Forrester

For Security & Risk Professionals

Blog:Avoid The Information Security Squirrel

"My master made me this collar. He is a good and smart master and he made me this collar so that I may speak. Squirrel!"   In the Pixar film Up, squirrels frequently distract Dug the talking...

For Security & Risk Professionals

Report:What You Must Know About Data Privacy Regulations In Asia Pacific

Be Ready To Comply With Dynamic Regulatory Changes

Understanding the laws and regulations that govern data privacy across your organization is critical for any company, but it can be challenging. As a result, too many security and risk (S&R)...

• Downloads: 90

For Security & Risk Professionals

Report:The Forrester Wave™: Endpoint Security, Q1 2013

Endpoint Security Suites Take Center Stage In The Enterprise

In Forrester's 50 criteria evaluation of endpoint security vendors, we identified nine top providers in the category — F-Secure, IBM, Kaspersky, LANDesk, Lumension, McAfee, Sophos, Symantec,...

• Downloads: 517
• Rating:

For Security & Risk Professionals

Report:Build An Information Security Management System

Policy And Procedures: The S&R Practice Playbook

Over recent years, the information security industry has matured nicely; experts and associations have documented many best practice models, and their adoption has been widespread. It's disconcerting...

• Downloads: 743

For Security & Risk Professionals

Blog:Bit9’s Operational Oversight Is Probably Your Operational Reality

You are now no doubt aware that Boston-based security firm Bit9 suffered an alarming compromise, which resulted in attackers gaining access to code-signing certificates that were then used to sign...

For Security & Risk Professionals

Report:Measure The Effectiveness Of Your Data Privacy Program

Performance Management: The Data Security And Privacy Playbook

Privacy is one of the most important and emotional issues in information security. Privacy, or the lack thereof, affects a company's management, employees, and most importantly, customers. With the...

• Downloads: 236
• Rating:

For Security & Risk Professionals

Report:The Risk Manager's Handbook: How To Plan And Execute Appropriate Risk Treatment

Developing And Managing Efforts To Control Unacceptable Levels Of Risk

From understanding comes action. Your risk management efforts up to this point will have yielded a list of concerns; a measure of how much these concerns could affect objectives; and a decision of...

• Downloads: 194
• Rating:

For Security & Risk Professionals

Report:Top 15 Trends S&R Pros Should Watch: Q2 2013

From frantic security operations problems to the changing threat landscape, CISOs, senior security leaders, and other IT risk management leaders consistently have trouble keeping up with key trends...

• Downloads: 301
• Rating:

For Security & Risk Professionals

Blog:Collaborate With Your Non-Security Peers To See How Objectives Intersect (Hint: Mobile Context For Mobile Authentication)

“Enterprise rights management? What does that even mean?! You’re using security speak!” exclaimed my colleague TJ Keitt. TJ sits on a research team serving CIOs, and covers...

For Security & Risk Professionals

Blog:Avoid The Social Media Binary

Many organizations today get caught up in what I call the “social media binary,” where there are only two options to social media control: 1) Allow unrestricted access to social networks,...

For Security & Risk Professionals

Blog:The Forrester Wave: Email Content Security

It is with great pleasure that I announce the completion of my first Forrester Wave™: Email Content Security, Q4 2012. I’d like to thank the research associates (Jessica McKee and...

For Security & Risk Professionals

Blog:Crowdsourcing my RSA panels

The San Francisco RSA conference is now less than two weeks away, and this year I am moderating two great panels. I thought I'd reach out and solicit suggestions for discussion.  ...

For Security & Risk Professionals

Blog:Adding social network, geolocation, IAM logs, text analytics and link analytics Big Data to the arsenal of Fraud Management

A common theme during this week's SAS and FICO user conferences was how to use Big Data to make fraud decisions faster, more accurately and without impacting the customers in any negative way....

For Security & Risk Professionals

Blog:Expense In Depth And The Trouble With The Tribbles

You remember the tribbles don't you? The cute, harmless looking alien species from the second season of the original Star Trek that turn out to be anything but benign. They are born pregnant and...

For Security & Risk Professionals

Blog:Do You Think Of Consumers When It Comes To Data Security Policies And Controls?

Your customers are consumers too. They don’t turn into business bots when they set foot in the enterprise. Whether your organization sells a product or a service to enterprises or consumers,...

For Security & Risk Professionals

Report:The Forrester Wave™: Enterprise Fraud Management, Q1 2013

The Eight Providers That Matter Most And How They Stack Up

In Forrester's 15-criteria evaluation of enterprise fraud management vendors, we identified the eight most significant vendors in the category — 41st Parameter, ACI Worldwide, CA Technologies,...

• Downloads: 278

For Security & Risk Professionals

Report:The 15 Most Important Questions To Ask Your Cloud Identity And Access Management Provider

During the past three years, cloud-based identity and access management (IAM) solutions have become a viable and cost-effective alternative to on-premises, commercial off-the-shelf (COTS), or...

• Downloads: 186
• Comments: 3
• Rating:

For Security & Risk Professionals

Report:Determine The Value Of Information Security Assets And Liabilities — Information Security Economics 102

This is the second in a series of reports providing guidance and new methods for the financial management of information security. The CISO's role is rapidly changing. A few years ago the CISO for...

• Downloads: 108
• Comments: 2
• Rating:

For Security & Risk Professionals

Blog:How Do You Maintain Your Security Edge?

Keeping up with the threat and IT landscape, looking ahead to future technology and disruptive technologies, and keeping up with the regulatory landscape to identify what it means to your...

For Security & Risk Professionals

Playbook:The Governance, Risk, And Compliance Playbook

Maximize Business Performance With A World-Class GRC Program

Unexpected events are at best distracting and at worst catastrophic for an organization as it strives to meet its objectives. Risk and compliance professionals must help their colleagues anticipate...

For Security & Risk Professionals

Blog:Achieving Resilience Means Mastering The Response

Stephanie Balaouras and I published a report last week on the current state of crisis communications, and one thing is clear: most companies are not ready to invoke their crisis communications...

For Security & Risk Professionals

Report:The Forrester Wave™: Emerging Managed Security Service Providers, Q1 2013

Ten Emerging Service Providers That Have The Chops To Be Your Managed Security Service Provider

In Forrester's 15-criteria evaluation of the emerging managed security services provider (MSSP) market, we identified the 10 most significant providers in this category — Alert Logic; CompuCom;...

• Downloads: 582
• Rating:

For Security & Risk Professionals

Blog:Forrester’s 2013 Update To The Data Privacy Heat Map Shows Increasing Global Momentum Towards Data Protection Standards

As data flows between countries with disparate data protection laws, firms need to ensure the safety of their customer and employee data through regulatory compliance and due diligence. However,...

For Security & Risk Professionals

Report:Strategy Deep Dive: Define Your Data

Rethinking Data Discovery And Classification For Data Security

Defining data via data discovery and classification is an often overlooked, yet critical, component of data security and control. Security and risk (S&R) pros can't expect to adequately protect data...

• Downloads: 177
• Rating:

For Security & Risk Professionals

Blog:XACML is dead

Conversations with vendors and IT end users at Forrester's Security lead us to predict that XACML (the lingua franca for centralized entitlement management and authorization policy evaluation and...