215 reputation
13
bio website
location Oklahoma
age
visits member for 3 years, 10 months
seen Aug 6 '13 at 20:40

Apr
7
awarded  Supporter
Jan
2
comment How dangerous is it to use third-party security audit tools?
My $.02 is that if your name is tied into the affair, you are not being unreasonable in your request. Presumably you know exactly what is being audited and why (unless someone else specked it out and dropped it into your lap).
Aug
24
awarded  Yearling
Feb
21
comment Information Security standards in corporations
Make sure that the policies arising from your effort are enforceable ones.
Feb
8
comment Teaching security concepts
I always liked the idea of the e-wallet aspect of SET. Not especially flexible so likely one of several reasons why it wasn't adopted.
Feb
1
answered How does hacking work?
Jan
22
comment Business-to-Business Security Disclosure and Agreement
I realize that that they are not exactly what you are looking for but the The SANS Institute policy templates might offer a starting point. After all the agreement you mention, when enacted, becomes "policy" for the organizations in the agreement.
Jan
20
answered SQL query sanitation (black list)
Dec
22
awarded  Analytical
Dec
21
answered How to improve as a security expert
Dec
20
comment How to improve as a security expert
If your employer/organization periodically engages an outside firm to perform vulnerability testing ask/beg/struggle/fight to be involved withthat perhaps as the web/app dev point person. You can make a contact with someone doing the hands-on work (ask them how they broke into the game), you might be able to guide your employer by tapping into your theoretical knpwledge. Reviewing the written proposal of work submitted by the outside firm is useful as well as you might be able to make constructive suggestions about what they intend.
Dec
19
comment Policy requirements of Sarbanes-Oxley (SOX)
"The Interpretive Guidance reiterates the Commission’s position that management should bring its own experience and informed judgment to bear in order to design an evaluation process that meets the needs of its company and that provides a reasonable basis for its annual assessment of whether ICFR is effective." ---- Management tells the auditors what is in/out of SOX scope not the other way around. Too many auditors want to come into an organization and tell management what is in SOX scope.
Nov
30
comment What should be Database encryption strategy ?
Per BOL ms-help://MS.SQLCC.v10/MS.SQLSVR.v10.en/s10de_4deptrbl/html/c75d0d4b-4008-4e71-9‌​a9d-cee2a566bd3b.htm employing TDE in SQL Server does not provide encryption across communication channels. MS recommends SSL to ensure encrypt data across channels so eanm89 is correct in recommending SSL.
Nov
30
answered xp_cmdshell: should it ever be used?
Jul
19
awarded  Teacher
Jul
19
answered Security policy for system administrators
Jan
31
comment What policies maximize employee buy-in to security?
Have you never had annual performance review where your manager sits down with you, reviews what you did, and sets your goals for the coming year? In my experience when a person knows that the their performance goals for the coming year include their measurable compliance with Terms of Use or other corporate security policies and that figures into future raises or bonuses, based upon their meeting or exceeding those goals, their buy-in is amazingly swift. I'm not talking about a simple update to a job description or a set of procedures.
Jan
12
answered What policies maximize employee buy-in to security?