology Article

The Case for Outcome-Based Cybersecurity: A Data-Focused Shift in Cybersecurity Management

The challenges faced by today’s cybersecurity practitioners are well documented, however, the situation may be worse than described.

1 July 2022
Pam Nigro
ISACA Journal Article

Letter From the Incoming Board Chair: Dear Readers

As a technology professional, I have borne witness to a technology evolution from sneakernet to ethernet to Internet.

Author: Pam Nigro
Cyber Decisions Only Executives Can Make
ISACA Journal Article

Information Security Matters: Cyber Decisions Only Executives Can Make

Cybersecurity is not simply a technical problem.” I have heard and read this many times (and have said it a few times, as well).

Author: Steven J. Ross
Implementing Emerging Technologies—Agile SDLC Still Works
ISACA Journal Article

IS Audit in Practice: Implementing Emerging Technologies—Agile SDLC Still Works

It was a big deal scheduling network operation center (NOC) tours for customers when I was a client account director in network services...

Author: Cindy Baxter
Charting the Course for Quantum Computing
ISACA Journal Article

Innovation Governance: Charting the Course for Quantum Computing

Once upon a time, I was an undergraduate physics major studying a subject called quantum mechanics.

Author: K. Brian Kelley
Focal Points for Auditable and Explainable AI
ISACA Journal Article

Focal Points for Auditable and Explainable AI

Artificial intelligence (AI) is a branch of computer science that originated, at least academically, almost 75 years ago.

Author: Guy Pearce
Making and Breaking Data Security With Quantum Machines
ISACA Journal Article

Making and Breaking Data Security With Quantum Machines

The characteristics of the quantum universe are not very intuitive when based on observations of everyday physics, which may explain why even theoretical physicist Albert Einstein found the phenomena “spooky."

Author: Dalia Khader
Evaluating Ethical Challenges in AI and ML
ISACA Journal Article

Evaluating Ethical Challenges in AI and ML

In general, privacy, bias and discrimination are currently receiving a lot of attention. However, it is common for them to be underprioritized in technology implementations and treated as isolated issues...

Author: Joshua Scarpino
Managing Security Across Disparate Database Technologies
ISACA Journal Article

Managing Security Across Disparate Database Technologies

Enterprise databases present several unique challenges for security and audit professionals. They are paradoxical, as they must securely store vast amounts of sensitive data...

Author: Adam Kohnke
Eliminating the Embedded Malware Threat at the Binary Level
ISACA Journal Article

Case Study: Eliminating the Embedded Malware Threat at the Binary Level

Attack methods that evade enterprise security controls are understandably favored among cybercriminals, and the growing trend toward embedding malware in documents is evidence of the difficulty of...

Author: Mick Brady
Rethinking the Effectiveness of Controls in the Digital Age
ISACA Journal Article

Rethinking the Effectiveness of Controls in the Digital Age

In the midst of international geopolitical turbulence, organizations must mobilize to keep their businesses dynamic and establish long-term strategic postures that define ways forward amid instabilities.

Author: Jeimy J. Cano M.
Privacy, Security and Bias in Emerging Technologies
ISACA Journal Article

Privacy, Security and Bias in Emerging Technologies

Emerging technology is an obvious and oft-repeated term, usually referring to digital technology recently developed. The first use of social messaging tools to make calls or send messages was approximately...

Author: Shini Menon
Implementing Artificial Intelligence
ISACA Journal Article

Implementing Artificial Intelligence: Capabilities and Risk

During the last decade, there has been exponential growth in artificial intelligence (AI) adoption. Total global enterprise AI investments grew from US$12.75 billion to US$67.85 billion between 2015 and 2020.

Author: Ivy Munoko
Kevin Keh
Blog Post

Arts vs. Sciences in IT: How UX Design Can Bridge the Gap

As professionals in IT-related fields, our jobs can seem very explicit: Binary 1s and 0s and Boolean true or false is baked into much of what we do. There are exceptions of course, but often there is a right answer or a wrong answer, and little space in between.

30 June 2022
Larry Wlosinski
Security Article

Writing a Charter for an Enterprise Security Operations Center

The security operations center (SOC) is the heart of information security for medium- to large-sized organizations. It ensures organizational cyber well-being by monitoring the infrastructure and managing its cyberhealth.

30 June 2022
Podcast
Podcast

Breaking Down the ESET T1 Threat Report

ESET, a global leader in cybersecurity, has released its T1 2022 Threat Report, which summarizes the most notable trends that shaped the threat landscape from January to April 2022.

30 June 2022
Kim Kaplan
Blog Post

MDDAP Helps Achieve Fast, Sustainable Solutions for Medical Device Quality

MDDAP’s successful development is due in part to the Case for Quality (CfQ) being launched from FDA’s own research with a wide variety of stakeholders, which revealed a problem in the industry: compliant manufacturers were still having similar types and frequency of issues as non-compliant manufacturers. While compliance was important, it alone wasn’t going to drive the desired quality outcomes.

29 June 2022
Jack Freund
@ISACA Article

How the Rise of the Chief Trust Officer Role Can Shape Digital Trust in Organizations

It’s often said that trust is hard to earn and easy to lose. It undergirds most everything we do, yet is so fragile that, without it, nothing works.

29 June 2022
Bruce R. Wilkins
@ISACA Article

The Need for Job Rotation

On the surface, job rotation may seem straightforward or even outright boring. But this business process can be interesting when you peel back the layers.

29 June 2022
HelpSource Security Lock
ISACA Journal Article

Help Source Q&A

Privacy by design is a methodology originally developed in 1995. It takes a broad view of a system and its data relative to seven principles.

Author: Sunil Bakshi
Reducing Security Vulnerabilities in a Hybrid Workplace Keyboard
ISACA Journal Article

Reducing Security Vulnerabilities in a Hybrid Workplace

The lockdowns and other precautions instituted based on the COVID-19 pandemic have fundamentally changed the way society lives, works and plays.

Author: Timothy Liu
Kashifu Inuwa Abdullahi
Blog Post

ISACA Member’s Impact in Nigeria Recognized on the Global Stage

Kashifu Inuwa Abdullahi, Chief Information Technology Officer, National Information Technology Development Agency in Nigeria, was recognized this year with the ISACA Inspirational Leadership Award “for leadership in bridging the digital divide by providing computers and other IT infrastructure to rural areas and schools and for providing virtual libraries.”

28 June 2022
Podcast
Podcast

Where Privacy Meets Security

Jo Stewart-Rattray, the Director of Technology & Security Assurance for BRM Advisory, believes privacy is a team sport. Every organization needs to be responsible for asking, “what data is being collected,” “where is the information held,” “what purpose is the information being collected for,” and “how is the information being protected.”

28 June 2022
Anna Johannson
Blog Post

How the Right Help Desk Processes Can Strengthen Security

The IT help desk might seem like a simple portal for helping end users manage their issues. But in reality, it represents one of the first (and best) filters for identifying potential cybersecurity problems that may arise.

27 June 2022
Ajay Wadhwa
Blog Post

Next-Generation CISO: Business, Technical or Mix of Both?

Before we get to the answer to the question posed in the title, let’s look at the typical job responsibilities of a CISO.

23 June 2022
Post-breach Lessons Learned from SolarWinds CISO Tim Brown
@ISACA Article

Post-breach Lessons Learned from SolarWinds CISO Tim Brown

SolarWinds CISO Tim Brown spoke with ISACA Board Director Rob Clyde at the ISACA Conference North America last month about lessons learned from the high-profile software supply chain incident in 2020.

22 June 2022
Zanele Njapha
Blog Post

Lessons in Change and Leadership from ‘The UnLearning Lady’

Zanele Njapha recently visited with ISACA Now to discuss her quirky nickname, her views on entrepreneurship and organizational change, and more.

22 June 2022
Bassel Kablawi
Security Article

Why (and How to) Dispose of Digital Data

The stakes are too high for organizations not to comply with data privacy regulations. For example, noncompliance with the EU General Data Protection Regulation (GDPR) can result in a fine of up to €10 million or up to 2% of the organization’s worldwide annual revenue from the preceding financial year, whichever is higher.

22 June 2022
The Human Consequences of Ransomware Attacks
ISACA Journal Article

The Human Consequences of Ransomware Attacks

The Internet’s impact on daily life is unquestionable. It provides a platform for communication, ecommerce and interactions between individuals and enterprises around the world.

Author: Joseph Cheng | CISA, CRISC, CPA
Rob McDonald
Blog Post

Reach and Teach: An Effective Way to Market and Advertise Cybersecurity Services

Now is the time for cybersecurity professionals to get in front with their message.

21 June 2022
Yiannis Pavlosoglou
Blog Post

Introducing the Principle of Need to Have Available

The principle of need to have available can be summarized as having only the permissions you need for your next set of tasks.

21 June 2022
Podcast
Podcast

How To Build A Following Around Your Ideas

In this talk based on her book Stand Out: How to Find Your Breakthrough Idea and Build a Following Around It, Dorie Clark explains how to build a following around your ideas.

21 June 2022
The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce
Blog Post

The Overlooked Characteristics That Can Elevate the Cybersecurity Workforce

While much has been said and written about the difficult cybersecurity skills and hiring landscape, one key characteristic that is typically overlooked in cybersecurity professionals is empathy.

17 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Jan Anisimowicz

Jan Anisimowicz is an experienced senior IT manager with over 23 years of experience in GRC, data analysis, broad business, and technical perspective in telco, banking, pharma, and insurance.

17 June 2022
audit and assurance
Blog Post

Foundational Understanding of Databases Boosts Auditors’ Value

With all the areas under an IT auditor’s purview, it is challenging, perhaps impossible, to be as proficient as we would like to be in all areas.

16 June 2022
Podcast
Podcast

Climate Resiliency and Regulation

Climate resiliency and green innovations are of worldwide interest today, but what is the best way to use skills and expertise that will make a difference?

16 June 2022
The Business Impacts of COVID-19: A Post-Pandemic Approach to IT Security and Data Privacy Risks
@ISACA Article

The Business Impacts of COVID-19: A Post-Pandemic Approach to IT Security and Data Privacy Risks

The business impacts of COVID-19 went far beyond a workforce used to sweatpants and slippers in lieu of their former business casual clothing, said speaker Ralph Villanueva at ISACA Conference North America 2022.

15 June 2022
Hollee Magrum- Willis and Belinda Enoma
@ISACA Article

Authentic Allyship and Intentional Leadership

Hollee Mangrum-Willis, Senior Program Manager of ISACA’s One In Tech foundation, sat down with Belinda Enoma, data privacy and cybersecurity leader, to discuss authentic allyship and intentional leadership.

15 June 2022
Improving Security Across the Software Supply Chain
@ISACA Article

Improving Security Across the Software Supply Chain

Today’s software development needs to take a comprehensive approach to be secure. Security needs to be considered at every step of the software supply chain.

15 June 2022
Hussam Khattab
@ISACA Article

Privacy Paradox: Digital Transformation and Governance

A few months ago, my young son wanted to watch videos on YouTube. I let him use my phone, and he started watching one video after another.

15 June 2022
Binita Patel
Blog Post

Perimeter-less Security

“Never trust, always verify” have been the buzzwords ever since the term “zero trust” was coined. According to Pulse, 87% of decision-makers believe that zero trust security strategy will simplify their organization’s security architecture.

15 June 2022
Paul M. Perry
Audit Article

The Repetitive History of IT Audit Outcomes

While the term “IT audit” may be defined differently across organizations based on industry requirements and their applicable frameworks, the outcomes of such audits are often fairly predictable.

15 June 2022
Reducing Cybersecurity Security Risk From and to Third Parties
ISACA Journal

Reducing Cybersecurity Security Risk From and to Third Parties

A major lesson from the COVID-19 pandemic is that protecting oneself is only part of the solution that will put a stop to the virus.

Author: C. Warren Axelrod
Brian Gallagher
Blog Post

Reaching Objectives and Enabling Success: How CMMI Creates Habit Persistence

During ISACA Conference North America 2022, ISACA launched a new initiative focusing on the pursuit of digital trust, which means that this topic was present in several discussions throughout the conference.

14 June 2022
Podcast
Podcast

Gaining Digital Trust by Eliminating Privacy Dark Patterns

With the growing emphasis on consent for collecting and processing data, some enterprises have turned to tricking data subjects into giving their consent by using privacy dark patterns.

14 June 2022
Jingcong Zhao
Blog Post

Making Continuous Controls Monitoring Work for Everyone

As a security assurance professional, you know the importance of controls testing. After all, only organizations that thoroughly test and prove their controls’ effectiveness can be confident that they’ve sufficiently mitigated their security and data privacy risks.

13 June 2022
Larry Alton
Blog Post

Customs Goes Digital: Exploring the Latest Trends

It’s been amazing to watch how almost every aspect of global life has been digitized in some shape or form over the past several years – and customs is no different. The question is, which aspects are changing? And is it for the better?

10 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Mark Thomas

Mark and Jessica dive deep into his career journey and their shared history of developing ISACA training content.

9 June 2022
China's Personal Information Protection Law
@ISACA Article

China’s Personal Information Protection Law Highlighted in New ISACA Resource

Enterprises around the world could feel the consequences of China’s Personal Information Protection Law (PIPL), which recently went into effect.

8 June 2022
ISACA Supply Chain Security Report Spotlights Major Vulnerabilities
@ISACA Article

ISACA Supply Chain Security Report Spotlights Major Vulnerabilities

Less than half of respondents to a new ISACA survey have high confidence in the security of their organization’s supply chain as supply chain risks have become increasingly top-of-mind for enterprises and consumers alike throughout the pandemic.

8 June 2022
Jack Freund
@ISACA Article

The Future of Quantitative Cyberrisk Reporting

An increasing number of boards of directors (BoDs) are paying greater attention to their cyberrisk exposure, which has placed pressure on security teams to provide BoDs with what they need.

8 June 2022
Career and Leadership
Blog Post

The Great Resignation & Employee Retention in Digital Trust Professions: Closing Critical Workforce Gaps

ISACA Conference North America 2022 last month featured the launch of ISACA’s new initiative focusing on the pursuit of digital trust, which was a recurring theme throughout many of the event’s presentations.

8 June 2022
Process Mapping Synergy Gains From BCP and DR
ISACA Journal Article

Process Mapping Synergy Gains From BCP and DR

Understanding how processes work and where controls are needed is crucial for organizations to improve their efficiency. Process mapping is a common place to start.

Author: Alonzo Longshore
Evan Wheeler
Blog Post

Give Your IT Risk Program a Jump-start

I’m constantly fielding questions about how to start building a modern-day IT risk management program, and a quick Google search reveals that there are many differing opinions on the best approach.

7 June 2022
Podcast
Podcast

Cybersecurity in a COVID-19 World: Insights on How Decisions Are Made

In the early days of the Covid-19 pandemic, all organizations pivoted to remote work.

7 June 2022
Mea Clift
Blog Post

Supply Chain Risk Management: Where Do We Start?

Mea Clift examines how to climb the mountain of evaluating vendors to ensure they're meeting security standards.

6 June 2022
Andrea Tang
Blog Post

Demystifying China’s Personal Information Protection Law: PIPL vs. GDPR

On 20 August 2021, the National People’s Congress (NPC) passed the final version of the Personal Information Protection Law of the People’s Republic of China (PIPL), a comprehensive privacy law that covers multiple facets of personal information protection.

3 June 2022
Kevin Keh
Security Article

The Digital Gold Rush: Football, Ransomware and the Bottom Line

The San Francisco 49ers team, one of the NFL’s 32 professional football teams, was hit by a Ransomware-as-a-Service (RaaS) faction called BlackByte.

3 June 2022
Raymond Ito
Risk Article

The New Global Risk Profile

The Russia–Ukraine War has plunged the entire world into a new risk landscape, especially organizations that already faced high levels of risk.

2 June 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Caitlin McGaw

Caitlin McGaw answered an ad in the newspaper in 1997 for a position with an Executive Search Firm and she was instantly hooked.

2 June 2022
Risk Starter Kit
@ISACA Article

New Resource Helps Tailor Risk Management Programs

ISACA has released a Risk Starter Kit to aid enterprises in creating their own tailored risk management program.

1 June 2022
Caitlin McGraw
@ISACA Article

Ready to Crush Interviews? Add This Superpower to Your Career

Is there a secret sauce to interviewing? In a word, yes.

1 June 2022
Todd Fitzgerald
@ISACA Article

The CISO Evolution

Let’s travel back in time a bit to 1995. Michael Jordan returned to the NBA, DVDs were invented, and—most importantly, for the purposes of this article—the first CISO was hired.

1 June 2022
Ravi Shankar Vemuri
Blog Post

How Best to Protect Your Assets

How do you typically protect a special or expensive piece of jewelry? You may keep it in a bank locker or in an electronic safe in your home.

1 June 2022
Pam Nigro
Blog Post

In a World of Technology, ISACA Makes the Difference

At the beginning of this year, ISACA took on a bold new vision for the future: Be the standard-maker for digital trust everywhere.

1 June 2022
How Effective Is Your Cybersecurity Audit?
ISACA Journal Article

How Effective Is Your Cybersecurity Audit?

Cybersecurity is becoming an increasingly important focus for organizations, and the COVID-19 pandemic has only accentuated cyberrisk for every type of enterprise.

Authors: Matej Drašček, Sergeja Slapničar, Tina Vuko and Marko Čular
Shingi Mushangwe
Blog Post

The Governance, Assurance and Automation that Financial Services Organizations Need

In response to the recent Russian invasion of Ukraine, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a set of expansive economic measures designed to incapacitate the Russian financial system.

31 May 2022
Gopikrishna Butaka
Blog Post

The Future of Audit in the World of Interconnected Business

The COVID-19 pandemic had changed many things; one among them is the perception of the audit process as business processes have become more interconnected and interdependent.

27 May 2022
Naomi Buckwalter
Blog Post

Five Cybersecurity Memes and What They Say About Cybersecurity Today

Cybersecurity memes on social media are often good for a laugh, but several of the more popular ones have gained resonance with security professionals for a reason...

26 May 2022
Deepa Seshadri
@ISACA Article

Cultivating a Cyber Culture at Your Organization

Simon Sinek has said, “Corporate culture matters. How management chooses to treat its people impacts everything – for better or for worse.”

25 May 2022
Justin Henkel
@ISACA Article

How CISOs Can Uplevel the Security Conversation

Chief information security officers (CISOs) are becoming the most senior executive leader responsible for trust inside an enterprise.

25 May 2022
Sunil Bakshi
@ISACA Article

How Much Enough Is Enough?

Recently, due to the nature of my work, I was made aware of a cyberincident that was not widely publicized, wherein an attacker used social engineering techniques to manipulate a person into revealing their banking credentials, namely user ID and password.

25 May 2022
Jason Sechrist
Blog Post

Separating Fact from Fiction: Debunking Myths Around CMMC 2.0

With more than 220,000 companies supporting the US Department of Defense, the defense industrial base presents an enticing target for hackers, nation-states, and cybercriminals.

25 May 2022
Computer Brain with blue background
ISACA Journal Article

Real-World Data Resilience Demands an Integrated Approach to AI, Data Governance and the Cloud

The real-world rate of change affecting almost everything to do with data is what separates the theory of enterprise data resilience from its practice.

Author: Guy Pearce
Dr. Kimberlee Ann Brannock
Blog Post

Cybersecurity and Consumers

As a cybersecurity leader and scientist, I find it interesting that as I observe events all around me that all are seemingly unconnected, they are in fact connected, at times with exciting and favorable outcomes.

24 May 2022
Luigi Sbriz
Blog Post

Combining the Risk Register and the Maturity Model to Increase Total Value

Communicating the results of business controls to top management is never an easy process, especially if we want to ensure concrete information based on risk and effectiveness of controls is communicated. Generally, risk and controls rely on different methodologies; this is not ideal. Instead, we need flexible methodologies, collaboration between business processes and adequate tools.

23 May 2022
Digital Trust Requires All Hands on Deck—But the ROI Is Worth It
Blog Post

Digital Trust Requires All Hands on Deck – But the Payoff Is Big

The fields in which ISACA’s professional community works – such as audit, risk, security, privacy and governance – feed into the more encompassing realm of digital trust.

20 May 2022
Sundaresan Ramaseshan
Security Article

Performing User Access Reviews to Improve Enterprise Security

Security leaders can enhance security at their enterprises by conducting frequent and thorough user access reviews.

20 May 2022
Podcast
Podcast

Cyber (Business) Recovery

Steven talks to ISACA's Safia Kazi about how to prepare for a cybersecurity Event and how to recover. Steven discusses the types of attacks to watch out for, Business Continuity Planning and how to recover from a cybersecurity event.

20 May 2022
Safia Kazi
Privacy Article

Fostering Trust by Eliminating Dark Patterns

With the growing number of privacy laws and regulations that require consumer consent before collecting or processing data, some enterprises have turned to tricking consumers into giving their consent through the use of dark patterns, which are practices that deceive users into acting in a way in which they did not intend.

18 May 2022
Adham Etoom, CISM, CRISC, PMP, GCIH, FAIR, Government of Jordan, National Cyber Security Center, Jordan, and Ejona Preci, CISM, CRISC, ITIL, Information Security Risk Manager
Blog Post

COVID-19: An Ignitor in Information Risk Management

This makes one think about risk subconsciously as we are uncertain about when pandemics will happen as well as how we should be prepared to contain and reduce their impact.

18 May 2022
Andre Pitkowski and Daniel Bispo de Jesus,
Risk Article

Performing an Information Security and Privacy Risk Assessment

Enterprise information security and privacy professionals are responsible for identifying information security and privacy gaps in information management systems and processes.

18 May 2022
Better Cybersecurity Awareness Through Research
ISACA Journal Article

Better Cybersecurity Awareness Through Research

In the last few years, information security professionals have faced tremendous challenges. Just in 2021, there were more than two billion malware attacks and trillions of intrusion attempts.

Author: Ranjit Bhaskar
Matt Moog
Blog Post

Three Reasons Your Third-Party Management Program is Struggling

Building trust throughout an organization requires working collaboratively across lines of the business and gaining interdepartmental, cross-functional visibility.

16 May 2022
Understanding the Full Digital Trust Ecosystem
Blog Post

Understanding the Full Digital Trust Ecosystem

A Google search of “digital trust” turns up 5.73 billion results, and hundreds of recent trade press articles have covered the topic.

13 May 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A PDCA Approach to Conducting a DPIA

Since their inception, much has been written and discussed about Data Privacy Impact Assessments (DPIAs), a term introduced by the EU General Data Protection Regulation (GDPR).

11 May 2022
Veronica Rose
@ISACA Article

Survival Toolkit for Information Systems Auditors

Nobody starts out as an expert in their field, and work can become even scarier when switching from one career to another.

11 May 2022
Welland Chu
Blog Post

The Needed Societal Response to Cybersecurity Risk in the COVID Era

COVID-19 has transformed how business is conducted with the acceleration of cloud adoption and remote working. Organizations’ data is no longer kept within the perimeter of the office’s or data center’s boundary.

11 May 2022
Syed Salman
Governance Article

Maximizing the Benefits of DevOps Using COBIT

If adopted properly, Agile and DevOps practices can result in improvements in objective software development metrics such as deployment frequency, lead time for changes, change failure rate and mean time to recover (MTTR).

11 May 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Niki Gomes

Everyone starts somewhere and for Niki Gomes, it was at the front desk of a hotel where she worked her way up to hospitality management, before pivoting to accounting and finally to the American Red Cross...

11 May 2022
Andre Pitkowski
Blog Post

Award Winner Weaves ISACA Into Academic Curriculum

Andre Pitkowski recently visited with ISACA Now for a Q&A interview, reflecting on his award. The following is a transcript of the interview.

10 May 2022
Zero Trust in Data Privacy Operations
ISACA Journal Article

Zero Trust in Data Privacy Operations

Following the onset of the COVID-19 pandemic, the rapid expansion of remote work created new opportunities for cybercriminals.

Author: Valdez Ladd
Bhanu Jagasia
Blog Post

Zero Trust Does Not Imply Zero Perimeter

Typically, when we hear “zero trust” these days, folks generally hear the common example of remote employees not having to VPN (Virtual Private Network) back to their enterprise network to access the cloud resource.

9 May 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Ed McCabe

One of Ed McCabe's first childhood memories was taking apart his grandparent's heirloom grandfather clock to find out why it wasn't working.

27 May 2022
Anantha Sayana
Blog Post

Should Information Systems Audit Evolve to Information Systems Continuous Monitoring?

Nothing in this world is static. Everything evolves, and improvements often happen when things evolve.

6 May 2022
Blog Post

2021 Annual Report Spotlights ‘Inspiring Work’ of ISACA Community

Through new learning and credentialing opportunities, enterprise resources and its ever-growing global community, ISACA was in pursuit of digital trust throughout 2021 on multiple fronts.

5 May 2022
Digital Trust: A Modern-Day Imperative
@ISACA Article

Importance of Digital Trust Highlighted in Latest ISACA Report

Building digital trust is more important than ever before, according to ISACA’s latest free report, “Digital Trust: A Modern-Day Imperative.”

4 May 2022
Advancing trust in a digital world
@ISACA Article

ISACA 2021 Annual Report Released

ISACA’s 2021 Annual Report, with a theme of how ISACA is working to advance digital trust, is now available on the ISACA website.

4 May 2022
Pam Nigro
@ISACA Article

ISACA Announces 2022-23 Board Slate

Pamela Nigro will be the next chair of the ISACA board of directors when the 2022-23 ISACA board is installed on 1 June.

4 May 2022
Caitlin McGraw
@ISACA Article

Job Change and Buyer’s Remorse: Minimize Risk and Maximize Opportunity

It seemed like the perfect thing. The amazing gadget, the miracle face cream, the cool designer shoes – finally on sale.

4 May 2022
Brian Fletcher
Security Article

Basics for Improving the Safety of Your Organization's Data

The world is currently experiencing the Fourth Industrial Revolution (4IR), a result of which has been the innovation of big data.

4 May 2022
ISACA CEO - David Samuelson
Blog Post

Building a More Trustworthy Digital World

Technology is truly driving global innovation and the world economy.

3 May 2022
Michael P. Cangemi
Blog Post

In 50 Years, the ISACA Journal Has Had and Seen it All

Congratulations to the ISACA® Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA® members, their organizations, the IT governance community and society at large.

3 May 2022
Integrating MITRE With COBIT
ISACA Journal Article

Integrating MITRE With COBIT

Protecting enterprises from malicious code and software requires that governance and cybersecurity practitioners take a comprehensive approach.

Author: Blake Curtis
Spiros Alexiou
Blog Post

Practical Advice for Agile Audit

Agile audit is in right now, and it looks like even the people who were doing everything agile opposes are now ardent supporters and push for going agile.

2 May 2022
The Pitfalls of Supply Chain Risk Management
ISACA Journal Article

The Pitfalls of Supply Chain Risk Management

Many organizations have progressively increased their reliance on a growing number of global suppliers.

Author: David Podeswik
Operational Resilience Preparing for the Next Global Crisis
ISACA Journal Article

Operational Resilience: Preparing for the Next Global Crisis

Although resilience in business operations has been a priority for organizations since before the onset of the COVID-19 pandemic, the ongoing global pandemic has made resilience more critical than ever.

Author: Sumedha Adavade
Is Business Continuity Management Still Relevant?
ISACA Journal Article

Is Business Continuity Management Still Relevant?

Business continuity refers to the ability of organizations to minimize losses and keep functioning and fulfilling their missions, even under extremely adverse circumstances. But this is costly and, in current times, where cost cutting is a key concern, there is...

Author: Spiros Alexiou
Case Study Cloud-Native Security Using Security Using Zero Trust
ISACA Journal Article

Case Study: Cloud-Native Security Using Zero Trust

For most organizations, cloud usage is now the norm. Much like the adoption path of many technologies, the road to cloud normalization started with an initial reluctance and has only recently begun to gain wider acceptance.

Author: Ed Moyle
Incident Response During the Global COVID-19 Crisis
ISACA Journal Article

Incident Response During the Global COVID-19 Crisis

Since March 2020, the global COVID-19 pandemic has affected the characteristics of incident response (IR) in the cybersphere. These unprecedented times have forced some enterprises to deal with their most severe business crises to date and to cope with the pandemic’s impact on the threat landscape.

Author: Ofir Eitan
Understanding the Shared Responsibilities Model in Cloud Services
ISACA Journal Article

Understanding the Shared Responsibilities Model in Cloud Services

The world of on-premises technology was practical when cloud services were not available.

Authors: Jai Sisodia and Mohammed Khan
Meeting the Demand for Zero Trust Talent
ISACA Journal Article

Meeting the Demand for Zero Trust Talent

Implementing a zero trust architecture creates a more adaptable security platform that is not designed around a static, perimeter-based network defense strategy, which can help further protect critical systems and data from attacks based on confidentiality, integrity and availability.

Authors: Fortune Onwuzuruike and Kenneth Myers
Giving IT Governance Its Real Value
ISACA Journal Article

Book Review: Creating a Virtual-First Line of Defense for Secure Software Development

Creating functioning software is a challenge at the best of times, but ensuring that it is also secure is time consuming, requires fairly scarce skills and, frequently, is not effective.

Author: Robert Findlay
Michael Cangemi
ISACA Journal Article

Letter From a Past Editor: Dear Reader

Congratulations to the ISACA Journal on achieving 50 years of publications. The massive body of information published has, no doubt, positively impacted ISACA...

Author: Michael P. Cangemi
Cyber (Business) Recovery
ISACA Journal Article

Information Security Matters: Cyber (Business) Recovery

The last of the five core functions of the US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is Recover. It comes last because this function only comes into play if the previous four—Identify, Protect, Detect and Respond...

Author: Steven J. Ross
Resilience and Regulation
ISACA Journal Article

IS Audit in Practice: Resilience and Regulation

My evenings are usually quiet three weeks out of the month, but at least one week is packed with community meetings and city public hearings. The pandemic may have impacted in-person gatherings, but government and community action continue online.

Author: Cindy Baxter
The Impact of Cryptocurrency and Its Carbon Footprint
ISACA Journal Article

The Bleeding Edge: The Impact of Cryptocurrency and Its Carbon Footprint

In recent years, cryptocurrency has played an increasingly important role in the financial market. From July 2020 to June 2021, the popularity of global cryptocurrency increased by more than 880 percent.

Author: Jiewen Wang
Planning for Failure to Ensure Resilience
ISACA Journal Article

Innovation Governance: Planning for Failure to Ensure Resilience

Even prior to the COVID-19 pandemic, the technology world was in the midst of a fundamental shift in how we operate. DevOps and cloud computing adoption growth was the vanguard of this change.

Author: K. Brian Kelley
Help Source Q&A
ISACA Journal Article

Help Source Q&A

What is resilience and how it is related to business continuity? Simply put, “resilience” means the ability to withstand an adverse situation and return to normal.

Author: Sunil Bakshi
Frank Downs
Blog Post

Failure to Patch and the Rare Case of the Java Crypto Hack

One of the often-accepted truisms in cybersecurity is to ensure that all systems supporting and protecting business operations are up-to-date and current.

29 April 2022
Security
Blog Post

Living off the Land (LotL) Classifier Open-Source Project

In security, “Living off the Land” (LotL or LOTL)-type attacks are not new. Bad actors have been using legitimate software and functions to target systems and carry out malicious attacks for many years.

28 April 2022
Krishna Das Manghat
Emerging Technology Article

Benefits of Adopting Secure Access Service Edge for Operational Technology Security

Traditional operational technology (OT) networks are built based on the rigid 6-level (level 0 to level 5) hierarchical Purdue model, which has worked well for the last few decades.

28 April 2022
The Makings of a Cybersecurity Leader
@ISACA Article

The Makings of a Cybersecurity Leader

Phil Zongo, recently visited with @ISACA to discuss cybersecurity leadership, cyber strategy and his new memoir.

27 April 2022
Jack Freund
@ISACA Article

Understanding the Distinction Between Cyberwar and Espionage

“May you live in interesting times” is an apocryphal curse that is purported to be of Chinese origin. On the surface, it sounds like a good thing: one would think everyone would want to live in interesting times.

27 April 2022
CISM
Blog Post

Twenty Ways Information Security Has Become More Challenging in the Past 20 Years

To mark the anniversary of ISACA’s Certified Information Security Manager (CISM) we spoke with 20 CISM-holders to collect their commentary on the biggest challenges that have emerged in infosec since CISM came on the scene in 2002.

27 April 2022
A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2: Identity Trust Service Implementation

Identifying a physical person on a network using their digital name (username) is a task made possible by the authentication system.

Author: Luigi Sbriz
ISACA live tile
Podcast

ISACA Live: Risk Scenarios

Paul Philips and Lisa Young will discuss how risk scenarios help decision-makers understand how certain events can impact organizational strategy and objectives

27 April 2022
CISM 20th Anniversary Infographic
Blog Post

Twenty Ways Information Security Has Changed for the Better in the Past 20 Years

ISACA’s Certified Information Security Manager (CISM) certification is now in its 20th year and to mark the anniversary, we spoke with 20 CISM-holders to collect their commentary on what has changed for the better.

26 April 2022
Brian Fletcher
Blog Post

How CISOs Can Score Some Quick Wins

Brian Fletcher, recently visited with ISACA Now to discuss how chief information security officers (CISOs) can start off by achieving some quick wins for their organizations and how organizational cyber maturity enters the equation.

25 April 2022
Security Article

Decoding CUI—a Highly Valued Data Type at Risk

Governments often create or own information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and governmentwide policies. In the United States, this type of information is referred to as Controlled Unclassified Information (CUI).

25 April 2022
Brad Rhodes
Blog Post

Malicious Trends: What You Need to Know

According to the recent Cybersecurity Ventures 2022 “Cybersecurity Almanac,” organizations will spend approximately US$1.75 trillion on cybersecurity between 2021 and 2025.

22 April 2022
Industry Spotlight Podcast
Podcast

Managing Data Privacy Risks and Compliance with a Distributed Workforce

Data now includes, consumer's social media, news, view and even browser searches. From 2010-2020, the amount of data created, captured, and copied in the world increased from 1.2 trillion GB to 59 trillion GB and the amount created in the next 5 years is projected to double

22 April 2022
David Shavgulidze
Blog Post

Supply Chain Security: Analysis of the Georgian Ecosystem

According to the European Union Agency for Cyber Security (ENISA): “In cybersecurity, the supply chain involves a wide range of resources (hardware and software), storage (cloud or local), distribution mechanisms (web applications, online stores), and management software.

21 April 2022
Caitlin McGraw
@ISACA Article

The Layer Cake Paradigm Part II: Great Interview Questions that Make You Memorable

Recapping quickly, our focus in this article is how to ask questions during job interviews that “get the job done.”

20 April 2022
Tracking Two Decades of Changes in Information Security
@ISACA Article

Tracking Two Decades of Changes in Information Security

For the past 20 years, the Certified Information Security Manager® (CISM®) has served as the global credential that ensures alignment between an organization’s information security program and its broader strategic goals.

20 April 2022
A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1
ISACA Journal Article

A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1: Identity Trust Abstract Model

The identity of an Internet citizen, or netizen, is generally determined by asking the digital citizen to share personal data with the authentication system to obtain credentials to access data.

Author: Luigi Sbriz
Alex Holden
Blog Post

Proven Methodologies to Fight Ransomware

Though the topic of ransom and ransomware is extremely popular, a lot of discussions center around a few topics: prevention, insurance and recovery.

19 April 2022
Liz Pisney
Blog Post

Saluting Our Global Volunteers

When ISACA certification candidates take an exam, the content of that exam was created and reviewed by ISACA volunteers.

18 April 2022
Kurt Markley
Risk Article

How to Develop and Execute a Rigorous Data Backup and Recovery Strategy

When approximately 22 terabytes (TB) of Dallas Police Department (DPD) (Texas, USA) data were accidentally deleted during a cloud migration in March 2021, ultimately only 14 TB could be recovered, affecting myriad case files and prosecutorial actions.

18 April 2022
Podcast
Podcast

CMMC and CUI: Rocket Fuel

Join ISACA's Senior Manager, CMMI Professional Practice, Kileen Harrison as she talks with ecfirst's Chief Executive Officer, Ali Pabrai about his recently released articles, “What Cyberprofessionals Should Know About CUI”, and “US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework”.

18 April 2022
Joanna Karczewska
Blog Post

Celebrating Women in Cybersecurity

Joanna Karczewska, a longtime ISACA member from Poland, recently visited with ISACA Now to discuss the book and her views on progress made by women in the cybersecurity field. The following is a transcript of the interview:

15 April 2022
Muhammad Asif Qureshi
Blog Post

The Evolution of GRC

Back in the day, manual processes were dominant, with telex and fax being the most common mode of communication. As a result, risk governance was also focused on these ways of business processing.

14 April 2022
David Samuelson
@ISACA Article

Continuous Learning Commitment: The Path Forward in a Volatile Labor Market

It’s no secret that companies currently face an acute talent crunch. Between the pandemic, The Great Resignation and economic inflation – not to mention turbulent world events – we’re in a highly volatile labor market.

13 April 2022
John P. Pironti
@ISACA Article

Five Key Considerations for Improving IT Supply Chain Security

Most organizations have historically focused their information risk and security efforts on what they can control and often ignore their IT supply chains, which they can only influence.

13 April 2022
Rob Clyde, ISACA board director, Executive Advisor, ShardSecure, and Chris Dimitriadis, Chief Global Strategy Officer, ISACA
Blog Post

The Trans-Atlantic Data Privacy Framework: A Significant Step Toward Reinforcing Transatlantic Cooperation, Setting a New Standard for Personal Data Protection

Global trade has been growing for decades, as most economies accelerated their globalization since the 1990s, using digital technology as a key catalyst that helped industries interconnect further and innovate.

13 April 2022
Upesh Parekh
Risk Article

Achieving Effective Cloud Risk Management

Cloud technology has leaped to the forefront of the technological world in the last 2 decades. One would be hard pressed to find an enterprise that has not implemented cloud technology in some form or another.

13 April 2022
Kelly Hood
Blog Post

Level Up Your Governance to Drive Business Growth

When you search for the term “cybersecurity” online, you get approximately 17 billion images of padlocks and shields – but what is this trying to communicate?

12 April 2022
Cybersecurity in a COVID-19 World
ISACA Journal Article

Cybersecurity in a COVID-19 World

The COVID-19 crisis has created a cyberpandemic that is due, in large part, to decisions made by organizational leaders and stakeholders.

Authors: Maik Fichtenkamm, Gerald F. Burch, Ph. D and Jordan Burch
Jo Stewart Rattray
Security Article

Where Privacy Meets Security

In a world where data are pervasive and increasingly connected, for security professionals, protecting the privacy of individuals and organizations could be compared to trying to put an octopus into a string bag: a constantly changing, wriggly challenge.

11 April 2022
Joseph Cortese
Blog Post

What Business Leaders Need to Know About Cybersecurity Preparedness

Many cybersecurity incidents occur when organizations think they’re doing the right thing.

8 April 2022
Elastos Chimwanda
Audit Article

Essentials for an Effective Cybersecurity Audit

Cybersecurity has become a pressing issue worldwide, thereby necessitating robust auditing procedures to provide assurance to senior management and boards of directors (BoDs).

8 April 2022
Sandipan Gangopadhyay, CGEIT, and Stuart McGuigan
Blog Post

The Future of Complex Legacy Enterprise Transformation

The process of manual programming has never been a perfect or exact science, and the resulting defects that occur along the way have long plagued the software development lifecycle and are therefore perpetuated in legacy systems.

7 April 2022
Guy Pearce
@ISACA Article

Explainable Artificial Intelligence (XAI): Useful But Not Uncontested

Artificial intelligence (AI) has been referred to as a “black box” technology given the difficulty organizational management, and even specialists, have in explaining what the technology does with its data input.

6 April 2022
Information Security
Blog Post

Using SWIFT as a Lesson for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the Society for Worldwide Interbank Financial Telecommunication’s (SWIFT) communication system, were compromised.

6 April 2022
Donnie Carpenter
Risk Article

Concepts to Consider When Acquiring “The Little Guy”

Throughout the last decade, there has been an increase in cyberattacks targeting small- and medium-size enterprises with a myriad of techniques and payloads, and more than 80% of enterprise owners know they are at risk.

6 April 2022
Helpsource Q&A
ISACA Journal Article

Help Source Q&A

Before the pandemic, most organizations worldwide believed that offices were essential to their business and productivity deteriorates when employees work from home. 

Author: Sunil Bakshi
Binita Patel
Blog Post

Addressing the Biggest Challenges in Cloud Security

Gartner has predicted that by 2026 the public cloud expenditure will exceed 45 percent of all enterprise IT.

5 April 2022
Caitlin McGraw
@ISACA Article

The Layer Cake Paradigm: Strategies for Asking Great Questions at Each Interview Stage

This is the first of a two-part article on how to ask questions during interviews that “get the job done,” meaning they help you stand out from the competition, and they get you the valuable information you need to do excellent due diligence in the job search process.

6 April 2022
Karen Heslop
Blog Post

ISACA Seeks Input to Digital Trust Ecosystem Framework

If you do a Google search for digital trust, you’ll receive over 5.5 billion results; indeed, digital trust is a popular topic these days! Definitions of digital trust, however, vary widely.

4 April 2022
Deepa Seshadri
Privacy Article

Data Privacy: From Compliance to Trust

Organizations are looking to prioritize their users’ privacy notices and policies not just to protect their value and to be compliant with existing laws, but also to provide something that is the holy grail for a product: trust.

4 April 2022
Silvina Moschini
Blog Post

Technology and the Democratization of Opportunity

Silvina Moschini visited with ISACA Now to discuss digital transformation, cloud adoption, corporate social responsibility and more.

1 April 2022
Nasir Ali
Risk Article

Cybersecurity and Third-Party Supplier Risk

Enterprises today are being driven to adopt technology at an unprecedented pace as society witnesses what could be referred to as the Fourth Industrial Revolution (4IR). This technological adoption has been driven by factors such as the quest for efficiency, technology...

1 April 2022
Isabel Aguilera
Blog Post

Embracing the Possibilities of the Modern Business Landscape

Isabel Aguilera recently visited with ISACA Now to provide her perspective on technology’s role in shaping today’s business environment.

31 March 2022
Podcast
Podcast

CyberPros: Evolution of Interconnectivity of Cyber and Warfare with Fred Carr

In this episode, ISACA’s CyberPro, Jon Brandt chats with Founder and CEO of Anchor Systems, Fred Carr about the current threat landscape, challenges, and misalignment between public and private sectors, and impacts on national and global security.

31 March 2022
Gary Carrera
@ISACA Article

Zero Trust as Security Strategy to Prevent Data Exfiltration in the Cloud

Before diving into how zero trust security can factor into cloud security, it is worth clarifying that zero trust is not a new concept, nor is it a new technology that you can simply implement in your infrastructure to enhance the security of your data.

30 March 2022
Joanne Joseph
Blog Post

The Pandemic Era: A Period of Business Resilience

COVID-19 has markedly impacted the mitigation measures for business continuity and IT disaster recovery adopted by businesses over the last two decades.

30 March 2022
Donnie Carpenter
Security Article

The NATO Cyberresponse Dilemma

It should come as no surprise that the North-Atlantic Treaty Organization (NATO) finds itself in a bit of a legal and procedural dilemma regarding response efforts and capabilities to the Russian invasion of Ukraine.

30 March 2022
Understanding the Importance of the Turkish Information and Communication Security Guide on Cybersecurity
ISACA Journal Article

Understanding the Importance of the Turkish Information and Communication Security Guide on Cybersecurity

Countries around the world are looking to invest in infrastructure that will allow for the use and dissemination of innovative technologies.

Author: Tolga Mataracioglu
Lukas Werner
Blog Post

What to Consider When Making the Step to the Cloud

Organizations that decide to take their entire IT landscape, or parts of it, to the cloud need to consider the different factors that need to be prioritized according to their needs.

29 March 2022
Podcast
Podcast

A Security Awareness Program for PCI-DSS Compliance

People are considered the weakest link in any organization’s cybersecurity defenses.

29 March 2022
Hand typing on a keyboard
Blog Post

Edwards: From a Compliance Mindset to a Performance Mindset

Edwards was an early adopter of the MDDAP program. The company’s Draper, Utah facility completed its first MDDAP appraisal in 2017 as part of the program pilot.

25 March 2022
Dave Schmoeller
Blog Post

Using InfoSec Compliance Programs for Proactive IT Risk Management

Proactive IT risk management is crucial to maintain a successful business. This means implementing measures to identify and mitigate potential risks, continuously and reliably, before those risks can cause material (or worse, permanent) damage.

24 March 2022
Industry Spotlight Podcast
Podcast

Industry Spotlight with Jo Stewart-Rattray

In this episode of Industry Spotlight, Robyn Franko, Manager of Event Operations and Services at ISACA, chats with Jo about her background and career path, hobbies, and some interesting challenges the industry faces.

24 March 2022
State of Cybersecurity Infographic
@ISACA Article

Hiring Challenges Linger and Loom Large on Cybersecurity Landscape

Longstanding talent gaps on the cybersecurity landscape have been compounded in the era of The Great Resignation. ISACA’s free State of Cybersecurity 2022 report shows most companies have significant work to do to find and retain the cybersecurity talent they need.

23 March 2022
Zero Trust: How to Beat Adversaries at Their Own Game
@ISACA Article

New ISACA Zero Trust Resource Shows How to Beat Adversaries at Their Own Game

With the acceleration of remote working and employee use of personal devices for business purposes, enterprises need to develop a Zero Trust strategy to defend against threats.

23 March 2022
Kate O'Neill
Blog Post

Aligning Business Objectives and Human Outcomes in Digital Transformation

Kate O’Neill, recently visited with ISACA Now to provide her view of human-centric digital transformation, how data should be integrated into companies’ business models and more.

23 March 2022
Naomi Buckwalter
Blog Post

Cyber Workforce: Out of the Ashes and Into the Fire

ISACA’s State of Cybersecurity 2022 report was published earlier this week, and it’s not looking too good for us good guys. For the third year in a row, the cybersecurity labor shortage looms large as the main focal point, casting its long, grim shadow across most of the report’s 40-plus pages.

23 March 2022
Chad Martin
Audit Article

An Integrated Approach to Security Audits

A cyberattack can be devastating to any organization because it compromises sensitive data and, as a result, the financial position, strategic vision, and more important, the trust and credibility that the enterprise has built over the years.

23 March 2022
The Future of Govtech
ISACA Journal Article

The Future of Govtech

The average Internet user spends almost seven hours online every day, which equates to two days a week. Meanwhile, the Internet is used by approximately 4.9 billion people, which is more than 60 percent of the global population.

Author: Chetan Choudhury
Collin Beder
Emerging Technology Article

Digital Realities: Future Potentials and Use Cases

Humans are a curious species, and it is part of our nature to ponder the future. We are hardwired to find patterns, so we often use the past to predict what will emerge in the future.

22 March 2022
Raef Meeuwisse
Blog Post

Essential Tips for Staying Current on Cybersecurity Terminology

Navigating the language of cybersecurity is like trying to win an argument with someone you love. You must be open-minded, kind-hearted and committed.

21 March 2022
Veronica Rose
Blog Post

Don’t Let Collaboration Tools Become a Red Carpet for Black-Hat Hackers

2020 was a unique year and most of us couldn’t wait to call an end to it for so many reasons, including the increased trends in cyberattacks – some of which targeted collaboration tools such as in the example I noted above.

18 March 2022
Podcast
Podcast

The Transformative Power of Mobility

It's hard to believe the quarter century mark has almost arrived! Have you thought about what you would like your work world to be in 2025?

18 March 2022
Adam Kohnke
Blog Post

How Auditors Fit into the Zero Trust Journey

"Zero Trust” is one of those security buzzwords making the rounds on the inter-webs recently, but what does it mean and why should security or IT audits teams start caring about this term? Traditionally, enterprises concern themselves with forming a layered defensive...

17 March 2022
Strong Cyber Accountability at Board Level a Must
@ISACA Article

Strong Cyber Accountability at Board Level a Must

Accountability and oversight are the two key reasons why a company’s board exists. Everything that the board does can be subsumed into these two buckets.

16 March 2022
Lisa Villanueva
Blog Post

Evaluating Governance Over DevOps Practices

Auditors and related practitioners are always learning and prepared to pivot as new technologies and modes of software delivery are introduced.

16 March 2022
A Unified Response to Cyberattacks, Fraud and Financial Crime
ISACA Journal Article

A Unified Response to Cyberattacks, Fraud and Financial Crime

These days, virtually all aspects of public life are visible online. With this trend comes abundant risk. Organizations are negatively affected more frequently by cyber-related issues, including cybersecurity intrusions, fraud and financial crimes (e.g., money laundering, bribery, tax evasion).

Author: Vishal Chawla
Industry Spotlight Podcast
Podcast

Industry Spotlight with Raven David

Listen as Raven recaps the success of his cybersecurity awareness program, gives thoughtful advice to the next generation of young professionals, and discusses his current self-educating project, 3D printed chess set with Arduino-powered actuators and a Python chess engine.

16 March 2022
Larry Wlosinski
Blog Post

Improving Cybersecurity Incident Response

Incident response handling procedures could use some improvement. By utilizing and practicing incident response exercises, organizations can put in place a strong and integrated response to incidents of varying types.

15 March 2022
Podcast
Podcast

Privacy for Sale

Is Privacy a commodity? This episode explores the future direction of privacy and the demise of privacy in the digital age. Could privacy become something that people cannot afford, creating a two-tier system of internet users — those who can afford privacy and those who cannot?

14 March 2022
Donald Tse
Blog Post

Embedding Digital Trust in Fintech: Seven Practical Steps

There has long been debate about whether innovation and risk management can coexist. For some digital pioneers, risk and compliance are synonymous with being a roadblock to innovation.

11 March 2022
Molly Mullinger, CPA, Manager of Solutions Advisory Services at AuditBoard, and Shehan Jayakody, Senior Manager of Product Solutions, AuditBoard
Blog Post

Vulnerability Management: Addressing Your Weaknesses Before They Can Be Exploited

As businesses continue to extend their digital footprints to support remote workers and deliver the products and services customers demand, the risk of a breach grows exponentially.

10 March 2022
Hafiz Sheikh Adnan Ahmed
@ISACA Article

The Business Risk Posed by Artificial Intelligence

Artificial intelligence (AI) is no longer a new concept. Much has been written about this emerging technology and new articles and research are published online every day. Organizations have started to learn and understand its full potential.

9 March 2022
Rahul Pandey
Blog Post

Exploring HackTown: A College for Cybercriminals

It’s becoming simpler for wannabe cybercriminals to catch a portion of the billions of dollars lost through fraud happening every year. All you really need is some Bitcoin knowledge, some free tools and no moral qualms taking from others.

9 March 2022
Safia Kazi
Privacy Article

Educated and Empowered Data Subjects: A Privacy Prerequisite

US lawmakers recently introduced a bill seeking to improve transparency of terms of service agreements.

9 March 2022
A Strategic Risk-Based Approach to Systems Security Engineering
ISACA Journal Article

A Strategic Risk-Based Approach to Systems Security Engineering

In the 21st century, the backbones of business, trade, economy and critical infrastructure for public- and private-sector enterprises are information systems and the data they store, process and transmit.

Author: Hunter Sekara
Podcast
Podcast

Ensuring that Cybersecurity is Everyone’s Job

In this podcast, we join ISACA’s Performance Based Training Engineer, Collin Beder as he speaks with Tom Schneider, Senior Associate of Proactive Advisory for Cyber Defense Labs as they discuss Tom’s recently released article “Ensuring that Cybersecurity is Everyone’s Job”.

9 March 2022
Reshma Devi
Blog Post

Taking a Clear-Eyed View of the Road Ahead for Women in Security

ISACA member Reshma Devi recently visited with the ISACA Now blog to discuss her mindset about volunteering, her views on progress for women in the security industry and more.

8 March 2022
Sharda Shetty
Blog Post

My New Career Connection Through ISACA Mentorship Program

I have been a member of ISACA for over 10 years, and it has touched my life in many ways. When I first acquired the CISA certification in 2012, an avalanche of job offers followed!

7 March 2022
Podcast
Podcast

Zero Trust: How to Beat Adversaries at Their Own Game featuring Dr. Zero Trust

ISACA’s Jon Brandt welcomes Dr. Chase Cunningham aka Dr. Zero Trust to the ISACA CyberPros podcast. You may know Chase from his own podcast, Dr. Zero Trust, or book series, Cynja.

4 March 2022
Adham Etoom
Blog Post

Good Enterprise Governance Needs CGEIT: My Journey to Pass the Exam

I earned ISACA’s CRISC and CISM certifications in 2019 and 2020, respectively. I always feel a professional obligation to give back to ISACA global community through sharing my lessons learned after passing each exam – hopefully providing practical guidelines will be beneficial to professionals who are preparing to obtain these industry-recognized credentials worldwide.

3 March 2022
Avoiding the Chaotic 5G Rollout at US Airports
@ISACA Article

Avoiding the Chaotic 5G Rollout at Airports

5G rapid rollout is a high priority around the world because its adoption can generate high revenue in both the public and private sectors thanks to its greater speed, capacity, and quicker response, which can positively increase businesses’ productivity and efficiency.

2 March 2022
Caitlin McGraw
@ISACA Article

The Great Resource Roundup

A fact of modern life: We love curated lists and recommendations. Yelp, Wirecutter, Rotten Tomatoes, Amazon, and so many more … we all have our go-tos. Recommendations make life easier and more interesting.

2 March 2022
Tensions Shine Spotlight on Protecting Critical Infrastructure
Blog Post

Tensions Shine Spotlight on Protecting Critical Infrastructure

Given the tense security environment caused by Russia’s current attacks on Ukraine, threats to critical infrastructure are top-of-mind throughout the cybersecurity community.

2 March 2022
A Five-Layer View of Data Center Systems Security
ISACA Journal Article

A Five-Layer View of Data Center Systems Security

The data center is the central nervous system for any organization. As the hub of servers that host business-critical data, the data center needs special attention. There are some basic checks required for keeping IT systems safe in the data center. It is imperative for IT...

Author: Ravi Shankar Vemuri
GREGORY J. TOUHILL
ISACA Journal Article

Letter From the Board Chair: Dear Reader

The volume you are reading is the ISACA Journal’s second in its 50th anniversary year. The topic of the workforce is one that has evolved significantly over time—and one that continues to change rapidly.

Author: Gregory J. Touhill
Privacy for Sale
ISACA Journal Article

Information Security Matters: Privacy for Sale

On 16 September 2021, I was perusing my morning newspaper (well, actually, my morning news website) and was struck by this headline: “The Battle for Digital Privacy Is Reshaping the Internet.”

Author: Steven J. Ross
Transformative Power of Mobility
ISACA Journal Article

IT Audit in Practice: The Transformative Power of Mobility

It is hard to believe the quarter century mark is just a few years away. The pace of technology has been frenetic since the turn of the century, and the upcoming milestone that 2025 represents is an opportunity to reflect upon what it means for a workforce that has gone from dotcoms to Zoom.

Author: Cindy Baxter
Helpsource Q&A
ISACA Journal Article

HelpSource Q&A

Our organization is contemplating hiring a virtual CISO. How does the role work and how do we ensure that it will be effective and meet business objectives?

Author: Sunil Bakshi
Mindset Matters
ISACA Journal Article

Mindset Matters

On 11 March 2020, just two months after the initial cases were uncovered in Wuhan, China, the World Health Organization officially declared COVID-19 a pandemic. Eight days later, the US State of California became the first state to issue a stay-at-home order, requiring...

Author: Kevin M. Alvero
Bringing Enterprise Security Home
ISACA Journal Article

Bringing Enterprise Security Home

The May 2021 Colonial Pipeline ransomware attack that crippled fuel delivery for several days in the southeast region of the United States was not the first time US enterprises have been held hostage by criminal hackers—and it will not be the last.

Author: Pranav Kumar
The Cyberrisk Quantification Journey
ISACA Journal Article

The Cyberrisk Quantification Journey

Many organizations suffer from being unaware of their levels of cyberrisk and lack business engagement in cybertechnology in general.

Author: David Vohradsky
The Crucial Principle of Need to Have Available
ISACA Journal Article

The Crucial Principle of Need to Have Available

When confidentiality, integrity and availability (CIA) were established as the main information security attributes in the 1990s, employees around the world were not working from home due to a global pandemic.

Author: Yiannis Pavlosoglou
Growing a Technology Company Using a Secure-by-Design Approach
ISACA Journal Article

Case Study: Growing a Technology Company Using a Secure-by-Design Approach

In 2018, Trigo Vision was founded by brothers Michael and Daniel Gabay to help grocery stores embrace digital transformation and innovate toward a checkout-free experience for customers. The start-up, based out of Herzliya, Israel, built a technology predicated...

Author: Katie Teitler
Ensuring That Cybersecurity Is Everyone’s Job
ISACA Journal Article

Ensuring That Cybersecurity Is Everyone’s Job

Employees focus on the responsibilities that are listed in their job descriptions. If cybersecurity and privacy responsibilities are not documented in job descriptions, then it is likely that staff members will assume that cybersecurity is not a primary responsibility for them...

Author: Tom Schneider
Taking IT Operations From Phoenix to Hydra Dragon
ISACA Journal Article

Taking IT Operations From Phoenix to Hydra Dragon

If there is a choice between being a phoenix or a hydra dragon, which option would be better? Both are ancient mythical creatures with supernatural powers.

Author: Abdelelah Alzaghloul
Facts and Fallacies of IoT-Driven Workplace Transformation
ISACA Journal Article

Facts and Fallacies of IoT-Driven Workplace Transformation

Due to the fast-paced, IT-enabled industrial revolution, new and innovative technologies have become more deeply ingrained in business operations and society in general.

Author: Vimal Mani
Podcast
Podcast

Breaking Down the ESET T3 2021 Threat Report

Tune in as ISACA’s Kevin Keh talks with the Chief Security Evangelist of ESET, Tony Anscombe about the latest released report from ESET.

1 March 2022
Shannon Donahue
Blog Post

Volatile Times Call for Heightened Cybersecurity Preparedness

The recent attacks on Ukraine are a daunting reminder that today’s battles occur on two fronts: the physical world and the digital one.

28 February 2022
Allen Ari Dziwa
Blog Post

A Lesson for the Cybersecurity Community

With the numerous cyberattacks being reported in the news almost daily, I find it helpful to think of some words of wisdom from my grandfather.

25 February 2022
Luis Gorgona
Blog Post

Getting Creative with Maturity Models and COBIT 2019

Maturity models have become an area of personal interest in my professional practice. Maturity models can act as a common language that serves as a bridge between the business and the IT function.

24 February 2022
Capability Maturity Model
ISACA Journal Article

Capability Maturity Model and Risk Register Integration: The Right Approach to Enterprise Governance

The total number of active controls in an enterprise is always extremely high. Part of the normal functioning of any process or activity is to define an objective, map the rules to achieve it, put them into practice and then constantly check their alignment with the defined objective.

Author: Luigi Sbriz
Bruce R. Wilkins
Security Article

Improving Cybersecurity Training to Protect Your Enterprise and Yourself

Security is everyone’s responsibility. Whether it is viewed as a burden, an obstruction to business goals or part of doing a good job, achieving effective security requires each and every individual to participate.

23 February 2022
Improving Cybersecurity Training to Protect Your Enterprise and Yourself
@ISACA Article

What Cyberprofessionals Should Know About CUI

It has been said that data are the new oil, and personally identifiable information (PII), personal data (PD) and protected health information (PHI) are being drilled for in the new data-based economy.

23 February 2022
Gurneet Kaur
Blog Post

Why Collecting the Right Metadata is Crucial for Scaling a Security Program

At Adobe, security is a critical priority for us, and we believe in defense-in-depth, which begins with monitoring — from collecting event logs and configuration data made available by public cloud providers, to logs from EDR systems and vulnerability scanning pipelines.

23 February 2022
Jonathan Brandt
Security Article

Courage Under Fire

Most people recognize that humans are fallible, but this fact can have dire consequences for those whose jobs entail protecting life or assets. Within the cyber realm, insiders are often responsible for cybersecurity incidents, resulting in a US billion-dollar security awareness computer-based training market.

23 February 2022
Wole Davis
Blog Post

Auditing in a Virtual Universe

The Industrial Revolution in the 18th and 19th centuries came with a lot of transformations and innovations that gave rise to the use of machines and fundamentally changed the ways humans live.

22 February 2022
Data and AI Management in Smart Agriculture
ISACA Journal Article

Data and AI Management in Smart Agriculture Using Soil and Crop Data

With smart agriculture using soil and crop data gaining traction around the world, the importance of data management is also being increasingly recognized. As in any other business, the products produced (in this case, crops in agriculture) need to be safe and environmentally and socially friendly.

Authors: Mitsuhiko Maruyama, Taiji Ayabe, Yotaro Sato and Alexander Vinson
Podcast
Podcast

Building Digital Trust in a FinTech Start Up

Today's Page to Podcast features ISACA's Kevin Keh and Donald Tse, the Head of Cyber & Technology Risk at Mox Bank and author of "Cybersecurity and the Technology Risk in Virtual Banking", as they dive into the virtual banking scene in fintech.

22 February 2022
Journal 50 Years
Blog Post

Celebrating Five Decades of the ISACA Journal

The ISACA Journal is more than just a print and digital publication – for 50 years, it has served as a reflection of ISACA’s membership, in the view of Steven Ross.

18 February 2022
Podcast
Podcast

Lessons Learned from a Year of Remote Work

Working from alternate work sites using unsecure networks may be here to stay, but there is much to learn from 2020 that can help improve cybersecurity capabilities for remote staff.

18 February 2022
Cat Coode
Blog Post

Drilling Down on Data Protection and DPO Reporting

Cat Coode, founder of Binary Tattoo and an expert in global privacy regulation compliance, recently participated in a privacy-themed Ask Me Anything thread on ISACA’s Engage platform.

17 February 2022
The Role of Technology in SOX and ICFR Compliance Programs
ISACA Journal Article

The Role of Technology in SOX and ICFR Compliance Programs

After several major accounting scandals, the US Sarbanes-Oxley (SOX) Act of 2002 was enacted in the United States to protect investors from fraud, improve reliability of financial reporting and restore investor confidence.

Author: Nneoma Okorie
Who Is Ultimately Responsible for Your Organization’s Security?
@ISACA Article

Who Is Ultimately Responsible for Your Organization’s Security?

Being a telecom engineer by profession, most of my time is spent in technical areas where most of the people are usually of the opinion that network security is the responsibility of the security team (Security Operations Center) and the security auditors only.

16 February 2022
Jo Stewart Rattray
Blog Post

How to Navigate the Perfect Storm: Cyberthreats and Skills Shortages

Over the past two years in particular, the importance of cybersecurity has been globally recognized, and sophisticated cyberattacks have made international headlines.

15 February 2022
Pablo Ballarin
Emerging Technology Article

Ethical Emerging Technologists

Cybersecurity professionals aim to help organizations protect their information and IT infrastructures. Their main purpose is to avoid negative impacts, not only to their clients’ enterprises, but also to their clients’ and users’ lives.

15 February 2022
The Evolution of Audit in the Wake of the Pandemic
ISACA Journal Article

The Evolution of Audit in the Wake of the Pandemic

The practice of audit is age-old, though the many models and methods have evolved over time. The audit community has faced significant challenges, ranging from misalignment with auditees to ignorance about changing risk areas with technology advances.

Author: Gopikrishna Butaka
Podcast
Podcast

Unpacking Pakistan's Cybersecurity Policy 2021

ISACA’s Director of Professional Practices & Innovation, Jon Brandt, is joined by Muneeb Imran Shaikh, author of "Pakistan’s Cybersecurity Policy in 2021: A Review".

15 February 2022
Governance
Blog Post

Individual Behavior, Corporate Action and Sarbanes-Oxley

In recapping the history of the Sarbanes-Oxley Act (SOX) of 2002, discussions often include lists of the corporations whose actions led to enactment of this United States legislation. The terms “corporate scandal” and “corporate fraud” are used.

14 February 2022
Information Security
Blog Post

A Workplace Sea Change: Sizing Up The Next Normal

The workplace in February 2022 looks drastically different than it did even a year ago and is likely to be reshaped even further in the year to come.

11 February 2022
Alex Bermudez
Blog Post

Many Shades of a Common Problem: Privacy Rights Requests

DSARs, IRRs, Consumer Rights’ Requests, Derechos ARCO – if you broke out into a cold sweat reading any one of those, then this blog post is for you. Privacy requests are complex and burdensome in daily operations today, and only getting more prolific.

10 February 2022
Redefining Risk Toward Its Management
ISACA Journal Article

Redefining Risk Toward Its Management

One analysis of the word “risk” and its impact on risk management processes uses RISK as an acronym for reasoning, intelligence, strategy and knowledge.

Author: Tapas Bhattacharya
Podcast
Podcast

Using XDR and Zero Trust to Combat Ransomware

Listen in as ISACA's Research Advisor, Brian Fletcher and Trend Micro's Bill Malik look into the realities behind ZDR and Zero Trust, how ransomware works, and how the both XDR and Zero Trust can help organizations minimize their vulnerabilities.

10 February 2022
Governance Roundup - What Are You Doing About Environmental, Social and Governance Factors in Your Enterprise?
@ISACA Article

Environmental, Social and Governance Gains Traction

A new ISACA publication discusses the importance of establishing an environmental, social and governance (ESG) framework and applying it to an enterprise’s daily operations.

9 February 2022
ISACA Conference Session to Spotlight Lessons from SolarWinds Breach
@ISACA Article

ISACA Conference Session to Spotlight Lessons from SolarWinds Breach

An upcoming ISACA Conference session will shed new light on one of the most consequential cybersecurity events of all time.

9 February 2022
Sunil Bakshi
@ISACA Article

Tips for Effective Control Design

While someone may be familiar with a concept because they have been putting it into practice for some time, when they try to articulate it to others, they might find it difficult to explain.

9 February 2022
Leeza Garber and Scott Olson
Security Article

Using a Team Approach in the New Year to Face the Future

Anticipating how the world of technology will evolve and change is not only a goal for economists, investors and power players in the stock market, but for cyberentrepreneurs, risk managers, IT professionals, chief information security officers (CISOs) and chief security officers (CSOs).

9 February 2022
Chetan Anand
Blog Post

Insights into Environmental, Social and Governance (ESG)

Are we prepared for the Environmental, Social and Governance (ESG) challenge? Organizations are facing heightened expectations from interested parties such as regulators, customers, consumers, investors, community activists and others when it comes to ESG.

8 February 2022
Paul Thompson
Blog Post

Leveraging Cybermaturity to Right-Size Cybersecurity

We hear the word “cybermaturity” tossed around quite often these days, but what does it mean? Cybermaturity is a state describing the sophistication, or rigor, of one’s cybersecurity capabilities and processes.

8 February 2022
A Three-Way Approach for Breaking Down the Great Wall of IT
ISACA Journal Article

A Three-Way Approach for Breaking Down the Great Wall of IT

Sometimes known as the Stone Dragon, the Great Wall of China is one of the world’s greatest engineering wonders. This masterpiece can be seen from space and was built as a series of fortifications over several hundred years and across the historical northern borders of Imperial China.

Author: Abdelelah Alzaghloul
Justin Henkel
Blog Post

Aggravating Circumstances for an RCE Vulnerability: A Log4j Retrospective and Risk Landscape Evaluation

Information security teams were forced to respond over the holiday as an Apache Log4j zero-day vulnerability was discovered and socialized across the infosec community.

7 February 2022
Luigi Sbriz
Blog Post

Understanding the Importance of Effective Board Communication

For any cybersecurity framework to be successful, it is essential that the chief information security officer (CISO) or equivalent figure be able to simply communicate with top management the state of security in the organization, present an improvement plan, justify it with the risk assessed and request the necessary resources.

4 February 2022
Podcast
Podcast

What is Environment, Social, and Governance (ESG)?

Mark Thomas (Founder, Escoute) and Caren Shiozaki (EVP & CIO, TMST, Inc.) join ISACA's Lisa Villanueva for a conversation about Environment, Social, Governance or ESG.

4 February 2022
The Importance of a National Digital Identity System
ISACA Journal Article

The Importance of a National Digital Identity System

The leaders and policymakers of nations around the world are working on building national digital identity systems and frameworks.

Author: Biji Scaria
A man staring at a network
@ISACA Article

Report Provides Insights on Evolving Privacy Landscape

New research from ISACA explores the latest trends in enterprise privacy—from privacy workforce and privacy by design to privacy challenges and the future of privacy—in its new Privacy in Practice 2022 survey report, sponsored by OneTrust.

2 Feburary 2022
Caitlin McGraw
@ISACA Article

The Job Search Timing Conundrum

Hiring for IT audit, IT GRC and information security roles appears to be in full-tilt boogie mode. Posts from hiring leaders promoting their openings are appearing frequently on LinkedIn.

2 February 2022
Matt Stamper
Blog Post

Simplify and Contextualize Your Data Classification Efforts

In the CISO Desk Reference Guide, I noted how critical the concept of “context” is to security programs. The same holds true for our organizations and their respective privacy programs.

2 February 2022
Christopher Henry
Blog Post

Achieving Workforce Diversity in Cybersecurity

In the current global landscape of near daily announcements of cyberattacks, organizations can no longer just sit back and wait for employees to find them; they must be proactive.

1 February 2022
Opeyemi Onifade
Governance Article

Using COBIT for Value-Based Direction Setting

Every organization goes through a phase in its life cycle that leaves it with 2 options: transform or decline.

1 February 2022
The Evolution of Information Systems Audit
ISACA Journal Article

The Evolution of Information Systems Audit

From the early days of electronic data processing (EDP) to modern cybersecurity, IS audits have come a long way. The landscape around information systems has been changing, but as in any journey, an eye on the rearview mirror enables better decision-making and safer travel forward.

Author: Anantha Sayana
Podcast
Podcast

The Impact of SOX on the Industry 20 Years Ago and Today

The Sarbanes-Oxley (SOX) Act was passed by the United States Congress in 2002. 20 years later, ISACA's Robin Lyons asks Cindy Baxter, Director at What’s the Risk, LLC all about SOX.

1 February 2022
Gopikrishna Butaka
Blog Post

The Weakest Link in the Cybersecurity Chain: Are You Aware of It?

Recently, there was a debate on our audit team regarding the increased amount of cybercrime during the pandemic and the best ways to handle it.

31 January 2022
CA Ratan Singh Tanwar
Blog Post

My Guide to Passing the CISA Exam

Becoming CISA-certified in the first attempt is not an easy task, but it can be passed simply by following a dedicated and structured study plan.

28 January 2022
Humans and Cybersecurity
ISACA Journal Article

Humans and Cybersecurity— The Weakest Link or the Best Defense?

Cyberwar and conventional war have certain similarities, but cyberwar involves obscure and often anonymous enemies. Cybersecurity is one of the most significant challenges facing both enterprises and individuals today. It is vital to be prepared to defend against the war waged by sophisticated cyberadversaries.

Author: Julien Legrand
Podcast
Podcast

Privacy in the Dark (Data)

Listen in as Safia Kazi, ISACA's Privacy Professional Practice Advisor, as she speaks with Steve Ross, Executive Principal of Risk Masters International, about his article "Privacy in the Dark (Data)".

27 January 2022
Tips of the Trade - Jack Freund
@ISACA Article

Proximate Cyberrisk Management Starts With Culture

Everybody wants to get to the root cause of a problem, but few actively try to manage the risk around its edges.

26 January 2022
Seeking Sustainable Results in Addressing Cyber Talent Gap
@ISACA Article

Seeking Sustainable Results in Addressing Cyber Talent Gap

One the most discussed topics of the past decade has been the growing talent gap in cybersecurity.

26 January 2022
Taking the Lead to Build the Cyber Workforce of the Future
@ISACA Article

Taking the Lead to Build the Cyber Workforce of the Future

2021 was a thrilling roller coaster of peaks, dips, twists and turns for cyber professionals across the United States in both the public sector and private industries.

26 January 2022
Yunique Demann
Blog Post

Plenty of Progress Still Needed on the Privacy Landscape

2021 was an eventful year for privacy with the emergence of new legislation such as the California Consumer Privacy Act, Brazilian General Data Protection Law and China Personal Information Protection Law.

26 January 2022
Dave Schmoeller
Blog Post

What Is a Risk Heat Map & How Can It Help Your Risk Management Strategy

In the early 2000s, pharmaceutical company GlaxoSmithKline (GSK) was facing a serious risk: One of its manufacturing plants did not meet the requirements of current good manufacturing practices (CGMP).

25 January 2022
Security Article

US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework

Cybersecurity is only as good as an organization’s weakest link. Increasingly, the weakest link is the cyber supply chain.

25 January 2022
Working Toward a White Box Approach
ISACA Journal Article

Working Toward a White Box Approach

It has long been the assumption that, once built, all computer systems are Turing machines—that is, devices that perform one small, deterministic step at a time—and are, therefore, deterministic in nature

Authors: Sandipan Gangopadhyay, Stuart Mcguigan, Vijay Chakravarthy, Dheeraj Misra and Sumit Tyagi
Podcast
Podcast

Industry News Wrap

ISACA's CyberPro Jon Brant breaks down industry news stories so far in the new year: Log4j, Cyber Insurance, Augmented Reality/Virtual Reality, Metaverse, Deep Fakes, and even the legal discussion around vehicle car data.

26 January 2022
David Samuelson
Blog Post

Charting a Course for Digital Trust

As we begin this new year, we’re also in the early stages of executing on a new strategic plan that will shape ISACA’s focus in 2022 and the coming years.

24 January 2022
Adham Etoom and Veronica N. Rose
Blog Post

Enablers That Propelled Our Careers to a Higher Level

Undoubtedly, ISACA is cultivating the next generation of digital trust professionals as it is a one-stop-shop for top-notch industry-recognized credentials, pieces of training that bridge the gaps between what people learn in university and the practical skills required to perform tasks at work.

21 January 2022
SWIFT’s Customer Security Program
ISACA Journal Article

SWIFT’s Customer Security Program: Lessons for the Cybersecurity Community

In February 2016, the world witnessed a sophisticated cyberheist in which the computer terminals of Bangladesh Bank, which interfaced with the communication system of the Society for Worldwide Interbank Financial Telecommunication (SWIFT), were compromised through spear phishing emails.

Author: Ninad Dhavase
Boosting Cyberresilience for Critical Enterprise IT Systems
@ISACA Article

Boosting Cyberresilience for Critical Enterprise IT Systems With COBIT and NIST Cybersecurity Frameworks

The term cyberresilience is defined as “[T]he ability of a system to continue to operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities and recover to an effective operational posture in a time frame consistent with mission needs.”

19 January 2022
David Samuelson
@ISACA Article

Foundation in Place for a Promising Year Ahead

Happy New Year, ISACA community! The year ahead holds great promise, but before we turn our attention to all there is to look forward to in 2022, let's briefly reflect on how we've reached this point.

19 January 2022
Reaching DevSecOps Maturity
@ISACA Article

Reaching DevSecOps Maturity

Development teams may be using the latest and greatest technology to build amazing products, but security does not always keep the same pace.

19 January 2022
Stay on Top of Privacy Challenges with These Must Dos
@ISACA Article

Stay on Top of Privacy Challenges with These ‘Must-Dos’

Organizations seeking to build and strengthen their privacy programs in 2022 face a range of challenges – the proliferation of data, an evolving regulatory landscape, ongoing challenges related to the COVID-19 pandemic, and many more.

19 January 2022
Michael Powers
Blog Post

Technology Control Automation: Improving Efficiency, Reducing Risk and Strengthening Effectiveness

A principal component of a sound risk management framework, particularly in highly regulated institutions, is an effective control testing program.

19 January 2022
ShanShan Pa
Blog Post

Code of Conduct: An Effective Tool for GDPR Compliance

We are three+ years out from the EU General Data Protection Regulation (GDPR) taking effect. While many organizations are still new to or struggle with GDPR, a more recent milestone could shed light on this development for privacy practitioners and implementors.

18 January 2022
David Brown
Security Article

Cybersecurity Lies and the Lying Liars Who Tell Them

I freely admit I borrowed my title from former US Senator Al Franken’s 2003 book Lies and the Lying Liars Who Tell Them. But I think it is time we as security professionals take a good hard look at ourselves and admit all the ways that we are lying…to OURSELVES!

18 January 2022
Cybersecurity Incident Response Exercise Guidance
ISACA Journal Article

Cybersecurity Incident Response Exercise Guidance

Organizations must review cybersecurity threats and attack vectors, understand the importance of the incident response plan (IRP), review response activities, conduct tabletop exercises, analyze the exercises to determine areas for improvement, manage reporting and conduct IRP maintenance.

Author: Larry G. Wlosinski
Audit and Assurance
Blog Post

Is Agile Auditing a Sure Thing for Internal Audit?

Operational innovation. Business resilience. Operational disruption, possibly resulting from third-party management issues like suppliers’ solvency, compliance, service/product quality and even suppliers’ behavior (if your enterprise happens to be subject to the UK Bribery Act or similar legislation).

14 January 2022
Strengthening Cybersecurity With Red Team Engagements
ISACA Journal Article

Strengthening Cybersecurity With Red Team Engagements

These days, cyberadversaries are coming up with different kinds of capabilities and objectives behind each of their new cyberattacks, which has forced organizations to do a deeper, more introspective evaluation of their existing cyberdefense mechanisms.

Author: Vimal Mani
Hafiz Sheikh Adnan Ahmed
@ISACA Article

A Look Ahead at New Data Privacy Regulations

“Data are the new oil” is no longer a new sentiment. This has become the reality for individuals, organizations and entire countries since the adoption of digital transformation throughout the last 15 years.

12 January 2022
Luigi Sbriz
@ISACA Article

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

The idea of a risk register used in a practical and effective way is an expectation of the ISACA’s Certified in Risk and Information Systems Control® (CRISC®) certification.

12 January 2022
Jon Brandt
@ISACA Article

Finding Calm Amid Chaos: Improving Work-Life Balance

Many write about the need for work-life balance, but nothing affirms its criticality more than a negative health report. Recently, a friend required significant medical treatment, which provided some additional inspiration for this column.

12 January 2022
Patrick Sullivan
Blog Post

Maintaining Your Compliance Strategy During (and After) CISO Turnover

Amidst the “Great Resignation,” employees across industries — and experience levels — are reconsidering their relationship with work.

12 January 2022
David Samuelson
Blog Post

Foundation in Place for a Promising Year Ahead

In large part, 2021 for ISACA was about putting in place a sturdy technological foundation on which our community can grow. It was a year of big challenges and bigger successes.

11 January 2022
A Brief History of the Cybersecurity Profession
Security Article

A Brief History of the Cybersecurity Profession

Cybersecurity careers are in high demand, but a closer look at the timeline of network technology and the Internet reveals that this has virtually always been the case.

11 January 2022
A Security Awareness Program for PCI DSS Compliance
ISACA Journal Article

A Security Awareness Program for PCI DSS Compliance

Fintech organizations that provide payment solutions to merchants, banks and financial institutions have a strict requirement to maintain security and regulatory compliance.

Authors: Yasmin Razack and Timothy Sorbin
Podcast
Podcast

How Do Organizations Control Their Use of Social Media

What are the main risks that most enterprises need to consider when it comes to social media? If you don’t know, you and your organization are in danger of serious reputational risk!

11 January 2022
Vimal Mani
Blog Post

A Bird’s Eye View of Cyberinsurance Plans

Most cyberattacks launched by hackers result in financial repercussions for the organization and cause disruption of its critical assets and services.

10 January 2021
Glorin Sebastian
Blog Post

Online Education From a Security Risk and Controls Perspective

The internet and the subsequent online revolution have led to the digitization of almost every aspect of human life; education is no different.

6 January 2022
Going Agile in Audit
ISACA Journal Article

Going Agile in Audit: What to Do and What Not to Do

Agile is on trend these days. Even the people who opposed agile in the past have now jumped on the bandwagon and actively campaign for going Agile while not always understanding what that means—and often inserting the same nonagile obstacles they have been practicing into their version of Agile audit.

Author: Spiros Alexiou
Podcast
Podcast

From the Board Level to the Code Level

Blake Curtis is a global business risk and security engineer for Deloitte Global and a research scientist with a Ph.D. in cybersecurity and risk management. Today he breaks down frameworks, governance and governmental controls from the board level to the code level.

6 January 2022
Three Key Priorities for Privacy Practitioners in 2022
@ISACA Article

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away.

5 January 2022
Caitlin McGraw
@ISACA Article

Develop This Essential Career Skill in 2022: Getting to the Next Question

The head of IT audit at a major global organization once told me that an absolutely critical thing to success on the job was “getting to the next question.”

5 January 2022
More Governance than Ever
@ISACA Article

More Governance Than Ever

Few would doubt the need for proper enterprise governance, which, ultimately, ensures that direction is set, benefits are realized, risk is managed and resources are reasonably used. These four conditions summarize what governance is all about.

5 January 2022
New Resources Address Evolving Challenges on the Audit Landscape
@ISACA Article

New Resources Address Evolving Challenges on the Audit Landscape

In 2022, many audit professionals will shift their focus to developing dynamic new strategies such as agile auditing, revisiting established technologies from a remote or hybrid working environment perspective, and closing any gaps between compliance expectations and current practices—and how they can enhance their skills to meet the needs of the evolving audit landscape.

5 January 2022
Prasad Chaudhari
Blog Post

Recognizing the Customer’s Responsibility in a Shared Responsibility Model

Every industry, regardless of size, is eager to realize the benefits of the cloud. The cloud providers’ ability to move from a Capital Expenditures (CAPEX) model to Operating Expenses (OPEX) is not all about upfront cost savings, which the cloud platforms offer.

5 January 2022
Podcast
Podcast

ISACA Cyber Pro Chats with Naomi Buckwalter

ISACA’s Cyber Pro, Jon Brandt, invites information security guru, Naomi Buckwalter, Director of Information Security and IT to the podcast to discuss hot and heavy topics within Cybersecurity and the IT industry.

5 January 2022
Luigi Sbriz
Blog Post

Can a Risk Register Focused on Information Security Be Readable by Senior Management?

In a practical way means that it could be managed directly by the owner of the risk. However, seeing a senior manager interact directly with the risk register instead of using an executive summary does not happen often.

4 January 2022
Cybersecurity and Technology Risk in Virtual Banking
ISACA Journal Article

Cybersecurity and Technology Risk in Virtual Banking

Managing cybersecurity and technology risk is a major challenge for virtual banks. Although cyberattacks and a lack of system resilience can be detrimental for both traditional and virtual banks, they arguably have a greater impact on the latter.

Author: Donald Tse
Podcast
Podcast

What Will it Take to Reach DevSecOps Maturity?

While our development teams have been busy running full speed ahead using the latest and greatest technology to build amazing products, security teams haven’t always been known to keep the same pace – and we have reached a point of “developer revolt.”

4 January 2022
Journal 50 Years
ISACA Journal Article

Letter from the CEO

The ISACA Journal you hold in your hand—or read on your screen—marks an important milestone. The year 2022 is the 50th year of this publication.

Author: David Samuelson
Privacy in the Dark Data
ISACA Journal Article

Information Security Matters: Privacy in the Dark (Data)

According to informed sources, 55 percent of all enterprise data are dark, so there is a lot of information just sitting there waiting to be (mis)used.

Author: Steven Ross
Innovation Against Cyberattacks
ISACA Journal Article

Innovation Governance: Innovation Against Cyberattacks

With the challenges of securing cyberspace, there has been a great deal of innovation throughout the past decade, especially in the last couple of years. However, the multitude of attacks and their increasing sophistication is going to require even more innovation...

Author: K. Brian Kelley
Migrating to the Cloud
ISACA Journal Article

Migrating to the Cloud: How the COVID-19 Pandemic Has Affected the IT Landscape

The question of whether to move on-premises software to the cloud has been relevant for several years. In the past, every year a few more enterprises migrated to the cloud, but that changed significantly in 2020 when organizations faced the effects of the COVID-19 pandemic.

Authors: Lukas Werner and Gerald Burch, PH.D.
On the Need for Combined Assurance
ISACA Journal Article

On the Need for Combined Assurance

Over the last 50 years there have been vast changes in IT. Opinions vary, but one of the most disruptive was the invention of the Internet, which, in turn, led to the creation of cloud computing.

Author: Ian Cooke
IT Audit
ISACA Journal Article

IT Audit: A Look Ahead

Traditionally, the term “IT audit” suggests certain familiar procedures such as ensuring the functionality and integrity of an entity’s tools, systems and networks; testing and monitoring the security of IT systems against intrusion or misappropriation...

Author: Kevin M. Alvero
The GRC Journey Never Ends
ISACA Journal Article

The GRC Journey Never Ends

Information security has existed since humans started sharing information. For example, Julius Caesar developed a cipher to protect information from unauthorized disclosure.

Author: Muhammad Asif Qureshi
Minority Students Drive Into the Tech Talent Pool
ISACA Journal Article

Case Study: Minority Students Dive Into the Tech Talent Pool

From the most senior level to the rank-and-file, the workforce running the US technology industry has long failed to mirror the ethnic diversity of the tech user base or society at large.

Author: Mick Brady
Overcoming a False Sense of Security
ISACA Journal Article

Overcoming a False Sense of Security: How to Deeducate Current Security and Control Practices

The current international dynamic characterized by tension between nations in the midst of gray zone conflicts highlights the challenges in cyberspace and how cyberoperations affect the relationships of enterprises and countries.

Author: Jeimy Cano
Embedded Finance Brings Banks to New Frontiers of Risk
ISACA Journal Article

Embedded Finance Brings Banks to New Frontiers of Risk

Embedded finance has been hailed as a paradigm shift in financial services, moving from being product-centric to customer-centric.

Author: Terrence Cai
Thorsten Stremlau
Blog Post

How to Enable DICE and TPM for Optimal Security

By 2030, more than 24 billion Internet of Things (IoT) devices will have entered our cities, workplaces and homes, according to Transforma Insights. For years, I have been working to make sure that these devices have a healthy immune system so that they can defend against malicious attacks.

30 December 2021
HelpSource Q&A
ISACA Journal Article

Help Source Q&A

How can organizations define risk appetite? Is there any standard method or technique?

Author: Sunil Bakshi
K-Harisaiprasad
Blog Post

Cybersecurity in Arbitration

Arbitration is a process of resolving a dispute between two or more parties through one or more arbitrators to obtain a legally binding decision outside of court. The proceedings and awards remain confidential.

29 December 2021
Assessing and Improving Information Governance Maturity Across Emerging Data and Cloud Systems
Blog Post

Assessing and Improving Information Governance Maturity Across Emerging Data and Cloud Systems

Organizations are concerned about the impact of rapid digital transformation on their data privacy, security, compliance and legal risk.

28 December 2021
Building a Maturity Model for COBIT 2019 Based on CMMI
ISACA Journal Article

Building a Maturity Model for COBIT 2019 Based on CMMI

Years ago, the COBIT 5 Process Assessment Model (PAM) was commonly used to assess the maturity level of a COBIT implementation.

Author: Luis Gorgona
ISACA live tile
Podcast

Emerging Tech Session #5 - Ultra-Emerging Tech

Join Kevin Keh, IT Professional Practices Lead - Research Development for ISACA, and guest, Ramses Gallego, International Chief Technology Officer for CyberRes in the latest session of our LinkedIn Live series on Emerging Technology.

27 December 2021
Security
Blog Post

Log4Shell Update and Resources

In the past week, you’ve likely seen multiple headlines about a new major security vulnerability. Log4j is an open-source logging framework built on Java coding language that is used by approximately one-third of all webservers. On 9 December, a flaw in the code was discovered and rated a 10 out of 10 on the Common Vulnerability Scoring System (CVSS) due to its possible impact. 

23 December 2021
Glib Pakharenko
Blog Post

The Importance of VPN Technology Assurance

Virtual Private Networks (VPNs) for many years have already been in place in almost every organization. Their use has been mostly limited to functioning as site-to-site tunnels between offices and third-party organizations, providing remote access of IT specialists for incident/change...

23 December 2021
Communicating Information Security Risk Simply and Effectively, Part 2
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 2

The ability to answer top management's questions is the first step to being successful in presenting information security risk effectively. In enterprise risk management, the difficulty is to combine different data...

Author: Luigi Sbriz
Drawing Connections Between Security and Employee Personalities
@ISACA Article

Drawing Connections Between Security and Employee Personalities

An enterprise’s employees are often regarded as its biggest weakness in terms of cybersecurity. Though some threats are posed inadvertently by employees with certain personality traits, an organization can also be targeted intentionally by an employee acting as an insider threat.

22 December 20212
Sushila Nair
@ISACA Article

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

22 December 20212
Wole Davis
Blog Post

Central Bank Digital Currency and Governments’ Quests for Control

According to National Geographic, “An adaptation is any heritable trait that helps an organism, such as a plant or animal, survive and reproduce in its environment.” Eucalyptus trees survive the wildfires of the Australian forest because of their thick, multilayered barks that act as insulation against heat.

22 December 2021
Veronica Rose
Blog Post

Qualities of a Trusted Information Systems Auditor

The information systems auditor’s journey is one of exploration because each time we encounter new risks, processes and controls, they become a part of our work.

21 December 2021
Communicating Information Security Risk Simply and Effectively, Part 1
ISACA Journal Article

Communicating Information Security Risk Simply and Effectively, Part 1

In organizations, the topic of enterprise risk management presents a twofold problem: the calculation of the level of risk and effective communication to top management. An accurate risk assessment loses all its effectiveness if it is not properly understood by managerial executives with decision-making power.

Author: Luigi Sbriz
R.V. Raghu
Blog Post

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase data is the new oil. But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

20 December 2021
Joel Schwarz
Security Article

We Can Neither Regulate Nor Sanction Away Cryptocurrency’s Facilitation of Ransomware

While 2020 will be remembered for the beginning of the COVID-19 pandemic, 2021 may be remembered as the year when ransomware entered the collective public consciousness, courtesy of the Colonial Pipeline and JBS ransomware attacks.

20 December 2021
Kerie Kerstetter
Blog Post

Compliance Versus Risk: Why Choosing the Right Approach is So Important

Most organizations have now realized the critical importance of cybersecurity risk management.

17 December 2021
Mark Thomas
Blog Post

A Holistic Training Approach That Helps Enterprise Governance Thrive

If you have been on your professional or social networking sites in the past several months, you might have noticed that many of your colleagues are posting about their newly acquired certifications.

15 December 2021
Adopting International Standards
ISACA Journal Article

Adopting International Standards in Africa to Protect Critical Infrastructure

The digitally interconnected world has immense potential. Internet-based technologies are becoming an integral part of every critical infrastructure.

Author: Patrick Katuruza
IT Audit in Practice Survival When You Are Small Business Continuity and Resilience
@ISACA Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan.

15 December 2021
Nominations Open for ISACA Board of Directors
@ISACA Article

Nominations Open for ISACA Board of Directors

Nominations for the 2022-2023 ISACA Board of Directors are open now through 31 January 2022.

15 December 2021
Veronica Rose
@ISACA Article

Shining a Stronger Spotlight on the Information Systems Audit Profession

Way back while I was in university, despite the fact that I was pursuing a bachelor’s degree in computer science, I never heard any faculty mention a profession in IS/IT audit. To date, when I mention my profession to some, they ask what in the world it is that I do.

15 December 2021
Robert Findlay
Blog Post

The Challenging Task of Auditing Social Media

A request to audit social media is rarely confused with a pleasant sunny day at a picnic. It is fundamentally an audit of the organization’s marketing department, which comes with challenges as marketers are not always following best practices of internal controls.

15 December 2021
Diversity in the Cybersecurity Workforce
Security Article

Diversity in the Cybersecurity Workforce

The cybersecurity professional labor shortage is no secret and has only been exacerbated by the COVID-19 pandemic. For many enterprises, hiring processes slowed or stopped altogether; even those which were able to resume normal recruitment efforts were met with a cyberskills gap.

15 December 2021
Chris Dimitriadis
Blog Post

Log4shell Vulnerability Highlights Critical Need for Improved Detection and Response Policies and Procedures

A zero-day vulnerability of Log4j (CVE-2021-44228), an open-source, Java-based logging utility widely used by enterprise applications and cloud services, recently came to light.

14 December 2021
Trusted AI Platforms for the Connected Car Ecosystem
ISACA Journal Article

Trusted AI Platforms for the Connected Car Ecosystem

It is common knowledge that sensitive or personal data from connected cars are at risk of being hacked or breached. More important though, is that it is critical to realize that connected cars pose serious threats to human lives, including fatalities.

Authors: Khyati Mehta, Chinmoy Rajpal and Gaurav Verma
Ramses Gallego
Blog Post

Three Key Priorities for Emerging Tech Practitioners in 2022

Regardless of where somebody specializes in the IT field – whether an audit, risk, privacy, governance or security practitioner – the impact of emerging technology is becoming increasingly relevant.

13 December 2021
Rob Clyde
Blog Post

Wanted: Experienced, Passionate Leaders for ISACA Board of Directors

There’s a saying when it comes to what makes an effective board of directors: Noses in, fingers out. That’s the approach the ISACA Board of Directors takes, meaning the Board is responsible for governance and oversight for the organization, but we steer clear of the operational execution.

13 December 2021
Nivedita Malhotra
Privacy Article

Preparing for Upcoming Data Privacy Regulations

The global privacy landscape has changed drastically since the EU General Data Protection Regulation (GDPR) became law in 2018.

13 December 2021
Ravikumar Ramachandran
Blog Post

Three Key Priorities for Governance Practitioners in 2022

The accelerating technological advancements and digital transformation did not reduce its pace in 2021 and it does not figure to in 2022, nor for the foreseeable future.

10 December 2021
Jack Freund
Blog Post

Three Key Priorities for Cyberrisk Practitioners in 2022

It’s that time of the year again where people are making prognostications about what will happen in the new year.

9 December 2021
Evidence-Based Prioritization
ISACA Journal Article

Evidence-Based Prioritization of Cybersecurity Threats

The landscape of cybersecurity threats is evolving at a tremendous pace. New adversaries with increasingly sophisticated tactics and tradecraft seem to emerge on a continuous basis

Authors: Richard Kerkdijk, Sebastiaan Tesink, Frank Fransen and Federico Falconieri
Podcast

Security Operations Challenges in 2021

ISACA’s Director, Channel Business Development, Chris DeMale is joined by ServiceNow’s Director of Product Marketing, Karl Klaessig in this follow up interview that takes a deeper look into his presentation during ISACA’s Virtual Summit session, Security Operations Challenges in 2021.

10 December 2021
AI Uses in Blue Team Security
@ISACA Article

Artificial Intelligence Uses in Blue Team Security: What’s Working and What Isn’t?

Artificial intelligence (AI), machine learning (ML), and deep learning (DL) are often applied in cybersecurity, but their applications may not always work as intended.

8 December 2021
R.V. Raghu
@ISACA Article

Data Minimization: An Approach to Data Governance

Data has fueled the hockey stick-shaped growth of enterprises worldwide, probably leading to the much-adopted phrase, “Data is the new oil.” But recent high-profile data breaches and the rise of data protection regulations have made data into a double-edged sword to be wielded with extreme care.

8 December 2021
Tips of the Trade - Jack Freund
@ISACA Article

More Bad News About Cyber

If you clicked on this column because its title conveyed a negative tone, you are not alone. It is well known that negativity drives user interaction in online environments.

8 December 2021
Rebecca Herold
Blog Post

Three Key Priorities for Privacy Practitioners in 2022

Each year privacy professionals have more and more issues to address. Existing privacy risks never really go away. They simply lurk beneath the new issues that claim the attention of privacy pros until the time is prime to exploit those old vulnerabilities.

8 December 2021
Sushila Nair
Blog Post

Three Key Priorities for Cybersecurity Practitioners in 2022

The availability of security talent — or lack thereof — has emerged as the key limiting factor in information security’s ability to secure the modern business.

7 December 2021
Reduced Appetite
ISACA Journal Article

Reduced Appetite: How COVID-19 Will Impact Future Business Continuity Planning

No one could have predicted the far-reaching effects of the COVID-19 outbreak. However, many organizations had invested in business continuity and disaster recovery (BC/DR) to prepare for such unexpected disruptions.

Authors: Pascal A. Bizarro and Aaron Wheeler
Podcast
Podcast

Information Security Programs Need to be Ubiquitous, Proactive, and Vigilant

This ISACA TV interview is a discussing about information security concerns (and challenges), evolution, and the future. Topics covered include mobile computing devices, the Internet of Things (IoT), artificial intelligence (AI), cyber threat intelligence (CTI), software tools...

7 December 2021
Ookeditse Kamau
Blog Post

Three Key Priorities for Audit Practitioners in 2022

These past two years have been a stretch for everyone. Most are still learning how to work differently and re-evaluating their strategies to get the best out of the worst season.

6 December 2021
Linda Kostic
Governance Article

COBIT Focus Area: Information and Technology Risk—A Model for Internal Audit Analysis

Risk management is an important function in any organization. Financial services organizations often employ the three lines of defense approach to manage risk within the organization.

6 December 2021
Alain Marcuse
Privacy Article

Finding Common Ground: Security, Privacy and Marketing

It is a common perception that marketing is generally at odds with security and privacy. Although these are broad generalizations with plenty of excluded nuances and exceptions, marketing is seen as thriving on data—the more, the better.

6 December 2021
Adham Etoom
Blog Post

Cyber Defense Strategies 4.0 Incorporating AI Technology

In the age of Industrial Revolution 4.0, cybersecurity has become a more pressing and disturbing concern for both boards and senior management globally.

3 December 2021
Terry Cai
Blog Post

Data-Driven vs. Data-Informed: How Auditors Find the Right Balance

Data is a powerful thing. Consequently, the role that data analytics play in today’s audit profession cannot be emphasized enough, especially in light of digital transformation across different industries.

2 December 2021
Artificial_intelligence_adoption_250
@ISACA Article

Artificial Intelligence Adoption in Internal Audit Processes

As artificial intelligence and automation technologies advance, they are being used in a variety of fields to automate operations that were previously done manually.

1 December 2021
Caitlin McGraw
@ISACA Article

How to Ace Your Performance Review

So, do you prepare for your performance review? Like, really prepare – meaning that you have a list of your accomplishments.

1 December 2021
Sunil Bakshi
@ISACA Article

Tech Debt, Explained

I recently heard the term tech debt for the first time and wondered what it meant. A brief search engine query provided the shocking information that this term was first coined in 1992 by Ward Cunningham, a developer who developed Wiki software.

1 December 2021
Cyber maturity graphic
Blog Post

Cybermaturity: A Path to Right-Sizing Cyber Practices

The concept of cybermaturity has gained increased attention in recent years, while still not being well-understood in many circles across the industry.

1 December 2021
Podcast
Podcast

How Innovative Enterprises Win With Secure Machine Learning

Enterprises use machine learning to validate who they are doing business with and to find new opportunities. ISACA's IT Professional Practices Lead Kevin Keh discusses secure machine learning with Protegrity's Chief Security Strategist Ulf Mattsson.

1 December 2021
Aselsan MGEO Case Study
Blog Post

Case Study: How ASELSAN MGEO Improved Design and Management Processes with CMMI V2.0

Defense contractors and general manufacturers across the globe that are looking to improve overall design and management processes or upgrade their cybersecurity maturity level can do so with ease and efficiency – even during a pandemic.

30 November 2021
The Impact of Schrems II
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 1

The transfer of personal data out of the European Union (EU) to nations around the world takes place tens of thousands of times every day, and it has been occurring for so long that it has largely become routine business.

Author: Scott M. Giordano
Molly-Mullinger_Elliott-Bostelman
Blog Post

Six Steps to a Mature Policy Management Program

When the reality of the pandemic sank in, and people shifted to remote working nearly overnight, companies had to rethink the data and technology policies written for a typical office working space. Some organizations were scrambling to make updates, while others already had a policy management program to guide them through this event.

29 November 2021
Cybersecurity A Shared Responsibility
@ISACA Article

Cybersecurity: A Shared Responsibility

Let me begin by asking everyone a question – what does “shared responsibility” mean? What are the responses that come to your mind when you ask the question?

24 November 2021
Four Levers to Drive a Cyber savvy Culture
@ISACA Article

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

24 November 2021
Pakistan Cybersecurity Policy in 2021 A Review
@ISACA Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception. With its increasing number of start-ups, young professionals and digital transformation programs that have been implemented by established organizations, it was incumbent upon Pakistan to enact a cybersecurity policy supported by an overarching framework that also addressed data protection and privacy.

24 November 2021
C. Warren Axelrod
Blog Post

Privacy in Greater Peril

There is a saying that states “May you live in interesting times,” but it is considered to be a curse. Unfortunately, we are living through a particularly interesting period that is turbulent, high risk and oftentimes devastating.

23 November 2021
Algorithms and the Auditor
ISACA Journal Article

Algorithms and the Auditor

Recent advances in machine learning (ML) and artificial intelligence (AI) have raised new awareness and concerns of algorithms, including their uses and misuses and their potential and limitations.

Author: Spiros Alexiou
Shini Menon
Blog Post

Imagining Audit Tech With AI

As an experienced professional who has worked with pharmaceutical, medical device, financial service, government, retail and hedge fund organizations, it did not take me many years to realize that audits and assessments were largely manual, tedious and intensive activities.

22 November 2021
Bill Malik
Security Article

Using Zero Trust and XDR to Stop Ransomware

The rise of ransomware has inspired the creation of myriad techniques attackers can use to achieve their goals. At its core, ransomware encrypts an enterprise’s data and then sells the key needed to decrypt them.

22 November 2021
Podcast
Podcast

HCL State of Cybersecurity 2021

Jon Brandt (Information Security Professional Practices Lead at ISACA) and Renju Varghese (Fellow and Chief Architect at HCL Technologies) break down the State Of Cybersecurity 2021 —Part II report.

22 November 2021
Melissa Swartz
Blog Post

Changing the World on ISACA CommunITy Day

The first Saturday in October has become my favorite day of the year at ISACA. Every year, thousands of ISACA members and their families join together to perform local community service, and we track those efforts to measure the collective impact we have when we work together – even while apart.

19 November 2021
Podcast
Podcast

ISACA’s New CyberPro – Jon Brandt

Listen in as ISACA’s Information Security Professional Practices Lead, Jon Brandt grabs the podcast microphone and takes over November’s Cyber Pros to discuss CISA’s Directive Breakdown.

19 November 2021
Julia Kanouse
Blog Post

Acronyms Only Scratch the Surface of What ISACA Stands For

ISACA itself is an acronym, formerly standing for the Information Systems Audit and Control Association. And of course, we’re well known for our global portfolio of IT certifications – CISA, CISM, CRISC, CGEIT, CDPSE, CET, ITCA – not to mention the COBIT framework.

18 November 2021
Benefits Management for Digital Transformation Programs
ISACA Journal Article

Benefits Management for Digital Transformation Programs

The global economy is becoming more challenging due to greater international competition, the pace of digital transformation and increased customer experience expectations.

Authors: Sam Opdenakker, Kim Maes, Ph.D. and Steven De Haes, Ph.D.
Human error
Security Article

Human Error in Cyberspace

Human error is inevitable, even in fields as thorough and technically efficient as cybersecurity. While there are mechanisms in place to prevent and detect such occurrences, on occasion, even an enterprise that is usually a well-oiled machine can fall victim to vulnerabilities that may arise due to the human factor.

17 November 2021
Member Spotlight
@ISACA Article

Member Spotlight: Janelle Vasquez

Janelle Vasquez, recently visited with @ISACA to discuss her journey with ISACA, why entrepreneurship appeals to her and how she became enamored with Latin dancing, among other topics.

17 November 2021
Cobit
@ISACA Article

Tailored Governance for Small and Medium Enterprises

When it comes to small and medium sized enterprises (SMEs), there is no one-size-fits-all approach to governance for enterprise information and technology.

17 November 2021
Anna Vladimirova-Kryukova
@ISACA Article

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

17 November 2021
Greet Volders
Blog Post

COBIT’s Value for Small and Medium Enterprises

If one or more of the statements below reflects your thoughts on COBIT®, you should investigate the latest ISACA publication, COBIT for Small and Medium Enterprises (SMEs).

17 November 2021
Wickey Wang
Blog Post

Why the Cloud Market is Booming

Cloud computing and the extended cloud service industry have become mainstream in today’s IT industry

16 November 2021
A Text-Mining Approach to Cyberrisk Management
ISACA Journal Article

A Text-Mining Approach to Cyberrisk Management

Cyberrisk is one of the most pervasive threats facing the global community. The World Economic Forum (WEF) has listed cybersecurity failure as one of the top-five global risk factors since 2018.

Authors: Arunabha Mukhopadhyay and Kalpit Sharma
ISACA live tile
Podcast

ISACA Live: Emerging Tech - Cloud

Why is the cloud still considered an emerging technology in 2021? Why is the cloud both an enabler and catalyst for all other technologies? How has the cloud changed our organizational eco-systems?

16 November 2021
Tom Conkle
Blog Post

Cybermaturity and Protecting Against Ransomware

Ransomware continues to dominate the headlines in both cybersecurity journals and mainstream media.

15 November 2021
ISACA live tile
Podcast

LinkedIn Live: State of Cybersecurity, Part 2

In honor of Cybersecurity month, ISACA’s Director of Communications, Kristen Kessinger, and Information Security Practices Lead, Jon Brandt, discuss the findings of this year’s ISACA State of Cybersecurity...

15 November 2021
Grad Students
Blog Post

The Latest Trends for Master’s Students In IT and How To Leverage Them

There are many reasons people in the IT industry choose to pursue further education. It could be because of the pursuit of knowledge wanting to get ahead of the trends. Or it could be because of the financial aspect – the promise of a promotion or a higher pay that comes with the master’s degree. 

12 November 2021
Ted Harrington
Blog Post

Challenge Underlying Security Assumptions

Ted Harrington runs Independent Security Evaluators (ISE), the elite security researchers who pioneered car hacking, were first to exploit the iPhone, first to exploit Android OS, pioneered medical device hacking, and run hacking event IoT Village.

11 November 2021
Does Trust Still Matter in the Era of Zero Trust?
ISACA Journal Article

Does Trust Still Matter in the Era of Zero Trust?

The most common theme of recurring security incidents in recent memory has been associated with the breaches of seemingly trustworthy service providers or technologies.

Author: Ar Kar Oo
ISACA live tile
Podcast

ISACA's Global Strategy

Join ISACA’s CEO David Samuelson as he discusses ISACA’s Global Strategy with ISACA’s Chief Global Strategy officer Chris Dimitriadis. Chris shares his career path to ISACA, industry trends, advice to the next generation and how ISACA will continue to innovate in the future!

11 November 2021
Diagnosing the Epic Fails in Cybersecurity
@ISACA Article

Diagnosing the Epic Fails in Cybersecurity

The cybersecurity industry has long been failing, and to reverse course, a better understanding of the root causes of that failure is needed.

10 November 2021
Anyone Can Be an Ally: Grow your Learning and Make Positive Change
@ISACA Article

Anyone Can Be an Ally: Grow your Learning and Make Positive Change

“Allies are people who bring change to life in a given setting,” said Sarah Benczik, principal at Deloitte, during her presentation at One In Tech’s seminar during last month’s ISACA Conference Europe.

10 November 2021
State of the Threat Landscape
@ISACA Article

State of the Threat Landscape Expert Panel

ISACA Conference Oceania welcomed a panel of security experts from the region and beyond to dive into the current threats facing enterprises: cyberrisk, emerging tech adoption, educating stakeholders about risk, and more.

10 November 2021
The Magic Trick to Gaining Influence
@ISACA Article

The Magic Trick to Gaining Influence

Vinh Giang, keynote speaker at last month’s ISACA Conference Europe, was able to convince his parents that not only should he quit university, but that they should invest in his dream: teaching magic online.

10 November 2021
Anna Vladimirova-Kryukova
Blog Post

The Influence of the NIS2 Directive In and Outside of the EU

Recent years have been active for legislators all over the world when it comes to cybersecurity and privacy regulation.

10 November 2021
ISACA live tile
Podcast

Cyber Risk and Communicating to a Board of Directors

Digital transformation has heightened due to the pandemic. We went from, “we can’t work from home” to “we can only work from home moving forward”.

10 November 2021
Podcast
Podcast

Digital Body Language

What is digital body language and why does it matter? Join ISACA's Director of Global Volunteer Engagement Megan Moritz as she speaks with Erica Dhawan, author of Digital Body Language: How to Build Trust and Connection, No Matter the Distance. Mega and Erica discuss...

10 November 2021
Podcast
Podcast

Getting Started with Risk Quantification

One of the cornerstones of managing the unknown is defining it and measuring it. Anything that could cause harm to an organization needs to be tracked and managed. As more and more transactions occur entirely on digital platforms or are at least facilitated digitally, the ability of cybersecurity issues to trigger a breakdown in the delivery of products and services is a top concern of executives and boards.

10 November 2021
Podcast
Podcast

IT Audit in Practice: Survival When You are Small-business Continuity and Resilience

Everyone needs a resilient operating model, and the pandemic has been the reality check showing how necessary it is to have a plan. Was your small-business or corporation prepared for the shift to remote work in early 2020? If not, you probably realized that business continuity is more than having the right systems and applications in place.

10 November 2021
Podcast
Podcast

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external cloud environments, and information sharing.

10 November 2021
Podcast
Podcast

Security as a Service

What is security as a service and when is it needed? Tune in as ISACA’s Cyber Pros explain how the increase in hacks and attacks are forcing companies to take cyber security more seriously.

10 November 2021
ISACA live tile
Podcast

The Cybersecurity Workforce

Join ISACA’s Director of Communications, Kristen Kessinger as she interviews ISACA’s Information Security Professional Practices Lead, Jon Brandt about what is currently happening in the cybersecurity workforce.

10 November 2021
Podcast
Podcast

US DoD’s CMMC Guidelines — What You Need to Know

Cybersecurity Maturity Model Certification or CMMC is a new security program being released by the US DoD. If you are a DoD contractor, your livelihood could be at stake as contract requirements and contractors will need to be certified or a contract won’t be awarded.

10 November 2021
How to Construct a Governance System From the Board Level to the Code Level
ISACA Journal Article

How to Construct a Governance System From the Board Level to the Code Level

The concepts involved in promoting a mature structure for software platforms and applications can be quite intricate.

Author: Blake Curtis
Blog Post

New Opportunities Await ISACA Members in 2022

With Membership and Certification renewals right around the corner, I wanted to take a moment and preview some of what you have to look forward to in 2022!

8 November 2021
Nikolas Badminton
Blog Post

Planning for Multiple Futures at Once

Nikolas Badminton, a keynote speaker at ISACA’s EVOLVE emerging tech virtual conference, taking place 16-17 November, recently visited with ISACA Now to share his perspective on the business technology landscape.

8 November 2021
Muneeb Imran Shaikh
Security Article

Pakistan’s Cybersecurity Policy in 2021: A Review

Countries are increasingly adopting new technologies across various business spheres, and Pakistan is no exception.

8 November 2021

Talking to Alan Turing About Artificial Intelligence
Guy Pearce, CGEIT, CDPSE, and Maureen Kotopski
Blog Post

Talking to Alan Turing About Artificial Intelligence

Is it enough that a computer can be called intelligent if it can deceive a human into believing that the computer is human? Maybe not.

5 November 2021
Larry Wlosinski
Blog Post

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a new and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

4 November 2021
Adopting Technical Controls for Data Privacy in the Digital Age
ISACA Journal Article

Adopting Technical Controls for Data Privacy in the Digital Age

These days, people tend to share seemingly related or unrelated personal information online, such as birthdays, addresses, contact details, relationships and holiday plans.

Author: Muhammad Tariq Ahmed Khan
Caitlin McGraw
@ISACA Article

Counteroffers on the Rise: Job Seekers, Be Prepared for a Wild Ride

The counteroffer strategy typically lies dormant until talent shortages mount. Then, they start popping up like mushrooms after a rain. Like mushrooms, some are tasty, while many are detrimental to your career; some are deadly damaging.

3 November 2021
Exploring Blockchain
@ISACA Article

Exploring Blockchain Forensics

Blockchain forensics enable organizations and experts to manage financial crime and reputational risks associated with cryptocurrencies and other blockchain applications from the onboarding of new customers and ongoing maintenance for existing customers.

3 November 2021
John P. Pironti
@ISACA Article

Five Key Considerations When Applying a Trust, but Verify Approach to Information Security and Risk Management

Doveryai, no proveryai or ”trust, but verify,” the Russian proverb made famous by former US President Ronald Reagan, means that a responsible person always verifies everything before committing themselves to a common business with anyone, even if the other party seems completely trustworthy.

3 November 2021
Tuan Phan
Blog Post

Exploring Blockchain Forensics

In technical terms, blockchain forensics is the use of science and technology to investigate and establish facts in criminal or civil courts of law.

3 November 2021
Sumedha Adavade
Blog Post

Building a Strong Risk Culture in the New Normal

The current times are challenging for many organizations in terms of adjusting their frame of mind to working in a hybrid manner (i.e., from home and in the office), keeping abreast of new guidelines from local regulatory and government authorities and managing operational risk.

2 November 2021
The Impact of Schrems II, Part 2
ISACA Journal Article

The Impact of Schrems II on the Modern Multinational Information Security Practice, Part 2

As discussed in “What the Schrems II Ruling Means for Modern Multinational Information Security Practice, Part I,” on 16 July 2020, the Court of Justice of the European Union (CJEU) rendered what is likely to be its most disruptive decision to international commerce to date, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (“Schrems II”).

Author: Scott M. Giordano
Cyberthreat Intelligence as a Proactive Extension to Incident Response
ISACA Journal Article

Cyberthreat Intelligence as a Proactive Extension to Incident Response

Cyberthreat intelligence (CTI) is one of the latest buzzwords in the information security industry.

Author: Larry G. Wlosinski
Jon Brandt
Security Article

Operational Security: A Business Imperative

The US military developed the operational security (OPSEC) methodology during the Vietnam War. Military service afforded me unique opportunities and insights obtained throughout assignments that spanned across the intelligence community and multiple areas of warfare.

1 November 2021
j21v6-Afraid-of-the-Dark
ISACA Journal Article

Information Security Matters: Afraid of the Dark (Data)

I have a cabinet at home that is stuffed full of…well, I am not quite sure what. I am pretty sure there are chargers, although I am not as certain that the devices they once charged still exist. There are cables, connectors and whatnot—a lot of whatnot. If I were a betting man, I would wager that most readers have a cabinet, closet, box or drawer just like mine.

Author: Steven J. Ross
j21v6-How-the-Lack-of-Business
ISACA Journal Article

IT Audit in Practice: Interconnections and Vendors

Business success is inextricably defined by relationships. No matter what technology is used or what brilliant application has been launched, the connections between business owners, suppliers and clients reflect the strategy and how the business owner defines...

Author: Cindy Baxter
j21v6-A-Fairy-Tale-of-Innovation
ISACA Journal Article

The Bleeding Edge: A Fairy Tale of Innovation

Greetings traveler! Since you have been navigating the wonderful and informative world of the ISACA® Journal for some time, you have likely been inspired to explore and question the world around you. I invite you to take a break from staring at screens for I have a tale to tell.

Author: Dustin Brewer
j21v6-Interconnectivity-Innovation
ISACA Journal Article

Innovation Governance: Interconnectivity Innovation

In today’s business world, few organizations larger than a small enterprise can survive without interconnectivity limited to just email or a website. Even smaller not-for-profit organizations are using tools that provide greater interconnectivity.

Author: K. Brian Kelley
j21v6-How-Innovative-Enterprises
ISACA Journal Article

How Innovative Enterprises Win With Secure Machine Learning

New solutions help innovative enterprises succeed in an ever-changing, increasingly competitive digital economy. These solutions can empower enterprises to activate and extract value from sensitive data and engender trust by preserving the privacy of customers and employees.

Author: Ulf Mattsson
j21v6-Differentiating-Internal-Audit
ISACA Journal Article

Differentiating Internal Audit in Supply Chain Risk Management

Bracing consumers for looming supply chain disruptions has become a repetitive task for the news media in the wake of the COVID-19 pandemic. In early 2021 alone, consumers were told to prepare for shortages of everything from gasoline to chlorine and chicken to computer chips.

Author: Kevin M. Alvero
j21v6-The-Anatomy-of-ICT
ISACA Journal Article

The Anatomy of ICT and Services Supply Chain Risk Management

Innovative cyberattacks are emerging across the world in the wake of the COVID-19 pandemic. Attackers are using more sophisticated tools, techniques and processes (TTPs), including information and communications technology (ICT) and services supply chains...

Author: Vimal Mani
j21v6-How-the-Lack-of-Business
ISACA Journal Article

The Pandemic Exposed a Lack of Business Continuity. How Business Must Change

Business continuity planning (BCP) has received considerable attention recently due to the COVID-19 pandemic. Many organizations found that they either did not have a plan to address the many changes that occurred due to the pandemic or that their plan...

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid and Tyler Fezzey
j21v6-Building-an-Enterprise-SOC
ISACA Journal Article

Case Study: Building an Enterprise SOC and Risk Management Function

Starting in the early 2000s and until the mid-2010s, compliance was a primary driver for many cybersecurity programs; as instilled by business executives, the fear of failing an audit was more worrisome than the threat of a breach.

Author: Katie Teitler
Cyberruse at the Cybergates
ISACA Journal Article

Cyberruse at the Cybergates: Technology, People and Processes

In 1587, Spain was at war with England. Under King Philip of Spain, the Spanish Empire built an armada of 130 large battleships, all waiting in the bay of Cadiz, Spain, ready to invade England.

Author: Pratim Datta
Helpsource
ISACA Journal Article

Help Source Q&A

We are hearing the term “disinformation” more often. Is it the same as misinformation? If not, what is the difference?

Author: Sunil Bakshi
Phil Zongo
Blog Post

Four Levers to Drive a Cyber-savvy Culture

In 1898, The New York Times published a fascinating article, “An Old Swindle Revived,” which lamented the rising number of Americans who were falling victim to a resurgent 30-year-old scam.

29 October 2021
Security Adjustments to Strengthen the Bond Between Risk Registers and Information
ISACA Journal Article

Security Adjustments to Strengthen the Bond Between Risk Registers and Information

A valuable component of corporate governance is the risk register. Although it is not mandatory, using a risk register to build a sound risk governance process for an organization is strongly recommended.

Author: Luigi Sbriz
Top Ransomware attacks
@ISACA Article

Surge in Ransomware Attack and 10 Biggest Attacks in 2021

Ransomware attacks have increased alarmingly in 2021. No industry is safe from this malicious act, and every computer file is at risk of being encrypted.

27 October 2021
Security Terminology
@ISACA Article

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, law or information technology.

27 October 2021
Cybersecurity Workforce Diversity
@ISACA Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

With the growing challenges of finding suitable cyberworkforce recruits, organizations must analyze and understand the current workforce composition. Minorities comprise 26 percent of the cybersecurity workforce and only 21 percent of the overall workforce.

27 October 2021
Sunil Bakshi
Blog Post

A Strategy for Tackling ISACA Certification Examinations

ISACA offers several certifications in technology areas related to IT governance, information security, information system audits, privacy, risk management and emerging technologies.

27 October 2021
Serena Zhao
Blog Post

Delivering Company-wide Security through Cross-collaboration

You’ve just been directed by your CISO to create a set of operational security standards. Where do you even begin?

26 October 2021
The Evolution of Security Operations and Strategies for Building an Effective SOC
ISACA Journal Article

The Evolution of Security Operations and Strategies for Building an Effective SOC

Cybersecurity threats are becoming increasingly complex, sophisticated, malicious, well organized and well funded. The widespread adoption of artificial intelligence (AI)-powered tools and technologies will lead to customized, high-impact cyberattacks.

Author: Lakshmi Narayanan Kaliyaperumal
Avani Desai
Blog Post

Taking Fakeness to New Depths with AI Alterations: The Dangers of Deepfake Videos

Even if you haven’t heard the term before, chances are you’ve come across dozens of deepfake videos online and maybe didn’t know it.

25 October 2021
Larry Alton
Blog Post

Head In The Clouds: Seeing Cloud Security Risks Clearly

Businesses have transitioned huge swaths of their operations to the cloud in recent years, and the messaging around the shift has included at least one key pitch: the cloud is more reliable and more secure than legacy technology.

22 October 2021
Ioannis Routsis
Blog Post

Fascinating Numbers: How COBIT 2019 Helps Set Targets and Measure IT Performance

Since I was a child, I have been good at mathematics and my sister, who is one year older than me, has often taken advantage of this by explaining theories to me in order to do her homework. I did not mind because numbers always fascinated me.

21 October 2021
The Invisible Enemy Within
ISACA Journal Article

The Invisible Enemy Within: Insider Threats

When most organizations think of an insider threat, their focus is on a technically skilled, disgruntled and unethical employee or contractor with privileged access.

Author: Allen Ari Dziwa
Digital Governance
@ISACA Article

Can IT Governance Be Dispensed With?

In the present context of digital transformation no longer being optional for any enterprise in the current digitization-driven economy, whether wholly or partially in the case of retention of some legacy systems, a commitment to strong IT governance is absolutely mandatory for survival.

20 October 2021
Tips of the Trade- Todd Weinman
@ISACA Article

‘How Much Does It Pay?’

As a recruiter who specializes in recruiting audit and GRC professionals, I spend significant amounts of time each week reaching out to prospective candidates, via email, InMail, or phone, about the opportunities for which we are recruiting.

20 October 2021
WHPEUFS
@ISACA Article

ISACA Provides Guidance on Operational Resilience in EU Financial Sector

The European Union’s recently released Digital Operational Resilience Act (DORA) draft is designed to provide digital operational resilience rules for EU financial institutions, and ISACA provides guidance on this proposal in its new white paper, Digital Operational Resilience in the EU Financial Sector: A Risk-Based Approach.

20 October 2021
Angela Hall
Blog Post

Addressing New Operational Resilience Requirements of the EU-DORA Proposal

In 2020, the European Union (EU) published a proposal on digital operational resilience known as EU-DORA. EU-DORA, albeit a proposal only, marks a turning point in EU banking regulation as it introduces wide-ranging new requirements in several areas and combines earlier singular regulatory provisions.

20 October 2021
Volkran Evrin
Blog Post

Qualitative vs. Quantitative Risk Assessment

With the ongoing impact of the COVID-19 pandemic in today’s business ecosystem, the value of decision making by using risk-oriented thinking has emerged more clearly and precisely.

19 October 2021
David Cross
Security Article

Novel Ideas From NIST for Fighting APTs

2021 brought many surprises, not the least of which was an uptick in the scale and severity of cyberattacks. One might be tempted to call 2021 the year of ransomware, yet ransomware is not merely automated worms anymore.

19 October 2021
Rise of Ransomware Attacks
ISACA Journal Article

Rise of Ransomware Attacks on the Education Sector During the COVID-19 Pandemic

Malware has existed for decades. Ransomware has become one of the most financially devastating types of malware attacks and poses a serious threat to agencies, school districts and other organizations

Author: James G. Koomson
Bojan Bajic
Blog Post

Key Pointers For a ‘People-First’ Transformation

So much has changed in the past decade of technology. Remember early iPhones, or the first generation of social media platforms just hitting the mainstream?

18 October 2021
Podcast
Podcast

ISACA Conference Europe – Keynote speaker: Vinh Giang

Listen in as ISACA Conference Europe Keynote speaker, Vinh Giang's discusses how he became the successful entrepreneur, magician and keynote speaker that he is today.

18 October 2021
Eszter Diana Oroszi
Blog Post

Patching Security Awareness: Human Traits as Vulnerabilities

October is Cybersecurity Awareness Month, a time of year when security awareness improvement actions become especially prominent.

15 October 2021
Augustus Ndamage
Blog Post

How to Prepare for and Pass the CISA Exam on Your First Try

In life, it is very easy to spot a certain model and brand of car if that is what you are yearning to have.

14 October 2021
Establishing a Foundation and Building an Insider Threat Program
ISACA Journal Article

Establishing a Foundation and Building an Insider Threat Program

Establishing a brand new process, function or program can be daunting. Some of the challenges include determining where to start, researching whether it has been done successfully in the past and, if it has, discovering the best practices and frameworks that can be used as a starting point.

Author: Kara Nagel
Ajay Barot
@ISACA Article

Latest Collaboration Brings Emerging Technology Focus to Puerto Rico

One of the best parts about my role at ISACA is the chance to build new relationships that can truly lead to transformative progress in people’s learning paths and, ultimately, their careers.

13 October 2021
Shuaib Shakoor
@ISACA Article

Navigating Changes in Internal Audit

Shuaib Shakoor, CISA, executive director for internal audit at professional services firm JLL, visited with @ISACA to discuss how internal audit is changing, how audit teams should approach cyberrisk and the challenges that accompany implementing emerging technology.

13 October 2021
Bruce R. Wilkins
@ISACA Article

Unraveling the Dark Web

When discussing the dark web, some might say that one will never find a more wretched hive of scum and villainy. But if that is true, why does it continue to exist?

13 October 2021
Kevin Alvero
Blog Post

Business Continuity Planning: Finding a Better Way

Although the details change on a case-by-case basis, a large number of organizations in some parts of the world have begun to reinstate pre-pandemic business operations in some form or another.

13 October 2021
Veronica Rose
Blog Post

Pass the IT Risk Fundamentals Certificate Exam on the First Attempt

To any exam-taker, it is always magnificent after completion of your test to view the screen displaying “You Passed.”

12 October 2021
Tom Conkle and Kelly Hood
Security Article

Lessons Learned From a Year of Remote Work

Over the last year, organizations have had to address many new challenges. When the COVID-19 pandemic first hit, many enterprises had to send staff home with workstations, printers and other resources they needed to continue working.

12 October 2021
Cybersecurity Workforce Diversity
ISACA Journal Article

Cybersecurity Workforce Diversity—Including Cultures, Personalities and Neurodiversity

There is undoubtedly a substantial gap in available cybersecurity personnel to fill the existing open positions, and most researchers believe this gap is only going to grow without a significant change in how personnel are recruited into and retained within the field.

Author: Christopher Henry
Vinh Giang
Blog Post

The Power of Goal-Setting and Re-Imagined Communication

Vinh Giang, a keynote speaker at ISACA Conference Europe 2021, recently discussed themes of perspective, empowerment, goal-setting, and positive mindset to encourage others to believe in the possibility of positive change with ISACA Now.

8 October 2021
Paul Frenken
Blog Post

Using Security Terminology Correctly

Every profession has its own language/vocabulary, whether it is the medical profession, lawor information technology.

8 October 2021
Wickey Wang
Blog Post

The Ethics of Artificial Intelligence

Artificial intelligence (AI) is intelligence demonstrated by machines as opposed to the natural intelligence displayed by humans or animals.

7 October 2021
The Influence of Employee Personality on Information Security
ISACA Journal Article

The Influence of Employee Personality on Information Security

Employees are often considered the weakest link in the information security chain, creating both unintentional and intentional security threats for their employers and their employers’ partners and customers.

Authors: Gerald F. Burch, John H. Batchelor, Randall Reid, Tyler Fezzey and Christine Kelley
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Challenges of AI and Data Privacy—And How to Solve Them

Artificial intelligence (AI) has developed rapidly in recent years. Today, AI and its applications are a part of everyday life, from social media newsfeeds to mediating traffic flow in cities to autonomous cars to connected consumer devices such as smart assistants, spam filters, voice recognition systems and search engines.

6 October 2021
Caitlin McGraw
@ISACA Article

The Profile: The Most Underrated Section in the Modern CV

The Profile or Summary section at the very beginning of many résumés is the most underrated and abused section of all. Underrated because most professionals don’t fully understand how powerful this opening section of the CV can be, which is to say, extremely powerful.

6 October 2021
Why you will be hacked
@ISACA Article

Time to Push Back Against Emboldened Cybercriminals

There are no questions about the growing profitability of cybercrime, which will reach an estimated US$10.5 trillion by 2025.

6 October 2021
Richard Bailey
Blog Post

Seven Tips for Protecting Your HIPAA Database

Protecting confidential data is a top priority for every industry, but when it comes to the healthcare industry, the regulations and compliance requirements that are in place require stringent data protection measures.

6 October 2021
US Policy on the Use of Force in Cyberspace
ISACA Journal Article

US Policy on the Use of Force in Cyberspace

The United States’ ability to defend and protect itself in cyberspace has evolved at an incredible pace. This evolution has been accomplished largely due to various frameworks such as the US National Cybersecurity Strategy (NCS), Joint Publication 3-12 and Presidential Policy Directive 21.

Authors: Roncs Etame-Ese, Daniel Odei, Sean Manning, Eric Mavakala and Andrew Hall, Ph.D
Luigi Sbriz
Blog Post

How Can the Relationship Between Risk, Control and Maturity Create Value?

Sometimes the world of internal control is associated with the color gray—an environment of repetitive, boring and ineffective activities.

4 October 2021
Jesse Fernandez
Security Article

Protecting Your Organization From Ransomware

It seems as though ransomware is constantly being discussed on the news. It also seems there have been more news stories about ransomware in the past few months than in the past few years.

4 October 2021
Brian K. Ngac
Blog Post

When Are Virtual Chief Information Security Officers the Right Choice?

Cybersecurity executive management and leadership are a key component to securing an organization’s infrastructure and assets properly.

1 October 2021
Leadership David Samuelson
@ISACA Article

Cultivating the Next Generation of Digital Trust Professionals

Attracting the next generation of professionals is not just critical for ISACA’s future – it is critical for the future of our professions.

29 September 2021
Tips of the Trade-Mostafa
Blog Post

Five Easy Technical Tips for an Optimized SAP GRC ARA Report

An effective and mature governance, risk and compliance (GRC) program has proper business requirements and the right blend of automation and technology support.

29 September 2021
Write Strong Risk Scenarios
Blog Post

How to Write Strong Risk Scenarios and Statements

Risk management is both art and science. There is no better example of risk as an art form than risk scenario building and statement writing.

29 September 2021
Decentralized Cloud Computing
ISACA Journal Article

Decentralized Cloud Computing

Computing has penetrated all aspects of everyday life from smartphones, cars, televisions and cameras to home appliances.

Author: Daniel D. Wu, Ph.D., CISA, CISM
Shivvy Jervis
Blog Post

Building the Sustainable Innovations of the Future

Shivvy Jervis, Futurist & Founder of the FutureScape 248 laba, recently visited with the ISACA Now blog to discuss the job landscape of the future, what makes innovations sustainable, her past work with the United Nations and more.

27 September 2021
Assessing CyberSecurity
@ISACA Article

Assessing the State of Cybersecurity in 2021 and Preparing for 2022

Nearly three-quarters of the way through 2021, it is a good time to take stock on the state of cybersecurity and lessons learned this year.

22 September 2021
Information Security
@ISACA Article

Collective Curriculum Development in Information Security

We have all heard about or experienced the cybersecurity workforce and skills shortage. In an attempt to address the skills shortage from an educational institution point of view, I used crowdsourcing to develop a new graduate level cybersecurity course.

22 September 2021
Information System Contingency
@ISACA Article

Understanding the Information System Contingency Plan

There has been increasing discussion around and occurrences of ransomware, a trending and very costly cyberthreat (which I discussed in “Ransomware Response, Safeguards and Countermeasures”).

22 September 2021
Is Cyberspace Secure From Humans
ISACA Journal Article

Is Cyberspace Secure From Humans?

A stable mechanism is one that operates consistently and sensibly. Cybersecurity is fundamentally a dynamic sociotechnical mechanism and, due to the human factor, it is vulnerable because human behavior and decisionmaking are complex and often unreliable.

Author: Gopikrishna Butaka
Aneta Waberska
Blog Post

Five Considerations for Leveraging the Unified Compliance Framework

The compliance landscape is constantly shifting, and companies are often challenged to meet the requirements of multiple regulations and frameworks.

20 September 2021
Community Day
@ISACA Article

2021 ISACA CommunITy Day Fast-Approaching

Come give back with ISACA® for our third annual CommunITy Day as fellow ISACA members, staff and their families take action in their local communities to help make a difference across the globe.

15 September 2021
Five Reasons to Add Privacy Knowledge to Your Professional Repertoire
@ISACA Article

Five Reasons to Add Privacy Knowledge to Your Professional Repertoire

When we think of privacy professionals, we usually think of someone with the Data Protection Officer (DPO) designation, but that is a narrow view. A privacy professional does not need to have a DPO title in order to perform privacy responsibilities.

15 September 2021
Sunil Bakshi
@ISACA Article

Insurance as a Risk Response

A July 2021 post on ISACA’s Engage platform considered how insurance coverage can be proposed as a risk response when presenting the risk to senior management and the board of directors (BOD). Although there were quite a few replies to the post, I would like to answer from an operations perspective.

15 September 2021
Angela Hall
Blog Post

CRISC and My Career Path Dedicated to Risk and Controls

Throughout my years working in risk and controls, the two constants that helped propel my career have been demonstrating professional knowledge and enabling opportunities.

15 September 2021
A Technology Control Testing Automation Case Study
ISACA Journal Article

A Technology Control Testing Automation Case Study

Many organizations, particularly those highly regulated by government entities, such as banking and insurance, employ a Three Lines of Defense model for risk management.

Author: Michael Powers
Stephanie Urban
Blog Post

Cloud Auditing 101: How Do I Get Started?

We’re entering what feels like a new era in re-inventing how we once worked. Pre-2020 seems like a lifetime ago, and not only are organizations accelerating their cloud adoption, we as practitioners are re-examining our own careers and skills.

3 September 2021
Caitlin McGraw
@ISACA Article

Are Video CVs Back? Hiring Leaders Weigh In

This past July, TikTok launched a trial video résumé program to connect job-seekers with more than 30 major companies, including Target, Chipotle and Shopify. The job listings were a mix--for example, a “restaurant team member” for Chipotle and a senior data engineer for Shopify.

1 September 2021
Simona Rollinson
@ISACA Article

Future-Proofing Our Tech Stack

ISACA operates with a digital-first mindset. Soon, we will have the technological infrastructure in place to fully execute on that mentality.

1 September 2021
ISACA Conference Oceania Keynoters
@ISACA Article

ISACA Conference Oceania Keynoters to Share Solutions, Optimism for Future of Tech

Energize yourself, your career and your life with powerful messages from outstanding keynote addresses at ISACA Conference Oceania 2021, an event taking place virtually 28-30 September.

1 September 2021
How Do Organizations Control Their Use of Social Media? Part 2
ISACA Journal Article

Accessing Data and Maintaining Privacy Before, During and After Catastrophic Events

The basic precepts of privacy do not change in the face of catastrophes, but the type and amount of personally identifiable information (PII) used and generated and the need for legitimate access to those data increase substantially.

Author: C. Warren Axelrod
Sandeep Godbole
Security Article

Cyberrisk Quantification for Improved Cybersecurity

Cyberthreats and cyberattacks are inevitable. Cyberrisk, which formerly was considered relevant only to cybersecurity professionals, is now recognized as having the potential to threaten an entire organization.

31 August 2021
Wickey Wang
Blog Post

An IT General Controls-Based Audit Approach for Blockchain

From an audit standpoint, there are many different focal points for blockchain. Fortunately, looking at blockchain from the perspective of IT general controls (ITGCs) makes auditing blockchain more manageable and simpler.

30 August 2021
Valerie Lyons
Privacy Article

Doing Privacy Right, Not Privacy Rights

The current privacy discourse is shaped around the question: “Is your organization compliant with privacy regulations such as the EU General Data Protection Regulation (GDPR), the US State of California Consumer Privacy Act (CCPA) or the US Health Insurance Portability...

30 August 2021
j21v5-Privacy-Data-Management
ISACA Journal Article

Information Security Matters: Privacy Data Management

Several issues ago, I wrote an article in this space titled, “Why Do We Need Data Privacy Laws?”1 In that piece, I expressed my skepticism about many new privacy laws while the old ones were still not being observed.

Author: Steven J. Ross
j21v5-The-Human-Side-of-Cybersecurity
ISACA Journal Article

IT Audit in Practice: The Human Side of Cybersecurity—Careers

Cyber cops? In the 1990s, who would have thought that technology would offer an endless number of job opportunities fighting the bad guys? The technical nature of cybercrime offers information systems specialists unique career options in a world where cybercrime...

Author: Cindy Baxter
j21v5-Is-Anybody-Home
ISACA Journal Article

The Bleeding Edge: Is Anybody Home? The Return

While the world waited for the scientific breakthrough of a vaccine for COVID-19, we created second lives for ourselves in an effort to battle boredom, continue to work and learn, and stave off the mental side effects of living in quarantine for as long as possible.

Author: Dustin Brewer
j21v5-Innovating-the-Human-Factor
ISACA Journal Article

Innovation Governance: Innovating the Human Factor

In information security, one of the standard axioms is that people are the weakest link. Trust forms the foundation of society. Though in the last few years, we have seen the consequences of specific breakdowns in that trust. However, trust still drives things. Humans still trust.

Author: K. Brian Kelley
j21v5-Exploitable-Traits-as-Vulnerabilities
ISACA Journal Article

Exploitable Traits as Vulnerabilities: The Human Element in Security

As the saying goes, every chain is only as strong as its weakest link and, in the case of information security, that weakest link is the human factor. Employees are high-level risk factors at all enterprises.

Author: Eszter Diána Oroszi
j21v5-What-Role-do-Humans-Play
ISACA Journal Article

What Role do Humans Play in Ensuring Cybersecurity?

Human behavior is a significant variable in any organization’s cybersecurity program. People have the potential to create serious issues through negligence or harmful intent, but they can also play a vital role in keeping an organization’s information assets secure.

Author: Kevin M. Alvero
j21v5-Virtual-CISOs
ISACA Journal Article

Virtual CISOs: Security Leader or Security Risk?

Every organization needs a leader dedicated to establishing, executing and preserving its information security mission. For many mature organizations, this leader is the chief information security officer (CISO).

Author: Brian K. Ngac
j21v5-Rethinking-the-Weakest-Link
ISACA Journal Article

Rethinking the Weakest Link in the Cybersecurity Chain

The cybersecurity chain consists of IT systems, software, networks and the people who interact with this technology. Most cyber researchers consider humans to be the weakest link in the cybersecurity chain. Nine out of 10 (88 percent) data breach incidents are caused...

Author: Glorin Sebastian
j21v5-Technology-Modernization
ISACA Journal Article

Case Study: Technology Modernization, Digital Transformation Readiness and IT Cost Savings

“Digital Distinction” is a major trend for growing, medium-sized organizations, with growth requiring a well-executed digital platform enabled by foresight, leadership and accountability that helps ensure that societal needs are addressed with limited input resources.

Author: Guy Pearce and Richard Fullerton
j21v5-Best-Practices
ISACA Journal Article

Best Practices for Setting Up a Cybersecurity Operations Center

The cybersecurity operations center (CSOC) is a vital entity within any enterprise structure. Its responsibilities are dictated by the size of the enterprise, whether the enterprise is multinational, the enterprise’s preference for centralized or decentralized cybersecurity...

Author: Robert Putrus
Jack Freund
@ISACA Article

It Is Time to Focus on Cyberresilience

The events of 2020 have brought to the forefront of everyone’s mind the need for organizational resilience.

25 August 2021
A Holistic Approach to Mitigating Harm From Insider Threats
@ISACA Article

New Resource Sizes Up Insider Threats

Insider threats can be especially unpredictable for security teams to deal with, as perpetrators might already have access to organizational resources that are not available to the general public.

25 August 2021
Cybermetrics
@ISACA Article

Understanding Cyber Risk Metrics and Reporting

Cyber risk is top of mind for organizations around the world, but effectively addressing that risk and reporting on it to enterprise leaders require a nuanced approach based on organizations’ risk appetite and strategic aims.

25 August 2021
Abdelelah Alzaghloul
Blog Post

Modernizing IT Operations for the Digital Age

The IT discipline has evolved in an unanticipated pace during the last decade, and it is still evolving, forcing both development and operations teams to adapt to this new digital age that is centered around delivering value faster, cheaper and better.

25 August 2021
How Do Organizations Control Their Use of Social Media? Part 2
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 2

Imagine this scenario: A client asks an auditor to review their enterprise’s usage of social media, likely because their chief operating officer (COO) has asked them to do so.

Author: Robert Findlay
Chris Dimitriadis
Blog Post

Embracing the Next Step in My ISACA Journey

My introduction to ISACA was simple enough – a friend of mine recommended I pursue the Certified Information Systems Auditor (CISA) certification back in 2003.

23 August 2021
Ali Pabrai
Security Article

Achieving the CMMC’s Highest Levels

The achievement of higher levels of the US Department of Defense (DoD)’s Cybersecurity Maturity Model Certification (CMMC), specifically Maturity Levels 4 and 5, enhances an organization’s ability to protect Controlled Unclassified Information (CUI) and reduces the risk of advanced persistent threats (APTs).

23 August 2021
ISACA Acts
@ISACA Article

ISACA Acts as Expert Adviser to UK Cyber Policymakers

Concerns related to cyberattacks are wide-ranging, with impact on organizations’ reputations, the possibility of physical/financial harm and supply chain disruptions causing the most unease, according to ISACA’s recently released State of Cybersecurity 2021 report.

18 August 2021
FinTech
@ISACA Article

The FinTech Effect: Redefining the Financial Ecosystem

As the saying goes, “Nothing lasts forever.” This is the case with traditional banks and financial houses with their big and massive structures, from Wall Street in the United States to Bangalore in India. Banking as we have come to know it is changing.

18 August 2021
Caitlin McGraw
@ISACA Article

‘The Great Resignation’: The First Thing You MUST Do If Considering a Job Change

Of late, I have had both hiring managers and IT audit, GRC and security practitioners calling to ask about the “Great Resignation.” Team leaders are worried about retention and back-filling roles.

18 August 2021
Charisa Orwig
Blog Post

The Non-Human Path to an Effective Insider Threat Program

An insider threat program may seem like something from the Philip K. Dick story “The Minority Report,” where three precognitive individuals (precogs) identify criminals before they commit the crime and the precrime police force arrests the identified criminals to prevent the crime from occurring.

18 August 2021
What Government Contractors Should Know About the US DoD’s CMMC Guidelines
ISACA Journal

What Government Contractors Should Know About the US DoD’s CMMC Guidelines

By now, defense contractors of all sizes and service types should know about the Cybersecurity Maturity Model Certification (CMMC). If they do not, it is important to learn about it sooner rather than later: Their livelihoods will depend on it.

Author: Johann Dettweiler
Sandhya Narayan
Blog Post

Making the Security Conversation More ‘Feature-Driven’

A constantly changing security landscape driven by increasingly persistent threats, growing attack sophistication and tighter compliance requirements keeps both the security and product teams at Adobe busy.

16 August 2021
Kirsten Lloyd
Governance Article

Establishing Artificial Intelligence Governance

Artificial intelligence (AI) is seemingly everywhere, with events such as the COVID-19 pandemic spurring increased investment in AI as organizations accelerate plans to power an increasingly digitally connected workforce.

16 August 2021
Bruce R. Wilkins
@ISACA Article

How and Why Publicly Available Information Is Used

There are thousands of servers on the Internet ready to satisfy any data request that one might have. Although the Internet is commonly divided between the open web, the deep web and the dark web, only the open and deep webs coexist on the same infrastructure. The dark web, which will be explored in a forthcoming article, exists on an entirely separate network.

11 August 2021
At ISACA web CommunityDay
@ISACA Article

ISACA CommunITy Day Set for 2 October

Join ISACA for the third annual CommunITy Day as ISACA members, staff and their families take action in their local communities and make a difference worldwide. This year’s CommunITy Day event is scheduled to take place on 2 October 2021.

11 August 2021
Fonteva transition
@ISACA Article

ISACA Website Outage Planned for Mid-September as New Association Management System Is Implemented

ISACA is preparing to transition to a new association management system that will deliver more valuable, relevant and personalized information to ISACA members.

11 August 2021
Blockchain Audit Program
@ISACA Article

New Resource Evaluates Blockchain Controls

Blockchain technology has become one of the most promising technological advancements of the past decade with the potential to transform a variety of key industries.

11 August 2021
Ved Prakrash
Blog Post

The Complexity Conundrum: Simplifying Data Security

As technology continues to evolve at an accelerating pace, unprecedented situations like the COVID-19 pandemic have further cemented our digital way of living and doing business. With digitization, there has been massive data proliferation and growth of data repositories.

11 August 2021
Decoding the Secrets of Cyberinsurance Contracts
ISACA Journal

Decoding the Secrets of Cyberinsurance Contracts

Cyberattacks are emerging faster than ever in the wake of the COVID-19 pandemic. As new dimensions are incorporated into these disruptive cyberattacks, enterprises around the world must be more vigilant about protecting their critical information assets.

Author: Vimal Mani
Ookeditse Kamau
Blog Post

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

9 August 2021
ISACA live tile
Podcast

ISACA’s Digital Transformation Part III — The Digital Member Experience

David Samuelson and ISACA’s Chief Membership Officer, Julia Kanouse discuss the positive impact of technology on our members and the ways in which our global community has grown even closer despite the pandemic.

6 August 2021
Three Things COBIT® Is – And Three Things It Isn’t
@ISACA Article

Enhancing Digital Transformation Through New COBIT Focus Area for DevOps

Advancing digital transformation is a top priority for today’s enterprises. Providing business and technology leaders with new tools to support this effort, ISACA’s new publication, COBIT Focus Area: DevOps, offers guidance based on COBIT 2019 to optimize governance and management practices for enterprises implementing DevOps.

4 August 2021
IT Auditors Corporate Jungle
@ISACA Article

How IT Auditors Can Avoid Becoming Prey in the Corporate Jungle

“Survival of the fittest,” a phrase first coined by Herbert Spencer after reading Charles Darwin’s On the Origin of Species, describes what may be called the cardinal rule of the jungle. Darwin used it to describe the process of natural selection.

4 August 2021
Caitlin McGraw
@ISACA Article

Influencing and Engaging Gen Z: Let’s Fill the Workforce Gap!

Back in March, I wrote a blog post for ISACA Now titled “IT Audit is ‘Boring’? Time to Fix the Perception Problem.” The post seemed to strike a chord; it stirred up a lot of conversation globally and generated more than 9,000 views on LinkedIn.

4 August 2021
Jon Brandt
Security Article

Final Thoughts on the State of Cybersecurity in 2021

ISACA® recently published State of Cybersecurity 2021, Part 2: Threat Landscape, Security and Cybersecurity Maturity, the second part of its annual cybersecurity report. Now in its seventh year, the report enables ISACA to poll its target audience and report the survey findings.

4 August 2021
Direct From the Practitioner
ISACA Journal

Direct From the Practitioner: Crowdsourcing for Cybersecurity Curriculum

Cybersecurity threats and the technology to deal with them are constantly evolving. Because of this, both aspiring and current cybersecurity practitioners must be educated about relevant issues and should keep up to date on new developments so they can adapt and excel in defending their enterprises’ assets.

Author: Brian K. Ngac
Podcast
Podcast

Why should I listen to you?

Dustin Brewer and Frank Downs will take you through their journey, from their start in cybersecurity to how they expanded their knowledge and skills to become the recognized cyber professionals that they are today.

3 August 2021
Avani Desai
Blog Post

Leading a Business and Raising a Family: 5 Ways to Maintain the Balance as a Boss Mom

If you’re a woman—especially if you’re both a working boss and a mom—I bet you can relate to Beyoncé’s hit “Run the World (Girls),” a proud shout-out to female strength and empowerment.

2 August 2021
James Paul Kakembo
Blog Post

Key Considerations in an Era of Remote and Hybrid Workforces

COVID-19 has changed the way we live, think, work and operate in a way that was never envisioned. Many organizations have now embraced the hybrid model, with employees splitting time between in-office and remote work.

30 July 2021
Ekaterina Volkovich
Privacy Article

The Automation of a Data Protection Officer’s Tasks

Data protection officers (DPOs) are facing increasing difficulties when performing tasks manually to comply with data privacy regulations. Gathering information about personal data processing activities in a large enterprise can take several months.

30 July 2021
Veronica Rose
Blog Post

Does Your Organization Have a Risk-Aware or Risk-Blame Culture?

In this blog post, I would like to share with you some of the scenarios to recognize if we are instead in blame culture organizations when it comes to risk management.

29 July 2021
Hybrid Security COnsiderations
@ISACA Article

Caught In Between: Evolving Security Challenges for the Hybrid Workplace

After a year and a half of pandemic, most audit, security and governance professionals have grown comfortable with the “remote work” risk landscape.

28 July 2021
State of Cybersecurity
@ISACA Article

State of Cybersecurity: Reputational Damage from Attacks Tops List of Concerns

With high-profile cyberattacks such as the SolarWinds incident and the Colonial Pipeline ransomware attack on the rise, global government and business leaders are challenged to keep pace with the barrage of threats.

28 July 2021
Daisy Madeleine Jardine-Viner
@ISACA Article

The Final Decision: Which Cybersecurity Job Offer Should I Accept?

As a recruiter, it isn’t uncommon for my cybersecurity candidates to end up with three or four job offers. I recently worked with a candidate who was trying to decide between seven! In this in-demand field, how do you work out which job offer to accept?

28 July 2021
Shawn Rhodes
Blog Post

Seeing the Impact of Change in Real Time

Shawn Rhodes, TEDx Speaker and a nationally syndicated columnist, recently visited with ISACA Now to discuss the evolving risk landscape, managing change and more.

28 July 2021
Partly Cloudy or Clear Skies Ahead?
ISACA Journal Article

Partly Cloudy or Clear Skies Ahead?

In a recent survey of general counsel at large enterprises, titled The General Counsel Report 2021: Rising to Today’s Challenges and Building Resilience for the Future, the majority of respondents indicated that the risk they feel their organizations are most notably ill prepared to navigate is the impact of “emerging” data sources on ediscovery—the process of collecting, analyzing and reviewing electronic evidence—for legal matters, investigations and regulatory compliance.

Authors: Tim Anderson, Ted Barassi and Ted Barassi
ISACA live tile
Podcast

The Lowdown on IoT

Join ISACA's Dustin Brewer as he tells you what you need to know about IoT now – why is it still considered an emerging tech? What are the biggest cybersecurity threats, and what opportunities will the Internet of Things bring in the next five years?

28 July 2021
Sandra Ajimotokin
Blog Post

AI Looms as Major Variable on Cyberthreat Landscape

Artificial intelligence is one of those big, scary topics that can incite fear, excitement, or a bit of both. Security professionals such as myself wonder how increased usage of AI and machine learning will help to shape the future state of our work.

27 July 2021
Guy Pearce
Blog Post

Privacy By Design: How Far Have We Come?

One can hardly consider any part of the data value chain today – from data acquisition to data archiving or disposal – without considering privacy.

26 July 2021
Neeraj Benjamin
Blog Post

Is Blockchain the Ultimate Cybersecurity Solution for My Applications?

Blockchain technology can offer important cybersecurity benefits, such as reducing cyberattacks, and it has recently created a lot of hype as a panacea for all the current challenges related to information security.

23 July 2021
Blog Post

New Points of Connection for ISACA's Global Community

Whether it is our chapters collaborating in new ways, the rise of virtual and hybrid conferences, or growing traction on the Engage platform, ISACA’s global community has come even closer together despite the challenges brought on by the pandemic.

22 July 2021
Podcast
Podcast

Breaking Down the ESET Threat Report

ESET has released its T1 2021 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research.

22 July 2021
ShanShan Pa
@ISACA Article

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up.

21 July 2021
Optimizing Risk Response
@ISACA Article

New Paper Explores Combination of Risk Responses for Enterprises to Weigh

Risk response is a part of daily life – every time drivers get in a car, they actively implement strategies to respond to driving-related risks through wearing a seatbelt, being a defensive driver, and having a car with enhanced safety features. However, everyone is willing to take on a different level of risk, which makes matters complicated.

21 July 2021
Gary Carrera
@ISACA Article

Preventing the Next Cybersecurity Attack with Effective Cloud Security Audits

The use of cloud services to support business needs has exponentially increased over the past years. Most companies have now moved from traditional IT environments to private or public cloud deployments to support IT, security and business needs.

21 July 2021
Caitlin McGraw
@ISACA Article

What Do You Want Your Career to Be? Now’s the Time to Ideate

The second half of 2021 is the ideal time to dream, plan, revise and set new goals. This second half of the year is like none other before. Many are reclaiming a sense of normalcy after a health crisis that shut down the world. It is tempting to dive into that with trips...

21 July 2021
Sunil Bakshi
Blog Post

A Nuanced View of Risk Response

Managing risk is not easy despite it often being considered “common sense” since we do risk assessments all the time in our day-to-day life.

21 July 2021
Prevention of Vulnerabilities in Software Development Using Design Thinking
ISACA Journal Article

Prevention of Vulnerabilities in Software Development Using Design Thinking

In today’s software delivery, the Agile methodology is one of the most widely adopted approaches. Agile has several variants such as Scrum, XP, Kanban and Scrum Bann.

Authors Thejasvi Nagaraju and Shubhamangala Aithal
How IoT Has Changed, and Why It’s Still Considered ‘Emerging Tech’
Blog Post

How IoT Has Changed, and Why It’s Still Considered ‘Emerging Tech’

Even though the IoT originated 15 years ago, organizations in 2021 continue to define IoT as an emerging piece of technology.

20 July 2021
Sushila Nair
Blog Post

Wanted: A Cybersecurity Upton Sinclair

The drumroll of ransomware attacks featured on the evening news, such as the recent Kaseya incident or the Colonial Pipeline incident in the US, has brought the issue further into the public’s awareness.

19 July 2021
Isaac Kohen
Privacy Article

How to Promote Privacy Best Practices at Work

Data privacy is increasingly top-of-mind for today’s executives. The 24th Annual Global CEO Survey—US Findings found that chief information security officers (CEOs) ranked cybersecurity and data privacy second among 11 areas of impact and value, which is why many organizations are putting financial resources behind privacy initiatives.

19 July 2021
Tony Martin-Vegue
Governance Article

The Elephant in the Risk Governance Room

Effective risk governance means organizations are making data-driven decisions with the best information available at the moment.

19 July 2021
Larry Marks

Rethinking Cyberresilience

The National Institute of Standards and Technology (NIST) Special Publication 800-160 has caused organizations to do some rethinking when it comes to cyberresilience and disaster recovery, and what this standard means to existing plans.

15 July 2021
Podcast
Podcast

Cybersecurity Isn’t Real, Right? Wrong!

Every day, the risk of cyber and ransomware attacks regularly increases in frequency and danger. But despite the proof in numbers, many organizations still don’t recognize the need to fortify their fortress and improve the strength of their Cybersecurity practices.

15 July 2021
Advanced Security
@ISACA Article

Encryption and Extended Monitoring to Protect Secret Information

All companies —no matter how small— need some form of a security program to protect their secret information. However, the security that is currently in place to protect those secrets are oftentimes insufficient.

14 July 2021
Ravikumar Ramachandran
@ISACA Article

Five Ways Frameworks Can Drive Your Organization’s Digital Transformation

The top executives and CEOs of organizations across the globe are overwhelmed trying to cope with changing technological developments and customer expectations.

14 July 2021
Julia Kanouse
@ISACA Article

ISACA Community Finds New Connection Points

The power of community is ISACA’s secret sauce. It’s what binds our global community together, and never has that been more evident than during the pandemic.

14 July 2021
Yotam Ben Ezra
Blog Post

Bridging the Gap Between Security and the Business: A New Approach to Business Risk Quantification

In the security arena, today’s teams have to navigate significant layers of complexity, contending with too many different standards and too many disparate technologies. When we talk about security, we have a lot of buzzwords, catchphrases, and, of course, acronyms, which too often serve to compound the confusion.

14 July 2021
The Changing Face of Education
ISACA Journal Article

The Changing Face of Education: Risk, Security and Process Around Distance Learning

The digital revolution has changed many industries, including education. Although digitized learning platforms have made education and information more easily accessible, they have also brought on a rise in cybersecurity and other process risk that must be addressed.

Author: Glorin Sebastian
Josh Hamit
Blog Post

What Do CIOs Want from IT Newcomers? Adaptability

How can recent graduates and other newcomers to IT fields make an impression on CIOs and other enterprise technology leaders who are looking to hire? Josh Hamit, vice president and CIO with Altra Federal Credit Union, recently visited with ISACA Now to describe what characteristics he finds most promising in early-career candidates.

13 July 2021
Antonio Ramos
Security Article

How to Determine the Cybersecurity Level of Your Value Chain

Assuring that third parties with access to systems and/or information do not pose a risk to business is a major pain for most organizations, but there are ways to assess the level of cybersecurity that a vendor provides.

13 July 2021
ShanShan Pa
Blog Post

Let Your Data Spark Joy

One day I was having a conversation with my friend Takaya regarding holiday plans during the global pandemic. I figured since there’s nowhere to go, I might just try Marie Kondo’s life-changing magic of tidying up. Plus, the person I was speaking with is also a privacy fanatic like me...

12 July 2021
Anna Johannson
Blog Post

How AI Can Make Your Office More Safe and Secure

It’s hardly news that artificial intelligence has amazing potential to boost organizations’ productivity and workflows

9 July 2021
David Cross
Security Article

Security Inventors Need Not Apply

Part of what makes a cyberjob appealing is that you get to invent, build the “killer application (app)” or make a new breakthrough. That is the appeal for many brilliant creative types, but the reality is that the cybersecurity realm does not allow much leeway for creativity.

9 July 2021
A (Kind of) Quantitative Approach to Organizational Risk Tolerance
Blog Post

A (Kind of) Quantitative Approach to Organizational Risk Tolerance

At times it seems risk tolerance relates to the famous quote on congressional accomplishments, “When all is said and done, there is a lot more said than done.” This is likely because the term is often used qualitatively. That is, we describe one organization as more or less risk tolerant than another without addressing how much more or less.

8 July 2021
Podcast
Podcast

Building a Zero-Trust Network Platform

Finding a balance between a pleasant user experience and stringent security requirements can be a challenge.

8 July 2021
John P. Pironti
@ISACA Article

Five Key Considerations When Adopting a Seed Vault Approach for Ransomware Protection

A “seed vault” approach to ransomware protection can be a last-resort method for organizations to access their data in the event of a catastrophic availability event such as a ransomware attack.

7 July 2021
ISACA awards
@ISACA Article

Have a Question for ISACA Leaders? Join Our ‘Ask Me Anything’

ISACA members can join ISACA Director Veronica Rose, ISACA Board Chair Gregory J. Touhill and ISACA CEO David Samuelson as part of a new “Ask Me Anything” Leadership Series.

7 July 2021
R.V. Raghu
@ISACA Article

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

7 July 2021
Caitlin McGraw
@ISACA Article

The Best Interview Hack? Start With Rethinking Your Résumé

Most people face job interviews with a degree of trepidation about the unknown-ness of it all. There is the sense of the interview being sort of a black box. The biggest bogey is trying to suss out what the hiring team is really looking for.

7 July 2021
Ravikumar Ramachandran
Blog Post

Architecting COBIT for Governance Success

While I was in the process of implementing the ISO 27001 standard for a mission-critical healthcare system for one of the major health care organizations in India, I became COBIT-certified, and I took the opportunity to use COBIT to ensure compliance not only in an ISO 27001 audit but also in the privacy assessment that the organization was undergoing at the same time, which was conducted by a government agency.

7 July 2021
A Trusted Secure Ecosystem Begins With Self-Protection
ISACA Journal Article

A Trusted Secure Ecosystem Begins With Self-Protection

As the connected digital ecosystem expands, cyberthreats and vulnerabilities are gaining momentum at an unprecedented scale. Creating a healthy immune system on every device is critical to build cyberresilience and protect organizations, end users and networks from malicious attacks.

Author: Thorsten Stremlau
Andrea Tang
Privacy Article

Cross-Border Data Transfer and Data Localization Requirements in China

In 2020, China launched a global data security initiative focused on strengthening international coordination for cross-border data flow and outlining the principle of personal information protection.

6 July 2021
Larry Alton
Blog Post

Three Ways the IT Department Can Boost Customer Retention

When a business’s decision-makers develop a customer retention strategy, they typically involve certain critical team members such as the marketing director, in these discussions.

2 July 2021
Tuan Phan
Blog Post

Did the FBI Hack Bitcoin? Deconstructing the Colonial Pipeline Ransom

On 7 May, 2021, Colonial Pipeline, a US oil pipeline system, that mainly carries gasoline and jet fuel to the southeastern United States suffered a ransomware cyberattack that impacted the computerized equipment that managed the pipeline.

1 July 2021
ISACA awards
@ISACA Article

2022 ISACA Awards Call for Nominations

Each year, ISACA recognizes outstanding contributions that advance our professional community and exemplify our leadership and purpose.

30 June 2021
Three Things COBIT® Is – And Three Things It Isn’t
@ISACA Article

3 Things COBIT Is & 3 Things It Isn’t

For over 25 years, COBIT 2019 has built on and integrated best practice frameworks that are used to develop and promote the process of understanding, designing and implementing enterprise governance of IT (EGIT).

30 June 2021
Cobit Application Rationalization
@ISACA Article

Achieving Application Rationalization Using COBIT 2019

How many applications does the average organization use? Research shows that, typically, an organization with 200 to 501 employees uses 123 applications.

30 June 2021
Ginger Spitzeri
@ISACA Article

Connecting Community to Build the Future of Cybersecurity

ISACA’s annual State of Cybersecurity report provides an environmental scan of the cyber workforce and real-world implications of enterprise budgets, the length of time required to fill positions, and what skills cyber professionals need to ensure success in their roles.

30 June 2021
Evolving Cybersecurity
@ISACA Article

Evolving Your Cybersecurity Through Cyber Maturity

In a recent ISACA survey that asked participants what their top cybersecurity program goals were, more than 73 percent cited that achieving continuous improvement of cyber security was their number-one need.

30 June 2021
Sean Ways
Blog Post

Transformation Goes Beyond Hardware, Software

Technology drives everything that we do at ISACA – whether that is powering members’ pursuit of a career-changing certification, providing an array of flexible virtual learning opportunities, offering support and resources for our global chapters – the list goes on.

30 June 2021
j21v4-RBAC
ISACA Journal Article

Information Security Matters: RBAC, BCM & SoD

What a perfect information technology headline! Three acronyms and not a single word. But they are three important concepts in information security, and I would like to take a few pages to explore their intersection.

Author: Steven J. Ross
j21v4-driving-digital
ISACA Journal Article

The Network: Driving Digital Transformation

Information technology is changing the world. It is transforming how we interact, learn and communicate. Around the world, IT fuels national prosperity and security, and ISACA members are at the forefront of optimizing and securing the digital ecosystem.

Author: Gregory Touhill
j21v4-algorithmsand-audit
ISACA Journal Article

IT Audit in Practice: Algorithms and Audit Basics

I must admit, when I saw the theme of this volume of the ISACA Journal, algorithms, or as we call them at work “algos,” I thought, “There’s a topic I don’t understand.” Of course, that is not really the case because every industry I have worked in uses algorithms...

Author: Cindy Baxter
j21v4-the-student
ISACA Journal Article

The Bleeding Edge: The Student Becomes the Teacher

If you have been following this column, you have probably recognized some recurring themes, one of those themes being that for everyone, especially IT personnel, continuing education is never finished.

Author: Dustin Brewer
j21v4-algorithms-and-the-enterprise
ISACA Journal Article

Algorithms and the Enterprise Governance of AI

Alan Turing (1912-1954), a founding father of artificial intelligence (AI) and the inventor of the Turing Test that determines whether a computer can think, defined algorithms as sets of precise instructions for solving problems.

Author: Guy Pearce and Maureen Kotopski
j21v4-to-bot-or-not
ISACA Journal Article

To Bot or Not to Bot? That Is the Question for Digital Banking

There is a legendary proverb that emphasizes that a journey of a thousand miles begins with a single step. In this case, the first step is highlighting the concept of digital banking by introducing the idea of chatbots or bots.

Author: Luis Emilio Alvarez-Dionisi
j21v4-how-can-AI
ISACA Journal Article

How Can AI Drive Audits?

Auditing is viewed as a manual, subject-matterdriven, tedious and sometimes highly subjective practice. With the digital disruption that surrounds IT professionals, it is time to explore how the next generation of artificial intelligence (AI), natural language processing...

Author: Shini Menon
j21v4-how-effective
ISACA Journal Article

How Effective Is Blockchain in Cybersecurity?

Recently, blockchain technology has created a lot of hype as a panacea for all issues related to information security. Blockchain technology provides stronger transactional security than traditional, centralized computing services for secured networked transaction ledger.

Author: Neeraj Benjamin
j21v4-retooling
ISACA Journal Article

Case Study: Retooling Carbon Accounting—Better Business, Healthier Planet

Salesforce, a San Francisco, California, USA-based enterprise with a global workforce exceeding 54,000, offers a broad range of cloud software and services, including customer relationship, customer service, marketing automation, analytics and application development.

Author: Mick Brady
j21v4-Information-System
ISACA Journal Article

Modern IT Operations: Ninja, Samurai or Ronin?

For decades, the IT discipline has suffered from a division between its two main entities: the development team and the operations team. This segregation of duties (SoD) has resulted in different mindsets, models and tools, and competing and conflicting objectives.

Author: Abdelelah Alzaghloul
j21v4-how-do-organizations
ISACA Journal Article

How Do Organizations Control Their Use of Social Media? Part 1

A few years back, there was an Irish enterprise that based its whole business model on its social media presence. This was a vital part of the enterprise’s business strategy, and it prided itself on its use of social media channels. So, it was no surprise when the chair...

Author: Robert Findlay
j21v4-HELP-source
ISACA Journal Article

HelpSource Q&A

How much cybersecurity budget or investment does an organization need to effectively plan to reduce the number of security incidents and data breaches? How can security practitioners convince the board of directors (BoD) to approve this budget?

Author: Sunil Bakshi
Cyberresilience in an Evolving Threat Landscape
ISACA Journal Article

Cyberresilience in an Evolving Threat Landscape

It is important to know if one’s organization is robust enough to survive in the event of a security event, let alone expand and improve. Many reputable cybersecurity organizations are publishing guidance on how to respond in the event of a theft or data breach.

Author: Larry Marks
Benjamin Hentschel
Blog Post

Mountain Climbing and the CGEIT Exam: Relishing the Journey

Studying for a certification is not so different from any other endeavor, whether it be professional or personal. One of my hobbies for over a decade has been hiking mountains of all shapes and sizes.

29 June 2021
Ookeditse Kamau
Blog Post

Accounting for Cyber Fraud Risks During Audit Planning

With a changing global economic outlook, there has been a correlated shift in the fraud landscape, and how audit leaders should manage it. An assessment of fraud possibility is a requirement when carrying out an audit engagement, after all.

28 June 2021
Babur Kohy, CDPSE, CASO, and Michael M. Dowd CASO, XRY
Privacy Article

Advertising Technology: The Invisible Tracker Cheating Privacy

There are many privacy concerns impacting humanity across the globe—one of which is advertising technology (ad tech).

28 June 2021
Podcast
Podcast

Advance Security for Secret Information

Listen in as ISACA Journal columnist, Steven Ross, CISA, CDPSE, AFBCI, CISSP, MBCP, delves deeper into his latest article, “Advanced Security for Secret Information.” As a follow up to his two previously published journals, “Keeping Secrets,” and “Secrets and Privacy,” Ross continues to make the case that the protection of secret information is becoming a significant issue in cybersecurity.

28 June 2021
Farhan Imitaz
Blog Post

Is Traditional Detection and Response Reliable?

I have been in the security industry and helped customers with their cybersecurity business challenges for the last 15 years; therefore, I have had the opportunity to witness and experience the evolution and modernization of attack vectors, the evolution of advanced tactics and techniques and the expansion of the attack surface.

25 June 2021
Avani Desai
Blog Post

How IOT Opportunities and Risks Will Evolve in a Post-Pandemic Environment

According to the World Economic Forum, the number of connected devices exceeded 50 billion last year.

24 June 2021
Cybersecurity-merryGoRound_0621_tile_500
@ISACA Article

Cybersecurity Merry-Go-Round

There are many US citizens outside the cyber industry who only pay attention to cybersecurity incidents when they are affected by them. It can be argued that every data breach directly affects those whose personally identifiable information (PII) was accessed by...

23 June 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

QR Code Security Challenges

Quick Response (QR) codes are rising in popularity. According to a survey conducted by MobileIron, more than 66% of respondents stated that a QR code makes life easier in a touchless world–despite a majority of people lacking security on their mobile devices.

23 June 2021
Daisy Jardine-Viner
@ISACA Article

Three Ways to Limit Burnout and Improve Work-Life Balance in Cybersecurity

As a recruiter, it’s my job to speak with professionals who are actively or passively considering looking for a new job. One of the most common discussions I have now (even more so since the pandemic) is around work-life balance and burnout.

23 June 2021
Amy Witkowski
Blog Post

Redefining Effective Project Management

As we undergo a digital transformation at ISACA, one key element has been strategic project management.

23 June 2021
A Novel Approach for Government Acquisition and Procurement
ISACA Journal Article

A Novel Approach for Government Acquisition and Procurement

In 2015, the commissioner of US Customs and Border Protection (CBP) engaged the Defense Acquisition University (DAU) (Fort Belvoir, Virginia, USA) to review CBP’s acquisition and procurement performance.

Authors: Steven Moyer, Gunter Brunhart, Richard Dubs, Thomas Erickson, Robert Skalamera, Rob Kepner
ISACA live tile
Podcast

ISACA’s Digital Transformation Part II — People, Process, and Technology

David Samuelson is back and continuing his discussion of ISACA’s Digital transformation. This time David interviews members of ISACA’s IT team — CTO, Simona Rollinson; Sr. Director, Application Development, Sean Ways; and Sr. Director of Enterprise Project Management, Amy Witkowski.

23 June 2021
ISACA live tile
Podcast

ISACA’s Digital Transformation Part I — Positive Potential of Technology

Join ISACA’s CEO David Samuelson as he discusses the positive potential of technology with ISACA’s Chief Product Officer, Nader Qaimari.

23 June 2021
Silvana Carpineanu
Blog Post

How Mid-Sized Businesses Can Overcome Cybersecurity Challenges

Growing cybersecurity concerns, combined with regulation and compliance challenges, are a problem for enterprises of all sizes including mid-sized companies.

22 June 2021
Digital-transformation_250
Blog Post

ISACA Talks Digital Transformation

ISACA hosted a LinkedIn Live discussion last week regarding new strategies that are being developed and implemented as part of ISACA’s ongoing digital transformation, and how those efforts will benefit members.

22 June 2021
Gary Carrera
Blog Post

How Cloud-Based Mobile Device Management Supports Remote Working

Years ago, companies managed their devices manually and often using solutions allowing capabilities for device management activities.

21 June 2021
RV Raghu
Blog Post

Rethinking Risk Response in the Digital Enterprise

What does the term risk response, or risk treatment, as it is sometimes colloquially known, suggest (especially the word “treatment”)? If you are like me, treatment probably signifies risk is something that is bad, like a disease, and hence needs to be treated, or worse is like industrial effluent that needs treatment before being released into nature.

18 June 2021
Tom Faraday
Blog Post

Metrics that Matter: Measuring Organizational Performance in a Post-Pandemic World

There’s no question that environmental, social and corporate governance (ESG) is on the minds of almost every board member and C-suite leader, but it has expanded beyond the boardroom and is now also top of mind for investors and consumers. This all happened—or at least was accelerated—as a result of the COVID-19 pandemic.

17 June 2021
At-ISACA_web_Tips-Rising-Professionals_061621_500
@ISACA Article

Five Ways for New IT Pros to Accelerate Career Growth

Gaining a foothold in IT careers can be intimidating for industry newcomers, given the rising complexity of the technology landscape and the evolving privacy and security threats professionals must learn to mitigate.

16 June 2021
Caitlin McGraw
@ISACA Article

What the Heck is ‘Auditor Instinct’? IT Audit and Security Leaders Provide the Low-down

For years, I have had IT audit directors ask me, as a recruiter, to look for experienced IT audit professionals with “auditor instinct” – that ability to “just know” when something isn’t quite right and when more questions and more digging are is needed to surface the big issues, the root causes, the major findings.

16 June 2021
GRC Conference
@ISACA Article

Virtual and In-person Options Available for 2021 GRC Conference

A high degree of flexibility for learners will mark the hybrid 2021 GRC Conference, taking place 9–11 August. The conference, put on jointly by The IIA and ISACA, will take place in Denver, Colorado, USA, as well as virtually.

16 June 2021
New Resource Illustrates Synergies Between ITIL 4 and COBIT 2019
@ISACA Article

New Resource Illustrates Synergies Between ITIL 4 and COBIT 2019

Organizations looking to create value for their stakeholders can implement frameworks as effective tools for building structures, organizing thoughts, planning events and architecting businesses. A new free white paper from Axelos and ISACA discusses...

16 June 2021
Organizational Culture for Information Security
ISACA Journal Article

Organizational Culture for Information Security: A Systemic Perspective on the Articulation of Human, Cultural and Social Systems

Many international reports and research centers repeatedly insist that the individual is the most important element concerning information security and one of the most relevant when determining an information protection practice for organizations.

Author: Jeimy Cano
Podcast
Podcast

Just the Fax on Cybersecurity

Is your home printer or fax machine an IOT device? You bet it is! Dubbed ‘Faxploit’, research has shown how cyber criminals can infiltrate any home or corporate network by exploiting wireless printers and fax machines. A fax numbers is all it takes to launch this type of attack.

16 June 2021
Mark Thomas
Blog Post

Leverage COBIT and ITIL for Customer-Centric, Connected and Collaborative Organizations

The information and technology (I&T) industry has operated in a changing environment for decades, but it wasn’t until the recent convergence of many disruptive events that forced us to rethink our governance models.

15 June 2021
Veronica Rose
Blog Post

Practice Healthy Career Hygiene

Just like the way hygiene is comprised of conditions or practices conducive to maintaining health and preventing disease, especially through cleanliness, the practice of career hygiene is no different when it comes to preventing career risk, building career capital and maintaining a healthy career.

14 June 2021
Ron Quaranta
Blog Post

Understanding Blockchain Risks and the Coming Wave of Enterprise Adoption

In collaboration with AICPA & CIMA, ISACA published a joint white paper in April entitled “Blockchain Risk: Considerations for Professionals,” an important work that describes and provides background about specific risks related to blockchain implementation and operation.

11 June 2021
Nader Qaimari
Blog Post

The Case for Stackables in Addressing the Skills Gap

I have written before about how there are fractures in our current education system, globally, and how the skills gap continues to widen as there is misalignment between what students are taught in universities and what companies need and expect.

10 June 2021
Board of Directors
@ISACA Article

ISACA Installs 2021-2022 Board of Directors

ISACA welcomed its 2021-2022 Board of Directors last week during its virtual Annual General Meeting. The new board includes members with diverse backgrounds and a range of expertise from across the globe, including new Board Chair Gregory J. Touhill.

9 June 2021
Cloud Governance
@ISACA Article

Key Questions to Address for Effective Cloud Governance

The migration to the cloud is occurring faster than ever in an era of widespread remote work and increased need for speed and agility in conducting business. As enterprises move away from on-premise servers and embrace cloud computing and SaaS applications...

9 June 2021
Sunil Bakshi
@ISACA Article

The Peltzman Effect and Cybersecurity

The COVID-19 vaccination program designed to contain the pandemic is progressing rapidly across the globe. As the number of people who are vaccinated increases, experts have raised concerns about the Peltzman effect, wondering if people will feel more secure...

9 June 2021
Ulf Mattsson
Blog Post

Preserving Privacy With New Technologies

New technologies for data protection can arm innovative enterprises to win in an ever-changing, increasingly competitive digital economy.

9 June 2021
Graciela Braga
Governance Article

The Better the Board Management, the Better the I&T Governance

Today, information and technology (I&T) can have tremendous influence on whether an organization succeeds or fails.

9 June 2021
Sea Change in Risk Culture
ISACA Journal Article

Sea Change in Risk Culture

Until a few months ago, no one would have believed that large swaths of the workforce would be doing nearly everything from within the four walls of their homes, including, for example, the most complex banking transactions and other financial activities that normally involve walking into a bank branch office.

Author: Sumedha Adavade
Election Security 2020
Blog Post

Serving ISACA is Baked into My Professional DNA

Many in IT fields fixate on the new technology and tools that are regularly trumpeted to help us keep pace with new challenges. While the allure of technological innovation draws our attention, we often forget that technology must complement the people and processes...

8 June 2021
Nandita Rao
Blog Post

Building a Successful Strategy for the CDPSE Exam

Evolving privacy regulations and technology require companies to implement privacy by design and by default into products.

7 June 2021
Milica Vojnic
Security Article

What Role Does Data Destruction Play in Cybersecurity?

There are many concerns associated with the modern cybersecurity community. Robust firewalls, reliable cloud storage solutions, in-house IT support and antivirus bundles are all examples. Still, the role of data destruction should never be taken for granted.

7 June 2021
Vimal Mani
Blog Post

Cyberresilience: A Critical Cybersecurity Capability

The rapid evolution of cyberthreats leaves the gamut of risk assessment efforts undertaken by organizations inadequate in addressing cybersecurity concerns.

4 June 2021
Sourya Biswas
Blog Post

The Importance of Risk Assessments and Risk-Informed Decision Making

Recently, I wrote about the concept of “just enough security” and mentioned how “striking the balance between too much, not enough, and just enough security is no cakewalk.”

3 June 2021
The Privacy-Research Connection
@ISACA Article

The Privacy-Research Connection

Medical research and clinical trials have long been relied on as means of obtaining useful, accurate data to learn more about diseases and their potential treatments.

2 June 2021
Caitlin McGraw
@ISACA Article

The Risk of Remote Work

When it comes to how people work, 2020 was a fantastic experiment, demonstrating that millions of professionals in myriad roles, across a plethora of company sectors and sizes, around the world, can successfully work remotely.

2 June 2021
Colonial Pipeline Attack Infographic
@ISACA Article

ISACA Pulse Poll: Ransomware Insights in the Aftermath of Colonial Pipeline

The Colonial Pipeline attack caused massive disruptions to gasoline distribution in parts of the United States in May, resurfacing preparedness for ransomware attacks as a front-burner topic for enterprises around the world.

2 June 2021
Sneha Dasgupta
Blog Post

Four Things I’ve Learned as an Early-Career Professional To Help Create Trust

As an early-career professional, I have learned – through experience and an amazing set of mentors – that two of the most crucial qualities that can impact your career opportunities are: Integrity and Credibility.

2 June 2021
Guy Pearce
Blog Post

Beware the Privacy Violations in Artificial Intelligence Applications

It has been proposed that, “Privacy matters to the electorate, and smart business looks at how to use data to find out information while remaining in compliance with regulatory rules.” Since “smart business” also consists of “the electorate” as employees, at least one...

27 May 2021
Daisy Jardine-Viner
@ISACA Article

Developing Your Career in Cybersecurity

In my previous article “Becoming a CISO,” one of the core pieces of advice was to stay curious and always learn. In the cybersecurity space, learning and development is crucial to progression.

26 May 2021
CMMI V2.2
@ISACA Article

Announcing CMMI V2.2 Release – Security and Safety

ISACA’s new CMMI Model content describes best practices for holistically defining security and safety strategies, approaches, activities, and functions necessary to protect an organization’s entire ecosystem, including personnel, resources and information.

26 May 2021
The Role of the Supply Chain in Security
@ISACA Article

The Role of the Supply Chain in Security

One of the many unexpected consequences of the COVID-19 pandemic has been the global computer chip shortage—or reallocation, as described by security expert Frank Downs in the “Supply Chain Security Considerations” episode of the ISACA Podcast.

26 May 2021
Cyberrisk Quantification
@ISACA Article

Explore Cyberrisk Quantification With Free ISACA Resource

Cyberrisk quantification (CRQ) expresses cybersecurity risk in terms of monetary value to the enterprise. A new white paper from ISACA, Cyberrisk Quantification, addresses the importance of acquiring useful data and amplifying it as part of a CRQ analysis.

26 May 2021
Jack Freund
@ISACA Article

Cyberrisk Quantification Purity Tests

Measurement can be a tricky thing. Many practitioners want more ways to measure the effectiveness of cybersecurity programs to determine whether they are doing the right things to protect their organizations.

26 May 2021
Paul Phillips
Blog Post

Converting Technology Language to Business Language with Cyberrisk Quantification

Cyber risk is continuously evolving. Companies are dealing with different threat actors and events every day, which is why cyber is the fastest-growing risk for many enterprises, and why cybersecurity ranks among the top priorities for global organizations.

26 May 2021
A hand touching a computer server
Governance Article

A Systematic Approach to Implementing a Governance System Using COBIT 2019

Effectively addressing the challenges posed by the COVID-19 crisis requires not just a management system but a governance system that is designed with a primary focus on stakeholder needs and continually serving customers.

26 May 2021
Lost in the Woods
ISACA Journal Article

Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard

George is an inexperienced hiker. He is lost in the woods and it is dark. He wants to go back to civilization. He has a global positioning system (GPS) navigator, but he does not know how to use it correctly.

Author Ioannis Routsis
Tracey Dedrick
Blog Post

Proud to Be Part of ISACA’s Growth and Resilience

First and foremost, it has been my great honor and privilege to serve as Chair of the ISACA Board of Directors. It has been my true pleasure to be surrounded by the sincere dedication of the staff, the board and ISACA members around the world.

25 May 2021
Chris Cooper
Blog Post

Ransomware Defense Calls for Solid Fundamentals, Rigorous Enforcement

Every 11 seconds, an employee will click on a link or open an attachment in a seemingly innocent email and his or her organization will be rapidly infected with ransomware.

24 May 2021
Ali Pabrai
Security Article

APTs Require Enhanced Cyberdefense

Advanced persistent threats (APTs) are introduced by adversaries that possess sophisticated levels of expertise and significant resources, which allow them to achieve their objectives by using multiple attack vectors (e.g., cyberattacks, physical attacks, deception).

24 May 2021
Sizing up the New US Executive Order on Cybersecurity
Blog Post

Sizing up the New US Executive Order on Cybersecurity

For years we have seen standards, regulations and legislation arise in the aftermath of a cyber incident or shifts on the technology landscape.

21 May 2021
A Modern Perspective on IT Risk
@ISACA Article

A Modern Perspective on IT Risk

With cybercrime and related threats on the rise, and increased global spending on cybersecurity with not much impact on risk reduction, there is a need for change. “Let’s switch our mindset from the old management style that uses outdated thinking and slows remediation, and instead look to a forward, modern perspective,”...

19 May 2021
ISACA Conference Keynoters
@ISACA Article

ISACA Conference Keynoters Deliver Calls to Action

ISACA Conference North America 2021 united business IT professionals in many roles and disciplines. One commonality in attendees’ careers is the desire to bring more passion, leadership and bravery to both their work and personal lives. The conference’s three keynote presenters...

19 May 2021
Remote Engagements, Audit Fatigue Among Challenges for Auditors
@ISACA Article

Remote Engagements, Audit Fatigue Among Challenges for Auditors

“As auditors, we abide by clear rules that are repeatable,” Doug Landoll said this month in his ISACA Conference North America presentation, “Remote Assessments: Retooling Security Risk Assessments in a Pandemic Environment.” He shared some of the work-around solutions...

19 May 2021
Mary Breslin
@ISACA Article

Revisiting Third-Party Risk in the Pandemic Era

Pandemic-driven disruption has drastically changed the way most organizations conduct business, and that includes third-party vendors upon which many companies heavily rely.

19 May 2021
Cybersecurity War
@ISACA Article

Why We’re Losing the Cybersecurity War

It’s time to admit we’re losing the cybersecurity war and become more accountable about the real reasons why.

19 May 2021
Demystifying the Implementation of Cyberresilience Programs
ISACA Journal Article

Demystifying the Implementation of Cyberresilience Programs

Cyberattacks are emerging faster than ever across the world in the wake of the COVID-19 pandemic. With newer dimensions incorporated into emerging disruptive cyberattacks, organizations globally are more vigilant about protecting their critical information assets.

Author: Vimal Mani
Gary Carrera
Blog Post

Best Practices to Implement Secured Cloud Collaboration Tools

According to a recent study published by Gartner Inc., end-user spending on public cloud services could grow 23.1% in 2021, reaching US$332.3 billion compared to $270 billion in 2020.

18 May 2021
Tuan Phan
Blog Post

Hidden Insights from The Pulse: Emerging Technology 2021

In The Pulse: Emerging Technology 2021 report, ISACA sought feedback on specific emerging technology trends, training, and implementations, to identify and establish a baseline of what constitutes an emerging technology, as these definitions can vary from person-to-person or between organizations.

18 May 2021
Podcast
Podcast

The Relationship Between Privacy and Research

Volunteering to participate in medical research is a commendable act of service, but to do so can understandably raise questions about subject privacy. In this episode of the ISACA Podcast, ISACA Journal columnist Cindy Baxter discusses...

18 May 2021
Tony Luciani
Blog Post

Achieving Continuous Compliance and IT Control Automation

Every organization has to comply with regulations and control frameworks. As assurance professionals, we are often tasked with understanding the compliance requirements, validating the compliance controls’ design, and then testing the control effectiveness.

17 May 2021
Kelly Hood
Privacy Article

Building a Solid Foundation for Privacy: What Data Exist?

As more privacy regulations are released, organizations must evaluate their privacy capabilities. However, it is difficult to know where to start. The first thing organizations need to do to make sure they are being responsible is to determine what data they possess.

17 May 2021
Jason Yakencheck
Blog Post

Understand the Cyber Skills Shortage to Get Ahead

Cybersecurity remains a seller’s market. Threats and exploits continue to be more sophisticated and increase in frequency

14 May 2021
Nader Qaimari & David Samuelson
Blog Post

Building the Foundation for ISACA’s New Learning Pathways

Nader Qaimari, Chief Product Officer at ISACA, was interviewed by ISACA CEO David Samuelson on 7 May in a LinkedIn Live discussion on ISACA’s digital transformation and how it is supporting the evolving learning resources for ISACA’s professional community. The following is an excerpt from the conversation.

13 May 2021
Congratulations to the 2021 ISACA Hall of Fame Inductees
@ISACA Article

Congratulations to the 2021 ISACA Hall of Fame Inductees

ISACA is pleased to honor the 2021 Hall of Fame inductees for their thought leadership, volunteer service and/or engagement activities. Earlier this year ISACA announced the legacy inductees to initiate this new honor, and to complete the first class of this member-to-member recognition...

12 May 2021
Risk
@ISACA Article

Fighting Risk to Find Resilience

Digital transformation can add value to an organization and position it to become—and stay—resilient. But to accomplish this, “you have to have some way of measuring both your maturity today and where you are in the digital transformation journey,” ServiceNow’s ...

12 May 2021
IoT
@ISACA Article

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword. GRC systems target a fusion of three elements that should harmoniously exist in business...

12 May 2021
Sunil Bakshi
@ISACA Article

Is Outsourcing Truly Considered Risk Sharing?

Risk management practices specify that every risk be identified and assessed. Based on the risk assessment, one or more of the following four risk management options can be chosen as the preferred method of addressing the risk...

12 May 2021
Thomas Kyei-Boateng
@ISACA Article

Welcoming Thomas Kyei-Boateng: ISACA’s new CFO

Thomas Kyei-Boateng joined ISACA in May as Chief Financial Officer (CFO). Thomas is a strategic finance professional with 15 years of progressive experience in financial leadership roles at some of the world's biggest organizations, including Capital One Financial Corporation...

12 May 2021
Ron Lear
Blog Post

Performance and Compliance – Stop the Level Chase!

Take a maturity level-based compliance framework as a compliance example. The intention and design of these frameworks is that compliance can be boiled down to a single number, e.g. maturity level 3, which theoretically then equates to certain demonstrable performance expectations.

12 May 2021
Neil Harper
Blog Post

Bridging the Digital Divide

Niel Harper is an ISACA Global Achievement Award-winner for “contributions to capacity building across the world towards the development of affordable, open and user-centric Internet infrastructure.” Find out more about Niel’s background and achievements in the Q&A below.

11 May 2021
Alejandro Mijares
Security Article

The US FFIEC’s Cybersecurity Assessment Tool in Numbers

In an era of hyperconnectivity, cybercriminals are constantly innovating their tactics to exploit human error and technological vulnerabilities. Adapting to the changing threat landscape is essential for any organization to remain secure in the digital age.

11 May 2021
Podcast
Podcast

Supply Chain Security Considerations

The computer chip shortage resulting from the COVID-19 pandemic may sound like a mere supply chain issue, but the ramifications of it have also been felt in the cybersecurity sector.

11 May 2021
Guy Pearce
Blog Post

Data Resilience: A Hero’s Journey for Data Professionals

In the archetypal hero journey, once ordinary characters, such as Luke Skywalker, Frodo Baggins, Arya Stark, Katniss Everdeen or even the android, Data, leave what they know to pursue a quest, facing many extraordinary, fantastic and sometimes supernatural predicaments or dilemmas in an unknown world.

10 May 2021
Binita Patel
Blog Post

Fill in Gaps from University Studies for Early Career Success in InfoSec

The world of InfoSec is full of opportunities and challenges, but not everyone is ready to tackle them right out of school.

7 May 2021
Larry Alton
Blog Post

Practical Tips to Get the Right Cybersecurity Insurance for Your Company

Falling victim to a cyberattack isn’t an experience anyone wants to deal with. However, cyberattacks are always a potential threat and cause devastating consequences. Just in the first half of 2020, 36 billion records were exposed in data breaches. The effects of those breaches will be felt for quite some time.

6 May 2021
Blockchain Risk Considerations for Professionals
@ISACA Article

Complimentary Guide Explores Blockchain Risk

Blockchain can bring transformational benefits to businesses, but also comes with risks that need to be identified and mitigated, as detailed in a new joint white paper from ISACA and AICPA, Blockchain Risk: Considerations for Practitioners.

5 May 2021
How to Stay on Top of Data Privacy Changes and Ensure Ongoing Compliance
@ISACA Article

How to Stay on Top of Data Privacy Changes and Ensure Ongoing Compliance

After a flurry of activity and changes to privacy settings and disclosure, many felt they could move on once they had checked that compliance box. But things have not remained static from a regulatory standpoint

5 May 2021
Caitlin McGraw
@ISACA Article

Improving the Odds of Your Résumé Reaching the Hands of a Human

Talent acquisition and HR teams like ATSs because they reduce the hours spent by humans (often too few in HR functions) reading résumés. Presumably, the AI in the ATS system can parse for key words and match those to a job description and any other custom parameters that a company builds into their résumé screening.

5 May 2021
State of Cybersecurity 2021
@ISACA Article

State of Cybersecurity 2021: Cyber Field Thriving Despite Pandemic

Despite the widespread economic damage resulting from the COVID-19 pandemic, the cybersecurity industry has remained relatively unscathed, according to ISACA’s State of Cybersecurity 2021 study.

5 May 2021
Annual Report
@ISACA Article

The Power of Technology in a Pandemic

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available...

5 May 2021
Avani Desai
Blog Post

How IoT-Specific Knowledge Helps GRC Professionals – And Why It Matters

In a world brimming with more smart devices than people and with a growing percentage of us tethered to the internet, GRC has become far more than an acronym buzzword.

May 5 2021
Cyberresilience in a Societal Context
ISACA Journal Article

Cyberresilience in a Societal Context

In this century, especially in the previous few years, several factors have placed enormous stress on the resilience of businesses—and by extension, of their suppliers, customers and employees—around the world. The first among these was the global financial crisis...

Author: Steven J. Ross
Jon Brandt
Blog Post

The More Things Change in Cybersecurity, the More They Stay the Same

Amidst a global pandemic that prompted a wide range of governmental response actions and mandates, the cybersecurity industry was largely untouched, as shown by respondent data to ISACA’s State of Cybersecurity 2021: Global Update on Workforce Efforts, Resources and Budgets.

4 May 2021
The Pace of Technology Change Doesn’t Have to Be Overwhelming
Blog Post

The Pace of Technology Change Doesn’t Have to Be Overwhelming

When I started my career in technology, I began by working on SNA networks. Mainframes, Virtual Telecommunications Access Method (VTAM), Synchronous Data Link Control (SDLC), and Token Rings were all things I learned about right away, and just when I got good at them, I was thrown into a land of Transmissions Control Protocol / Internet Protocol (TCP/IP) and multiprotocol networks.

3 May 2021
MD-annual-report-2020
Blog Post

Pandemic Calls for Flexibility, New Approaches

2020 was a year that called for great flexibility. In the face of major unforeseen challenges created by the COVID-19 pandemic, ISACA moved swiftly to ensure it still was serving the needs of its professional community, quickly making remote proctoring available for certification exams and transitioning in-person conferences to virtual events, among many major safety-minded “pivots” brought on by the pandemic.

30 April 2021
j21v3-Advanced-Security
ISACA Journal Article

Information Security Matters: Advanced Security for Secret Information

No matter how small, every enterprise beyond a lemonade stand has some form of a security program. Even someone with a one-person business probably has a personal computer with Internet connectivity, and that PC undoubtedly has a firewall, antivirus software...

Author: Steven J. Ross
j21v3-Survival
ISACA Journal Article

IT Audit in Practice: Survival When You Are Small—Business Continuity and Resilience

We have all been through a lot. The pandemic has built a new working model, changing leadership perceptions on how and where work can be performed. The intricate plans that many enterprises tested on an annual basis in line with business continuity turned into...

Author: Cindy Baxter
j21v3-Cryptocurrency
ISACA Journal Article

The Bleeding Edge: Cryptocurrency—A Microcosm of Emerging Technology

Emerging technologies can be a tough subject for discussion. Experts, practitioners and just about anyone in the IT field can be very opinionated and passionate when it comes to a particular technology, especially if they are currently working on an implementation...

Author: Dustin Brewer
j21v3-Innovating-Resilience
ISACA Journal Article

Innovation Governance: Innovating Resilience

Innovation is not just about new products, new ways to compete and developing new features. Innovation is also examining what is in place today, seeing where the gaps are and building solutions to address those gaps. When it comes to resilience, innovation has a strong role to play.

Author: K. Brian Kelley
j21v3-The-Global-Pandemics
ISACA Journal Article

The Global Pandemic’s Affect on Business Continuity

Though the events of 2020 are sometimes characterized as unimaginable, many organizations have been preparing for a global pandemic for years. However, many others have found themselves scrambling to maintain operations in the wake of mass shutdowns...

Author: Kevin M. Alvero
j21v3-Data-Resilience
ISACA Journal Article

Data Resilience Is Data Risk Management

Data resilience has several vendor definitions, for example: maintenance of the availability of hosted production data, the ability of data infrastructure to avoid unexpected disruptions, and a combination of the governance, operational and technical considerations...

Author: Guy Pearce
j21v3-Working
ISACA Journal Article

Working Toward a Managed, Mature Business Continuity Plan

Business continuity is defined as having the right tools in place to make sure that an organization can continue to function during an interruption of one or more of its critical mission functions.

Author: Sven De Preter
j21v3-Succession
ISACA Journal Article

Succession Planning for Business Continuity

In this digital age, when discussing business continuity, the first things that come to mind are technology and related processes. However, it is important to note that the critical elements of human resources (HR) and processes have equal weight. The challenge of ...

Author: Muhammad Asif Qureshi
j21v3-Journey
ISACA Journal Article

Case Study: A Journey Toward CMMC Compliance

Peerless Tech Solutions is a managed service provider that specializes in support for government contractor clients. As a federal contractor in its own right, Peerless, in late 2019, began an internal project to prepare itself for compliance with Cybersecurity Maturity Model Certification...

Author: Mick Brady
j21v3-Information-System
ISACA Journal Article

Information System Contingency Planning Guidance

When planning information security for a system, it is essential to remember to include contingency planning because it provides the resilience needed to respond to technical disruptions and ensure the system is available. The critical planning component is an information...

Author: Larry G. Wlosinski
j21v3-HELP-SOURCE
ISACA Journal Article

Help Source Q&A

Recently I heard the term “purple team.” What are the objectives and roles of this team?

Author: Sunil Bakshi
A Futurist’s Take on Cryptocurrency
@ISACA Article

A Futurist’s Take on Cryptocurrency

Cryptocurrency is a useful tool for solving process issues and conducting transactions within enterprises. Its record-keeping and self-auditing capabilities make it highly valuable to many industries—and individuals. Some authorities believe cryptocurrency is used primarily...

28 April 2021
Daisy Jardine-Viner
@ISACA Article

Becoming a CISO

Almost every candidate recruiters speak to in cybersecurity wants to know one thing: How do I reach the top and get to that CISO level? Speaking with individuals who specialize in the space is one of the best places to start.

28 April 2021
Breaking Through Into Cybersecurity
@ISACA Article

Breaking Through Into Cybersecurity

Our specialty at Tiro Security is cybersecurity and GRC, and here is one of the reasons I highly recommend it: the great thing about cybersecurity is that there is an element of it in every single role inside IT (and even outside of IT).

28 April 2021
Can There Ever Be Normalcy in Cyberspace?
@ISACA Article

Can There Ever Be Normalcy in Cyberspace?

Challenges face the US government amid an increasingly turbulent threat landscape foreshadowed by the December 2020 SolarWinds supply chain attack. But to categorize SolarWinds as merely a hack is a disservice, as it is now understood to be a major cybercampaign involving an estimated 1,000 nation-state actors.

28 April 2021
LG-benjamin-Witt_Sarah_Wonlanske
Blog Post

Governance and Ethics of Emerging Technology

As organizations explore and adopt emerging technologies, governance is rarely if ever at the forefront of their agendas.

28 April 2021
Risk Assessment
ISACA Journal Article

Risk Assessment and Analysis Methods: Qualitative and Quantitative

A risk assessment determines the likelihood, consequences and tolerances of possible incidents. “Risk assessment is an inherent part of a broader risk management strategy to introduce control measures to eliminate or reduce any potential risk-related consequences.”

Author:Volkan Evrin
Sourya Biswas
Blog Post

In the Technology Age, You Can’t Always Trust What You Hear and See

It seems like any mention of technological advancement also can unearth a case of misuse.

27 April 2021
Kyla Guru
Blog Post

Cybersecurity’s Allure for Rising Professionals

Kyla Guru, a Stanford University student and CEO of Bits ’N Bytes Cybersecurity Education, visited with ISACA Now to discuss her passion for cybersecurity and why she considers the field to be a great fit for young professionals.

26 April 2021
Key Considerations for Business Continuity and Disaster Recovery
Blog Post

Key Considerations for Business Continuity and Disaster Recovery

Business success is often couched in terms of growing and maintaining the customer base and launching innovative products.

23 April 2021
Ookeditse Kamau
Blog Post

Reasonable Professional Care for The Next Generation of Women Leaders

As we celebrated International Women’s Day last month under the tagline “Choose to Challenge,” I took time to reflect on my own journey.

22 April 2021
Caitlin McGraw
@ISACA Article

Composing Thank You Notes That Support Your Job Search and Your Life

Want to stand out from the competition when interviewing for jobs? Send a thank you note. But don’t just send any old thank note copied from a template because a boring thank you note will do more harm than good.

21 April 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Developing an Enterprise Innovation Practice

Today, the survival of enterprises depends on the ability to innovate. Since the world is becoming more global and the development of new technologies is rapidly increasing, the ability to effectively innovate is likely to become even more important in the future.

21 April 2021
Certified in Emerging Technology An ISACA Certification logo
@ISACA Article

New Certified in Emerging Technology (CET) Credential Features Stackable Certificates

Not only do today’s practitioner in audit, governance, privacy, risk and security need to be knowledgeable about their disciplines, but increasingly, they have to understand how their fields are being impacted by emerging technologies...

21 April 2021
The Hidden Benefits of Nontraditional Backgrounds in Security Roles
@ISACA Article

The Hidden Benefits of Nontraditional Backgrounds in Security Roles

It is widely known that a skills gap has plagued the cybersecurity workforce for years, leaving security professionals in high demand. But according to Adobe’s Director of Application Security, David Lenoe, now is a good time for organizations to source from a generally untapped...

21 April 2021
Dustin Brewer
Blog Post

Secure Implementation of Emerging Technology Critical in Evolving Business Landscape

The COVID-19 pandemic changed how we utilize technology on both a personal and business level. Although some of these changes will fade away as we approach the end of the pandemic, there will be permanent effects that will linger indefinitely.

21 April 2021
Innovating in Times of Change
ISACA Journal Article

Innovating in Times of Change: The Place for Artificial Intelligence in Auditing

With the growth of computing power and big data over the last two decades, the direction of artificial intelligence (AI) adoption has been forward, and it is moving fast. AI is technology that aims to boost the capability of machines to mimic human cognitive skills...

Author: Ivy Munoko
Melissa Swartz
Blog Post

Creating Community and Connections with ISACA Volunteers

It is my honor to write this blog each April as we celebrate the contributions and connections we have made through the ISACA Volunteer Program.

20 April 2021
George McPherson
Blog Post

How to Prepare for the CISM Exam

Governments around the world are in the midst of the challenging task of pushing out COVID-19 vaccines in a safe, but urgent and calculated manner. Unprecedented leadership is needed to overcome logistical hurdles.

19 April 2021
Ali Pabrai
Security Article

Advanced Cyberdefense US DoD’s CMMC Maturity Level 5

Advanced persistent threats (APTs) require that organizations respond with active and credible cyberdefenses. This is the focus of Maturity Level 5 of the US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC). Maturity Level 5 focuses on the protection of Controlled Unclassified Information (CUI) and is the highest level of cybersecurity defined in the CMMC standard.

19 April 2021
William Emmanuel Yu
Blog Post

Varying Standards of Censorship and Privacy in the Age of Parler

On 6 January 2021, the US Capitol was stormed. It was subsequently determined that some of the perpetrators of this act, which resulted in loss of life, used the social media platform Parler to coordinate the attack.

16 April 2021
Podcast
Podcast

Pursuing Risk Resilience

To survive—and thrive—after a digital transformation, organizations must establish a robust resilience program. In this episode of the ISACA Podcast, sponsored by ServiceNow, Risk Solutions Specialist Brandon Reese...

16 April 2021
Yoshimasa Masuda
Blog Post

A New Framework to Drive Digital Transformation

Yoshimasa Masuda recently visited with ISACA Now to discuss his Adaptive Integrated Digital Architecture Framework (AIDAF) for digital transformation and innovation and its connections in areas including pandemic response, healthcare and academia.

15 April 2021
Julia Kanouse
@ISACA Article

Your Attention, Please: Introducing the New @ISACA

No matter where we live, or what our professional roles may be, there are many shared experiences to which we all can attest. One of those universal truths in today’s world: there is so much content out there, it can be overwhelming.

14 April 2021
Caitlin McGraw
@ISACA Article

Tune Up Your Career Now for High Performance All Year

Maintenance, hygiene, good habits, best practices. Whatever we call looking after our careers, the ongoing work of building our career success is our business as professionals.

14 April 2021
CCAK
@ISACA Article

ISACA Launches New CCAK Certificate in Partnership with Cloud Security Alliance

In partnership with the Cloud Security Alliance (CSA), ISACA has launched the new Certificate in Cloud Auditing Knowledge™ (CCAK™)—the first-ever credential of its kind that fills a need for vendor neutral, technical training and credentials in cloud auditing.

14 April 2021
Mostafa Elghazaly
@ISACA Article

How to Embrace Agile Principles in Risk Management

Risk management professionals must embrace a new way of working by applying the principles of Agile. Applying Agile principles in assurance generates high-quality, focused value faster, using short sprints over the course of the year to alleviate the burden of a stringent audit plan.

14 April 2021
Mohit Kalra
Blog Post

Fingerprinting a Security Team

The central security team in a product development organization plays a vital role in implementing a secure product lifecycle process.

14 April 2021
Third-Party Assurance
ISACA Journal Article

Third-Party Assurance: Why and How?

Outsourcing IT services to the cloud offers many benefits for organizations. The concerns regarding maintaining and securing IT services become the responsibility of the supplier. The organization is supported and risk is transferred with a contract.

Author: Jouke Albeda
Ronke Oyemade
Blog Post

5G Implementation: Healthcare Costs and Benefits

Normal, day-to-day life has been reshaped by the COVID-19 pandemic for more than a year, greatly impacting the lives of virtually everyone. People were and still are being advised to stay home, isolating themselves from the rest of world to reduce the spread of the virus.

13 April 2021
Sudhakar Sathiyamurthy
Privacy Article

A Primer to Defensible Data Disposition

Transforming business frontiers have created an expanding digital universe and explosive data growth, requiring organizations to act as reservoirs and graveyards of data. With the amount of data that exists doubling every 2 years...

12 April 2021
Tony Martin-Vegue
Governance Article

Using Risk Assessment to Support Decision Making

An effective and mature risk governance program drives better decision making in all directions of an organization: up to leadership and the board, down to individual contributors and laterally to all lines of business.

12 April 2021
Genuine Parts Company Case Study
Blog Post

Genuine Parts Builds Improved Cyber Maturity with ISACA’s CMMI® Cybermaturity Platform

Genuine Parts Company determined that its initial cyber maturity assessment needed to create a baseline against a common framework that aligns with NIST CSF and the ISO 27001 controls.

9 April 2021
David Samuelson
Blog Post

Incoming ISACA Board Features Experienced Leaders, Diverse Backgrounds

Diversity is one of ISACA’s great strengths, and it comes in so many forms. Because of our global scope – ISACA has a presence in 188 countries and more than 220 chapters worldwide – our geographic diversity may be most obvious, enabling ISACA members to network and learn from colleagues from many cultures and backgrounds.

7 April 2021
Thomas Tyler
Blog Post

Managing a Remote Team Securely and Effectively

More than a year after the start of the COVID-19 pandemic, organizations across the world are still adjusting to this unprecedented event.

7 April 2021
Aina Rao
Blog Post

Shorting Third-Party Security

Last night, I watched a movie named “The Big Short.” While it was a complete dramatization of events that led to the financial market collapse of 2008, it seemed too good to be fiction.

7 April 2021
Ethics and Morality in the Fourth Industrial Revolution
ISACA Journal Article

Ethics and Morality in the Fourth Industrial Revolution: Rethinking Ethics, Values and Innovation in the Digital Age

The Fourth Industrial Revolution (4IR) is fundamentally changing the world, and technological advances such as artificial intelligence (AI), machine learning (ML) and digitization are increasingly affecting how people live, work, communicate, learn and play.

Author: Oupa Mokgoantle
Podcast
Podcast

The State of Cryptocurrency

Cryptocurrency has helped make blockchain technology mainstream, lauded by the general public for its decentralizing capabilities and in the cybersecurity space due to its integrity and self auditing.

6 April 2021
MDDAP
Blog Post

Driving Sustainable Improvement for Medical Device Quality

Medical device manufacturers seeking to better understand, measure and improve their capabilities have a new avenue to do so.

5 April 2021
Alex Holden
Security Article

A Tiny Link in an Endless Chain

We are all part of a giant and interwoven supply chain. Cybersecurity failure within the supply chain is a collective problem that has always existed, but its severity has been brought to light once more due to recent events.

5 April 2021
Tony Martin-Vegue
Governance Article

The Sweet Spot of Risk Governance

In baseball, the “sweet spot” refers to the precise location on a bat where the maximum amount of energy from a batter’s swing is shifted into the ball.

5 April 2021
Sam Meenasianv
Blog Post

So, You Read Cybersecurity Predictions For 2021: What’s Next?

By now, it’s not the cybersecurity predictions for 2021 that matter – it’s what you do with them.

2 April 2021
Minaz Khan
Blog Post

A Four-Step Approach to Adopting a Privacy Framework

Organizations with mature privacy programs are reaping more benefits than average and are finding it easier to comply with new privacy regulations, according to Cisco’s 2021 Privacy Benchmark Study.

1 April 2021
Giving IT Governance Its Real Value
ISACA Journal Article

Giving IT Governance Its Real Value

One of the most misused words in IT is “governance.” Unfortunately, the constant misuse of the terms “IT governance” and “governance” often leads to either a lack of context or a blurred meaning that is subject to personal interpretation.

Author: Ramón Serres
CCAK
@ISACA Article

ISACA Launches New CCAK Certificate in Partnership With Cloud Security Alliance

In partnership with the Cloud Security Alliance (CSA), ISACA has launched the Certificate in Cloud Auditing Knowledge (CCAK)—the first-ever credential of its kind that fills a need for vendor-neutral technical training and credentials in cloud auditing.

29 March 2021
John P. Pironti
@ISACA Article

Navigating Change: The 5 Stages of Security Control Acceptance

Change, even when embraced, requires adjustments within organizations and their workforces. The changing and evolving threat landscape and frequency of attacks has highlighted the need for organizations to continue implementing new security controls—and mature existing ones.

29 March 2021
Privacy professionals
@ISACA Article

Privacy Professionals Can Now Test Their Expertise With ISACA’s CDPSE Exam

The demand for technical privacy professionals is high, but these roles are harder and more time-consuming to fill than legal/compliance positions, according to ISACA’s Privacy in Practice 2021 survey report.

29 March 2021
Encourage Cyber Accountability by Embracing Security Culture
@ISACA Article

Encourage Cyber Accountability by Embracing Security Culture

An organization’s first line of defense against cyberthreats is its employees and the culture in which they work, but without a proper security posture, they can quickly become an enterprise’s weakest link.

29 March 2021
The Hidden Vulnerabilities of Remote Access Tools
@ISACA Article

The Hidden Vulnerabilities of Remote Access Tools

The sudden shift to remote work caused by the COVID-19 pandemic left organizations and IT departments scrambling to provide in-home office solutions that would allow employees to continue working safely.

29 March 2021
Career Goals with CRISC
@ISACA Article

Accomplish Your Career Goals With CRISC

Jose Vazquez has spent most of his career working in compliance, audit and business controls roles and has familiarized himself with many industry- and company-specific IT risk management frameworks.

29 March 2021
Fabiola Amedo
Blog Post

How to Overcome Obstacles on Your Path to Certification

“It ain’t about how hard you can hit, it’s about how hard you can get hit and keep moving forward; how much you can take and keep moving forward. That’s how winning is done.”

29 March 2021
Jose Ramon Coz Fernandez
Governance Article

Auditing IT Governance in the Navigation Sector

Auditing IT governance in the navigation sector is a challenge. The number of interdependencies and stakeholders in new navigation systems makes the process truly complex, and the increasing trend in subcontracting large parts of a system hides some of those interdependencies and other details in a huge number of contracts and other legal documentation.

29 March 2021
Mohammed Khan
Privacy Article

Data Minimization—A Practical Approach

The amount of data collected across enterprises has exponentially increased over the years—and it continues to grow.

29 March 2021
Podcast
Podcast

Diversifying the Security Hiring Pool

It is no secret that there has long been a gap in the cybersecurity workforce. But enterprises can take a step toward filling it by looking to nontraditional candidates, according to Adobe’s Director of Application Security, David Lenoe.

29 March 2021
Ron Lear
Blog Post

Capability is King and Performance is Paramount

Being a musician myself (jazz and classical bass trombonist), I was thinking about how playing music well during a concert is VERY similar to developing new software or system or service.

26 March 2021
Michael Argast
Blog Post

Selecting, Building, Landing and Growing Your Cybersecurity Career

I’ve been fortunate to work in a wide diversity of cybersecurity roles over my two decades in the field – from operations, services, consulting, vendors, managed service providers (MSPs) and more. I’ve hired hundreds of professionals from senior, experienced leaders to green new recruits.

24 March 2021
5G
ISACA Journal Article

Healthcare Revolution in the 5G Age: Health Risk and Opportunity

In 2017, more than 180 scientists and doctors across the European Union (EU) co-signed an appeal calling on the EU to halt the rollout of fifth generation (5G) technology for telecommunications until potential hazards for human health and the environment...

Author: Ronke Oyemade
Sebastian Terry
Blog Post

Creating a Values-Driven, Balanced Life and Career

Sebastian Terry, an author, TV host and founder of the 100 Things philanthropic movement, recently visited with ISACA Now to discuss his approach to goal-setting and life balance.

23 March 2021
A cloud with a blue computer background
Blog Post

Overcoming Cloud Hurdles Through Effective Audits

Remote access, increased collaboration capabilities, automatic software updates, potential for cost savings – organizations increasingly are drawn to these and other major benefits of leveraging cloud services

22 March 2021
Jon Brandt
Security Article

Entrepreneurship Gone Bad

Just when you thought 2020 was bad enough, 2021 ushered in its own chaos. The events that transpired in the United States during the first weeks of the new year were highly emotional, wrought with anxiety and, in many ways, an embarrassment to every US citizen who wakes up each day just trying to do and be better than the day before.

22 March 2021
Rebecca Herold
Blog Post

Best Practices for Data Hygiene

Data hygiene consists of actions that organizations can, and should, take as a matter of following not only compliance requirements, but also as part of basic risk management program practices. Consistent, risk-specific data hygiene practices supports not only...

19 March 2021
Sourya Biswas
Blog Post

Why Executive-Focused Security Awareness Training is Important

Willie Sutton was a bank robber in the early 1900s, and a quite successful one at that. Over a long and less-than-illustrious-but-more-than-successful career, he amassed over US$2 million. Even without considering inflation, that’s a serious chunk of change.

18 March 2021
Tony Luciani
Blog Post

Four Steps to Achieve SOC 2 Compliance

SOC 2 compliance is stressful for many organizations, but achieving continuous compliance while lowering the annual frustration is within your reach.

17 March 2021
Privacy-Preserving Analytics and Secure Multiparty Computation
ISACA Journal Article

Privacy-Preserving Analytics and Secure Multiparty Computation

Organizations are increasingly concerned about data security in several scenarios, including collecting and retaining sensitive personal information; processing personal information in external environments, such as the cloud...

Author: Ulf Mattsson
Ed Moyle
Blog Post

What Next? Near- and Long-Term Actions Following Microsoft Exchange Hack

By now, you’ve almost certainly heard about the serious and ongoing attacks being conducted against on-premise Microsoft Exchange Server implementations.

16 March 2021
Privacy
@ISACA Article

Discover the Future of Privacy and Risk at ISACA’s Virtual Summit

As emerging technologies including artificial intelligence (AI), the Internet of Things (IoT) and robotic process automation (RPA) continue to dominate innovation in IT, enterprises have been granted more access to personal data than ever. This has made the need for...

15 March 2021
How Workforce Risk Was Impacted by COVID-19
@ISACA Article

How Workforce Risk Was Impacted by COVID-19

The workforce as we know it has undergone significant changes since the onset of the COVID-19 pandemic, some of which are likely to become permanent. Shifting to remote work has allowed employees around the world to keep their jobs...

15 March 2021
New Stackable ISACA Certification
@ISACA Article

New Stackable ISACA Certification Designed for Students, New Professionals and Career Changers

ISACA is dedicated to helping individuals at every skill level obtain the IT knowledge foundation they need to succeed in the industry. To aid in this effort, ISACA has created the Information Technology Certified Associate (ITCA) certification...

15 March 2021
Jack Freund
@ISACA Article

Not All Risk Treatment Options Are the Same

Risk management frameworks can teach risk professionals valuable lessons about what a risk management program should look like. We are encouraged to begin by making a list of the threats to, and vulnerabilities of, our organizational assets...

15 March 2021
Writing for ISACA
@ISACA Article

Showcase Your IT Thought Leadership by Writing for ISACA

ISACA is committed to expanding the IT knowledge base by publishing original thought leadership that explores trending topics in the fields of governance, privacy and cybersecurity. To source this valuable content, ISACA invites industry experts to serve as volunteer...

15 March 2021
Nader Qaimari
Blog Post

New ITCA Credential Aims to Fill Urgent Skills Gap for IT Candidates, Employers

We consistently hear about the shortage of cybersecurity professionals, often mentioned in the same sentence discussing the growing threat of data breaches and malware attacks.

15 March 2021
Muneeb Imran Shaikh
Blog Post

How the CISO Can Build Support from Senior Management

Trust is the cornerstone of any relationship, and it is built and nurtured progressively based on many factors.

12 March 2021
Brennan Baybeck
Blog Post

How to Thrive as a CISO: Award-Winner Brennan P. Baybeck Shares His Perspective

Brennan P. Baybeck, CISA, CISM, CRISC, CISSP, recently was named 2021 CISO of the Year in the APEX Awards, hosted by the Colorado Technology Association. Baybeck, VP & CISO for Customer Services at Oracle Corporation, was ISACA’s 2019-2020 board chair and remains an ISACA board director.

11 March 2021
Patrick Offor
Blog Post

Understanding the Link Between the Need Signal and Information Privacy Equipoise

One thing that became clear when writing an article on need signal is that we are just scratching the surface in our understanding of information privacy, both practically and from a scholarly standpoint.

11 March 2021
Babur Kohy
Blog Post

Contemplating the Dark Web and Secure Human Behaviors

Technological advances have made the job of information system auditors, risk managers and governance and security professionals difficult.

10 March 2021
I&T Governance Framework for Artificial Intelligence in Marketing
ISACA Journal Article

I&T Governance Framework for Artificial Intelligence in Marketing

Information and technology (I&T) governance is a critical component of corporate governance, and it becomes even more crucial when organizations implement emerging technologies. Of the various emerging technologies that are currently transforming...

Authors: Benjamin A. Witt, Sarah J. Wolanske and Jeffrey W. Merhout
Mirna Boheiri
Blog Post

CISA-Certified Professionals Are More Needed Than Ever: How I Prepared to Join the Club

The COVID-19 pandemic is revealing just how important it is for all businesses to have a robust and efficient information technology infrastructure.

9 March 2021
Podcast
Podcast

Remote Access Tools From a Hacker Perspective

Remote access tools can be an IT blessing, allowing tech support to quickly and remotely troubleshoot computer problems while reducing the need for lengthy conversations with confused employees.

9 March 2021
Celebrating the Women
Blog Post

Celebrating the Women in our Global Network of Engaged Members

In honor of International Women’s Day, the ISACA Now Blog asked women who are helping elevate the profession about their volunteer roles with ISACA and their advice about getting involved.

8 March 2021
Caitlin McGaw
Blog Post

IT Audit is ‘Boring’? Time to Fix the Perception Problem

I was recently on a social media site where professionals join a career topic discussion group and ask questions. Someone asked: What job is boring? The very first answer: “IT audit.”

4 March 2021
Avoiding the Post-Quantum Cyber Apocalypse
Blog Post

Avoiding the Post-Quantum Cyber Apocalypse

Today, the comfort of our modern living is driven by advances in information technology: think of the mobile banking apps on your phones, the proliferation of blockchain technologies, and the various electronic sensors and components that are powering your home appliances, cars and the electricity grid, hospitals, and the list goes on.

3 March 2021
Benefits of Using a SOAR Solution
ISACA Journal Article

Benefits of Using a SOAR Solution

Security orchestration, automation and response (SOAR) is a widespread discussion among academicians, technologists, and executives linked to the cyber and digital spaces.

Author: Farhan Imitaz
Sonja Jovanovic
Blog Post

HR and Cybersecurity: Supporting Each Other in Challenging Times

Cybersecurity was not on the top of the agenda for many Human Resources professionals in early 2020.

2 March 2021
Auditing for Success
@ISACA Article

Auditing for Success

Thorough compliance audits are critical to the success of every IT organization—and every auditor. But to achieve the desired results, sufficient time and resources must be allotted to prepare for the audit.

1 March 2021
Bruce R. Wilkins
@ISACA Article

Be Wary of Security Product Marketing

I recently read an article about cybersecurity and concluded that vendor influence on the discipline has reached a point of concern. Vendors and their marketing campaigns strive to introduce different terms into cyberprofessionals’ occupational jargon...

1 March 2021
CDPSE
@ISACA Article

Certify Your Privacy Experience With CDPSE Early Adoption

As data collection and management regulations increase in number and complexity, enterprises must enlist IT privacy professionals to successfully implement data privacy programs from a technical perspective.

1 March 2021
SheLeadsTech: From Inspiration and Awareness to Action
@ISACA Article

SheLeadsTech: From Inspiration and Awareness to Action

ISACA is committed to improving gender diversity in the technology field. To support this initiative, ISACA has continued to evolve its SheLeadsTech program since its inception in 2017.

1 March 2021
The Power and Potential of 5G
@ISACA Article

The Power and Potential of 5G

Cellular network technology has evolved at an exceptional, nearly unpredictable pace, growing from the voice-only system it once was to the impressive voice, text and data 5G technology of today.

1 March 2021
Michelle Poler
Blog Post

Become Inspired, Not Intimidated, by Technology

Michelle Poler, a creative and passionate social entrepreneur, fear-facer, and branding strategist, will be the closing keynote speaker at the ISACA Conference North America 2021, a virtual event to take place 4-6 May.

1 March 2021
Diana L. Burley
Security Article

The Assault on Truth

Truth. Fact—a statement in accordance with reality. For years, there has been an assault on truth, whether through the promotion of “alternative facts,” the normalization of seemingly insignificant lies, the sharing of half-truths that mischaracterize reality or the confounding of fact and opinion.

1 March 2021
Ssalar Atrizadeh
Privacy Article

Understanding the Importance of US Privacy and Identity Theft Laws

It is essential for IT experts and practitioners to be aware of and understand privacy laws as there are increasing global cybersecurity incidents.

1 March 2021
Reviewing Digital Transformation Practices
Blog Post

Reviewing Digital Transformation Practices

Competitive pressures, new markets and new digital technologies are the main drivers of digital transformation.

26 February 2021
Ali Pabrai
Security Article

Resilience in the Cybersecurity Supply Chain

The US Department of Defense (DoD) cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC), establishes 5 maturity levels.

26 February 2021
Benefits of Using a SOAR Solution
ISACA Journal Article

IS Audit in Practice: Relinquishing Privacy to Research

I have always loved medicine. The science is intriguing and you can get involved if you want, which I did as a teenager, volunteering at the local hospital and giving blood every time a blood drive came through my community.

Author: Cindy Baxter
Keeping Secrets
ISACA Journal Article

Information Security Matters: Keeping Secrets

In my last column, I made the case that the protection of secret information—as opposed to personally identifiable information (PII)—is becoming a significant issue in cybersecurity. This article picks up where that one left off.

Author: Steven J. Ross
j21v2-The-Boxes-of-Pandora
ISACA Journal Article

The Bleeding Edge: The Boxes of Pandora and Schrodinger

If you have not heard it already, the Schrodinger’s Cat thought experiment1 is meant to help people understand just how strange things are on the quantum level of existence. From superposition to entanglement, when it comes to quantum mechanics...

Author: Dustin Brewer
j21v2-Privacy-Innovations
ISACA Journal Article

Innovation Governance: Privacy Innovations

At the time of the writing of this article, the SolarWinds supply chain hack is the big news within information security. Due to the sophistication of the attack and the follow-up, information security researchers believe a nation-state actor...

Author: K. Brian Kelley
j21v2-A-Guide-to-Selecting
ISACA Journal Article

A Guide to Selecting and Adopting a Privacy Framework

COVID-19 imposed change on every aspect of life and business in 2020, but 2020 was also a significant year in the world of privacy protection for reasons beyond the pandemic.

Author: Minaz Khan
j21v2-What-Is-Your-Privacy
ISACA Journal Article

What Is Your Privacy and Data Protection Strategy?

The global data privacy and protection landscape has been radically transformed within the last five years, notably with the enactment of the EU General Data Protection Regulation (GDPR) in 2018.

Author: Corlane Barclay
j21v2-Varying-Standards
ISACA Journal Article

Varying Standards of Censorship and Privacy in an Interconnected World

On 5 August 2020, the US State Department announced the expansion of the Clean Network,1 which includes a number of programs intended to safeguard US assets and protect US IT from interference by malicious actors.

Author: William Emmanuel Yu
j21v2-Need-Signal
ISACA Journal Article

Need Signal: Information Privacy Equipoise

It has become apparent that need signal, more than information privacy concern or information privacy calculus, is the primary driver for individuals’ online participation or online transactions, whether it is participating or transacting in egovernment...

Author: Patrick Offor
j21v2-Building-a-Zero-Trust
ISACA Journal Article

Case Study: Building a Zero Trust Architecture to Support an Enterprise

Cimpress is a US$2 billion global company specializing in “mass customization,” meaning customizable business-to-business (B2B) and business-to-consumer (B2C) hard copy and digital print products. Cimpress was founded in 1994 with a focus on helping...

Author: Katie Teitler
j21v2-The-Gentle-Art-of-Password
ISACA Journal Article

The Gentle Art of Password Management

System and security administrators and information system auditors are often faced with the task of providing an adequate level of IT assurance for their own enterprises or those of their clients. This daunting challenge has become a high-profile endeavor...

Authors: David Trepp and Joshua Schmidt
j21v2-The-Dark-Web
ISACA Journal Article

The Dark Web and the Role of Secure Human Behaviors

Dark web concepts are helpful for preserving the privacy and security of its users. These hidden corners of the Internet provide anonymity for people who are oppressed by their governments, free speech to journalists, and secure communication channels...

Authors: Babur Kohy, Warren D. Holston and Ibrahim Waziri Jr.
David Foote
Blog Post

How the Pandemic Has Boosted Some Tech Skills and Certifications

With the annus horribilus of 2020 now behind us, have tech certifications been affected by all the sturm und drang brought on by the double whammy of a pandemic and economic recession? The answer may surprise you.

24 February 2021
Deepfake: The Lay of the Land
ISACA Journal Article

Deepfake: The Lay of the Land

Deepfake is the modern equivalent of Photoshop. It uses an artificial intelligence (AI) method called deep learning to create fake images and videos.

Authors: Pavankumar Mulgund and Samina Lohawala
Ookeditse Kamau
Blog Post

Being a Reasonable IT Auditor During the Pandemic

Recently I have had a number of people asking me, “How are you conducting your audits with the onset of the COVID pandemic?”

23 February 2021
Maria Gregorio
Blog Post

Best Practices to Manage Risks in the Cloud

The growth in cloud computing has been exponential. Forrester predicted that the global public cloud infrastructure will grow 35% to US$120 billion in 2021. COVID-19 has served to accelerate this trend further

22 February 2021
Andrea Tang
Privacy Article

China’s Personal Financial Information Protection

On 8 December 2020, the chairman of the China Banking and Insurance Regulatory Commission (CBIRC) laid out areas that the authorities will be looking at closely in the fintech industry.

22 February 2021
Alen Beganovic
Security Article

Cybersecurity in the Digital Onboarding Process

Acquiring new clients using a digital channel such as a mobile application rather than requiring a physical presence is a process referred to as digital onboarding.

22 February 2021
Podcast
Podcast

Risk After COVID-19: A New Workforce

The COVID-19 pandemic has prompted massive changes within the modern workforce, providing risk assurance and audit professionals a unique opportunity to assess how they approach the risk framework.

22 February 2021
Prithvi Bisht
Blog Post

Creatively Scaling Application Security Coverage and Depth

One of the biggest challenges and opportunities for an Application Security (AppSec) team is to scale effectively.

18 February 2021
Neil Lappage
Blog Post

Baselining Cybersecurity Skills for All IT Professionals

In the era of modern IT, it is becoming increasingly important for IT professionals to have a base-line contemporary cybersecurity skillset.

17 February 2021
Sudeep Subramanian
Blog Post

Rethinking Information Security Awareness Strategies

In 2000, it was predicted that semantic attacks that target humans and use the vulnerability in information processing capabilities of humans would be the primary attack vector of cybercriminals.

17 February 2021
Melissa Swartz
Blog Post

Congratulations to the Exceptional 2021 ISACA Award Recipients

ISACA values the contributions of our members and professionals across our industry and recognizes outstanding achievements annually through the ISACA Awards Program. Join us in celebrating the 2021 ISACA Award Recipients!

16 February 2021
Abdul Rafeq
Governance Article

Using COBIT 2019 to Proactively Mitigate the Impact of COVID-19

Enterprises are established with set objectives of meeting stakeholders’ needs and serving customers with desired products or services that add value. To be able to continually meet these objectives, an appropriate risk management strategy with a...

16 February 2021
Corporate Governance
ISACA Journal Article

Book Review: Corporate Governance—A Pragmatic Guide for Auditors, Directors, Investors, and Accountants

Vasant Raval’s Corporate Governance: A Pragmatic Guide for Auditors, Directors, Investors, and Accountants clearly sets the tone for the reader in the preface by stating that the “primary purpose of this book is to provide as complete a picture of the current state of corporate governance in the USA.”

Author: Ken Doughty
How to Improve Your Cybersecurity Audit
@ISACA Article

How to Improve Your Cybersecurity Audit

Cybersecurity audits ensure that organizations are well prepared to defend themselves against internal and external cyberthreats.

15 February 2021
Sunil Bakshi
@ISACA Article

Why Auditors Should Adopt Social Engineering

Social engineering is considered a type of security attack that targets the weakest link; that is, humans. However, rather than discuss how to audit social engineering preparedness or eliminate social engineering attacks, I pose—and answer—the question, do auditors need to acquire social engineering skills?

15 February 2021
Risk in 2021, as Identified by IT Auditors
@ISACA Article

Risk in 2021, as Identified by IT Auditors

The onset of the COVID-19 pandemic at the end of 2019 led to a tumultuous year that followed for organizations worldwide. Usual business operations came to a halt, with a resulting shift to remote work for many that presented new challenges—and increased risk.

15 February 2021
Creating a Culture of Cybersecurity at Princeton University
@ISACA Article

Creating a Culture of Cybersecurity at Princeton University

Building a culture of cybersecurity through user awareness training reduces risk to the enterprise and can enhance employee productivity.

15 February 2021
Security
@ISACA Article

The Dangers of Neglecting Physical Security

In the age of cloud-hosted services, the Internet of Things (IoT) and remote work, cybersecurity conversations typically revolve around securing your network and devices, rather than your office building.

15 February 2021
Leroy Chiao
Blog Post

Freedom to Fail – and Innovate

Leroy Chiao recently visited with ISACA Now to discuss lessons he took from his time as an astronaut, his observations on the latest technology trends and more.

12 February 2021
Ronke Oyemade
Blog Post

The COVID-19 Pandemic, Digital Security and 5G Security Architecture

Normal day-to-day life was brought to a halt by the COVID-19 pandemic, which greatly impacted the lives of virtually all people worldwide in unprecedented fashion.

10 February 2021
Nudging Our Way to Successful Information Security Awareness
ISACA Journal Article

Nudging Our Way to Successful Information Security Awareness

Ensuring the security of information flowing in an organization requires the attention of all stakeholders including top management, employees and customers. Compliance with information security policies should be taken seriously with small or large...

Authors: Sudeep Subramanian and Udita Agrawal
Muhammad Mushfiqur Rahman
Blog Post

Essential Cybersecurity Components: Continuous Monitoring, Human Intelligence and Commitment

Continuous monitoring is essential in the cybersecurity ecosystem of an organization. Proper design, implementation and continuous monitoring provide just-in-time reflection of users, devices, networks, data, workloads activities and status in the organization’s infrastructure.

9 February 2021
Anna Murray
Privacy Article

CCPA in a Multilayered B2B Environment

Organizations that collect business-to-business (B2B) data from residents of the US State of California got a reprieve in 2019. The California Consumer Privacy Act (CCPA) went into effect in January 2020, applying to the collection of business-to-consumer (B2C) data.

5 February 2021
Ryan Kelch
Blog Post

When the Mundane Becomes the Target

Cloud security in 2020 was upended from previous years – to say the least. The COVID-19 pandemic fundamentally altered human behavior, and those changes directly impacted the tech industry.

4 February 2021
Podcast
Podcast

The Perils of Overlooking Physical Security

With today’s advanced cloud capabilities, cybersecurity is an obvious priority at many organizations. But that can leave physical security diminished or outright neglected.

4 February 2021
Sundaresan Ramaseshan
Blog Post

Disciplined IT Hygiene During Organizational Change

Everyone knows that IT and its evolution is an undisputable partner in any organization. IT teams no longer play a supporting role.

3 February 2021
Identifying the Practices of Digital Transformation
ISACA Journal Article

Identifying the Practices of Digital Transformation: Based on a Systematic Literature Review

Initiatives using digital technologies as an enabler have been studied and implemented by many enterprises in recent years, mainly due to the increasing demand from customers for value-added products and services delivered faster and more conveniently.

Authors: Tomás Aguiar, Silvia Bogea Gomes, Paulo Rupino da Cunha and Miguel Mira da Silva
Joanna Grama
Blog Post

When to Assess Security and Privacy During the Procurement Process

Many organizations are concerned about security, privacy and vendor management for information technology (IT) services and applications, and rightly so.

2 February 2021
Improve Your Active Directory Security
@ISACA Article

Improve Your Active Directory Security

Malicious cyberactors can leverage an organization’s Active Directory settings to gain network privileges by moving laterally. However, by taking proactive security measures, it is possible to reduce the attack surface of the enterprise’s network.

1 February 2021
The State of Privacy in the New Year
@ISACA Article

The State of Privacy in the New Year

Though some organizations consider privacy to be a static, one-size-fits-all objective to be accomplished merely to comply with regulations, it should instead be viewed as an essential part of gaining customer trust and, therefore, critical to business success.

1 February 2021
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Building Cloud Governance From the Basics

Cloud computing and cloud services have become a reality, and they are here to stay. Organizations of all sizes are adopting cloud computing and cloud services. According to Cisco, cloud data centers will process 94% of workloads in 2021.

1 February 2021
Information Technology
@ISACA Article

Information Technology From an Ethical Perspective

The power of an organization’s ethics, culture and individual behaviors to contribute to successful governance and management practices is often underestimated. Effective IT auditors must understand the ethical implications of the information systems...

1 February 2021
audit and assurance
@ISACA Article

Top ISACA Resources of 2020

In today’s rapidly changing technology landscape, continuing education and skills development are essential tools for professionals who wish to keep up. To contribute to the IT knowledge base, ISACA is dedicated to creating relevant educational content...

1 February 2021
Vote For an Inspirational Volunteer
@ISACA Article

Congratulations, 2021 ISACA Award Recipients and Hall of Fame Inductees

ISACA is pleased to recognize the 2021 ISACA Award recipients and honor the first-ever Hall of Fame inductees for their thought leadership and volunteer service. It is only through peer nominations that ISACA can recognize these achievements.

1 February 2021
Mea Clift
Security Article

Supply Chain Threats and the Cybersecurity Solution

On 6 December 2020, the Craft Industry Alliance reported that the McCall printing facility in Manhattan, Kansas, USA, had been shut down since October 2020 due to what appeared to be a malware attack.

1 February 2021
Sourya Biswas
Blog Post

Security in the Cloud: Not Somebody Else’s Problem

Unless you’ve been living under the proverbial rock, you likely are aware of the Capital One breach in 2019 that leaked confidential information from more than 100 million credit applications stored in the Amazon Web Services (AWS) cloud.

29 January 2021
Victor Gamra
Blog Post

How to Identify Vulnerable Third-Party Software

The year 2020 will be reflected in history as a year of many surprises. In hindsight, one trend that, though not a surprise, rattled unexpecting companies, was the explosive occurrence of cybersecurity breaches via third-party software.

28 January 2021
Scott C. Algeier
Security Article

Cost-Effective Steps to Managing Cyberrisk

Today’s complex cyberthreat landscape is a risk to all enterprises. Combating these threats requires an enhanced, coordinated and sustained national effort across industry and government. A determined, well-resourced adversary can penetrate any network.

27 January 2021
Cyberattacks
ISACA Journal Article

What Type of Management Is Required to Stop Serious Cyberattacks?

The actual level of cyberrisk that many organizations face is now far out of alignment with what top management would consider an acceptable level of cyberrisk. In 2017, Warren Buffett, the chairman and chief executive officer (CEO) of Berkshire Hathaway...

Authors: Charles Cresson Wood and Jody R. Westby
Nadia Bizzarri
Blog Post

Cyber Insurance for a Changing Landscape

In 2020, we adjusted to a global pandemic. Many businesses were not prepared to face this new reality but were forced to respond quickly to ensure their operations continued.

26 January 2021
Hafiz Sheikh Adnan Ahmed
Blog Post

Privacy in Practice 2021: Data Privacy Trends, Forecasts and Challenges

Data privacy, privacy management, digital privacy, data protection – the list goes on when it comes to data privacy and protection imperatives. The phrase “Data is the new oil” was coined considering the growing importance of personal and organizational data.

26 January 2021
Solving Your Most Frequently Asked Questions
Blog Post

Solving your Most Frequently Asked Questions

In late 2020 and early 2021, ISACA received more inquiries from members and customers than ever before, with unprecedented demand for certifications, including the CDPSE early adoption program.

25 January 2021
Sandy Silk
Blog Post

When IT is Your Profession, Life-long Learning Beyond Academia is Your Devotion

When you begin a new role or join a new employer, specific existing skills and experience secured the opportunity for you.

25 January 2021
Anna Johannson
Blog Post

Setting the Record Straight on 5 Cloud Security Myths

When it comes to cybersecurity in today’s digital landscape, the cloud is one of the most misunderstood elements.

22 January 2021
Guy Ngambeket
Privacy Article

Smart Objects and Their Privacy Implications

In the cybersecurity realm, it has long been discussed and understood that people are considered the weakest link in cybersecurity. And, like security, everyone has a crucial role to play to ensure a reasonable degree of privacy, to keep personal data safe.

22 January 2021
Jacob Young
Blog Post

Azure DevOps: Access, Roles and Permissions

As IT auditors, we are well aware that the change management process is a critical component of IT controls testing in risk-based and compliance audits.

21 January 2021
Robert Putrus
Blog Post

Cybersecurity and the Board of Directors

A key initiative that enterprises should not overlook is the need for IT teams to bridge the gap between the chief information security officers (CISOs) and their organization’s board of directors (BoD).

20 January 2021
Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls
ISACA Journal Article

Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls

Cyberrisk is not just an IT issue; it is much broader. The magnitude or impact of a cyberattack can determine the survival of an enterprise. Business risk continues to exist.

Author: Robert Putrus
Surveying the State of Privacy in 2021
@ISACA Article

Surveying the State of Privacy in 2021

Consumers are becoming increasingly aware of how, when and by whom their data are being used. Organizations that fail to protect the privacy of their customers are at risk of financial and reputational damage. Results from ISACA’s 2020 State of Privacy survey...

18 January 2021
Jack Freund
@ISACA Article

Zero Trust Should Not Equal Zero Business

The IT community made some incorrect assumptions about risk in 2020. That is to be expected, as all risk assessments rely upon assumptions. However, it is important to ensure that such assumptions are communicated to others and clearly articulated...

18 January 2021
Communicating Cyberrisk to Organizational Leadership
@ISACA Article

Communicating Cyberrisk to Organizational Leadership

Cybersecurity professionals are often tasked with presenting technical risk assessments and the subsequent implications to their organization’s board of directors (BoD). To do so effectively, one must adopt the language that the board members use...

18 January 2021
Refine Your Cloud Expertise With ISACA’s Cloud Auditing Certificate
@ISACA Article

Refine Your Cloud Expertise With ISACA’s Cloud Auditing Certificate

Cloud auditing is a critical step in successfully migrating to the cloud. Organizations can develop a better understanding of what cloud services and deployment strategies will result in the most improvement for their business though cloud auditing.

18 January 2021
Reinvigorate Your Professional Development at Latin CACS 2021
@ISACA Article

Reinvigorate Your Professional Development at Latin CACS 2021

Professional conferences are an exciting and enriching way to explore valuable learning experiences and form connections with industry professionals. While in-person gatherings were brought to a halt in 2020 due to the global risk of the COVID-19 pandemic...

18 January 2021
Aleš Zupan
Security Article

Cyberrisk Governance: A Practical Guide for Implementation

Despite cybercrime cost amounting to more than US$1 trillion globally in 2020—more than 1% of the global domestic product (GDP)—the topic still does not receive sufficient attention at the board and C-suite levels in organizations, according to a report conducted by the Center for Strategic and International Studies (CSIS) and McAfee.

14 January 2021
Larry Alton
Blog Post

Eight Benefits of Seeking a Career in IT

Information technology (IT) is a field that can open up many different career paths. In IT, you could be responsible for installing and configuring hardware, managing third-party software, providing training and support to employees, auditing security systems, or possibly writing custom software.

15 January 2020
privacy
Privacy Article

Impacts of Canadian Government Oversight of PIPEDA

The Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) is a comprehensive act that governs collecting, using and disclosing personal information. Initially, the act was a mechanism proposed to ensure trust in e-commerce...

15 January 2021
Princess Ngozi Uche Ucheoption
Blog Post

Princess Ngozi Uche: A CSX-P Pioneer

Princess Ngozi Uche, the first CSX Cybersecurity Practitioner Certification (CSX-P) credential-holder in Nigeria, has a pioneering spirit, as further evidenced by her work to help initiate an ISACA chapter in Port Harcourt.

14 January 2021
Podcast
Podcast

Assessing the Ethical Implications of Information Technology

IT enterprises with strong ethical frameworks are successful not only in making a greater, more positive impact on society, but in terms of financial and reputational status as well. To achieve this, however, organizations must be able to involve everyone...

14 January 2021
Josh Hamit
Blog Post

Accelerating to the Cloud, Responsibly

Coming out of 2020, most organizations are probably pivoting from digital transformation to digital acceleration. In only a matter of weeks, the world witnessed unprecedented adoption of digital technology that will shape consumer behaviors and business operations for years to come.

13 January 2021
Technology-Based Trust With Blockchain
ISACA Journal Article

Technology-Based Trust With Blockchain

Emerging technologies such as 5G, microservices, the Internet of Things (IoT), cloud computing, containers, blockchain and many others are shaping the meaning of “technology-based trust.” Consequently, technology-based trust deals with the acceptance...

Author: Luis Emilio Alvarez-Dionisi
David Samuelson
Blog Post

Building on the Lessons from 2020

As we begin a new year, I think it’s safe to say that many of us are ready to leave 2020 in the rearview mirror.

11 January 2021
Philip Casesa
Blog Post

Four Ways to Change the Cybersecurity Hiring Process

A few years ago, I was an IT director on the hunt for new IT talent. I went the traditional route, posting jobs, reviewing resumes and holding interviews

8 January 2021
Ali Pabrai
Privacy Article

America’s Newest Privacy Rights Act—California’s CPRA

2023 compliance readiness starts now. The US State of California’s Proposition 24, known as the California Privacy Rights Act of 2020 (CPRA), was passed by voters in the November 2020 election. The CPRA provides additional rights to consumers and places...

8 January 2021
Robert Brzezinski
Security Article

Cloud Strategy Challenges

I have had the privilege of working with organizations that adopted cloud strategies and were able to improve productivity for end users and optimize IT operations and cybersecurity. I have also worked with organizations that stepped into the cloud world...

8 January 2021
Muhammad Mushfiqur Rahman
Blog Post

Threat Hunting and Cyberrisk Assessment Using Cyber Kill Chain

Virtually every organization needs to provide digital services to its clients. However, digitization creates enormous threats for an organization, its customers and its employees.

7 January 20201
Abdelelah Alzaghloul
Blog Post

Leveraging Marketing to Overcome the Cybersecurity Workforce Shortage

Organizations around the globe are struggling to overcome the challenge of the cybersecurity workforce shortage, and filling this gap has become a top priority as cyberthreats continue to grow.

6 January 2021
Security and Risk Assessment of IT Defense Strategies Considering the Cyber Kill Chain
ISACA Journal Article

Security and Risk Assessment of IT Defense Strategies Considering the Cyber Kill Chain

Defensive IT architecture helps to deploy defense-in-depth concepts in an organization’s IT architecture, which helps to prevent, identify, detect, contain, respond to and recover from cyberincidents in a timely manner. Defensive architecture in information...

Author: Muhammad Mushfiqur Rahman
Emerging Tech
Blog Post

Five Security and Emerging Tech Insights for 2021

As we begin 2021, ISACA experts are weighing in with anticipated major trends in the worlds of cybersecurity and emerging technology that they expect to gain traction in the new year.

5 January 2021
Julian Marquez
Governance Article

Indicator Management: A Question That Should Start With “Why?”

Enterprises’ operational functions often need their data on a real-time basis to know about business performance and have an overall assessment of their strategic and tactical goals. Simultaneously, the risk management function wants to define analytical models ...

5 January 2021
Mostafa Elghazaly
@ISACA Article

Building an Effective Data Privacy Communication Plan Using 3 Design Principles

An effective data privacy communication plan will increase awareness of data privacy requirements and help establish a clear set of steps to execute when a breach occurs. There are 3 reasons why an effective privacy communication plan is critical to the success...

4 January 2021
privacy
@ISACA Article

Demonstrate Your Privacy Expertise With the CDPSE Beta Exam

Certification exams are developed by ISACA through consultations with industry experts in the IT community. Beta exams allow for the gathering of valuable feedback from candidates around the world, resulting in final exams—and grades—that accurately...

4 January 2021
Zero Trust
@ISACA Article

The Rise of Zero Trust, Explained

As pressure to meet compliance requirements continues to mount, more enterprises are turning to a zero trust approach. To effectively implement the zero trust framework, enterprises should achieve a thorough understanding of its nuances.

4 January 2021
UK Cyber Security Council Established to Strengthen Skill Sets, Collaboration
@ISACA Article

UK Cyber Security Council Established to Strengthen Skill Sets, Collaboration

Over 100,000 cyber roles come up in the UK each year, yet half of companies state they have a basic skills gap and a third struggle to fill those roles. ISACA® is proud to help champion the cybersecurity profession as a founding member of the Cyber Security Alliance...

4 January 2021
Leader
@ISACA Article

Nominate an Outstanding Individual to Serve on the ISACA Board of Directors

ISACA strives to provide continuous value to members by serving as a beacon of knowledge for the IT community. Electing a strong Board of Directors to govern is an important part of that effort. Nominations for the 2021-2022 ISACA Board of Directors...

4 January 2021
ISACA Foundation Strives to Achieve Global Impact in 2021
@ISACA Article

ISACA Foundation Strives to Achieve Global Impact in 2021

As key leaders in the cyber field know, organizations across all industries rely on cybersecurity professionals to serve as the frontline of defense against threats and risk. But the shortage of qualified cybersecurity workers is increasing, exposing organizations...

4 January 2021
Neil Lappage
Privacy Article

Will Low-Earth Orbit Satellites Fly Under the Privacy Radar?

As the world considers what 5G will mean for privacy, low-earth orbit (LEO) satellite Internet continues to gain momentum and quietly fly under the radar from a privacy perspective.

4 January 2021
j21v1-A-Window
ISACA Journal Article

A Window of Opportunity: Ending the Cyberworkforce Shortage Once and For All

Two years ago, the cyberworkforce shortage was the number-one concern for chief information security officers (CISOs), security operations center (SOC) managers and other security leaders. Researchers estimated that there would be 1.8 million unfilled...

Author: Philip Casesa
Language: 日本語
j21v1-Adaptation
ISACA Journal Article

Adaptation of Information Security in the Agile World

One of the core values of Agile is to maintain built-in quality, which implies that security controls should be embedded in the Agile mindset. However, it may be argued that information security and an Agile mindset do not always go hand in hand with...

Author: Gerald Pang
j21v1-Secrecy-and-Privacy
ISACA Journal Article

Information Security Matters: Secrecy and Privacy

The COVID-19 pandemic has accelerated many trends in information technology that were already evident before the global outbreak, including teleworking, cloud-based hosting and distance learning. Not all the accelerated trends were positive, however.

Author: Steven J. Ross
j21v1-Watching-Out
ISACA Journal Article

IS Audit in Practice: Watching Out for Workforce Risk in the New Normal

What a year 2020 was: climate change marked by wildfires across the globe and record counts of tropical storms; health welfare at center stage from a pandemic that changed people’s lives and attitudes; elections that called cybersecurity effectiveness...

Author: Cindy Baxter
j21v1-Intelligence
ISACA Journal Article

The Bleeding Edge: Intelligence—A Not-So-Mediocre Commodity

“Brains are the only things worth having in this world, no matter whether one is a crow or a man.” Not that long ago, humankind used candles to produce light and horses to travel or to do mechanical work.

Author: Dustin Brewer
j21v1-Transforming
ISACA Journal Article

Case Study: Transforming Princeton’s Security Culture Through Awareness

Security awareness and training programs (also known as user awareness programs) educate users about computer security and organizational policies and procedures for working with IT resources. User awareness programs can reduce information risk...

Authors: Dan Blum, David Sherry, and Tara Schaufler
j21v1-Tips-for-Strengthening
ISACA Journal Article

Tips for Strengthening Organizations From Within, the Tom Hanks Way

At a time when cyberthreats continue to grow, organizations around the globe are struggling to overcome the challenge of a cybersecurity workforce shortage. According to the 2019 Strategies for Building and Growing Strong Cybersecurity Teams...

Author: Abdelelah Alzaghloul
j21v1-Security
ISACA Journal Article

Security Discipline and Hygiene Mean Healthy, Naturally

In this time of the COVID-19 pandemic, personal cleanliness and hygiene are discussed more frequently than ever before. It is essential to maintain hygiene to stay safe and prevent the spread of COVID-19. Even from a cost perspective, the cost of being cautious...

Author: Sundaresan Ramaseshan
Privacy
ISACA Journal Article

Help Source Q&A

What is “zero trust” in information security? Is it a new concept or just old wine in a new bottle?

Author: Sunil Bakshi
The Rise of Fintech: Managing and Controlling your Money
Blog Post

The Rise of Fintech: Managing and Controlling your Money

Every now and then, I travel across the world of emergent technologies. My passport has been stamped so many times for my visits to the wonderland of IoT, cloud computing, virtual networking, containers, microservices, cybersecurity, virtual machines...

30 December 2020
Key Performance Indicators for Security Governance, Part 2
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 2: Security Reporting for Senior Management

The value of information security may be understood differently within an enterprise. For security specialists, the need for protective measures against known threats is sufficient to justify investments. However, management wants higher level reports presenting results based on figures...

Author: Andrej Volchkov
Niral Sutaria

Artificial Intelligence Regulations Gaining Traction

Not long ago, complex artificial intelligence (AI) systems involving deep learning were mainly just theories. There were very few practical use cases. Today, many organizations are using AI to make their processes more efficient. AI has gained traction much faster than other emerging technologies.

29 December 2020
Looking to the Accelerated Digital World of 2021
Blog Post

Looking to the Accelerated Digital World of 2021

“There are decades where nothing happens; and there are weeks where decades happen.” True to this quote by Lenin and as articulated by Fareed Zakaria in his book, Ten Lessons for a Post-Pandemic World...

23 December 2020
Artificial Intelligence’s Impact on Auditing Emerging Technologies
ISACA Journal

Artificial Intelligence’s Impact on Auditing Emerging Technologies

Artificial intelligence (AI) is the demonstration and simulation of human intelligence by machines, especially computer systems. AI, robotic process automation (RPA), the Internet of Things (IoT) and blockchain are among the next-generation technologies that are considered disruptive in nature.

Author: Niral Sutaria
Podcast
Podcast

What Makes a Threat an APT?

APTS are typically driven by experienced cyberactors, significant funding and a target that possesses extremely sensitive data. The depth of these threats means that virtually no enterprise is immune, even those which have implemented highly sophisticated cybersecurity measures.

22 December 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Auditing Guidelines for Artificial Intelligence

Over the past few years, there has been a tremendous shift toward emerging technologies such as blockchain, robotics and artificial intelligence (AI). Global organizations and governments have come to terms with the impact—and opportunity—of advanced technology.

21 December 2020
Compliance Assurance During the Time of COVID-19 and Beyond
@ISACA Article

Compliance Assurance During the Time of COVID-19 and Beyond

Has there ever been a more challenging climate for the second and third lines of defense? The COVID-19 pandemic has quite clearly changed the entire 2020 landscape for financial services. A flurry of economic challenges and hurdles has put tremendous pressure...

21 December 2020
Ten Ways Hospitals Can Prepare for Ransomware Attacks
@ISACA Article

Ten Ways Hospitals Can Prepare for Ransomware Attacks

The COVID-19 pandemic has resulted in a surge of ransomware attacks focused on 1 target in particular: hospitals. To help combat this trend, ISACA has provided a tip sheet with 10 key actions hospital cybersecurity teams can take...

21 December 2020
#IamISACA
@ISACA Article

#IamISACA: My New and Unexpected Adventure

I spent nearly 4 months of this year shopping for complete strangers, thousands of miles from my home and navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic—and I loved it.

21 December 2020
Information security
Blog Post

IT Audit Technology Risk: Knowns and Unknowns

Knowns and unknowns. In a game of word association, some may think of the US National Aeronautics and Space Administration (NASA). It was an associate administrator from NASA’s Office of Safety and Mission Assurance who heightened awareness of known/unknown risks in a 2003 presentation on safety and mission success.

21 December 2020
Let’s Apply APT Lessons From SolarWinds Hack
Blog Post

Let’s Apply APT Lessons From SolarWinds Hack

Well, my cyber and information security friends, it’s that time again. We’re starting to get asked questions about what we do by more than just our immediate supervisors. We get comments such as “I bet you’re busy this week” and “Should I change my password on my account?”

21 December 2020
Anna Johannson
Blog Post

5 GDPR Compliance Tips for Businesses That Are Still Lagging Behind

We’re more than two years removed from the introduction of the General Data Protection Regulation (GDPR) into EU law.

18 December 2020
Muhammad Asif Qureshi
Privacy Article

Privacy During a Pandemic

It will soon be one year since the first case of COVID-19 was reported. Ever since that first case, governments, healthcare providers and pharmaceutical companies have been under constant pressure to find a vaccine for this virus.

18 December 2020
Gabriel Cusu
Governance Article

The Role of IT Governance During the COVID-2019 Pandemic

It is likely that 2020 will remain in history as the year of COVID-19. The virus has changed everything, affecting personal and professional lives across the globe. Organizations have had to change their ways of working, and as a result, many more people are now working remotely to adhere to social distancing protocols.

16 December 2020
ISACA Community Shows Off Its Diverse Talents in 2020 #IamISACA Stories
Blog Post

ISACA Community Shows Off Its Diverse Talents in 2020 #IamISACA Stories

Beginning in April, our #IamISACA series has told the stories of the accomplished, volunteer-minded and multitalented people who make up the ISACA community. We hope you have enjoyed reading and viewing these stories as much as we have enjoyed sharing them...

17 December 2020
Eight Future Privacy Governance Imperatives That Boards Have a Duty to Perform
Blog Post

Eight Future Privacy Governance Imperatives That Boards Have a Duty to Perform

Surveys show that most people still feel they should have more control over their data and are uncomfortable with the sale of their data to third parties, implying that some privacy regulations are failing to effectively protect the privacy of their citizens.

16 December 2020
The Role of IT Governance During COVID-19 and Beyond
ISACA Journal Article

The Role of IT Governance During COVID-19 and Beyond: Keeping the Momentum

This is an extremely critical and dangerous period in everyone’s lives. A single message is heard from every corner of the world: “Stay home.” This is a vastly different situation from how the world has functioned for the last five decades.

Author: Lionel Jayasinghe
Podcast
Podcast

Exploring the Push for Zero Trust

Increasing pressure on many organizations to meet compliance requirements has resulted in a push to adopt a zero trust approach. But for implementation to be successful, enterprises must obtain a thorough understanding of the nuances of the framework.

16 December 2020
Organizational Culture: Friend or Foe in 2020?
Blog Post

Organizational Culture: Friend or Foe in 2020?

2020 has either been a year of reviews or a year of forward reflections depending on what dominated your outlook.

15 December 2020
Tuan Phan
Blog Post

A Foundational Path for Blockchain Implementation

Twelve years after its birth, blockchain technology has now become mainstream. Its market adoption can be attributed to the industry and blockchain enthusiasts who pushed for new regulations.

14 December 2020
Isaac Kohen
Privacy Article

Why Employee Privacy Matters More Than Ever

For organizations and their employees, 2020 is a uniquely transformative and challenging year. Although this reality is expressed in many ways—including a global pandemic, a deep economic recession, perpetual social unrest and a litany of natural disasters...

14 December 2020
Jon Brandt
Security Article

When Worlds Collide

This year will likely be remembered unfavorably by most people due to the multitude of hardships, losses and inconveniences associated with the COVID-19 pandemic.

11 December 2020
How to Involve Senior Management in the Information Security Governance Process
Blog Post

How to Involve Senior Management in the Information Security Governance Process

Chief information security officers (CISOs) and security specialists often complain about the disinterest of senior management in information security.

10 December 2020
Paul Phillips
Blog Post

Assessing Risk in a Pandemic

To effectively assess risk in a pandemic, leaders need to focus on the risk at hand, the associated right metrics, and evaluate all elements of risk: impact, likelihood and velocity.

9 December 2020
Digital Banking Poses Challenges for Third-Party Risk Management
ISACA Journal Article

Digital Banking Poses Challenges for Third-Party Risk Management

Digital banking is a disruptive trend growing in the banking industry across the world. Simply put, it includes banking services provided primarily or wholly through digital or electronic means.

Authors: Maosen Cai and Han Yan
Navigating the New Hiring Landscape
Blog Post

Navigating the New Hiring Landscape

Daisy Jardine-Viner, a cybersecurity recruitment specialist for NDK Infosec, recently shared her expertise on pandemic-impacted industry hiring trends at ISACA’s EuroCACS conference, hitting on topics including Zoom interview best practices, how the pandemic has altered hiring and what skills and credentials can best position candidates for success in this new climate.

8 December 2020
Mitigating the Dangers of Malware
@ISACA Article

Mitigating the Dangers of Malware

Malware, sometimes conflated with electronic “spam,” has long been a commonly used tactic by ill-intentioned cyberactors, geared toward targets that range from hyper-protected government bodies to student email accounts.

7 December 2020
Sunil Bakshi
@ISACA Article

Securing Work-From-Home Devices

The outbreak of the COVID-19 pandemic resulted in lockdown measures that were imposed to contain the spread of the virus, which included a freeze on commuting to the office to work in person for almost everyone but essential workers.

7 December 2020
Cybereducation
@ISACA Article

ISACA Foundation Commits to Children’s Cybereducation

As developments in technology continue to saturate all aspects of everyday life, it has become more important than ever to ensure that children are properly educated about cyber best practices.

7 December 2020
Vote For an Inspirational Volunteer
@ISACA Article

Vote For an Inspirational Volunteer for the ISACA Founders Award

ISACA® is proud to honor members who have shown outstanding dedication to activities that advance ISACA's purpose, including volunteer service and member engagement activities.

7 December 2020
#IamISACA
@ISACA Article

#IamISACA: Respecting Technology’s Power–and Its Limits

I currently work as the head of internal audit at SAVE, an organization that manages the airport of one of the most beautiful cities in the world, a city with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships: Venice, Italy. SAVE is also the parent company of several organizations that manage other airports in the Italian northeast airport system, including Treviso, Verona and Brescia.

7 December 2020
Anna Johannson
Blog Post

How Smart Technology Helps Fintech Companies Succeed

Smart technology has evolved at a rapid pace. In the beginning, smart tech reached consumers in the form of smart household appliances like thermostats, security systems and refrigerators.

7 December 2020
Surendra Nidar
Governance Article

The Role of IT Governance in Addressing Pandemic-Related Cyberrisk

The entire world is now grappling with the COVID-19 pandemic, which is turning out to be not only a massive health challenge, but also one of the most enormous economic challenges in recent history. With every passing day, thousands of positive cases are added to the already huge number of active cases.

7 December 2020
Sizing Up the Impact of COVID-19 and Remote Work on IT Auditors
Blog Post

Sizing Up the Impact of COVID-19 and Remote Work on IT Auditors

The year 2020 will go down in the history books as one of the most trying years in modern world history. The COVID-19 pandemic has tested nearly every nation, government, business and individual in many unforeseen ways that heavily impact daily life, with additional consequences and impacts likely into the future.

3 December 2020
Podcast
Podcast

The Microcomputing Revolution

Since its conception, microcomputing has made waves in the open source community, providing an accessible and relatively user-friendly way for technology owners to create their own amateur smart devices before mass-manufactured ones hit the market.

3 December 2020
#IamISACA: Weekend Studies for Weekday Successes
Blog Post

#IamISACA: Weekend Studies for Weekday Successes

As a security professional, I am used to new vulnerabilities and threats materializing every day, creating unforeseen challenges and a huge learning scope. It can be difficult, but that is what drew me to the profession in the first place.

2 December 2020
Security and Compliance: What to Expect in 2021
Blog Post

Security and Compliance: What to Expect in 2021

There is little doubt that 2020 has been one of the most challenging years many security professionals have encountered.

2 December 2020
Scott C. Algeier
Security Article

Why You Need to Take Cybersecurity Seriously in the New Year

Today’s cyberthreats are more complex and severe than ever. The risk to organizations of all sizes has never been greater. As we begin 2021, it is important to reflect on the state of cyberthreats so that organizations can better secure themselves.

2 December 2020
Robotic Process Automation
ISACA Journal Article

Robotic Process Automation to Aid Accounting and Finance Departments

Enterprises are currently experiencing one of the most groundbreaking periods of technology evolution since the Internet first came on the scene decades ago, and the rise of robotic process automation (RPA) is a perfect example.

Authors: Angel R. Otero, and Ryan Paul Fink
Security Awareness as a Corporate Asset
Blog Post

Security Awareness as a Corporate Asset

A recent blog post about culture as a corporate asset discussed the importance of a healthy culture in an organization.

1 December 2020
Why Cybersecurity Is a MUST not a SHOULD
Blog Post

Why Cybersecurity Is a MUST not a SHOULD

There is no doubt that security is now a recognized need within and across organizations. This reflects the acceptance of how an organization’s behavior is dependent on shared beliefs, values, and actions of its employees, which includes their attitudes towards cybersecurity.

30 November 2020
Andrea Tang
Privacy Article

Privacy Governance and Privacy Engineering in the Cloud

In the light of digital transformation, cloud computing has become widely adopted. The separation of ownership, management and usage rights of resources increases the possibility and severity of privacy risk in the cloud.

30 November 2020
#IamISACA: My New and Unexpected Adventure
Blog Post

#IamISACA: My New and Unexpected Adventure

I spent nearly four months this year shopping for complete strangers, thousands of miles from my home, navigating completely different food and culture than I am used to, all while attempting to build a new life in the midst of a global pandemic.

25 November 2020
Fintech Governance Challenges, Levels and Theories
ISACA Journal Article

Fintech Governance Challenges, Levels and Theories

The fintech industry is growing at such a fast pace that investors, boards of directors, senior management and government regulators need to reexamine current practices and models of fintech governance. One well-known example of this growth is the US$16 billion ...

Author: Luis Emilio Alvarez-Dionisi
Simplifying the Transition to Quantum-Safe Security with Crypto Agility
Blog Post

Simplifying the Transition to Quantum-Safe Security with Crypto Agility

The quantum computing threat to public-key encryption is enormous. Large-scale quantum computers are on the not-too-distant horizon.

24 November 2020
John P. Pironti
@ISACA Article

Five Key Considerations for Developing a Cybersecurity Emergency Action Plan

Recently, the ever-expanding cybersecurity threat landscape, along with an increasing frequency of attacks, has highlighted the need for organizations to develop and implement emergency action plans as part of their business resilience programs.

23 November 2020
Data Security and IT Audit
@ISACA Article

The Connection Between Data Security and IT Audit

The world’s economy is powered by data. Yet organizations still experience significant difficulties when it comes to protecting and securing information. As ransomware evolves and cloud services attacks increase, enterprises face heightened pressure to secure data.

23 November 2020
Cybersecurity Attacks
@ISACA Article

Transform From Trust to Zero Trust at Asia CACS 2020

This year, the COVID-19 pandemic and its resulting physical distancing requirements have made the idea of congregating with other professionals to explore industry topics and insights seem like a thing of the past. Yet the ISACA community can still gather...

23 November 2020
Audit
@ISACA Article

Using ITAF to Empower IT Audit

In the United States in the early 2000s, several very public cases of financial fraud occurred within large organizations such as WorldCom, Adelphia Communications and Enron. The construction and facilities management corporation Carillion in the United Kingdom raised similar fraud concerns...

23 November 2020
Technology
@ISACA Article

ISACA CTO Shares Tech Upgrades to Improve Online Learning Experience

To better serve members, ISACA has rolled out 2 significant technology updates. The first is a new learning platform called ISACA PERFORM. PERFORM, as the name suggests, offers an experiential approach to learning that improves engagement and performance.

23 November 2020
Security by Design: Are We at a Tipping Point?
Blog Post

Security by Design: Are We at a Tipping Point?

The much-publicized Target breach of 2013—where 70 million customers lost their personal data, 40 million credit and debit card details were stolen, more than US$250 million was spent to manage the breach and the chief executive officer (CEO) and chief information officer (CIO) were replaced—does not even place among the top 15 breaches of this century.

20 November 2020
Podcast
Podcast

Strategies for Securing Remote Technology

The dust of the COVID-19 pandemic has begun to settle and professionals around the globe are now more comfortable with the realities of remote work. Yet even increased familiarity with working from home still leaves room for security threats to arise.

11 November 2020
Ivana Bartolett
Blog Post

How the Concept of Privacy is Shifting

Ivana Bartoletti, a privacy and digital ethics expert recently visited with ISACA Now to share her perspective on major trends in privacy, digital ethics, AI and more.

19 November 2020
Enterprise Security Morphing and Evolving Into Security Intelligence
Blog Post

Enterprise Security Morphing and Evolving Into Security Intelligence

The ongoing global crisis brought about by the COVID-19 pandemic has caused a huge shift in society and how we conduct our daily lives.

18 November 2020
#IamISACA: CISM Connects the Dots in My Professional Development
Blog Post

#IamISACA: CISM Connects the Dots in My Professional Development

At the beginning of my career, I was partly lucky, but later on also quite selective in deciding to work for organizations and bosses that embraced empowerment and supported individual development of their people, as I myself was always a strong advocate of servant leadership and continuous education.

18 November 2020
CISO Burnout
Security Article

Understanding and Addressing CISO Burnout

The job of a chief information security officer (CISO) is notoriously grueling. CISOs often only remain in their roles for a year or two, with high stress levels and unrealistic organizational expectations among the leading factors that drive CISOs from the job.

18 November 2020
Harnessing Zero Trust Security
ISACA Journal Article

Harnessing Zero Trust Security

Cybersecurity is awash with acronyms, jargon and marketing slogans. There is no dearth of so-called “silver bullets.” Yet, history and headlines demonstrate the ongoing success of adversaries and tell us a different story.

Author: Rajiv Raghunarayan
Deepa Seshadri
Blog Post

Approaching Risk Management in the New Normal

As we approach the end of 2020, it has become clear that the COVID-19 pandemic is not a passing storm or something that we can wait out before returning to a familiar business routine; it is the new normal.

16 November 2020
Daimon Geopfert
The Nexus Article

The Cybersecurity Implications of an Evolving Work Environment

It is an understatement to say that COVID-19 has forced significant changes in how most organizations operate today.

16 November 2020
Securing the IoT Landscape of Tomorrow
Blog Post

Securing the IoT Landscape of Tomorrow

Security consultants and practitioners have insight into how organizations of various sizes, across both the public and private sectors, are preparing for Internet of Things (IoT) deployments during this unusual pandemic year.

13 November 2020
Guy Pearce
Privacy Article

Three Ways Your Approach to Privacy Is at Risk

At the federal (or national) level, the risk associated with outdated privacy laws has received good coverage. What has received less coverage is how outdated—and, therefore, risky...

13 November 2020
Raising the Bar Beyond Privacy Compliance
Blog Post

Raising the Bar Beyond Privacy Compliance

In the context of privacy by default, privacy compliance is not nearly enough.

12 November 2020
#IamISACA: I Love What I Do
Blog Post

#IamISACA: I Love What I Do

Doing your job well with knowledge and commitment requires you to love what you do. I started my career almost 19 years ago, but information security as a profession came into my life 10 years ago.

11 November 2020
Robotic Process Automation for Internal Audit
ISACA Journal Article

Robotic Process Automation for Internal Audit

Advances in data science, processing capabilities and technology have sparked the fourth industrial revolution. Organizations are rapidly digitalizing parts of their businesses using robotic process automation (RPA) to achieve efficiency and increase quality.

Author: Hassan Toor
Change Is Good
Blog Post

Change Is Good

Shortly after its launch in 2014, I bought a Microsoft Surface Pro 3. If you studied for the Certified Information Systems Auditor (CISA) exam using the review manual or online review course, studied for the Certified in Risk and Information Systems Control (CRISC) exam using the online review course, took the Certified in the Governance of Enterprise IT (CGEIT) exam or read an “IS Audit Basics” column anytime since 2016, you likely read words penned on that computer.

10 November 2020
Journal App
@ISACA Article

Accessing the ISACA Journal Is Easier Than Ever

In today’s digitally saturated world, much media and knowledge consumption takes place electronically. With the free ISACA Journal app, IT industry thought leadership is no exception. The app contains the latest and most timely ISACA Journal content and...

9 November 2020
Risk
@ISACA Article

Identify KRIs to Keep Your Business Afloat During the Pandemic

New and sometimes unpredictable IT vulnerabilities have cropped up as a result of work-from-home policies implemented in the wake of the COVID-19 pandemic. One way organizations can combat these situations for effective governance is by identifying...

9 November 2020
Securing the Cloud
@ISACA Article

Securing the Cloud for Competitive Edge

External forces in business today have driven organizations to transform their IT and security practices. The rise of cloud adoption has left many security teams half-invested in their current security measures, while the other half looks toward the future.

9 November 2020
Sunil Bakshi
@ISACA Article

The Auditor’s Dilemma

Recently, the COVID-19 pandemic and its effects on the IT industry triggered a memory in my mind as an auditor. It took place some years ago when I had just passed my Certified Information Systems Auditor (CISA) exam and was eager to conduct system...

9 November 2020
Leading-Diversity-in-Risk
@ISACA Article

ISACA Foundation Creates Diversity Pipelines

The lack of diversity in the tech space continues to be a critical, prevailing issue, yet organizations are realizing this challenge extends beyond corporate responsibility, social justice or even regulatory compliance. A lack of diversity undermines good business practices.

9 November 2020
ISACA Community
@ISACA Article

ISACA Community Makes a Difference on Second Annual Day of Service

Even a global pandemic could not stop passionate ISACA members and their families from serving their communities. On 3 October 2020, 100 teams of ISACA members from around the world came together to give back for the second annual ISACA CommunITy Day...

9 November 2020
Working from Home with Remote Video Technology Audit and assurance
Blog Post

Working from Home with Remote Video Technology

Working from home has gone from being a luxury to a necessity because of the COVID-19 pandemic. Usually, we talk about disrupting technology, but this time, we have an external non-controllable factor that is causing the disruption.

9 November 2020
Victor Antonio Jimenez
Governance Article

COBIT Resource Optimization Mapped to TOGAF’s Architecture Review Board

Several years ago, the IT department of the largest bakery factory in the world conducted a COBIT® 5 assessment and implementation of enterprise governance as presented in the article, “A Partial Transition to COBIT 5 Demonstrates Value to IT.”

9 November 2020
One Year In: Tech Update From ISACA’s CTO
Blog Post

One Year In: Tech Update From ISACA’s CTO

Just over one year ago, I came on board as ISACA’s first chief technology officer. I knew I had an exciting challenge in front of me. ISACA members are extremely sophisticated technology professionals, and I needed to make your experience with us elegant, quick and on your terms.

6 November 2020
CCP
Security Article

Top Cyberattacks of 2020 and How to Build Cyberresiliency

Cyberattacks rank as the fastest growing crime in the US, causing catastrophic business disruption. Globally, cybercrime damages are expected to reach US $6 trillion by 2021.

6 November 2020
Alex Holden
Blog Post

Battling Ransomware: US Hospitals Under Fire

In 2010, I moved away from the financial industry into the world of cybersecurity consulting. My first consulting project was within the healthcare industry, and so was my next big project, and hundreds of projects in which I have participated since.

5 November 2020
Zero Trust Architecture—Myth or Reality?
ISACA Journal Article

Zero Trust Architecture—Myth or Reality?

Trust is an emotion that cannot be applied to machines; however, it is, regularly. In today’s hostile cyberspace, the “trust, but verify” approach typically results in crisis management. The IT landscape has been changing ever since the first computer was invented. More and more organizations are adopting big data...

Author: Muhammad Asif Qureshi
Podcast
Podcast

Managing Malware Threats

Phishing emails and dangerous links are among the most pervasive threats to cybersecurity, capable of targeting everyone from seemingly impenetrable government organizations to college students’ university email accounts.

4 November 2020
Don’t Just Fight Privacy Fires: Plan Ahead to Prevent Them
Blog Post

Don’t Just Fight Privacy Fires: Plan Ahead to Prevent Them

As privacy concerns continue to increase, most of us spend our days fighting fires. With more privacy regulations continuing to be released, it’s difficult to understand the key differences and know what is most important.

3 November 2020
#IamISACA: Diagnosing the Need for a Career Change
Blog Post

#IamISACA: Diagnosing the Need for a Career Change

Just a few short years ago, having completed my bachelor’s degree in physiotherapy, I was on track to become a doctor in the lake city of Udaipur, India, where I am from. But by the time I completed my doctorate, I realized that something was missing in my career and my life.

3 November 2020
Successful Second Annual CommunITy Day Changes the World!
Blog Post

Successful Second Annual CommunITy Day Changes the World!

A global pandemic did not stop the dedicated and passionate ISACA members, staff and their families around the world from giving back to their local communities on ISACA’s second annual CommunITy Day

2 November 2020
Ali Pabrai
The Nexus Article

Getting Started With CMMC, a US DoD Mandate for Cybersecurity

On 31 January 2020, the US Department of Defense (DoD) introduced a new cybersecurity standard, the Cybersecurity Maturity Model Certification (CMMC).1 Every cybersecurity and compliance professional, including senior executives, must raise their awareness of this important and valuable cybersecurity standard developed by the DoD.

2 November 2020
Keeping Up with Change with Agile
Blog Post

Keeping Up with Change with Agile

The phrase “the only constant is change” rings true for every single one of the organizations I have been a part of.

30 October 2020
Journal Volume 6
ISACA Journal Article

Information Security Matters: The Context of Cybersecurity in the Post-Pandemic World

In my previous article, I stated that “serious cyberattacks seem no worse than before” the COVID-19 pandemic. Whenever anyone qualifies a categorical statement, the qualifier is always awfully important. In this case, it invites the question, “Just what is a trivial cyberattack?”

Author: Steven J. Ross
Journal Volume 6
ISACA Journal Article

How to Start Your Quantum Migration Journey

If quantum migration were a train, it would be a cryptoagility train with the destination quantum readiness. All aboard!

Author: Paul Lucier
Journal Volume 6
ISACA Journal Article

Key Performance Indicators for Security Governance, Part 1

Having reliable metrics or key performance indicators (KPIs) in the field of information security is a prerequisite to building a successful security program. Measuring operational efficiency, costs and benefits has always been a concern for managers, and information security is no exception.

Author: Andrej Volchkov
Journal Volume 6
ISACA Journal Article

IS Audit Basics: Ethics in Information Technology

I am sitting down to write this column in mid-August, which, believe it or not, is quite late for an ISACA Journal vol. 6 column (at least for me). The reason? After 3.5 years and 21 articles, I have decided that this will be my last column.

Author: Ian Cooke
2020 Journal Volume 6
ISACA Journal Article

Leaving the Cathedral: A Case Study of Open Source as a Business Strategy

Most practitioners know that support for open-source software can sometimes be a loaded question for an organization. From a usage point of view, there are a few concerns. Organizations worry about compliance with open-source licenses— fearing, for example...

Author: Ed Moyle
Journal Volume 6
ISACA Journal Article

The Bleeding Edge: The Dog Days of IoT

When humans first domesticated wolves, the implications of the symbiotic relationships could not have been foreseen. We (humans) were slowly able to somewhat let down our guards while sleeping with our trusty companions on guard and place some of our hunting burdens on our furry friends.

Author: Dustin Brewer
Journal Volume 6
ISACA Journal Article

Innovation Governance: Innovation on Trust

Once upon a time, in order to secure a computer, an organization only had to worry about physical security. After all, computers took up an entire room and were programmed using punch cards that were fed into them. However, as computer technology progressed...

Author: K. Brian Kelley
Journal Volume 6
ISACA Journal Article

The Practical Aspect: Privacy Compliance—A Path to Increase Trust in Technology

The need for privacy is increasing at an unprecedented rate. It cuts across technologies and work models, especially the new ones, that create opportunities for and facilitate the management of personally identifiable information (PII).

Authors: Vasant Raval and Samir Shah
Journal Volume 6
ISACA Journal Article

Security and Privacy in the New Normal

Since the beginning of 2020, communities throughout the world—personal and professional—have been impacted in a way that was always only talked about in hypothetical scenarios, such as running an organization completely virtually.

Author: Deepa Seshadri
Journal Volume 6
ISACA Journal Article

The Unintended Consequences of Zero Trust on Enterprise Culture

It has been 10 years since John Kindervag, then with Forrester Research, first laid out the information systems security concept called the zero trust model. In the decade since, few organizations could boldly claim that their information technology environments were safe from hazards and threats emanating from the inside and outside.

Author: Grace F. Johnson
2020 Journal Volume 6
ISACA Journal Article

Predicting Cybersecurity Risk Severity Using Bayesian-Based Machine Learning

Cybersecurity risk assessment is a nebulous process that requires a delicate balance between art and science. Typically, a risk assessor begins by collecting relevant information for all the identified risk factors. The assessor gathers information from logs, architecture diagrams, network topology...

Author: Srinidhi Mallur
audit and assurance
ISACA Journal Article

Standards, Guidelines, Tools and Techniques

An up-to-date listing of the current IT Audit and Assurance Standards, Guidelines, and Tools and Techniques...

Author: ISACA
The 8 Most Common Cybersecurity Weaknesses to Watch for in Small Businesses
Blog Post

The 8 Most Common Cybersecurity Weaknesses to Watch for in Small Businesses

As a cybersecurity expert, you know that all it takes is a single weakness, or a single vulnerability to compromise the integrity of a business.

29 October 2020
#IamISACA: Curious About the Cloud and Addicted to Hockey
Blog Post

#IamISACA: Curious About the Cloud and Addicted to Hockey

It’s hard to believe I have been working in the financial services industry for 20 years. My primary focus over the last 12 years has been building enterprise, operational, and IT risk management programs from the ground up, including enablement of audit readiness.

28 October 2020
#IamISACA: Respecting Technology’s Power – and Its Limits
Blog Post

#IamISACA: Respecting Technology’s Power – and Its Limits

I’m currently working as the Head of Internal Audit at SAVE, the company managing the airport of the most beautiful city in the world, with an astonishing history of self-government and leadership in commercial, cultural and diplomatic relationships...

28 October 2020
Implementing the Right to be Forgotten When the Internet Never Forgets
Blog Post

Implementing the Right to be Forgotten When the Internet Never Forgets

The internet never forgets, or so the adage goes. But what started off as a catchy saying or something that might be relevant to a technology subculture has evolved into a global reality, especially with dropping storage costs, access to cheap internet and, more importantly, the propensity of the human race to share data willy-nilly.

28 October 2020
Addressing the Human Fallibility That Leads to a Data Breach
ISACA Journal Article

Addressing the Human Fallibility That Leads to a Data Breach

Within the last decade or so, cyberincidents have made headlines and have become top strategic risk factors for enterprises.

Author: Farid Vayani
Anna Johannson
Blog Post

How Law Firms Can Avoid Cybersecurity Fiascos

With each passing month, we’re seeing steep increases in the number of cyberattacks waged against businesses, particularly small businesses.

27 October 2020
Engage
@ISACA Article

New Expert Directory Connects Speakers With Opportunities

Industry thought leaders can be an invaluable resource for accessing exclusive, expertise-rich content. Unfortunately, the COVID-19 pandemic has brought many industry events to a halt, making it more difficult for professionals to connect with experts and consume their compelling content.

26 October 2020
Defining IT Governance and Its Roles for Business Success
@ISACA Article

Defining IT Governance and Its Roles for Business Success

Refining IT governance systems can be invaluable to organizations throughout today’s ever-changing, highly disruptive business environments. Identifying the differences between governance and management and using principles found in COBIT and Certified in the Governance of Enterprise IT...

26 October 2020
Lisa Young
@ISACA Article

Making Sense of Privacy

People everywhere are impacted by privacy, or more accurately, the lack of a common, global set of standards, guidelines and laws to help people understand what privacy is, what it means to them and how to take steps to ensure the privacy of information related to individuals, communities, societies and the enterprise.

26 October 2020
Risk
@ISACA Article

Managing the Risk of Remote Work

The COVID-19 pandemic has resulted in remote work becoming the new normal for employees worldwide. While this measure has been successful in keeping employees safe, unfortunately, it has introduced new security vulnerabilities that can put an organization’s systems and data at risk.

26 October 2020
Pursuing a New Career in Times of Adversity
@ISACA Article

Staying Connected While Working From Home

Virtually every industry has been impacted by the public health risk posed by COVID-19, and as a result, the realities of the traditional work environment have changed, possibly permanently. Conversations about disrupting technology have been forced to address the coronavirus...

26 October 2020
Leveraging COBIT 2019 to Face the Challenge of Digital Transformation in Small Enterprises
Governance Article

Leveraging COBIT 2019 to Face the Challenge of Digital Transformation in Small Enterprises

Information is a key resource for all organizations, regardless of their size. It is created, used, retained, disclosed and destroyed. Technology plays a key role in these activities. Both information and technology (I&T) have become an integral part of all aspects of personal and enterprise life.

26 October 2020
Diana L. Burley
The Nexus Article

Treat the Whole Patient: Cybersecurity Amid COVID-19

Treat the whole patient. Public health practitioners have long known that the symptoms a patient presents in the doctor’s office tell only a portion of the story.

26 October 2020
Cloud Native Security: A Blue Ocean
Blog Post

Cloud Native Security: A Blue Ocean

Digital transformation is driving massive workloads across to the cloud as organizations move beyond a traditional brick and mortar model. Cloud provides the flexibility to execute at speed, time to market and embrace change in the digital landscape.

23 October 2020
Why Build a Cybersecurity Culture?
Blog Post

Why Build a Cybersecurity Culture?

One of the best ways for an organization to reduce cyber risk is to build a culture of cybersecurity. This entails creating a mindset in employees that the risk is real and their daily actions impact that risk.

22 October 2020
#IamISACA: Activating My Spirit of Ubuntu
Blog Post

#IamISACA: Activating My Spirit of Ubuntu

My friends often ask why I am so passionate about volunteering. Answering this question requires me to look back over my life’s experiences. In the quest to find my purpose, I found great wisdom in Mahatma Gandhi‘s words, with one of my favorite sayings being, “The best way to find yourself is to lose yourself in the service of others.”

21 October 2020
#IamISACA: My Endless Journey in IT
Blog Post

#IamISACA: My Endless Journey in IT

In the early 2000s, studying Computer Science and Engineering was a hotcake field; everyone wanted to study it in Bangladesh. Only those who are truly passionate about IT stayed on this journey, and the rest left. Fortunately, I am one of those who has continued.

21 October 2020
Components of Security Awareness and Their Measurement, Part 2
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 2

Security awareness encompasses attitude and knowledge. There is a third component as well, automation, that defines behavior in stressful situations. These concepts were examined in part 1 of this two-part series. However, attitude and knowledge prejudice this kind of automation.

Author: Zsolt Bederna
Key Considerations for Robotic Process Automation
Blog Post

Key Considerations for Robotic Process Automation

Robotic Process Automation (RPA) is a modern trend in which a typically simple (i.e., requiring no real intelligence) sequence, that up until now involved a human operator, is replaced with a virtual robot.

20 October 2020
Valerie Lyons
Blog Post

Mind the Gap: Bridging the Divide Between Digital Ethics and Privacy

When Gartner highlighted “digital ethics and privacy” as one of its top 10 strategic technology trends for 2019, it noted that “any discussion on privacy must be grounded in the broader topic of digital ethics and the trust of consumers, constituents and employees.”

19 October 2020
Adam Kohnke
Blog Post

Auditing with Microsoft Azure

Writing about Azure audit and its associated audit program is a logical follow-up to a previous ISACA Journal article I wrote on auditing Amazon web services (AWS).

16 October 2020
Chloe Haywood
Blog Post

Cybersecurity Hiring Trends Now and in a Post-Pandemic World

There’s no doubt the coronavirus will permanently change the world we live in. For most of us, the past seven months have been a bumpy ride. Demonstrating adaptability (combined with a big dose of resilience) will be key to keeping the wheels turning career-wise in 2021.

15 October 2020
Podcast
Podcast

The Evolution of Wi-Fi

Once a technological marvel, the idea of a wireless connection to the Internet has become so engrained in the digital world that it is hard to fathom a time when that was not the case.

15 October 2020
#IamISACA: Learning My Way to a New Career Path
Blog Post

#IamISACA: Learning My Way to a New Career Path

I was approached by my company a few years back with an opportunity to build a cybersecurity program. At the time, I was working in our internal audit department and cybersecurity risk was a rising and prominent concern for our company.

14 October 2020
Components of Security Awareness and Their Measurement, Part 1
ISACA Journal Article

Components of Security Awareness and Their Measurement, Part 1

People are an essential part of security. They operate processes; produce technology, in the cases of hardware and software; and apply technology; therefore, they are the basis of security. Furthermore, they behave according to their intrinsic and extrinsic sources of motivations.

Author: Zsolt Bederna
Podcast
Podcast

Why You Need a Proactive Approach to Risk

The wave of remote working arrangements implemented as a response to the COVID-19 pandemic has introduced new and often unpredictable IT vulnerabilities.

14 October 2020
Dustin Brewer
Blog Post

Adapting to Emerging Technology

A pentester, security operations center (SOC) analyst, IT auditor, risk analyst and system administrator walk into a bar.

13 October 2020
Syed Salman
Governance Article

Digital Transformation Realized Through COBIT 2019

There is an understanding that is spreading quickly throughout the world: The COVID-19 pandemic has shut down much of the physical world temporarily and the resulting void will be filled by the digital world permanently.

13 October 2020
Enhance Professional Development by Renewing ISACA Membership
@ISACA Article

Enhance Professional Development by Renewing ISACA Membership

The rapid pace of global technological innovation in recent years has led to ever-changing expectations for professional skills and competencies. What satisfied employers 1 year ago may no longer be enough, and for that reason, taking advantage of professional development opportunities...

12 October 2020
Exploring the Basics of Blockchain
@ISACA Article

Exploring the Basics of Blockchain

Blockchain can be defined as a type of digital ledger that records and distributes transactions while protecting data integrity and availability. “Of the confidentiality, integrity and availability (CIA) triad, blockchain is trying to solve the integrity issue,” says cyber expert Dustin Brewer in the “Breaking Down Blockchain” episode of the ISACA Podcast.

12 October 2020
Pursuing a New Career in Times of Adversity
@ISACA Article

Pursuing a New Career in Times of Adversity

The turbulent events of this year have resulted in an uncertain job market for many, whether or not they expected to find themselves searching for a new position. This means it is more important than ever for information security...

12 October 2020
Bruce R. Wilkins
@ISACA Article

Zero Trust

So, it has begun. Zero trust, an old cybersecurity term that is being reintroduced with new meaning. If you remember zero trust, it is probably in the context of trusted development. Zero trust meant that all software created, and hardware tools used to enforce a security safeguard...

12 October 2020
ISACA Student Groups Open Doors to Opportunities
@ISACA Article

ISACA Student Groups Open Doors to Opportunities

Edmund Ho studies accountancy and information management at the City University of Hong Kong College of Business (Hong Kong, People’s Republic of China). He serves as the internal secretary of City University’s ISACA Student Group (ISG), which is affiliated with ISACA’s China–Hong Kong chapter and ISACA Global.

12 October 2020
Jon Brandt
The Nexus Article

Cybersecurity Awareness: Progress or Passivity?

October is Cybersecurity Awareness Month (CSAM), created 17 years ago as a public-private partnership to ensure individuals have the proper resources for online safety. CSAM 2020’s overarching theme is “Do Your Part. #BeCyberSmart” aimed at empowering...

12 October 2020
How COVID-19 Is Changing Risk Management
Blog Post

How COVID-19 Is Changing Risk Management

One of the most visible results of the COVID-19 pandemic is the transition from traditional office-based work to remote work-from-home (WFH) arrangements for global enterprises.

9 October 2020
Cloud Security Breaches: Who is Ultimately Responsible?
Blog Post

Cloud Security Breaches: Who is Ultimately Responsible?

Cloud security breaches consistently make news headlines. Yet, the stories of these breaches are often framed with vague explanations — a “misconfigured database” or mismanagement by an unnamed “third party.”

8 October 2020
Podcast
Podcast

Engineering an Effective Privacy Game Plan

Putting effective privacy measures into practice can be a difficult task for organizations that lack a comprehensive, well-documented privacy strategy. Without one, enterprises may be exposing customer data to vulnerabilities, and could find themselves at risk of noncompliance with privacy regulations.

8 October 2020
#IamISACA: Calligraphy is My Meditation
Blog Post

#IamISACA: Calligraphy is My Meditation

Starting my career in information security and privacy compliance roles has made for a fascinating journey. I am currently working in the fintech sector, which is a relatively young sector in the digital economy. I am learning disruptive technologies first-hand and also learning about start-up culture.

7 October 2020
Next-Generation Security
ISACA Journal Article

Next-Generation Security

The world is interconnected. An event that occurs in one part of the world (e.g., an infected animal for sale at a market introducing COVID-19 to humans) can have dramatic, unexpected consequences everywhere else.

Authors: Louisa Saunier and Kemal A. Delic
Podcast
Podcast

Finding the Human Factor in Work from Home

Once considered a privilege, remote work has become a necessity resulting from the public health risk posed by COVID-19.

7 October 2020
Prioritizing People Perils During a Pandemic Prioritizing people
Blog Post

Prioritizing People Perils During a Pandemic

With the COVID-19 pandemic continuing to plague the world, it goes without saying that as technology and transformational program leaders, we should be managing our “people” risk a lot closer.

6 October 2020
Benjamin Scribner
The Nexus Article

Take Action for Cybersecurity Awareness Month

With so much of our lives taking place online these days, wouldn’t it be great if there was a time of year that was dedicated to cybersecurity? The good news: There is.

5 October 2020
Rajul Kambli
Blog Post

Governance for Effective Digital Transformation

Many successful organizations have been transforming their processes to adapt to the changing environment.

2 October 2020
Embedding Security in the Agile Product Development
Blog Post

Embedding Security in the Agile Product Development

Outline security requirements at the beginning of the project, review the design to check if the requirements have been incorporated and perform security testing before go-live. If this sounds familiar, it should.

1 October 2020
Empathy and Flexibility Can Help Us Navigate a Chaotic 2020
Blog Post

Empathy and Flexibility Can Help Us Navigate a Chaotic 2020

Oof. What a year. 2020 has certainly been a year of contradictions. In some ways, it is a year that has trudged along at a glacial pace.

30 September 2020
#IamISACA: Bringing ISACA Closer to Home
Blog Post

#IamISACA: Bringing ISACA Closer to Home

In 2009, I was certified as a CISA and became an ISACA member, joining the Lagos Chapter in the west region of Nigeria. Five years after, I relocated to Port Harcourt in the south of Nigeria. At the time, there was no nearby ISACA chapter.

30 September 2020
Auditing the Cloud
ISACA Journal Article

Auditing the Cloud: Microsoft Azure

When it comes to the cloud and the methods used to audit this expanding technology, Amazon Web Services (AWS) is not the only major player. There may not be as many advertisements for Azure, but as of 2019, Microsoft was one of the top-three providers of public cloud services.

Author: Adam Kohnke
IT Audits: Running to Stand Still
Blog Post

IT Audits: Running to Stand Still

The work life of an IT auditor can be a thankless one. As the IT department becomes busier, it is increasingly difficult to get IT audit reports over the line. When they are completed, what is the reward?

29 September 2020
Hafiz Sheikh Adnan Ahmed
@ISACA Article

Six Privacy Considerations for Auditors

As compliance requirements continue to evolve, it is critical for auditors to stay abreast of the most current regulations. Efforts to implement proper privacy measures should not necessarily lead to separate information security projects completed merely for compliance reasons...

28 September 2020
privacy
@ISACA Article

Implementing and Executing Privacy by Design

Legislation such as the EU General Data Protection Regulation (GDPR) has popularized the concept of privacy by design, or the notion that privacy be at the forefront during the creation of every process and product in an organization.

28 September 2020
Cloud Environments
@ISACA Article

Strategies for Securing Complex Cloud Environments

Cloud services are commonly used for data storage, meeting operational needs and running applications. Changing to cloud services enables organizations to create new environments when needed and retire them if business needs shift.

28 September 2020
Digital mail
@ISACA Article

Subscribe to ISACA SmartBrief Newsletters to Learn the Latest Trends in Cybersecurity, Privacy and Governance

ISACA has partnered with SmartBrief to offer a new collection of newsletters focusing on the areas of cybersecurity, privacy and governance. The ISACA SmartBriefs deliver multiple pieces of relevant and timely industry news to subscribers’ inboxes in a regular, comprehensive newsletter.

28 September 2020
David Samuelson
@ISACA Article

ISACA CEO David Samuelson’s Commitment to Lifelong Learning

ISACA Chief Executive Officer (CEO) David Samuelson is proud to be a lifelong learner. “Helping people be better so that they can get the most out of their lives has always been a passion of mine,” Samuelson says in a new video as part of the #IamISACA series.

28 September 2020
Pursuing a Multicloud Security Strategy
Blog Post

Pursuing a Multicloud Security Strategy

If your organization is like most, you know that cloud is here to stay. Even if your organization is new to cloud, as a security practitioner, you know that it’s not a matter of “if” but “when” key business processes will find themselves becoming increasingly more dependent on externally-hosted services and cloud technologies.

28 September 2020
Pritesh Parekh
The Nexus Article

Secure Cloud Migration Starts With Trust

Several years ago, discussions with IT organizations tended to revolve around convincing skeptics to move to the cloud. This is no longer the case. Over time, those discussions evolved because IT leaders grew to understand the clear value of adopting cloud.

28 September 2020
Mark T. Edmead
Governance Article

Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy

COBIT is an IT governance and management framework designed to help organizations create value from their IT initiatives, better manage their risk and optimize resources.

28 September 2020
Make Security Awareness an Experience
Blog Post

Make Security Awareness an Experience

In a lot of countries, October is ”Cybersecurity Month,” and organizations like to time their security awareness programs around this period. As we approach October, it is important to start thinking about security awareness training and how best to engage employees.

25 September 2020
Jason Kang
Blog Post

CGEIT Preparation Tips and the Timelessness of Good Governance

My preparation for the CGEIT certification exam took about five months of self-study, deep-dive research on the weekends and answering practice questions.

24 September 2020
Ookeditse Kamau
Blog Post

Building a Privacy Focus Area Using COBIT and the NIST Privacy Framework

As ICT professionals we are overwhelmed with quite a number of frameworks, but it is the nature of the specialization in the field that prompts the need for them.

23 September 2020
#IamISACA: Uplifting Others: The Measure of My Life
Blog Post

#IamISACA: Uplifting Others: The Measure of My Life

The life of a human being should be measured and valued by what it does for others. That is what my parents taught me.

23 September 2020
Common Sense Authentication
ISACA Journal Article

Common Sense Authentication

In the mid-1970s, 96 kilobytes of computer memory cost more than US$100,000. Today, 8 gigabytes of computer memory can be purchased for less than US$50. That difference demonstrates the huge advancements in information systems in the last 45 years.

Author: Paul C. Schauer, Ph.D.
The Blurred Lines of Information Privacy Attitudes in the COVID-19 Era
Blog Post

The Blurred Lines of Information Privacy Attitudes in the COVID-19 Era

The paradox and the naked reality is that people are simultaneously needing to protect their personal information by not participating in online transactions, while also needing to participate in online transactions to obtain goods or services...

22 September 2020
‘No Other Option’ Than Ethical Hacking
Blog Post

‘No Other Option’ Than Ethical Hacking

FC, a well-known ethical hacker and social engineer, has been working in the information security field for over 20 years and excels at circumventing access controls.

21 September 2020
IT Governance Value and the Pandemic
Blog Post

IT Governance Value and the Pandemic

Today, more than ever, people, business and information & technology are related: I&T are essential resources to facilitate the survival of people and business.

18 September 2020
What I Learned About Risk During the Pandemic: Meme Edition
Blog Post

What I Learned About Risk During the Pandemic: Meme Edition

The internet is rife with memes that speak to how nobody could have seen what was coming in 2020. From the futility of buying a 2020 calendar to the pretentiousness of answering the question of where you are going to be in five years, they are endlessly funny and help to ease us through these difficult times. v

17 September 2020
#IamISACA: This Time, I’m Here to Stay
Blog Post

#IamISACA: This Time, I’m Here to Stay

The first time I became an ISACA member, I did not stay long. I became a member in 2015 simply because there was a need for an IT auditor at my organization, but that reason was not enough to keep me in ISACA.

16 September 2020
j20v5-article-091610
ISACA Journal Article

Addressing Risk Using the New Enterprise Security Risk Management Cycle

Enterprise Security Risk Management (ESRM) is a holistic security program designed to identify and prioritize assets and risk to mitigate those risk areas. ESRM bridges security professionals and asset owners in making informed decisions through the ESRM cycle.

Author: Harisaiprasad Kumaragunta
Like Cold Weather, Handle Election Security with Layers
Blog Post

Like Cold Weather, Handle Election Security with Layers

What I’m going to tell you in this blog post is nothing new, and no secret to most cybersecurity professionals, but it nonetheless bears repeating leading up to the November US election, and really taking to heart.

15 September 2020
Taking Steps to Win the Battle Against Misinformation
Blog Post

Taking Steps to Win the Battle Against Misinformation

As a risk professional working in county government in the state of Kansas, I am on the frontlines of helping to secure the upcoming 2020 US election.

15 September 2020
Realizing the Benefits of Robotic Process Automation
@ISACA Article

Realizing the Benefits of Robotic Process Automation

Robotic process automation (RPA) reduces the amount of time it takes to perform logical, repetitive tasks, allowing more complex, value-added work to be completed. RPA is software designed specifically to perform manual, regularly occurring tasks, not to be confused with the use of robotic machines to construct a product on an assembly line, which the name may imply.

14 September 2020
Jack Freund
@ISACA Article

Problems With Using Record Count as a Proxy for Risk

Developing a cyberrisk appetite can be a daunting task. Many organizations struggle to determine how much risk they have, how much is acceptable and how to measure risk at all. When faced with these problems, many practitioners default to measuring things that are within arm’s reach or appear novel or significant based on someone’s experience.

14 September 2020
audit and assurance
@ISACA Article

Finding a Framework That Fits

Enterprises that effectively implement a cybersecurity framework are better able to create value through processes, people and technology. Guided by a framework, organizations can establish their own cybersecurity policies and procedures while adhering to industry best practices.

14 September 2020
information security
@ISACA Article

ISACA Partners With NYU for Member Discounts on Exclusive Cyber Fellows Program

ISACA and the New York University (NYU) Tandon School of Engineering have partnered to offer the CSX Cybersecurity Practitioner (CSX-P) certification at a discounted price along with a 75% scholarship toward a Master’s in Cybersecurity to all ISACA members accepted into the NYU Cyber Fellows Program

14 September 2020
ISACA Awards Program
@ISACA Article

Nominations Due 30 September for the 2021 ISACA Awards

ISACA’s professional community is advanced by outstanding contributions from members who strive to exemplify ISACA’s purpose and leadership. It is through the ISACA® Awards peer-recognition program that incredible achievements of volunteers across the industry are celebrated, inspiring future generations of business technology professionals.

14 September 2020
Security Study
@ISACA Article

ISACA’s New Election Security Study Shows Declining Confidence

In the lead-up to the 2020 US elections, ISACA surveyed more than 3,000 US members in January 2020 and again in July. Results show that confidence levels are low—and declining. Even though experts largely agree that technical controls and security procedures for elections are relatively strong...

14 September 2020
CommunITy Day
@ISACA Article

Local Outreach Makes a Global Impact on ISACA’s CommunITy Day

Recognized by the American Society of Association Executives (ASAE) with a 2020 Power of a Gold Award for its global impact, CommunITy Day encourages ISACA members and their families to take action in their local communities while ISACA measures the positive effect created globally.

14 September 2020
The Secret to Passing Cybersecurity Certification Exams
Blog Post

The Secret to Passing Cybersecurity Certification Exams

Getting ready to take a certification exam in the cybersecurity realm – whether it’s CISM, CRISC, CISSP, CSX-P or another blue-chip certification – can be quite stressful.

14 September 2020
Adam Cason
The Nexus Article

A Green Eggs and Ham Guide to Securing Your Critical Infrastructure

Whether your data are in a box, with a fox, in a house, with a mouse, on a train, in the rain, in a car or on a boat... Wherever the critical data that you manage are located—which brings to mind the Dr. Seuss book Green Eggs and Ham...

14 September 2020
Ali Pabrai
The Nexus Article

COVID-19 Cyberattacks Require Businesses to Prioritize Cyberresilience

Businesses and end users are being targeted to download COVID-19 ransomware malware disguised as legitimate applications. We are witnessing an increase in phishing attacks that then lead to ransomware events by using COVID-19 as bait to mislead employees and customers.

14 September 2020
Ron Lear
Blog Post

CCPA: Nine Months In

Protecting consumer data privacy has been a critical issue for years, but California was the first US state to actually enact a law.

11 September 2020
Privacy as a Differentiator: Going Beyond Regulations
Blog Post

Privacy as a Differentiator: Going Beyond Regulations

The array of proposed and adopted privacy laws across the globe, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), reflect growing concerns around privacy.

10 September 2020
Common Misconceptions About Agile Auditing
Blog Post

Common Misconceptions About Agile Auditing

Before the pandemic disrupted our lives, I attended a fascinating webinar in which the head of a very large internal audit shop shared lessons learned from the department’s Agile journey.

9 September 2020
j20v5-article-090910
ISACA Journal Article

US Data Privacy Law: A Disparate Landscape in Need of Consolidation

Even before the EU General Data Protection Regulation (GDPR) brought attention to the issue of data privacy, the United States already had one of the most complex regulatory approaches to privacy, having implemented different laws and regulations by industry...

Authors: Jacob Nix and Pascal A. Bizarro
Podcast
Podcast

Breaking Down Blockchain

At its core, blockchain functions to maintain the integrity of data and systems. But how does it compare to other databases and when should it be used?

9 September 2020
Dušan Žikić
Governance Article

COBIT and IT Audit—A Partnership for Eternity

The first time I heard about COBIT was almost 10 years ago, as I was starting out as an IT internal audit intern. Since then, I have been using COBIT for various aspects of IT audit, including developing IT audit plans, planning and performing IT audit engagements...

8 September 2020
Making Our Mark on ISACA CommunITy Day 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Making Our Mark on ISACA CommunITy Day 2020
Blog Post

Making Our Mark on ISACA CommunITy Day 2020

How will we come together as a global community to do local volunteer service during a pandemic? As a member of the ISACA St. Louis Chapter, we just unanimously agreed that all chapter events are virtual-only for the 2020-2021 plan year. Can we pull off CommunITy Day again this year?

4 September 2020
Responding to and Protecting Against Ransomware
Blog Post

Responding to and Protecting Against Ransomware

There have been many recent successful ransomware attacks, and there is frustration that in today’s cybersociety, information security safeguards and best practices are not being followed by local governments, financial services, law enforcement, academia, government agencies, healthcare organizations and businesses and commercial enterprises.

3 September 2020
Choosing the Ideal API with Security in Mind
Blog Post

Choosing the Ideal API with Security in Mind

Application programming interfaces, or APIs for short, provide very secure and standardized ways for applications to work together and deliver greater information and functionality for end users

2 September 2020
#IamISACA: Reaching the Top, and Finding a New Challenge
Blog Post

#IamISACA: Reaching the Top, and Finding a New Challenge

After more than 10 years as an IT and IS auditor and consultant for one of the Big 4 audit and advisory companies worldwide, I gained world-class experience by working in a high-ranking professional environment on challenging local and international engagements.

2 September 2020
#IamISACA: Striving for Excellence
Blog Post

#IamISACA: Striving for Excellence

The 2008-2009 recession gave me the opportunity to look beyond the obstacles and to find out what opportunities lie after a crisis. With that in mind, today’s COVID-19 pandemic reminds me how a crisis turned into an opportunity to land in information security and to become involved with ISACA.

2 September 2020
Building a Privacy Culture
ISACA Journal Article

Building a Privacy Culture

Privacy is the right to be free from interference or intrusion. Information privacy is most often associated with digitization, but information privacy has been an issue ever since personal information started to be stored on and processed by mainframe and mini-computers.

Author: Muhammad Asif Qureshi
COVID-19: A Pilot for the Future of Work
Blog Post

COVID-19: A Pilot for the Future of Work

Daniel Susskind visited with ISACA Now to discuss how AI will impact the professional landscape, how COVID-19 factors in and more. The following is a transcript of the conversation, edited for length and clarity.

1 September 2020
Podcast
Podcast

The Road to Achieving Privacy by Design

Most organizations would agree that privacy by design is fundamental to growing a successful business and building customer trust. Yet putting this ideal into practice can often prove challenging. In this episode of the podcast...

1 September 2020
Mostafa Elghazaly
@ISACA Article

How to Build a Strategic and Effective GRC Operating Model

Many organizations are facing a set of challenges with regard to governance, risk and compliance (GRC)-related processes, technologies and overall programs embedded within their IT and business enterprise architecture.

31 August 2020
Audit Program From ISACA Reviews Microsoft Azure Cloud Platform
@ISACA Article

Audit Program From ISACA Reviews Microsoft Azure Cloud Platform

To be effective, auditors must familiarize themselves with the latest cloud trends and top cloud computing platforms such as Amazon Web Services (AWS) and Microsoft Azure (Azure) as well as market newcomers and the latest cloud trends.

31 August 2020
Navigating Governance
@ISACA Article

Navigating Governance in the Wake of COVID-19

An informed risk response is fundamental to the success of IT risk and assurance professionals, and the importance of this tactic has been amplified since the rise of the COVID-19 pandemic.

31 August 2020
Discover the Latest in Cybersecurity at ISACA’s Virtual Summit 2020
@ISACA Article

Discover the Latest in Cybersecurity at ISACA’s Virtual Summit 2020

In the age of the COVID-19 pandemic and physical distancing, gathering in a single room with hundreds of other professionals to explore ideas and the latest industry trends is unlikely to become a reality anytime soon.

31 August 2020
New Hall of Fame Recognizes Dedicated Volunteer Service
@ISACA Article

New Hall of Fame Recognizes Dedicated Volunteer Service

Volunteering not only benefits the recipient of the service provided, the act of giving creates a ripple effect and encourages participation across entire communities. Donating time to a cause can reinvigorate an individual both personally and professionally.

31 August 2020
Deploying a Data Security Defense
Blog Post

Deploying a Data Security Defense

Data security has always been a top priority, but the COVID-19 pandemic has made it even more prominent.

31 August 2020
CDPSE Spotlights Relationship Between Privacy and Security
Blog Post

CDPSE Spotlights Relationship Between Privacy and Security

Few organizations are driving more meaningful change than ISACA for our professions and our careers.

28 August 2020
journal volume 5
ISACA Journal Article

IS Audit Basics: Defining Targets for Continuous IT Auditing Using COBIT 2019

I have previously discussed sitting and passing my Certified Information Systems Auditor® (CISA®) exam back in 2005.1 I tend to remember that one of the hot topics at that time was continuous online auditing.

Author: Ian Cooke
journal volume 5
ISACA Journal Article

The Dark Side of Robotic Process Automation

Business processes involve performing a sequence of tasks, such as registering a sale, computing value-added tax, sending an invoice, packaging and sending the product, updating the inventory and accounts receivables, etc.

Author: Spiros Alexiou
journal volume 5
ISACA Journal Article

Pandemic-Driven Remote Working and Risk Management Strategies

One of the most visible results of the 2020 COVID-19 pandemic has been the mainstream transition from traditional office-based work to remote work-at-home arrangements. Government officials worldwide mandated that nonessential employees stay home.

Author: Brett Bonin
journal volume 5
ISACA Journal Article

The Bleeding Edge: Why the Bleeding Edge Is So Bloody

Those of us who have been in this industry for a while have seen amazing accomplishments and growth within the technology sector. We have also seen security breaches happen, usually paired with quick knee-jerk reactions and a “slap-a-Band-Aid-on-it” mentality as a response.

Author: Dustin Brewer