For Security & Risk Professionals

Shift In Ownership: Protecting Data Outside Your Four Walls  (1.6 MB PPT)

by Robert Whiteley, October 28, 2009

In September 2009, Forrester hosted a two-day event designed to help security and risk professionals understand the top three shifts impacting their job heading. This document summarizes the key recommendations we made to help master the shift in ownership . . .

For Security & Risk Professionals

Shift In Expectations: Modernizing Your SRM Program  (2 MB PPT)

by Robert Whiteley, October 28, 2009

In September 2009, Forrester hosted a two-day event designed to help security and risk professionals understand the top three shifts impacting their job heading. This document summarizes the key recommendations we made to help master the shift in expectations . . .

For Security & Risk Professionals

Shift In Architecture: Building A Flexible, Compliant Foundation  (1.9 MB PPT)

by Robert Whiteley, October 27, 2009

In September 2009, Forrester hosted a two-day event designed to help security and risk professionals understand the top three shifts impacting their job heading. This document summarizes the key recommendations we made to help master the shift in architecture . . .

For Security & Risk Professionals

PCI X-Ray: Network Segmentation

by John Kindervag, July 17, 2009

To effectively deal with the broad and complex requirements of Payment Card Industry (PCI) data security, you need to break the elements apart to provide enhanced clarity. We've designed the PCI X-Ray series to provide actionable information to help Forrester . . .

For Vendor Strategy Professionals

Market Overview: IT Security In 2009

by Jonathan Penn, April 22, 2009

The big news for the IT security market in 2009 is that it will fare relatively well. Cost and justification pressures are exerting themselves, but through increasing business-level visibility led by data-breach headlines, security spend continues to . . .

For Security & Risk Professionals

PCI X-Ray: IDS And IPS

by John Kindervag, April 8, 2009

To effectively deal with the broad and complex requirements of Payment Card Industry (PCI) data security, you need to break the elements apart to provide enhanced clarity. We've designed the PCI X-Ray series to provide actionable information to help Forrester . . .

For Application Development & Program Management Professionals

App Dev's Role In Securing Next-Generation Information Architectures

by Noel Yuhanna, November 13, 2008

Tightly coupling data sources with applications has been a common approach for applications that need to access enterprise data, but with increasing data volume and data complexity along with the need for real-time and accurate information, new options . . .

For Security & Risk Professionals

Securing Next-Generation Information Architectures

The Promise Of Improved Security Or The Risk Of New Attack Vectors

by Noel Yuhanna, October 24, 2008

Next-generation information architectures such as data federation and information services are gaining increased adoption, so security professionals must ensure their protection from all relevant threats. What is the nature of those threats? These next-generation . . .

For Security & Risk Professionals

Re-Architecting The Infrastructure For Data-Centric Security

by Paul Stamp, April 24, 2008

Companies are adopting a more data-centric approach to security, but they're finding that some protection still needs to reside in the infrastructure. Infrastructure-centric measures ease the transition from today's largely infrastructure-based security . . .

For Security & Risk Professionals

Industrial Control System Security

Electricity Distributors Get Security Mandates and Standards

by Geoffrey Turner, April 22, 2008

As digital industrial control systems (ICS) become increasingly interconnected both with each other and with enterprise information technology infrastructures, the risks of unauthorized access to and manipulation of these systems become unacceptably high. . . .

For Security & Risk Professionals

Five Trends That Will Shape The IT Security Profession In 2008

by Jonathan Penn, December 28, 2007

CISOs have been striving to evolve their security programs and focus more on addressing business risk issues than on responding to tactical security events. In 2008, we will see executives and business managers recognize the changing goals of security . . .

For Security & Risk Professionals

Trends 2007: Physical And Logical Security Convergence

by Geoffrey Turner, August 17, 2007

The integration of enterprise physical security controls and management regimes with enterprise IT security architectures is a nascent trend that has been forecast as imminent for several years. But despite the clear benefits to be gained from increased . . .

For Security & Risk Professionals

Information Security Framework  (333 KB PPT)

by Paul Stamp, March 3, 2007

Many CISOs and security managers want to take a more strategic approach to security, but don¿t have the time or the resources to put together a framework and the necessary tools to map out what their security program looks like and where they should invest . . .

Build Your Privacy Program: Privacy Information Architecture

by Michael Rasmussen, November 3, 2006

Privacy programs must define privacy information architecture. This architecture maps the flow of personal information through all of your organization's business processes and specifies restrictions on the use of that information inside your firm. Specifically, . . .

Jericho Forum Looks To Bring Network Walls Tumbling Down

by Paul Stamp, Robert Whiteley, July 8, 2005

The Jericho Forum, a powerful and vocal security user group that includes organizations like BP, Procter & Gamble, and the UK's Royal Mail, aims to change the way we think about IT and network security. The Jericho Forum claims that current security . . .

Building A Security Architecture Around Appliances

by Paul Stamp, June 24, 2005

Two big trends in the security market over the last couple of years have been the deployment of security functions on dedicated appliances and the combination of security functions into single appliances. A customer needs to make careful choices when . . .

Trends 2005: Application Security Architecture And Secure Web Services

by Randy Heffner, October 25, 2004

The 9/11 terrorist attacks and other heightened security concerns prompted IT to focus heavily on security. Appropriately, the first focus was infrastructure security. A higher-level focus on application security is now picking up steam and, together . . .

The Application Security Architect Role

by Randy Heffner, June 7, 2004

There are five major areas of responsibility for the role of application security architect: policy, architecture, implementation guidance, compliance, and process definition. Within these areas, tasks range from collaborating on policy definition to . . .

Major Application Security Objectives

A Clear Foundation For Application Security Architecture

by Randy Heffner, June 7, 2004

Application security architecture is a complex topic with many and varied requirements and design considerations. To maintain focus and control scope, it is important to stay centered on the three major objectives of application security architecture: . . .

Forrester Wave™: XML Security Gateways

A Question Of Exit Strategy

by Randy Heffner, March 29, 2004

Growing Web services adoption is driving demand for secure Web services. XML security gateways offer a quick-hit solution — perfect for high-priority projects operating on a tight schedule. But it is critical to look at the early market in the broader . . .

Keeping Developers Out Of Security

Misinformation Perpetuates Short-Sighted Application Security

by Randy Heffner, March 25, 2004

A recent example of application security misinformation comes from XML security gateway vendors that say companies must have a separate XML security layer to keep application developers out of security. It is the right idea to keep developers out of security, . . .

For Application Development & Program Management Professionals

Secure Web Services: Functional Design Priorities

by Randy Heffner, January 8, 2004

Many early, simple Web Services will make do with surface-level protection, simple authentication, node-to-node confidentiality and coarse-grained authorization. Sensitive Web Services may find business reasons to consider a much wider range of issues.

IT Trends 2004: Application Security Architecture

by Randy Heffner, November 20, 2003

Web SSO remains strong, vulnerability assessment picks up speed and application firewalls fight for a market niche ¿ but application architects must fit these into a high-level vision for comprehensive application security architecture.

For Application Development & Program Management Professionals

IT Trends 2004: Secure Web Services

by Randy Heffner, November 19, 2003

Application architects should retain a tactical, low-investment stance toward secure Web Services throughout 2004, because the strategic picture of industry standards and practices will not be clear until at least 2005.

The Role of Virtual Directories In Identity Management Architecture

by Jonathan Penn, October 28, 2003

Today, most implementations of virtual directories are tactical in nature. However, there is also a strategic role for virtual directory technology in identity management architecture that should not be overlooked.