We are in the process of finalizing some research planning for the next few months, so I want to see if there are any requests for research out there.
First, here are some papers we anticipate completing over the next 3 months:
- Understanding and Selecting a Database Encryption or Tokenization Solution
- Understanding and Selecting a Database Assessment Solution
- Project Quant for Database Security
- Quick Wins with DLP
- Pragmatic Data Security
- Network Security Fundamentals
- Endpoint Security Fundamentals
- Understanding and Selecting a SIEM/Log Management Product
- Understanding and Implementing Network Segregation
- Data Security for the Cloud
Some of these are sponsored, some aren’t, and all will be released for free under a Creative Commons license.
But we’d also like to know if there are any areas you’d like to see us develop. What the heck – since we give it away for free, you might as well take advantage of us. The one area we aren’t ready to cover yet is identity management, but anything else is open.
Seriously – use us. We like it. Oh, yeah.
Reader interactions
14 Replies to “Choose Your Own Whitepaper Adventure (and Upcoming Papers)”
I like the ff articles:
* Quick Wins with DLP
* Network Security Fundamentals
* Endpoint Security Fundamentals
* Understanding and Selecting a SIEM/Log Management Product
Much <3 for the relaunched Securosis.
I'd love to see fundamentals demystifying the alphabet soup of security frameworks (ITIL, COBIT, ISO 17799/27001, NIST SP 800). Aside from doing what everyone else in the same industry is doing, why choose one over the other? I prefer Mike's pragmatic approach to security programs, but there's no escaping the bureaucracy of these frameworks and certifications.
Would it be possible for you to point me to your paper that will assist me to ensure availability/confidentiality of information in a (MS SQL) database that resides on a virtual machine? [Each DB instance on separate OS installed on a single HW server.] Thank you. –Cathy
Rich,
I would like to read “Data Security for the Cloud.” Seems to be an evolving topic especially now. Also, I stumbled upon this resource for white paper analysis, check it out.
Thanks,
Dave
Rich,
I’d like to see something on Data Security and the Cloud that addresses how you vet and secure overseas outsourcers.
Larry
Perhaps “Understanding and Selecting Manual Penetration Testers/Assessors (Network/Application/.etc.)”. Looking forward to the SIEM piece.
Quick Wins with DLP
Honestly I’m interested in any DLP deep dive. I work on detecting content for a DLP vendor and I deal with the limitations all the time. Every vendor will of course tell you that they have the best way to detect content but each strategy comes with different advantages and limitations. I’m interested in hearing about the different approaches and the methods of minimizing those disadvantages.
Network Security Fundamentals + 1
Understanding and Selecting a SIEM/Log Management Product +1
Project Quant for File Permissions.
I know File servers are about the easiest thing out there, but I believe there’s a size and complexity threshold that could be identified as a reference point where certain alternative permissioning strategies or even technologies (i.e. Document Management Systems) is a best practice and MORE IMPORTANTLY shows a financial investment in those tools is better than continuing to attempt to centrally manage permission granularity on file servers
“Understanding and Selecting a SIEM/Log Management product”
Awesome idea! I just wrote one of these, but there is definitely more education on that needed.
I also like:
“Project Quant for Database Security”
Maybe
“Project Quant for Vulnerability [not patch] Mgt”
“Project Quant for Change Mgt”
etc
“Understanding and Selecting a SIEM/Log Management product” +1