ISSA Journal Ottobre 2020

ISSA Journal  - La rivista mensile riservata ai Soci AIPSI

Indice e contenuti dei principali articoli nell'edizione di Ottobre 2020:

• Using PCI Scope to Lower Risks and Cost, by R. Scott Pierangelo and David Lam. This article discusses leveraging technology identified in PCI Self-Assessment Questionnaires A and P2PE to reduce the risks and costs to an organization when processing credit cards, which also subjects the organization to fewer and less onerous compliance requirements. By leveraging newer technology and risk transfer, organizations can in some cases reduce questions almost tenfold.
• Cyber Risk Management: Strategic Plan or Afterthought, by Mark Langford - ISSA member, North Texas Chapter. This article discusses the current state of cyber risk management and the emerging factors that will motivate organizations to invest sufficiently in their cyber defenses to protect their vital data assets.
• Surveying Five Years of Java Deserialization CVEs, by Erik Elbieh - ISSA member, New Jersey Chapter. A dramatic increase in Java deserialization CVEs has occurred since research in 2015 highlighted a high-impact vulnerability class that has since been found in many widely used applications. This paper examines the progress made in identifying these Java deserialization vulnerabilities and uses a custom CVE dataset to extrapolate the trajectory of this vulnerability class over the next few years.
• Quantitative Risk Calculation in Cybersecurity: The Value of Quantifying Risk, by Chris van den Hooven - ISSA member, Netherlands Chapter. This article advocates for the intrinsic value of quantitative decision-making in cybersecurity.
• Python Programming: Object-Oriented Programming, by Constantinos Doskas - ISSA Senior Member, Northern Virginia Chapter. This article is an introduction to object-oriented technology. Python is an object-oriented language. Up to this point we have used many of the objects provided by Python, although our programming approach was procedural. What is object-oriented programming? Why was it developed? Why do we want to use it? These are questions that will be answered in this and the next few articles.

  Inoltre in questo numero:

• From the President
• Sabett's Brief
• To Enable or Not To Enable...That's No Longer A Question
• Women in Cybersecurity
• Meet the Next Generation of Cybersecurity Women
• The Cryptic Curmudgeon
• Security, and Business, Metrics
• Herding Cats
• Shut Up and Take My Money!
• Security in the News
• Association News
• Education Foundation
• Career Center