For Security & Risk Professionals

Know Your Code: How Static Analysis Tools Make Applications More Secure

by Chenxi Wang, Ph.D., Andrew Jaquith, November 20, 2009

Many companies, besieged by audit findings and application vulnerabilities, recognize the benefits of eliminating security vulnerabilities early in the software life cycle. For this reason, static analysis technologies for analyzing code-level security . . .

For Security & Risk Professionals

The Forrester Wave™: Identity And Access Management, Q4 2009

Oracle, CA, And IBM Lead, With Novell And Sun Microsystems Close Behind

by Andras Cser, November 3, 2009

In Forrester's 79-criteria evaluation of identity and access management (IAM) vendors, we found that Oracle, CA, and IBM lead the pack because of a rich IAM portfolio (both organically developed and acquired), an understanding of a rapidly changing market, . . .

For Enterprise Architecture Professionals

SOA Security 2009: Four Solution Patterns

A Two-Dimensional Continuum For Diverse SOA Security Solutions

by Randy Heffner, September 14, 2009

Architects crafting their organization's strategy and architecture for service-oriented architecture (SOA) security have a wide diversity of security requirements, business scenarios, and application infrastructure to deal with. To set a solid direction . . .

For Enterprise Architecture Professionals

SOA Security 2009: Products And Specifications

Selecting Standards, Specifications, And Products For SOA Security

by Randy Heffner, August 20, 2009

As enterprise architects set their organization's strategy for service-oriented architecture (SOA) security, they will have to filter through a variety of standards, emerging specifications, and products that can contribute features and functions for . . .

For Security & Risk Professionals

TechRadar™ For Security & Risk Professionals: Network Threat Mitigation, Q3 2009

by John Kindervag, July 22, 2009

The news is filled with reports of networks attacks and stolen data. Consumers routinely undergo the stress of fraudulent charges or compromised credit cards. Terms such as "botnet" have become part of our vocabulary. As a result, security and risk professionals . . .

For Enterprise Architecture Professionals

SOA Security 2009: Requirements And Design

Understanding Your SOA Security Requirements And Iterative Solution Design

by Randy Heffner, July 16, 2009

In industry discussions about SOA, external integration is treated as the benchmark indicator of SOA security maturity: If it's secure enough for external integration, SOA must be secure. By that benchmark, 30% of SOA users think SOA security is mature . . .

For Security & Risk Professionals

TechRadar™ For SRM Professionals: Application Security, Q3 2009

Application Security Comes Of Age Despite A Slowdown In Security Spend

by Chenxi Wang, Ph.D., July 8, 2009

As application-level exploits continue to generate headline news, security professionals increasingly look to application security measures to protect their organizations. To succeed, security professionals must understand the maturity of the various . . .

For Security & Risk Professionals

Application Security Technology Adoption Trends in 2009   (434 KB PPT)

by Chenxi Wang, Ph.D., June 25, 2009

Application security issues continue to garner headline attention. However, the current economic downturn has put some of the new application security initiatives to test; we are seeing a slight slowdown in new technology adoption this year. These data . . .

For Security & Risk Professionals

Application Threat Modeling: Uncover Security Vulnerabilities Before It's Too Late

Using Threat Modeling To Develop More-Secure Applications

by Robert Whiteley, April 22, 2009

Security and risk professionals have long used security threat modeling to find security vulnerabilities. However, many of your application development colleagues don't even know what threat modeling is. By communicating the benefits of threat modeling . . .

For Application Development & Program Management Professionals

Use Threat Modeling To Develop More-Secure Applications

The Payoff Is High For Avoiding Security Vulnerabilities During Development

by Mike Gualtieri, March 10, 2009

Many application architects and developers don't know enough about developing secure applications. Worse, many of them have a naive notion of application security that lulls them into thinking they have all the security bases covered. This means that . . .

For Security & Risk Professionals

Enterprise IT Security In Europe: 2008

Business Data Services Europe

by Bill Nagel, March 2, 2009

How are European enterprises adopting, using, and managing IT security technologies, including client security, data security, content filtering, and business continuity and disaster recovery? This document highlights an extensive data set collected from . . .

For Security & Risk Professionals

SMB IT Security In Europe: 2008

Business Data Services Europe

by Bill Nagel, February 26, 2009

How are small and medium-size businesses (SMBs) in Europe adopting, using, and managing IT security technologies, including client security, data security, content filtering, and business continuity and disaster recovery? This document gives highlights . . .

For Security & Risk Professionals

PCI X-Ray: Firewalls

by John Kindervag, February 13, 2009

To effectively deal with the broad and complex requirements of Payment Card Industry (PCI) data security, you need to break the elements apart to provide enhanced clarity. We've designed the PCI X-Ray series to provide actionable information to help Forrester . . .

For Enterprise Architecture Professionals

SOA Policy Management: Vendors And Products

The Market Landscape For SOA Policy Management Infrastructure And Services

by Randy Heffner, February 6, 2009

Service-oriented architecture (SOA) policy management is an important and emerging subset of SOA strategy, SOA governance, and SOA platform planning. Because SOA policy features and functions are arising within multiple types of products, many different . . .

For Security & Risk Professionals

IT Security Remains An Integral Part Of The Enterprise

The State Of Enterprise IT Security: 2008 To 2009

by Simon Yates, January 29, 2009

Forrester's recent security survey of North American and European enterprises shows hope for the current state of IT security. Thankfully, we found that the IT security organization continues to be a strong and important part of the business, as is demonstrated . . .

For Security & Risk Professionals

SMBs Struggle To Keep Pace With IT Security

The State Of SMB IT Security: 2008 To 2009

by Simon Yates, January 29, 2009

Forrester's recent security survey of North American and European SMBs provides some insight into the current state of IT security. We found that the IT security organizations for small and medium-size businesses (SMBs) are becoming more similar to those . . .

For Vendor Strategy Professionals

What President-Elect Obama's Cybersecurity Agenda Means For Security Vendors

by Khalid Kark, January 8, 2009

President-elect Barack Obama has acknowledged that leaving America's information systems unprotected could lead to a "crippling blow" to our economy. He has promised to make cybersecurity his top priority, declare cyberinfrastructure a strategic asset, . . .

For B2B Market Research Professionals

The State Of SMB IT Security: 2008 To 2009

Business Data Services North America And Europe

by Jonathan Penn, December 24, 2008

This document gives highlights of an extensive data set collected across North American and European small and medium-size businesses (SMBs) via our Enterprise And SMB IT Security Survey, North America And Europe, Q3 2008. Hot topics include data security, . . .

For B2B Market Research Professionals

The State Of Enterprise IT Security: 2008 To 2009

Business Data Services North America And Europe

by Jonathan Penn, December 24, 2008

This document gives highlights of an extensive data set collected across North American and European enterprises via our Enterprise And SMB IT Security Survey, North America And Europe, Q3 2008. Hot topics include data security, application security, . . .

For Security & Risk Professionals

Inquiry Spotlight: Application Security, Q4 2008

by Chenxi Wang, Ph.D., October 17, 2008

The issue of application security is increasingly important for security professionals in today's ever-evolving application vulnerability landscape. But Forrester's data shows a clear disconnect between perceived importance of application security and . . .

For Security & Risk Professionals

Case Study: North American Financial Services Company Defines An RBAC Vision And Services

by Andras Cser, August 28, 2008

A North American financial services company implemented the enterprise role management system by first assessing the current situation, laying out a formal role-based access control (RBAC) and governance vision, selecting a role management platform, setting . . .

For Security & Risk Professionals

Rich Internet Applications: Security Professionals Must Understand The Security Implications

Securing Rich Internet Applications

by Simon Yates, August 26, 2008

The use of rich Internet application (RIA) frameworks has sharply increased in the past year as more and more application development professionals embrace rich Internet development technologies like Ajax or Adobe Flash. But what does this mean for security . . .

For Application Development & Program Management Professionals

Securing Rich Internet Applications

by Jeffrey S. Hammond, March 17, 2008

This past year, Forrester saw dramatic growth in the number of developers and application platform decision-makers that indicate that they are using rich Internet application (RIA) frameworks. As they shift focus from RIA platform selection to deployment, . . .

For Security & Risk Professionals

Operationalizing Application Vulnerability Management

by Chenxi Wang, Ph.D., February 29, 2008

Criminals want access to your assets, and one of their preferred methods is to exploit vulnerabilities lurking in your applications. To protect your organization's applications and the information assets contained in them, security and risk professionals . . .

For Security & Risk Professionals

Five Trends That Will Shape The IT Security Profession In 2008

by Jonathan Penn, December 28, 2007

CISOs have been striving to evolve their security programs and focus more on addressing business risk issues than on responding to tactical security events. In 2008, we will see executives and business managers recognize the changing goals of security . . .