Home / Resources / News and Trends / Industry News

Industry News

A collection of the latest relevant articles providing insight, practical tips and knowledge sharing from experts in security, risk, governance, privacy and audit. Start here for the latest useful original articles from ISACA.

Chris Snyder
Featured Industry News Article

Healthcare’s Growing Threat Landscape

In an era where technology is deeply embedded in every aspect of daily life, the healthcare industry is no exception—and cybercriminals have taken notice. In 2024 alone, the healthcare industry has been the target of roughly one quarter of all reported cybersecurity incidents, which highlights it being a target over many other industries.

Read More

Industry News Most Recent Articles

Fene Osakwe
Audit Article

Control Considerations for a Data Privacy Audit

There are 5 key risk areas that could provide guidance for auditors in today’s evolving privacy landscape. By identifying and defining these key risk areas, auditors can ensure robust and comprehensive privacy oversight

3 March 2025
Isla Sibanda
Audit Article

The Role of Digital Transformation Audits: Transform While Upholding Governance Standards

Digital transformation is reshaping the landscape of industries globally. While the benefits are enormous, these transformations can also jeopardize an organization’s governance standards if not executed with rigorous oversight.

3 March 2025
Gert Jan Koster
Security Article

Hybrid SAP IT Landscape: Security Challenges and Mitigations

Most organizations today have an IT environment that combines on-premises and cloud services. The preference to integrate these services has caught on widely, as it has proven flexible, scalable, and cost efficient.

27 February 2025
Safia Kazi
Privacy Article

The Evolving Role of the Privacy Professional

The privacy profession is evolving to include multiple components of ethics, and privacy professionals must incorporate ethics-related considerations into their daily work.

21 February 2025
Collin Beder
Emerging Technology Article

The Cost of Convenience: AI Adoption and Security Blind Spots

For the past few years, many believed that the race for artificial intelligence (AI) supremacy was firmly in the hands of established players such as OpenAI and Anthropic.

11 February 2025
Chester Avey
Security Article

What to Know About EXIF Data, a More Subtle Cybersecurity Risk

Understanding what vulnerabilities exist, along with their potential severity and impact, can dramatically strengthen an organization’s cybersecurity posture and improve overall cyberreadiness.

6 February 2025
Safia Kazi
Emerging Technology Article

The Tangled Web of Executive Orders on AI

The rapid shifts in the way the US executive branch addresses AI under different administrations illustrates why organizations are better positioned if they approach emerging technologies from risk-based and ethical perspectives.

4 February 2025
Chris Snyder
Security Article

Healthcare’s Growing Threat Landscape

In an era where technology is deeply embedded in every aspect of daily life, the healthcare industry is no exception—and cybercriminals have taken notice.

3 February 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Guidelines for Operationalization of Web Client Runtime Security

This article includes seven suggested steps or activities that organizations may find useful in operationalizing their WCRS programs or capabilities.

31 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

Traditional Security Solutions Fall Short in Protecting Against Web Client Runtime Risk

This article describes the limitations of traditional security solutions in addressing WCRS risk and proposes implementation options for purpose-built security solutions.

30 January 2025
Sergei Vasilevsky, CISSP, and Kamal Govindaswamy, CCSP, CISSP, CIPP/US
Security Article

An Introduction to Web Client Runtime Security

The term Web Client Runtime Security (WCRS) was coined by the authors to highlight the security or possible malicious behavior of the code executed in users' browsers during their web interactions.

29 January 2025
Yakir Golan
Risk Article

Cyberrisk Quantification: A Strategic Imperative for Financial Resilience

As enterprise risk becomes increasingly intricate, the strategic execution of addressing multifaceted threats has grown more critical than ever.

24 January 2025
Justin Rende
Security Article

Cybersecurity Trends to Watch in 2025

There is no crystal ball to forecast the future; however, organizations can make informed predictions about cybersecurity in the coming year.

6 January 2025
Ryan Standbridge
Security Article

Overreliance on Automated Tooling: A Big Cybersecurity Mistake

Automation and artificial intelligence (AI) have been a positive force multiplier in the cybersecurity industry. Improved time efficiency, resources, cost, and productivity are great strides in the field and should be celebrated.

30 December 2024
Amit Patel
Security Article

Humans Are IT Security’s Weakest Link

When thinking about what makes up IT security, high-tech firewalls, robust encryption algorithms, and advanced threat detection systems are often the first things that come to mind.

10 December 2024
Yuman Chau
Security Article

Ensuring Data Security: The Importance of Cloud Backups and Drill Testing

In the organizational IT environment, system and data backup is crucial. Data backup is the last defense against downtime if data is corrupted or lost.

2 December 2024
Abdul Qayyum Mohammed
Emerging Technology Article

Innovation Is Shaping the Future of Network Engineering

Quantum computing and blockchain bolster security measures, ensuring robust protection for sensitive data in cloud environments.

2 December 2024
Alex Mathew
Governance Article

Cloud Data Sovereignty: Governance and Risk Implications of Cross-Border Cloud Storage

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

18 November 2024
Arun Gupta
Emerging Technology Article

Revolutionizing CRM: How AI-Enhanced Security is Transforming Customer Data Protection

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

14 November 2024
Brian Odian
Emerging Technology Article

Embracing the Future: The Quantum Computing Revolution Begins Now

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

7 November 2024
Chandra Sekhar Dash
Emerging Technology Article

The Importance of AI Safety in Customer Experience Automation

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

5 November 2024
Tori Anderson and Tracy Bordignon
Governance Article

Autopilot on Copilot: Governance Considerations and Pitfalls When Implementing Generative Artificial Intelligence

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

1 November 2024
Adeleke Ayobami
Audit Article

How Blockchain Technology is Revolutionizing Audit and Control in Information Systems

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

31 October 2024
Innocent Atasie
Audit Article

Eight facility zones to consider while Auditing for Information, Physical, and Environmental Security Compliance

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

25 October 2024
Safia Kazi, AIGP, CIPT, and Collin Beder, CET, CSX-P, Security+
Emerging Technology Article

Safely and Responsibly Using Emerging Health Technology

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

25 October 2025
Lalithkumar Prakashchand
Audit Article

Beyond the Blockchain Bubble: Distributed Ledger Technology for a Resilient Audit Landscape

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

23 October 2024
Chester Avey
Security Article

Comparing the MITRE ATT&CK and NIST Cybersecurity Frameworks

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

17 October 2024
Gagan Koneru
Privacy Article

The Evolving World of Data Privacy: Trends and Strategies

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

14 October 2024
Isaac Lee
Audit Article

By The Importance of IS Audit: Lessons Learned from the Evergrande Crisis

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

11 October 2024
Patrick Barnett
Security Article

DarkAngels Strikes Big: Record-Breaking Ransom Secured

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

10 October 2024
Arun Gupta
Governance Article

The Crucial Integration of CRM and Corporate Governance: A Key to Better Business Outcomes

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

7 October 2024
Olu Adekoya
Risk Article

Navigating Ransomware: Key Tactics for Enterprise Resilience

The increasing prevalence of ransomware attacks offers a unique learning opportunity. The experiences of diverse organizations across various sectors with a previous ransomware attack can provide practical lessons and invaluable insights for any enterprise to harness, empowering it to be better prepared and more resilient to ransomware attacks

1 October 2024
Gaya Ratham
Risk Article

Navigating Risk When Transitioning to the Cloud

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

1 October 2024
Fene Osakwe
Audit Article

The Evolution of Tech Assurance: Restructuring the IT Audit Function

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

27 September 2024
Yuman Chau
Security Article

From Hollywood to Hacking: Understanding Deepfake Scams

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

18 September 2024
Chris McGowan
Security Article

Centralized Services and Their Impact on Business Continuity

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

17 September 2024
Isla Sibanda
Emerging Technology Article

Reidentifying the Anonymized: Ethical Hacking Challenges in AI Data Training

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

16 September 2024
Sunil Arora
Risk Article

Persuasive Technology: The Technology That Connects and Controls Us

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

4 September 2024
Patrick Barnett
Risk Article

A New Threat Actor Group Emerges: Understanding Lapsus$

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

3 September 2024
Vaibhav Malik
Emerging Technology Article

Building a Secure and Compliant AI Infrastructure: Lessons from the Trenches

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

30 August 2024
Terry Ray
Governance Article

Auditors are Asking Better Questions—Organizations Should Have Better Answers

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

27 August 2024
Arun Mamgai
Emerging Technology Article

AI Security Risk and Best Practices

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

15 August 2024
Dorina Hamzo
Risk Article

Securing the Digital Landscape: Organizations Must Address Third-Party Risk Head-On

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

13 August 2024
Varun Prasad
Emerging Technology Article

AI Algorithm Audits: Key Control Considerations

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

2 August 2024
Patrick Barnett
Risk Article

Can Hardening Reduce Cyberrisk?

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

19 July 2024
Yuman Chau
Audit Article

The Importance of Independent IT Audit

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

12 July 2024
Adeleke Ayobami
Emerging Technology Article

Leveraging AI for Information and Cybersecurity

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

28 June 2024
Prabin Litto
Security Article

Cloud Security Challenges in the Pharmaceutical Industry

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

14 June 2024
Candice Jackson
Risk Article

Has the Digital Journey Added to the Risk of Using Third Parties?

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

7 June 2024
Patrick Barnett
Security Article

Understanding Sandworm, a State-Sponsored Threat Group

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

31 May 2024
Felix Muckenfuß, CIPM, CIPP/E
Governance Article

Reinforcing IT Governance in the Face of Constant Threats

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

21 May 2024
Ivan Mans
Security Article

SAP Security Maturity: A Crash Course

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

9 May 2024
Mathieu Gorge
Security Article

Navigating the Cyber Elephant in the Boardroom

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

29 April 2024
Art Poghosyan
Audit Article

Managing Compliance in 2024: Best Practices to Secure Cloud Access and Stay Audit-Ready

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

18 April 2024
Patrick Barnett
Security Article

Using a Functional Cybersecurity Exercise to Test Incident Response Plans

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

8 April 2024
Isaac Kohen
Security Article

Five Steps to Secure an Enterprise Against Insider Threats

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

26 March 2024
Safia Kazi
Privacy Article

Optimize Enterprise Data and Uphold Privacy With ISACA’s DTEF

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

14 March 2024
Industry News
Privacy Article

Achieving Ethical Protection of Data Privacy

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

12 March 2024
Aparna Agarwal
Security Article

The Top 5 Cybersecurity Threats and How to Defend Against Them

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

27 February 2024
Guy Propper
Security Article

Navigating the Shifting Ransomware Landscape

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

13 February 2024
Arun Mamgai
Security Article

How CISOs Can Take Advantage of the Balanced Scorecard Method

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

2 February 2024
Mike Boutwell
Risk Article

Navigating the Treacherous Waters of IT Risk

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

30 January 2024
Jordan Kassing
Audit Article

Five Controls to Consider When Auditing a Vendor Management Program

Vendor management is a fundamentally critical function that impacts an organization's operational success, efficiency, reputation and risk exposure.

23 January 2024
Ozman Azab
Audit Article

Six Benefits of a Cybersecurity Audit (and 6 Steps to Perform One)

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

16 January 2023
Fouad Mulla
Security Article

Building Cybersecurity Resilience With the Power of Habit

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

9 January 2024
Patrick Barnett
Security Article

Countermeasures to Protect Against TA505 (CL0P Ransomware)

TA505 has emerged as one of the most sophisticated and prolific threat groups of 2023. Organizations can protect themselves by implementing countermeasures intended to mitigate risk.

2 January 2024
Justin Rende
Security Article

Track These 7 Trends for Proactive Cybersecurity in 2024

As 2024 looms near, digital threats are expected to increase in sophistication. Consequently, the tools and strategies cyberprofessionals use to counter them must also adapt.

26 December 2023
Chris McGowan
Security Article

Quishing: The Invisible Threat in QR Code Technology

When quishing occurs, unsuspecting individuals are lured into scanning malicious QR codes that link to fraudulent websites or malware downloads. Awareness surrounding this new threat must be raised to protect personal data and digital safety.

19 December 2023
Sadiq Nasir
Security Article

Rethinking Cybersecurity Training to Build a Resilient Workforce

There is much to be gained by exploring various approaches to ensuring benefits realization for any cybersecurity training program.

12 December 2023
James Allman-Talbot
Security Article

The Grim Reality of a Cyberattack: From Probability to Certainty

The outlook is grim for organizations that wish to keep their data secure. It is necessary to understand practical methods for reducing the impact of suffering from an attack.

5 December 2023
Michalis Kamprianis
Risk Article

Third-Party Risk Management: The Security Blind Spot No One Wants to Discuss

Third-party risk analysis services and customer security questionnaires are no longer sufficient for risk management. Trust professionals must explore alternative solutions for mitigating risk.

28 November 2023
Arunava Banerjee
Risk Article

Optimizing Risk Transfer for Systematic Cyberresilience

As security professionals navigate the present cyberthreat horizon, it is crucial to understand the emerging dangers and fortify digital defenses with cyberinsurance to ensure a secure digital future.

21 November 2023
Fene Osakwe
Audit Article

Three Skills for Succeeding as an IT Auditor in the 21st Century

There are 3 skills that a modern IT auditor must possess to add value to the technology teams being audited and to avoid being seen through a negative lens by senior leadership.

14 November 2023
Sunil Arora
Security Article

From Chaos to Confidence: The Indispensable Role of Security Architecture

Similar to a high-rise building, a cybersecurity defense needs a solid foundation to avoid putting long-term stability at risk.

7 November 2023
Meghan Maneval
Privacy Article

What the Past Tells Us About the Future of Privacy in the United States

Because information can be replicated, exfiltrated or deleted in a matter of seconds, consumers and organizations need to implement steps to prevent, detect, respond to and remediate data breaches.

6 November 2023
Jack Freund
Security Article

What Is Considered a Material Cyberrisk Under the New US SEC Rules?

The cyberevent disclosure rules introduced by the US SEC in July 2023 have sparked a wave of concern among cybersecurity professionals and BoDs.

2 November 2023
Oliver Kling
Security Article

The Importance of Security Logistics in Software Development

Organizations must understand how security measures work, are implemented and behave—and under which circumstances they fail.

31 October 2023
Safia Kazi
Privacy Article

Legally Permissible Does Not Mean Ethical

Treating compliance as an aspiration and collecting excessive amounts of information is harmful to consumers; privacy professionals must help their enterprises’ privacy practices be more ethically focused.

30 October 2023
How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech
Emerging Technology Article

How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech

Companies increasingly are on the lookout for new professionals with skills and background in emerging technologies and how to implement them in the enterprise setting.

26 October 2023
Singirikonda Manikanta
Security Article

Redefining Cybersecurity Education

Industry news offers a dynamic and up-to-date source of information that can help bridge the knowledge gap and redefine cybersecurity education.

24 October 2023
Zachary Folk
Security Article

What Enterprises Need to Know About ChatGPT and Cybersecurity

It is the responsibility of security professionals to act now to determine how to safely leverage AI—if they wish to do so at all.

17 October 2023
Arun Mamgai
Emerging Technology Article

Generative AI With Cybersecurity: Friend or Foe of Digital Transformation?

Generative AI requires significant training and cultural change to ensure confidential data is not compromised, and the security data model training infrastructure requires significant investment and strong business support.

16 October 2023
Ivan Mans
Security Article

Profiling a SAP Hacker

To mitigate the risk of cyberattacks, organizations must keep their SAP systems up-to-date with the latest security patches and updates.

10 October 2023
information security
Emerging Technology Article

The Human and AI Partnership: Collaborating for Enhanced Cybersecurity

Both generative AI and precision AI hold promise in helping organizations defend against ever more sophisticated cyberattacks.

6 October 2023
Deneen Richard, CISA, CRISC, CRMA
Audit Article

Internal Audit Data Analytics for Beginners

There are 2 phases and associated steps that auditors can take to begin the journey of utilizing data analytics.

26 September 2023
James Huang
Security Article

Improving Security While Enabling Market Access With a CCF

Cloud service providers should consider creating a common cloud controls framework—a central information security compliance and certification methodology that can include certifications such as SOC 2, ISO 27001, C5, ENS, ISMAP, IRAP, and more.

19 September 2023
Safia Kazi
Privacy Article

The Privacy Pros and Cons of Anthropomorphized AI

There are privacy-related pros and cons to anthropomorphized AI, and certain considerations need to be made for enterprises that leverage consumer-facing generative AI.

14 September 2023
Patrick Barnett
Security Article

Seventy Questions to Assess Cybersecurity Risk on a Rapidly Changing Threat Landscape

There are 70 questions that can be asked to determine whether an enterprise has most defensive principles covered and has taken steps to reduce risk (and entropy) associated with cybersecurity.

12 September 2023
Jai Sisodia
Governance Article

Understanding the EU AI Act

By examining the nuanced details of the EU AI Act, IT auditors and other information security professionals can better understand how it might affect their future work.

6 September 2023
Eric Peck
Risk Article

Tools and Best Practices for Improving IT Issue Management

It is worth exploring the importance of IT issue management and highlighting best practices and tools that organizations can use to understand, measure and mitigate IT risk.

29 August 2023
Industry News
Security Article

An Executive View of Key Cybersecurity Trends and Challenges in 2023

To more effectively defend against attacks, it is important for cyberprofessionals to understand current trends and challenges that exist in the field of cybersecurity.

22 August 2023
Safia Kazi
Privacy Article

Lessons Learned From a Controversial Terms of Service Update

Enterprises are obligated to have clear and up-to-date terms of services in place.

17 August 2023
Amanda Tucker
Audit Article

How IT Auditors Can Embrace Neurodiversity in the Workplace With Agile

With the right environment and a handful of changes, neurodivergent individuals can be assets to any audit team.

15 August 2023
Carol Lee, Terence Law, Tom Huang and Lanis Lam
Governance Article

Navigating Regulatory Trends and Best Practices for Ethical AI Governance in Mainland China

It is essential for organizations and technology risk professionals to understand the evolving AI regulatory landscape shaping the future of AI in Mainland China.

14 August 2023
Lisa Levy
Privacy Article

Afraid of Leaking Business Data? Sit Down. We Need to Have "The Talk" About Data Management and Access Control

Data management and access control measures should be integrated into every aspect of an organization's operations, creating robust defenses against data leaks.

8 August 2023
Chris McGowan
Emerging Technology Article

Generative AI and the Potential for Nefarious Use

Organizations must be aware and ready to combat the possibility of generative AI being used to conduct cyberattacks.

1 August 2023
Bassel Kablawi
Risk Article

Reviewing the 2023 OWASP API Top 10

To ensure that enterprises are not subjected to the nightmare that is an API security breach, the updated OWASP API Top 10 list is worth examining.

1 August 2023
Safia Kazi
Privacy Article

Protecting Children and Privacy Is Not a Zero-Sum Game

Privacy professionals who can be advocates for privacy and encourage people to think more critically about what is posted online can help create an online experience that protects children and preserves privacy.

26 July 2023
Chris Madeksho
Risk Article

Managing Human Risk Requires More Than Awareness Training

A comprehensive information security awareness program must be in place to ensure that employees are aware of and educated about the threats they may encounter at the workplace.

18 July 2023
Chris McGowan
Security Article

The US SEC’s Proposed Cybersecurity Crackdown

The SEC has proposed amendments aimed at bolstering and standardizing the disclosure requirements related to cybersecurity risk management, strategy, governance and incident reporting for public companies.

12 July 2023
Adeline Chan
Governance Article

The EU AI Act: Adoption Through a Risk Management Framework

The AI Act is an important step in the development of an effective and responsible regulatory framework for AI in Europe.

10 July 2023
Keri Bowman
Governance Article

The Interplay of IGA, IAM and GRC for Comprehensive Protection in Cloud Transitions

It is critical that organizations pay attention to the significance of governance, risk and compliance in their identity and access management journey.

6 July 2023
Chris McGowan
Risk Article

Where Data and Behaviors Meet: The Internet of Behaviors

As is the case with any new technology, IoB has both benefits and risk

5 July 2023
Rethinking IT Asset Valuation
Risk Article

Rethinking IT Asset Valuation, Risk Assessment and Control Implementation

Risk management and evaluation are critical to every enterprise’s strategic planning for information security.

20 June 2023
Beatrice Nepoti and Cristiano Passerini
Emerging Technology Article

AI Systems Training Pause Sought

The decision of the GPDP to inhibit the use of an innovative tool based on generative AI, such as ChatGPT, may seem questionable; therefore, it is important to understand the motivation.

13 June 2023
Laura Zannucci
Audit Article

The Increasing Importance of IT Audits to the BoD

How can the BoD ensure that it is adequately meeting requirements? One of the best ways to identify gaps in what an organization is doing vs. what it is expected to do is to conduct a thorough IT audit.

6 June 2023
Meng Fai Chan
Emerging Technology Article

Navigating the Hype and Risk of Emerging Technologies

By taking a risk-informed approach, security and risk professionals can navigate the path forward in a way that balances the potential benefits of emerging technologies with the risk they may pose.

25 May 2023
Denise Owens
Audit Article

Managing Data Privacy and Information Security With IT Audits

Ensuring that data are protected and secured in the most efficient and economical manners possible are constant battles due to the increasing sophistication of cybersecurity threats and the amount of data protection regulations.

23 May 2023
Diego Fratus, CISA, CIA, CCSA, CRMA and Cedric Blotin, CISA
Audit Article

What the Post-Pandemic Future Holds for IT Auditors

COVID-19 acted as a catalyst that accelerated digital transformation, modified how brands interact with their customers and disrupted IT audit practices.

9 May 2023
Jon Brandt
Emerging Technology Article

Generative AI: The Future Is Now, and It’s Risky

Far too many users are starstruck by AI capabilities and are putting enterprises at substantial risk.

4 May 2023
Adeline Chan
Emerging Technology Article

Can AI Be Used for Risk Assessments?

To produce risk assessments with more accuracy, artificial intelligence (AI) can be used because one of its core competencies is data aggregation and interpretation.

28 April 2023
Kurt Markley
Risk Article

Data Recovery Pitfalls to Avoid

There are 4 common false beliefs that should be dispelled to better protect organizations and their data.

25 April 2023
Sophia Bekele
Emerging Technology Article

Breaking Through the Barriers of Leadership

Although traditional gender dynamics and systemic inequality create substantial obstacles that are preventing women from achieving parity in leadership roles within the metaverse, there are also ways for women to break through barriers.

20 April 2023
Patrick Barnett
Security Article

How Organizations Can Consistently Reduce Cyberrisk

Cyberrisk is an ever-changing parameter that requires constant analysis and is difficult to quantify.

11 April 2023
Chris McGowan
Risk Article

Social Media as a Growing Threat to the Workplace

Failing to prioritize the security and privacy of a social media account can result in negative consequences spanning both the personal and professional worlds.

28 March 2023
Belinda Mueller
Emerging Technology Article

Understanding and Mitigating the Risk of AI vs. Traditional Software

It is crucial to understand what makes AI so different from traditional rule-based systems and how to address these differences.

27 March 2023
Paul Philips
Risk Article

A Road Map to Breaking Down Zero Trust Barriers

Zero trust provides an enterprise the opportunity to create a more robust and resilient security posture, simplify security management, improve the end user experience and enable modern IT practices.

14 March 2023
Maria Sommerhalder
Emerging Technology Article

Standardization and Audit in the Blockchain Space

Standardization and audits play a crucial role in in mitigating the risk that organizations potentially face when implementing blockchain emerging technology.

14 March 2023
Yunique Demann
Privacy Article

Separating Privacy Awareness From Security Awareness Training

Having a privacy and security awareness training program is better than not having one at all, but having two focused programs addressing high-risk topics is beneficial to not only organizations, but employees as well.

13 March 2023
Industry news
Governance Article

Why Are Regulations Demanding SBOM Adoption?

With the rise of software-based products, regulators have quickly implemented new standards to help manage the complexities of the software supply chain.

6 March 2023
Mary Carmichael
Privacy Article

The Difference Between Data Privacy and Data Security

When it comes to data privacy, most people think about recent events such as TikTok’s data harvesting activities, Cambridge Analytica’s use of Facebook data without consent and new privacy regulations being introduced globally.

28 February 2023
Patrick Barnett
Security Article

Prepare for Success by Planning for Threat Actor Eviction

Before returning to business as usual after a breach, enterprises must ensure that all threat actors have been evicted from the network and are not able to enter again

28 February 2023
Sophia Bekele
Risk Article

The Role of Transparency and Accountability in Digital Transformation

Understanding the benefits of adopting transparency and accountability within an organization is key to digital transformation.

22 February 2023
Jannie Wentzel and Elissa Mckinley
Risk Article

Integrated Risk Management in an Interconnected World

In this integrated world, it is no longer enough for an enterprise to manage risk strictly within its own borders.

14 February 2023
Ray Payano
Risk Article

Using a Risk-Based Approach to Prioritize Vulnerability Remediation

By calculating vulnerability risk, enterprises can prioritize vulnerabilities based on risk level to help determine the order in which vulnerabilities are addressed.

7 February 2023
Meghan Maneval
Risk Article

What Kind of Glasses Are You Wearing? Your View of Risk May Be Your Biggest Risk of All

The beginning of a new year is the perfect time to reflect on the past year and assess any industry trends or upcoming events that could impact organizations.

31 January 2023
Patrick Barnett
Security Article

Common Misconceptions About Modern Ransomware

There are many misconceptions about ransomware attacks, often due to enterprises’ failure to adapt to changes in threat group tactics, techniques and procedures (TTPs).

24 January 2023
Sandra Kuyengwa
Audit Article

Key Considerations for Conducting Remote IT Audits

While remote auditing is nothing new, the COVID-19 pandemic and resulting need for social distancing fast-tracked the adoption of remote and hybrid audits.

17 January 2023
Justin Rende
Security Article

Eight Cybersecurity Trends to Watch for in 2023

As 2023 approaches, it is an opportune time for organizations of all sizes to examine their IT infrastructure and review their cybersecurity policies.

10 January 2023
Jonathan Tomek
Security Article

What Is Your IP Address Cybersecurity IQ?

Now more than ever, security professionals need a thorough understanding of the IP addresses that seek to access their networks.

3 January 2023
Frans Geldenhuys and Gustav Silvo
Audit Article

Seven Things to Know Before Automating IT General Control Audits

There are 7 major takeaways from an audit automation process.

20 December 2022
Rex Johnson and Hamlet Khodaverdian
Security Article

Improving Cyberresilience in an Age of Continuous Attacks

It is now more important than ever to constantly develop and mature cybersecurity readiness. A holistic and integrated approach with the right tools can provide a better chance of surviving a cyberattack.

13 December 2022
Jai Sisodia
Audit Article

AI Ethics and the Role of IT Auditors

It is critical that ethics be given careful consideration when designing, operating and auditing AI systems.

6 December 2022
Patrick Barnett
Security Article

How Cyberprofessionals and Threat Actors Have Changed Over the Decades

As threat actors get bolder and more creative, cybersecurity professionals must attempt to stay 1 step ahead.

29 November 2022
Patrick Barnett
Risk Article

How to Use Cyberthreat Intelligence to Proactively Reduce Cyberrisk

The ability to proactively learn about the tactics and capabilities of an attacker provides an excellent opportunity to prevent the attacker from entering the fort or doing any damage to the fort’s walls.

22 November 2022
Deepa Seshadri
Security Article

What Makes a Good Cybersecurity Professional?

A shift into a cyber career can be part of an impactful journey into helping protect the world around us.

15 November 2022
Poonan Gupta
Risk Article

The Risky Business of Bots

There are numerous use cases across enterprises where the deployment of bots has resulted in improved efficiency and reduced costs.

8 November 2022
Rowdha Mohammed
Security Article

Cybersecurity Strategies to Enable Digital Trust

Cybersecurity is an enabler of digital trust and a key success factor of the digital transformation journey.

2 November 2022
Bassel Kablawi
Privacy Article

Preparing Organizations for Saudi Arabia’s New Data Protection Law

Technologies are constantly evolving, more devices are being connected to the worldwide network, data are becoming more important than ever, and countries are taking data privacy more seriously, putting data into consideration in jurisdiction strategies.

1 November 2022
Graciela Braga
Governance Article

How Responsible for IT Governance Is the BoD?

With a fresh look at the importance of the role of the BoD and other stakeholders in IT governance, it is time for boards to take advantage of the opportunity offered by IT governance to create value in their organizations.

26 October 2022
Eszter Diána Oroszi
Risk Article

Taking a Risk-Based Approach to Pen Testing

The results of penetration (pen) tests are also worth examining using a risk-based approach.

24 October 2022
Sri Mallur
Security Article

How to Create an Enterprise OT Cybersecurity Program

As the importance of cybersecurity grows in the public eye, many organizations are considering leveling up their security postures with operational technology (OT) cybersecurity programs.

20 October 2022
Kathleen Martin
Risk Article

Higher Education, the Pandemic and the Need to Strengthen the Risk Framework

There is a need for oversight and controls to be revisited in certain higher education institutions.

13 October 2022
Michael Williams and Babur Kohy
Privacy Article

Detecting Insider Threat Behaviors Using Social Media Platforms

It is important for IT professionals to understand the availability of social media data and methods that can be used to identify possible insider threats using machine learning and the privacy and policy implications pertaining to it.

12 October 2022
Vikram Venkateswaran
Security Article

Cybersecurity Is a Top Priority for Pharmaceutical Organizations

The pharmaceutical industry is taking critical measures to enhance its cybersecurity posture.

11 October 2022
Joao Souza Neto
Governance Article

How to Conclude Governance System Design

The dynamics of the external and internal effects on organizations demand a flexible and customized governance system adapted to the specific needs of the organization.

10 October 2022
Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat
Audit Article

Co-Sourcing: Self-Educate, Participate, Self-Evaluate and Repeat

As a purposeful partnership with internal or external resources, co-sourcing simultaneously meets enterprise objectives and facilitates upskilling.

7 October 2022
Ivan Mans
Security Article

Addressing SAP Security Gaps

SAP requires high-level consideration, or critical elements of the business will be vulnerable to malicious cyberactors—with no apparent response.

22 September 2022
Safia Kazi
Privacy Article

Privacy Considerations During Mergers and Acquisitions

When news was announced that Amazon acquired iRobot, the enterprise that makes Roomba robot vacuums, many privacy advocates expressed concern.

22 September 2022
Richard Hollis
Security Article

The Circle of Failure: Why the Cybersecurity Industry Does Not Work

The cybersecurity industry has failed. The evidence is everywhere and overwhelming. Anyone who understands that the industry was founded on the fundamental objective of preventing IT systems from breaches and data theft can surely agree that it has failed. Those who do not agree are not paying attention.

15 September 2022
Steve Jackson
Audit Article

Auditee Buy-In—A Key Component of Effective Audits

In business, auditors are often portrayed as the bad guys. From an external audit perspective, auditors enter an organization with no true relationship with, or connection to, the auditee. The

14 September 2022
Mary Carmichael
Risk Article

Enabling Digital Trust With Canada’s Digital Charter

Data are the lifelines of a digital economy. They are driving forces for innovation, enabling cutting edge research and next generation technologies including artificial intelligence (AI), robotics and the Internet of things (IoT).

7 September 2022
Information security
Security Article

Taking Security Strategy to the Next Level

In an era of rampant ransomware and other malicious cyberattacks, it has never been more important to double down on cybersecurity analysis and strategy.

2 September 2022
Roderick Chambers
Governance Article

GRC Programming: The Third-Party Security Web

Governance, risk management and compliance (GRC) are growing disciplines with continuously changing identities.

29 August 2022
Risk
Risk Article

The Key(s) to Writing Good Risk Statements

To effectively manage risk at an organization, risk must be identified and analyzed by an information systems professional.

26 August 2022
Information Security
Risk Article

Does Your Organization Need a Security Risk Assessment?

The enterprise risk assessment and enterprise risk management processes comprise the heart of the information security framework.

19 August 2022
Jeffrey Champion
Security Article

Improved Visibility Means More Effective Security Tools

When it comes to evaluating the efficacy of security tools, the first question many people ask is “How do I know if my enterprise’s security tools are protecting sensitive data?”

17 August 2022
Christina Luttrell
Risk Article

Protecting Your Enterprise and Deterring Fraud in a New Risk Era

As uncertainty persists due to the COVID-19 pandemic, the war in Ukraine, international cyberthreats, inflation and a looming recession, it is clear that the world has entered a new era of risk.

9 August 2022
Frank Wei
Security Article

The Power of Provenance

While next-generation firewalls, extended detection and response (XDR) and other security solutions do a great job of detecting and thwarting cyberattacks, it is all too common for a sneaky or camouflaged threat to slip through into the network.

28 July 2022
Ejona Preçi and Peter H. Gregory
Security Article

SaaS Security Risk and Challenges

The hybrid work model imposed by organizations during the height of the COVID-19 pandemic triggered many enterprises to accelerate moves to cloud-based services for better resilience and efficiency.

26 July 2022
Ryan Cloutier
Risk Article

What Makes Risk Assessments So Unpleasant and How to Change That

“I would love to complete a security risk assessment,” said no one, ever. Many people would agree that performing and reviewing security risk assessments are not particularly enjoyable, especially for IT and security teams that are already overworked, understaffed and burned out.

22 July 2022
Piyush Bajpai
Emerging Technology Article

Mitigating Cryptocurrency’s Carbon Footprint

In today’s rapidly evolving finance industry, organizations can either change and thrive or fall behind the market competition. One of the most discussed evolving trends in finance is cryptocurrency.

15 July 2022
Biju Nair
Audit Article

The Evolution of Internal Audit in a Digital-First Environment

When leaders at a new digital bank were putting together a job description for their first chief audit executive (CAE), they knew they were looking for more than a candidate who could perform conventional internal audit functions.

13 July 2022
Relebohile Kobeli
Risk Article

How Enterprises Can Leverage Incident Reporting

Incident reporting plays a vital role in strengthening the internal controls necessary for an organization to operate properly. An incident is defined as “[A] nonstandard operation which causes interruption or reduction in quality of service.”

11 July 2022
Chetan Anand
Audit Article

Preparing Your First Supplier Audit Plan

Organizations outsource processes and services for a variety of reasons: to cut costs, preserve resources, make room for growth and remain competitive in their industries.

7 July 2022
Michael Podemski
Audit Article

Now Is the Time for IT Auditors to Perform Advisory Pre-Implementation Reviews

Demand for digital transformation is increasing as enterprises endeavor to offer more innovative products or services and modernize legacy IT environments.

5 July 2022
Kevin E. Jackson
Emerging Technology Article

The Case for Outcome-Based Cybersecurity: A Data-Focused Shift in Cybersecurity Management

The challenges faced by today’s cybersecurity practitioners are well documented, however, the situation may be worse than described.

1 July 2022
Larry Wlosinski
Security Article

Writing a Charter for an Enterprise Security Operations Center

The security operations center (SOC) is the heart of information security for medium- to large-sized organizations. It ensures organizational cyber well-being by monitoring the infrastructure and managing its cyberhealth.

30 June 2022
Bassel Kablawi
Security Article

Why (and How to) Dispose of Digital Data

The stakes are too high for organizations not to comply with data privacy regulations. For example, noncompliance with the EU General Data Protection Regulation (GDPR) can result in a fine of up to €10 million or up to 2% of the organization’s worldwide annual revenue from the preceding financial year, whichever is higher.

22 June 2022
Paul M. Perry
Audit Article

The Repetitive History of IT Audit Outcomes

While the term “IT audit” may be defined differently across organizations based on industry requirements and their applicable frameworks, the outcomes of such audits are often fairly predictable.

15 June 2022
Kevin Keh
Security Article

The Digital Gold Rush: Football, Ransomware and the Bottom Line

The San Francisco 49ers team, one of the NFL’s 32 professional football teams, was hit by a Ransomware-as-a-Service (RaaS) faction called BlackByte.

3 June 2022
Raymond Ito
Risk Article

The New Global Risk Profile

The Russia–Ukraine War has plunged the entire world into a new risk landscape, especially organizations that already faced high levels of risk.

2 June 2022
Sundaresan Ramaseshan
Security Article

Performing User Access Reviews to Improve Enterprise Security

Security leaders can enhance security at their enterprises by conducting frequent and thorough user access reviews.

20 May 2022
Andre Pitkowski and Daniel Bispo de Jesus,
Risk Article

Performing an Information Security and Privacy Risk Assessment

Enterprise information security and privacy professionals are responsible for identifying information security and privacy gaps in information management systems and processes.

18 May 2022
Syed Salman
Governance Article

Maximizing the Benefits of DevOps Using COBIT

If adopted properly, Agile and DevOps practices can result in improvements in objective software development metrics such as deployment frequency, lead time for changes, change failure rate and mean time to recover (MTTR).

11 May 2022
Brian Fletcher
Security Article

Basics for Improving the Safety of Your Organization's Data

The world is currently experiencing the Fourth Industrial Revolution (4IR), a result of which has been the innovation of big data.

4 May 2022
Krishna Das Manghat
Emerging Technology Article

Benefits of Adopting Secure Access Service Edge for Operational Technology Security

Traditional operational technology (OT) networks are built based on the rigid 6-level (level 0 to level 5) hierarchical Purdue model, which has worked well for the last few decades.

28 April 2022
Security Article

Decoding CUI—a Highly Valued Data Type at Risk

Governments often create or own information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and governmentwide policies. In the United States, this type of information is referred to as Controlled Unclassified Information (CUI).

25 April 2022
Thomas Lenzenhofer
Security Article

The Impact of People on Today’s Information Security Landscape

There is much written about long lists of cybersecurity problems (most of which practitioners may already be aware) or even potential solutions, so perhaps it is beneficial to take a moment to reflect on how the state of information security has changed over the years.

22 April 2022
Kurt Markley
Risk Article

How to Develop and Execute a Rigorous Data Backup and Recovery Strategy

When approximately 22 terabytes (TB) of Dallas Police Department (DPD) (Texas, USA) data were accidentally deleted during a cloud migration in March 2021, ultimately only 14 TB could be recovered, affecting myriad case files and prosecutorial actions.

18 April 2022
Upesh Parekh
Risk Article

Achieving Effective Cloud Risk Management

Cloud technology has leaped to the forefront of the technological world in the last 2 decades. One would be hard pressed to find an enterprise that has not implemented cloud technology in some form or another.

13 April 2022
Jo Stewart Rattray
Security Article

Where Privacy Meets Security

In a world where data are pervasive and increasingly connected, for security professionals, protecting the privacy of individuals and organizations could be compared to trying to put an octopus into a string bag: a constantly changing, wriggly challenge.

11 April 2022
Elastos Chimwanda
Audit Article

Essentials for an Effective Cybersecurity Audit

Cybersecurity has become a pressing issue worldwide, thereby necessitating robust auditing procedures to provide assurance to senior management and boards of directors (BoDs).

8 April 2022
Donnie Carpenter
Risk Article

Concepts to Consider When Acquiring “The Little Guy”

Throughout the last decade, there has been an increase in cyberattacks targeting small- and medium-size enterprises with a myriad of techniques and payloads, and more than 80% of enterprise owners know they are at risk.

6 April 2022
Deepa Seshadri
Privacy Article

Data Privacy: From Compliance to Trust

Organizations are looking to prioritize their users’ privacy notices and policies not just to protect their value and to be compliant with existing laws, but also to provide something that is the holy grail for a product: trust.

4 April 2022
Nasir Ali
Risk Article

Cybersecurity and Third-Party Supplier Risk

Enterprises today are being driven to adopt technology at an unprecedented pace as society witnesses what could be referred to as the Fourth Industrial Revolution (4IR). This technological adoption has been driven by factors such as the quest for efficiency, technology...

1 April 2022
Donnie Carpenter
Security Article

The NATO Cyberresponse Dilemma

It should come as no surprise that the North-Atlantic Treaty Organization (NATO) finds itself in a bit of a legal and procedural dilemma regarding response efforts and capabilities to the Russian invasion of Ukraine.

30 March 2022
Chad Martin
Audit Article

An Integrated Approach to Security Audits

A cyberattack can be devastating to any organization because it compromises sensitive data and, as a result, the financial position, strategic vision, and more important, the trust and credibility that the enterprise has built over the years.

23 March 2022
Collin Beder
Emerging Technology Article

Digital Realities: Future Potentials and Use Cases

Humans are a curious species, and it is part of our nature to ponder the future. We are hardwired to find patterns, so we often use the past to predict what will emerge in the future.

22 March 2022
Safia Kazi
Privacy Article

Educated and Empowered Data Subjects: A Privacy Prerequisite

US lawmakers recently introduced a bill seeking to improve transparency of terms of service agreements.

9 March 2022
Jonathan Brandt
Security Article

Courage Under Fire

Most people recognize that humans are fallible, but this fact can have dire consequences for those whose jobs entail protecting life or assets. Within the cyber realm, insiders are often responsible for cybersecurity incidents, resulting in a US billion-dollar security awareness computer-based training market.

23 February 2022
Pablo Ballarin
Emerging Technology Article

Ethical Emerging Technologists

Cybersecurity professionals aim to help organizations protect their information and IT infrastructures. Their main purpose is to avoid negative impacts, not only to their clients’ enterprises, but also to their clients’ and users’ lives.

15 February 2022
Leeza Garber and Scott Olson
Security Article

Using a Team Approach in the New Year to Face the Future

Anticipating how the world of technology will evolve and change is not only a goal for economists, investors and power players in the stock market, but for cyberentrepreneurs, risk managers, IT professionals, chief information security officers (CISOs) and chief security officers (CSOs).

9 February 2022
Opeyemi Onifade
Governance Article

Using COBIT for Value-Based Direction Setting

Every organization goes through a phase in its life cycle that leaves it with 2 options: transform or decline.

1 February 2022
Security Article

US DoD Launches Comprehensive CMMC 2.0 Cybersecurity Framework

Cybersecurity is only as good as an organization’s weakest link. Increasingly, the weakest link is the cyber supply chain.

25 January 2022
David Brown
Security Article

Cybersecurity Lies and the Lying Liars Who Tell Them

I freely admit I borrowed my title from former US Senator Al Franken’s 2003 book Lies and the Lying Liars Who Tell Them. But I think it is time we as security professionals take a good hard look at ourselves and admit all the ways that we are lying…to OURSELVES!

18 January 2022
A Brief History of the Cybersecurity Profession
Security Article

A Brief History of the Cybersecurity Profession

Cybersecurity careers are in high demand, but a closer look at the timeline of network technology and the Internet reveals that this has virtually always been the case.

11 January 2022

Industry News Archived Articles By Year

Check Mark
2025
Check Mark
2024
Check Mark
2023
Check Mark
2022
Check Mark
2021

Custom Training Programs

Looking to train your team? We can customize virtual training and certification programs for every need.

GET STARTED