Filters

Article Type

Domain

Credentials

Subjects

Product Type

Level

Language

16 of 3915 Results

@ISACA Article

Five Key Considerations for Crafting Board Presentations on Information Risk and Security

Developing and carrying out effective board of director (BoD) presentations is a crucial skill for information risk and security leaders and professionals.

2 December 2024
@ISACA Article

Proven Strategies to Boost the Effectiveness of Your Cyber Assurance Function

Cybersecurity often gets a bad rap. It’s widely perceived as an endless parade of threats, incidents and breaches.

2 December 2024
Blog Post

The Role of the Chair vs. CEO

The Board Chair and CEO both have distinct responsibilities to drive ISACA forward yet extensive collaboration and communication between the two is critical.

27 November 2024
ISACA Journal Article

Data Abuse in Cyberwarfare: Dissecting the Attack Model

In cyberwarfare, data abuse is a potent weapon wielded by state actors, criminal enterprises, and hacktivist groups to achieve strategic objectives and create chaos.

Authors: Aditya K Sood and Sherali Zeadally
Blog Post

The Arrival of CMMC: Positioning Your Company for Success

The long-awaited arrival of the Cybersecurity Maturity Model Certification (CMMC) presents an opportunity for professionals to position their organizations as go-to resources for CMMC guidance and compliance.

25 November 2024
Blog Post

User Access Review Verification: A Step-by-Step Guide

Conducting a User Access Review Verification ensures that only authorized individuals are able to access an organization's key systems and data.

21 November 2024
Blog Post

ISACA Career Catalyst Stories: Chirag Joshi, Founder and CISO, 7 Rules Cyber

On his way to success as an author, entrepreneur and cybersecurity leader, Chirag Joshi has turned to ISACA for credentialing, community and thought leadership.

20 November 2024
ISACA Journal Article

Digital Age Auditing: The Synergistic Effect of Machine Learning on Auditing Practices

Machine learning (ML) is becoming a crucial asset in the field of auditing.

Authors: Kgodiso Chiloane, Fatih Isik and Eugene Zita
@ISACA Article

Top Takeaways from ISACA AI Innovation Workshop

Just as the internet created a sea change on the technology landscape, so, too will artificial intelligence.

18 November 2024
Blog Post

Adding Value with Risk-Based Information Security

It is achievable to manage multiple control frameworks at the same time, with the effort of managing only one.

18 November 2024
Governance Article

Cloud Data Sovereignty: Governance and Risk Implications of Cross-Border Cloud Storage

Multinational organizations must navigate complex legal and regulatory challenges when adopting cross-border cloud services, which requires strategic planning and compliance measures to ensure successful implementation and mitigate potential risk.

18 November 2024
@ISACA Article

Growing Cyber Defenses from Seed to System

There are many different ways to approach cybersecurity. One of the most effective ways to critically approach cybersecurity is by leveraging systems thinking.

18 November 2024
Blog Post

A Simplified Approach to Cost-Effectively Boost Security Around Digital Crown Jewels

Cybersecurity teams can protect their crown jewels more effectively by following a few critical steps and by collaborating effectively with business units and enterprise leadership.

14 November 2024
Emerging Technology Article

Revolutionizing CRM: How AI-Enhanced Security is Transforming Customer Data Protection

In customer relationship management (CRM), emerging AI technology is vital for enhancing security measures.

14 November 2024
Blog Post

Inside the Audit Committee: Roles, Responsibilities and Qualifications

Our Notes from the Boardroom blog series continues with a detailed look at the role and responsibilities of ISACA's audit committee.

13 November 2024
ISACA Journal Article

The Impact of 5G: Unpacking Security and Privacy Concerns

5G, or the fifth generation of cellular networks, is expected to transform wireless communication with features such as highspeed data transfer capability, extremely low latency, and higher connectivity.

Author: Mahmoud Mohamed
Load More
Blog Post

CrowdStrike Panel Explores Lessons Learned from Massive Outage

An ISACA conference panel dissected the massive CrowdStrike incident, dissecting what went wrong and lessons learned to help avoid similar incidents in the future.

11 November 2024
Blog Post

Machine Learning Knowledge Looms Large at a Time of Accelerated AI Transformation

New ISACA courses in machine learning will prepare practitioners to better understand the lifecycle of machine learning projects, large language models, neural networks, and more,

8 November 2024
Emerging Technology Article

Embracing the Future: The Quantum Computing Revolution Begins Now

The ever-increasing, and impressive, capabilities of quantum computers could potentially break current encryption methods, necessitating advancements in cryptographic techniques to safeguard sensitive information.

7 November 2024
Blog Post

How Geopolitics Affects Cybersecurity Risk: A Primer

The geopolitical landscape can have a major impact on cybersecurity risk and provide alternate motivations for cybercriminals to the financial ones for which defenders tend to be more attuned.

6 November 2024
Blog Post

ISACA Career Catalyst Stories: Tatum Crisp, ISACA Auckland Chapter President

Tatum Crisp pursued ISACA chapter leadership to grow her communication and leadership skills, and the experience has paid even greater dividends than she anticipated.

5 November 2024
Emerging Technology Article

The Importance of AI Safety in Customer Experience Automation

Organizations aim to empower stakeholders with generative capabilities that streamline workflows, transforming traditionally manual processes into automated efficiencies.

5 November 2024
@ISACA Article

EU AI Act: What It Is, Who It Affects, and Next Steps for Practitioners

While the adoption of artificial intelligence (AI) can help enterprises operate more efficiently, there is significant risk associated with it, including lawsuits, AI misuse and biased data.

1 November 2024
@ISACA Article

Five Top Takeaways from Adam Grant’s Message to ISACA Members

Adam Grant, organizational psychologist and bestselling author, recently sat down with ISACA member and moderator R.V. Raghu for ISACA’s Member-Exclusive Speaker Series.

1 November 2024
Blog Post

The EU AI Act is Here: What You Need to Know and Do

Many different layers of compliance requirements are taken into consideration within the EU AI Act, including various AI use cases and models.

1 November 2024
Governance Article

Autopilot on Copilot: Governance Considerations and Pitfalls When Implementing Generative Artificial Intelligence

The adoption of generative artificial intelligence within enterprises has created an entirely new branch of governance and compliance risk.

1 November 2024
ISACA Journal Article

Information Security Matters: Raising Standards

CSF 2.0 has a new emphasis on governance, supply chains, and smaller enterprises.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: Risk in the Shadows

Shadow IT represents a growing threat to most organizations, especially those with a digital presence.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Future Proofing With Situational Awareness

Trust professionals have a reputation for being averse to new and potentially disruptive change.

Author: Ed Moyle
ISACA Journal Article

IS Audit in Practice: Disruptive Technology—An ESG Enabler

There has never been such a promising time for technology and environmental change.

Author: Cindy Baxter
ISACA Journal Article

The Encrypted Truth is Already Out There

Quantum computing progress will alter the dependence on current classical cryptography to safeguard data and network transmissions.

Author: Eric H. Goldman
ISACA Journal Article

Clearing a Path: Anticipating Disruptive Innovation With an Eye Toward Compliance

Innovation vs. compliance is one of the trickier balancing acts that any organization must attempt.

Author: Kevin M. Alvero
ISACA Journal Article

Exploring Opportunities and Challenges: An IS Audit Perspective on Generative AI Adoption

Incorporating generative AI into IS audit engagements presents new opportunities and challenges.

Author: Rui Feng Isaac Lee
ISACA Journal Article

Navigating the Shadows: A Comprehensive Framework for Anticipating, Identifying, and Managing Shadow IT

In the rapidly evolving digital age, enterprises are grappling with shadow IT.

Authors: Timothy D. Spivey and Timothy R. Mcilveene
ISACA Journal Article

Demystifying Quantum

Two key quantum developments have emerged in the cybersecurity space: post-quantum cryptography and quantum key distribution.

Author: Donavan Cheah
ISACA Journal Article

Securing LLMs: Best Practices for Enterprise Deployment

LLMs offer unprecedented capabilities in natural language processing, content generation, and decision support.

Author: Vaibhav Malik
ISACA Journal Article

Reassessing Risk: The Move to Third-Party Management

As global regulations evolve and reliance on third parties grows, today’s organizations find themselves navigating a complex risk environment.

Author: ISACA
Blog Post

Navigating the New Frontier: Mastering ESG Audits in Modern Business

Environmental stewardship, social responsibility and governance integrity represent three critical components of ESG audits.

31 October 2024
Audit Article

How Blockchain Technology is Revolutionizing Audit and Control in Information Systems

In the realm of information systems, ensuring data integrity, security, and transparency are paramount.

31 October 2024
Blog Post

What Type of Person Will Make a Good Cybersecurity Professional?

Beyond their technical know-how, effective cybersecurity professionals tend to have a range of other characteristics, such as adaptability, integrity and curiosity.

29 October 2024
Blog Post

Behind the Scenes with Adam Grant: The Opportunity of a Lifetime

A recent ISACA Member-Exclusive Speaker Event with Adam Grant presented new mindsets and approaches that can help professionals unlock more enjoyment and creativity in their work.

25 October 2024
Audit Article

Eight facility zones to consider while Auditing for Information, Physical, and Environmental Security Compliance

Access to critical facilities should be controlled and such controls should be reviewed regularly for suitability, adequacy, and effectiveness, whether these controls are preventive, corrective, deterrent, or detective in nature.

25 October 2024
Emerging Technology Article

Safely and Responsibly Using Emerging Health Technology

To maximize the value and minimize the harms associated with emerging health technologies, it is critical to address ethical, privacy, and societal concerns to ensure that these technologies help rather than hurt humanity.

25 October 2025
Blog Post

Approaching Risk, Compliance and Security Through a Consistent Lens with Enterprise Training

ISACA enterprise trainer Thomas Phelps shares his perspective on how group training can help brings teams together and collectively uplevel their knowledge and performance.

24 October 2024
Audit Article

Beyond the Blockchain Bubble: Distributed Ledger Technology for a Resilient Audit Landscape

The initial enthusiasm surrounding blockchain technology has subsided, paving the way for a more pragmatic exploration of its real-world applications.

23 October 2024
ISACA Journal Article

Untangling the Supply Chain Web With ISO 27001

Enterprises are growing more concerned that they might be attacked via their supply chain.

Author: Hannah Hunt
Blog Post

How the Emerging Technology Landscape is Impacting Cybersecurity Audits

Embracing continuous auditing and focusing on risk-based approaches are among the ways to effectively deal with the increasing complexity of cybersecurity audits as the emerging technology landscape continues to evolve.

22 October 2024
@ISACA Article

Five ISACA Members Earn Inaugural Chair Fellowships

Five ISACA members have been designated as the inaugural recipients of the ISACA Chair’s Fellowship Award for the 2024-2025 Board of Directors term.

21 October 2024
@ISACA Article

Integrating Psychological Safety into COBIT 2019: A New Horizon in I&T Governance

In a world increasingly driven by technology, organizations must balance the need for innovation and efficiency with the well-being of their employees.

21 October 2024
Blog Post

Introducing the Chair’s Fellowship Program

ISACA's new Chair's Fellowship Program provides awardees with the opportunity to gain board leadership skills and become well-versed in best practices for a high-performing board.

21 October 2024
Blog Post

ISACA Career Catalyst Stories: Karen Franklin, Director, Compliance Analytics with Discover Financial Services

Karen Franklin, ISACA member and participant in the Mentorship Program, calls pursuing her CISA certification 'one of the most pivotal decisions' she made along her career journey.

18 October 2024
Security Article

Comparing the MITRE ATT&CK and NIST Cybersecurity Frameworks

Naturally, this is much easier said than done, but by integrating these comprehensive and well-established cybersecurity frameworks, cyberprofessionals can craft their defense infrastructure to minimize risk.

17 October 2024
Blog Post

A Proactive, Continuous Approach to Automated Compliance

Automation and a compliance by design approach can empower organizations to build a more secure, compliant and efficient IT environment.

16 October 2024
Blog Post

Celebrating ISACA’s Cybersecurity Month Scholarship Recipients

Recipients of the ISACA Foundation's Cybersecurity Month scholarships share their aspirations for making their mark on the cybersecurity profession.

14 October 2024
Blog Post

Our Day in Court

ISACA prevailed in a recent court ruling, which will free up more time and resources to put the focus back where it belongs: on delivering value for members and certification-holders.

14 October 2024
Privacy Article

The Evolving World of Data Privacy: Trends and Strategies

To keep pace, organizations must familiarize themselves with crucial global privacy regulations and critical trends shaping the future of data protection.

14 October 2024
Audit Article

By The Importance of IS Audit: Lessons Learned from the Evergrande Crisis

The Evergrande Group scandal, wherein the company allegedly inflated its sales by US$79 billion despite audits by PwC, underscores the critical importance of robust IS audits.

11 October 2024
Blog Post

Is NIS2 In Danger of Becoming a Paper Tiger?

NIS2 is intended to improve cybersecurity resilience, but to reach its potential, there will need to be real consequences for organizations that are simply going through the motions.

10 October 2024
Security Article

DarkAngels Strikes Big: Record-Breaking Ransom Secured

This payment is likely the largest known ransom payment to date. Of course, many organizations pay ransoms without disclosing the details to the public, making it difficult to determine if this is the largest payment ever made.

10 October 2024
ISACA Journal Article

Managing Cyberrisk With the Help of GRC

Managing cyberrisk using GRC technologies can help align IT activities with business goals.

Author: Hemang Mehta
Blog Post

From Failure to Fulfillment: My Journey in Attaining the CRISC

Eight key takeaways that helped one CRISC-holder improve upon his first exam attempt and reach his goal of attaining CRISC certification.

8 October 2024
@ISACA Article

Accelerating Cybersecurity Maturity by Quantifying Risk

Organizations should embrace the benefits of modernity and avoid the assumption that they must first implement a low-fidelity qualitative risk program before transitioning to a quantitative one.

7 October 2024
@ISACA Article

Stress Levels on the Rise for Cybersecurity Professionals

Cybersecurity professionals increasingly are feeling stress, primarily in response to an escalating threat landscape, new ISACA research shows.

7 October 2024
Blog Post

Ready to Be a Board Director? Here are 12 Things You Should Know

Being an ISACA board director is much more than an honorary role, and requires expertise in a range of areas, including a strong command of global strategy.

7 October 2024
Governance Article

The Crucial Integration of CRM and Corporate Governance: A Key to Better Business Outcomes

Organizations can achieve their strategic goals and retain a solid ethical basis by integrating corporate governance frameworks with customer relationship management (CRM) plans. This vital integration leads to better results and a brighter future.

7 October 2024
Blog Post

ISACA Career Catalyst Stories: Ejona Preci, CISO, Lindal Group

Ejona Preci, a Germany-based CISO, says she has met 'true powerhouses' through ISACA that have helped accelerate and enrich her career journey.

3 October 2024
Blog Post

Choosing Your Cybersecurity Path

Building a successful career in cybersecurity can be a smoother process by identifying organizations with healthy security culture, avoiding monotonous tasks, embracing continuing education and showing an ability to learn from failure.

2 October 2024
Blog Post

The Hidden Culture Crisis and Human Burden Undermining Cybersecurity Resilience

The cybersecurity industry is facing a growing internal crisis that is not rooted in technology or external threats but in the culture underpinning our current workforce.

1 October 2024
Risk Article

Navigating Risk When Transitioning to the Cloud

Effective cyberrisk management in and of the cloud is important to safeguard sensitive data, maintain business continuity, and achieve regulatory compliance.

1 October 2024
Blog Post

The Importance of Establishing an Open-Source Ingestion Policy to Mitigate Threats

Open-source software can lead to many benefits while simultaneously introducing security risks, creating the need for a substantive open-source ingestion policy.

30 September 2024
Blog Post

Maximizing Usage and Trust of AI: Insights from ISACA China Hong Kong Panel

The ISACA China Hong Kong Chapter recently featured a panel exploring how organizations can make artificial intelligence more trustworthy and more effective.

27 September 2024
Audit Article

The Evolution of Tech Assurance: Restructuring the IT Audit Function

To ensure the smooth functioning of the IT department, it is essential to establish a well-structured IT audit department.

27 September 2024
Blog Post

Cyber Resilience: What Shawshank Teaches Us About Security

A focus on prevention alone was not sufficient in The Shawshank Redemption and it is similarly not going to do the job in building successful, modern security programs.

26 September 2024
Blog Post

Empowering Europe's Digital Future: How ISACA Contributes to Building Cyber Resilience and Digital Trust

ISACA just published its Vision Paper on “Empowering Europe’s Digital Future with Cyber Resilience, Competitiveness and Digital Trust.

26 September 2024
Blog Post

Shaping the Future of Digital Trust and Cybersecurity Policy: How ISACA Contributes to the UK

ISACA’s UK Vision Paper 2024: A manifesto for bridging the UK’s digital skills gap and improving cyber resilience.

25 September 2024
ISACA Journal Article

Addressing Security Concerns in a Mobile Computing Environment

Given the sensitive nature of information stored on mobile devices, the consequences of a breach can be severe.

Author: Rachit Gupta
Blog Post

From Theory to Action: Building a Strong Cyber Risk Governance Framework

Knowing your organization's risk appetite is the first step toward effectively integrating cyber risk quantification into an organization's cyber risk governance.

23 September 2024
Blog Post

A Career Journey You Won’t Want to Miss

Joining ISACA means not only becoming better equipped to succeed in your current job, but also for future opportunities throughout your career journey.

18 September 2024
Security Article

From Hollywood to Hacking: Understanding Deepfake Scams

Deepfake scams have become a pervasive threat in the digital age. They use artificial intelligence (AI) to create convincing yet entirely fabricated videos and audio recordings. Deepfake scams have the potential to damage reputations, spread false information, and even manipulate financial markets.

18 September 2024
Security Article

Centralized Services and Their Impact on Business Continuity

As organizations grow more reliant on major providers, business continuity and preventing, mitigating, and recovering from disruptions to resume operations become even more critical.

17 September 2024
Podcast

Addressing SAP Security Gaps

SAP systems are treated differently than many other enterprise applications from a cybersecurity perspective.

17 September 2024
@ISACA Article

Are You Technical or Non-Technical? Time to Reframe the Discussion

There is value in exploring the problematic nature of labeling someone as technical or non-technical and how this term is overly simplistic and potentially harmful.

16 September 2024
@ISACA Article

Is There a Market Failure in Cybersecurity?

There has never been a better time to be in the governance, risk and compliance (GRC) sector with ever-changing cybersecurity regulation.

16 September 2024
Blog Post

Leveraging Neurodiversity: Strategic Advantages in GRC

Recruiting and nurturing neurodiverse talent is a winning strategy for organizations looking to enhance their GRC and cybersecurity capabilities.

16 September 2024
Emerging Technology Article

Reidentifying the Anonymized: Ethical Hacking Challenges in AI Data Training

The emergence of sophisticated AI methodologies capable of identifying individuals through intricate behavioral patterns amplifies these concerns and underscores the pressing need for robust privacy mechanisms and ethical frameworks in AI data training.

16 September 2024
Blog Post

Data Governance for AI: It Starts and Ends with Data

Understanding the relationship between artificial intelligence and data is critical for organizations as they increasingly leverage AI in their business operations.

13 September 2024
Blog Post

The Curious Case of the Complacent Commercial Chief: An Internal Auditor's Challenge

Internal auditors are not always met with open-minded attitudes from key stakeholders, but they can break down resistance by taking the right approaches.

12 September 2024
Blog Post

AI and Risk Management: A Strategic Guide for CIOs and CISOs in Financial Services

Artificial intelligence is having a large impact on the risk landscape in the financial sector, underscoring the need for AI governance frameworks and thorough AI risk assessments.

11 September 2024
ISACA Journal Article

Human Risk Management: A Practical Approach

Cybersecurity strategies must be based on the assumption that humans will continue to make mistakes.

Author: Grant Hughes
Blog Post

Cybersecurity Compliance Essentials: Balancing Technical and Non-Technical Skills

Technical acumen can be valuable in working toward cybersecurity compliance, but non-technical elements also play a significant role in achieving compliance.

9 September 2024
Blog Post

ISACA Career Catalyst Stories: Abigael Bada – Founder, Fortini Tech

ISACA’s Career Catalyst Stories showcase how members have been supported by ISACA throughout all stages of their careers. Today, we profile Abigael Bada, founder, Fortini Tech.

6 September 2024
Blog Post

The Never-ending Quest: Why Continuous Monitoring is Crucial for Cybersecurity

Systematically analyzing threats from the beginning of the design phase enables practitioners to build security into systems in time to make a difference amid a difficult threat landscape.

4 September 2024
Risk Article

Persuasive Technology: The Technology That Connects and Controls Us

Persuasive technology is any digital system that influences user behavior or attitudes. Various interactive platforms, including social media, health apps, ecommerce websites, and educational apps, fall under this term. Persuasive technology urges users toward a desired outcome, whether that outcome is purchasing a product, adopting a better lifestyle, or staying hooked on a particular app or service.

4 September 2024
@ISACA Article

Emerging Technology: Key Challenges and Opportunities

Emerging technologies are those that are still under development or are just starting to be adopted on a large scale. They have the potential to significantly change the way we live, work and interact with the world around us.

3 September 2024
@ISACA Article

Ramifications Far-Reaching for Companies that Don’t Prioritize Digital Trust

Maintaining compliance and having strong security and privacy programs in place is good, but only goes so far if it does not add up to strong trust between organizations and their stakeholders.

3 September 2024
Blog Post

Preventing the Storage Limitation Principle from Becoming an Elusive Dream

Strengthening approaches to retention of personal data can lead to more business resilience, reducing risk of personal data exposure and sharper operational efficiency.

3 September 2024
Risk Article

A New Threat Actor Group Emerges: Understanding Lapsus$

It is crucial to understand the activities of this specific threat group, given their repeated successes in breaching security measures. Organizations must thoroughly understand Lapsus$ to proactively safeguard their data, rather than merely reacting to breaches.

3 September 2024
ISACA Journal Article

Information Security Matters: Cyber Impact Analysis

Whether it is a theft of data or an attack that renders systems inaccessible, cyberattacks are downright bad.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: When Risk Becomes Reality

Once trust is lost, business is often lost as well. Therefore, organizations must look closely at digital trust.

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Managing the Practical Risk Assessment

All risk is not the same. Industry dynamics, enterprise culture, and department risk tolerance all have enterprise impact.

Author: Cindy Baxter
ISACA Journal Article

Data Risk is Enterprise Risk: Good Data Practices as Risk Controls

There is no question that data risk equates to enterprise risk.

Author: Guy Pearce
ISACA Journal Article

Adding Value With Risk-Based Information Security

Effective IT security management system design must start with top management and include the entire perimeter of the supply chain, with special attention paid to ensuring compliance with all relevant laws.

Author: Luigi Sbriz
ISACA Journal Article

From Measurement to Management: Integrating Cyberrisk Quantification into Risk Governance

The inclusion of the governance domain was arguably the most notable addition to the NIST CSF 2.0.

Author: Jack Freund
ISACA Journal Article

Cybersecurity Risk Management Governance: An Agency Theory Perspective

An agency theory approach allows enterprises to have open dialogues and make informed cyberrisk management decisions.

Authors: Gerald F. Burch, Jordan Burch, and Mike McGarry
ISACA Journal Article

Continuous Auditing and Risk Monitoring: Implementation With Credit Line Management

Credit line management presents unique complexities for auditors.

Author: Terrence Cai
ISACA Journal Article

Building a Robust Third-Party Risk Management Program in a Connected Ecosystem

Third-party risk is an evolving problem characterized by steadily increasing complexities.

Author: Visveshwar Ramasubramaniam
ISACA Journal Article

Case Study: Achieving Greater Financial Efficiency at ISACA

When it came time to upgrade their FMS, ISACA teams had to be carefully coordinated.

Author: Katie Teitler-Santullo
Blog Post

The Often-Forgotten Organizational Dimensions of Resilience and Digital Trust

Bits don't know borders, meaning emphasis on building digital resilience and digital trust is paramount in this era to protect organizations and their reputations.

30 August 2024
Emerging Technology Article

Building a Secure and Compliant AI Infrastructure: Lessons from the Trenches

There are real-world security challenges that organizations face when deploying AI. Therefore, it is essential to devise and execute practical strategies that assist organizations in risk mitigation.

30 August 2024
Blog Post

DORA Compliance: Navigating the New EU Regulation

New regulations such as the Digital Operational Resilience Act (DORA) are intended to improve risk management and make operational resilience easier to attain.

28 August 2024
ISACA Journal Article

Collaborative Cybersecurity: Unifying Functions for a Secure Future

The complexity of cyberthreats often mirrors the fragmentation within a cybersecurity function. As threats evolve and diversify, cybersecurity functions cannot operate effectively in silos.

Author: Vishal Sharma
Governance Article

Auditors are Asking Better Questions—Organizations Should Have Better Answers

Security leaders agree that regulatory compliance is not an effective security strategy, yet the protection of data in most organizations is strictly limited to regulated data. Overcoming this paradox is necessary to build effective data security programs that both protect data and meet regulations.

27 August 2024
Blog Post

NIS2 Directive: Strengthening Public Cybersecurity and Infrastructure Across Europe

The European Union’s NIS2 Directive will align key cybersecurity practices throughout the EU, increasing member-states' ability to prevent cyber incidents and lessen their impact.

26 August 2024
Blog Post

Top GenAI Success Stories for Risk and Assurance Professionals, and the Crucial Caveats You Need to Know

Generative AI comes with several promising applications for audits and risk professionals, who also must be mindful of the environment in which they are working and diligently steer clear of potential AI pitfalls.

22 August 2024
ISACA Journal Article

The Value of Diversity and Inclusion in Cybersecurity

A strategy based on diversity and inclusion in the workforce will help address the challenges around building a strong security capability in organizations.

Authors: Yuri Bobbert, Morgan Djotaroeno and Bas Van Gils
Blog Post

ISACA Career Catalyst Stories: Jay Hira, Director, Cyber Security – Financial Services, KPMG Australia

ISACA member Jay Hira has moved from continent to continent for various job roles, but finds his relationship with ISACA to be a constant wherever his career has taken him.

20 August 2024
@ISACA Article

Applying Risk Appetite and Risk Tolerance in the Age of AI

The adoption of artificial intelligence—from generative AI to computer vision—has become a competitive necessity, not merely an option.

19 August 2024
@ISACA Article

Material Matters: The SEC's Cyber Disclosure Reality Check

Cyber disclosures to regulatory and capital markets have become increasingly relevant in the face of ongoing ransomware threats.

19 August 2024
Blog Post

‘Cyberpandemic’ Strikes a Crowd

The recent Crowdstrike incident underscored the need to reduce complexity and limit risky interdependencies to avoid widespread outages.

19 August 2024
Blog Post

A Journey Through Integrated Risk Management

When assembling the elements needed for a successful integrated risk management program, organizations should start with their end goal in mind.

16 August 2024
Emerging Technology Article

AI Security Risk and Best Practices

Many organizations are still trying to determine their AI strategy, and the pipeline security and ethics of large language models (LLM) must be factored into this. As organizations increasingly integrate AI into their operations, it is crucial to understand that it is not a one-stop solution.

15 August 2024
Blog Post

The Role of AI & Generative AI in Integrated Risk Management

The risk management space is undergoing big changes driven by the rise of artificial intelligence, resulting both in promising advancements and significant potential pitfalls.

14 August 2024
ISACA Journal Article

Protecting Enterprises From AI-Generated Deepfakes

In recent years, deepfakes have become a potent form of social engineering when used for exploitation and to disseminate misinformation.

Author: John Evans
Risk Article

Securing the Digital Landscape: Organizations Must Address Third-Party Risk Head-On

Third-party collaboration has evolved into a necessity for most organizations in today’s market. However, the challenges of managing a third-party risk program can be overwhelming.

13 August 2024
Blog Post

For Better AI Governance, Begin with Education

AI governance expert Meghan Maneval shared best approaches for more effective AI usage on the enterprise landscape in a recent Ask Me Anything discussion on ISACA's Engage platform,

12 August 2024
Blog Post

From Chapter Engagement to Global Inspiration: How ISACA Muscat Ignited My Spark

Engagement with local ISACA chapters can be a springboard to further success both within and beyond the ISACA professional network.

8 August 2024
Blog Post

An Introduction to Post-Quantum Cryptographic Risks

Post-quantum cryptography algorithms will increasingly become a focal point for organizations as quantum computing makes strides forward.

7 August 2024
ISACA Journal Article

Cyber-ESG Synergy: Protecting the 4th Industrial Revolution

It is worth exploring the nuances of stakeholder vs. shareholder capitalism, the impact of ESG on corporate creditworthiness, and the specific methodologies used by rating agencies to assess ESG criteria, with a focus on governance.

Author: Jack Freund
@ISACA Article

Five Key Considerations for Defensible and Reasonable Risk and Security

Reasonability and defensibility are common themes in audits, legal contracts, regulations, and security assessments of information risk management and security (IRMS) programs, capabilities, and controls. The term “commercially reasonable” frequently appears in contractual agreements and regulatory guidelines, signifying common standards for security capabilities and controls.

5 August 2024
@ISACA Article

ISACA Releases AI Courses on Ethics, Audit, and Machine Learning

ISACA has released an online, self-paced introductory course to AI for auditors, alongside other new courses on ethics and machine learning for business enablement.

5 August 2024
Blog Post

Overcoming the Shortcomings of Modern Authentication

An ISACA white paper examining authentication challenges in the deepfake era identifies challenges organizations face and methods that can overcome them.

5 August 2024
Podcast

Effective Third Party Risk Management in 2024: AI’s Impact and Future Trends

Traditional security questionnaires just aren't cutting it anymore.

2 August 2024
Emerging Technology Article

AI Algorithm Audits: Key Control Considerations

It is crucial to understand the inner workings of an AI system through these algorithmic audits that will provide us with insights into various aspects like training data, model development and training, and the underlying logic of AI systems. This information will enhance our confidence in the outputs of AI systems by verifying adherence to other principles of responsible AI.

2 August 2024
Podcast

The Cyber Standard Podcast | Episode 3

Welcome to Episode 3 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the essential aspects of applying for and assessing candidates in the cybersecurity field.

2 August 2024
Blog Post

Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success

Focusing on robust communication, keeping current with the regulatory landscape and aligning with key business objectives are among the approaches that can set modern CISOs up for success.

1 August 2024
Podcast

What Enterprises Need to Know About ChatGPT and Cybersecurity

Many people are pondering whether generative artificial intelligence (AI) tool ChatGPT is a friend or a foe.

31 July 2024
ISACA Journal Article

Integrating Cybersecurity into Project Management: A Comprehensive Approach Across SDLC Phases

In an era when digital transformation is at the forefront of organizational strategies, the importance of incorporating cybersecurity into project management processes cannot be overstated.

Author: Rajanikanth Potturi
Blog Post

How Boards of Directors Can Better Prepare to Lead on Cyberrisk

Board directors need to be aware of key cybersecurity-related strategies and investments and make sure they are aligned with the organization's risk appetite.

30 July 2024
Blog Post

Cyber Resilience Through More Effective Design

There is a saying that I expect many have heard before: “How do you eat an elephant”? “One bite, one part at a time.”

26 July 2024
Blog Post

AI Ethics and Why It Matters

Artificial intelligence ethics considerations must be top-of-mind for organizations when leveraging AI as trust, bias, security, privacy and other important elements should not be overlooked.

24 July 2024
ISACA Journal Article

Developing Trustworthy AI: Understanding the Inputs

Bad AI training data leads to bad outputs, and these bad outputs lead to distrust and skepticism of AI systems. People may be more reluctant to use AI systems that they do not find trustworthy, decreasing the return on investment associated with AI.

Author: Safia Kazi
Blog Post

The Risk of Malicious Push Notifications in Augmented Reality Apps

Push notifications in augmented reality applications carry overlooked risks, and app developers should help mitigate them by working closely with privacy and legal experts

22 July 2024
Blog Post

How to Merge AI and Robots Responsibly

When it comes to merging AI and mobile robots, standards, guidance and testing are critically important to ensure that developers and other key players in the ecosystem are operating responsibly.

19 July 2024
Risk Article

Can Hardening Reduce Cyberrisk?

An often overlooked means to significantly reduce risk has been hardening systems, technologies, and network infrastructure.

19 July 2024
Blog Post

Three Ways for Enterprise Leaders to Make Technology Transformations More Successful

Clear scope, vetting vendors carefully and retaining key resources can position organizations for success in technology transformation projects.

17 July 2024
ISACA Journal Article

Are AI BOMs the Future?

The rapid adoption of AI has introduced new attack surfaces that many digital trust professionals are only beginning to understand. AI BOM can help organizations better understand the provenance of AI components used to assess related risk.

Author: Ed Moyle
@ISACA Article

Introducing The Evolving Auditor

The world of finance is undergoing a digital revolution, and the role of the auditor is no exception.

15 July 2024
@ISACA Article

Ransomware Attacks Are Noisy. Learn How to Listen for Them.

During the initial intrusion stage of a ransomware incident, the attacker has the advantage.

15 July 2024
Blog Post

Why So Many Organizations Underestimate Insider Threats

Insider threats remain overlooked by many organizations even though they are potentially more devastating than many incidents coming from external attackers.

15 July 2024
Blog Post

Unlocking the Power of Digital Trust: Exploring ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework provides organizations with the guidance needed to build and maintain trust with customers and other organizational stakeholders.

12 July 2024
Audit Article

The Importance of Independent IT Audit

In the evolving digital landscape, enterprise IT departments are finding cybersecurity to be an indispensable shield, safeguarding innovation.

12 July 2024
Blog Post

The Looming Threat of Unsecured IoT Devices: A Deep Dive

A secure Internet of Things ecosystem demands a multi-faceted approach, including specialized security solutions and layered defense mechanisms.

10 July 2024
ISACA Journal Article

Leveraging Digital Transformation and AI to Combat Financial Fraud in Banking

Within the complex modern financial system, banks are the guards that protect the assets and transactions of many people. Yet it is because of this status that they are the perfect victims of competent criminals.

Author: Maduabuchi Christopher Okonkwo
Blog Post

Empowering Women in Technology: ISACA’s Commitment to Bridging the Gender Gap

Through the ISACA Scholarship Program and the Digital Trust Workforce Inclusion Program, the ISACA Foundation helps to create equitable access to education, training, and career opportunities.

8 July 2024
Blog Post

Ten Pivotal Moments in an Internal Auditor's Career

Learning to navigate disagreements, adapting to emerging technology and keeping up to date on key regulations are among many pivotal factors in an internal auditor's career success.

3 July 2024
@ISACA Article

Examining the Risks of IT Hero Culture

The allure of the "IT hero" is compelling. IT heroes are individuals who, like the Avengers or Batman, seem to single-handedly save enterprises day after day.

1 July 2024
@ISACA Article

ISACA Announces 2024 Annual General Meeting

ISACA’s 2024 Annual General Meeting of the Membership will be conducted in person in Schaumburg, Illinois, USA on 24 July at 8 a.m. Central Daylight Time at the ASA Auditorium and virtually.

1 July 2024
ISACA Journal Article

Information Security Matters: Carving an Elephant

Zero trust architecture is based on core principles including least privilege and network segmentation. But it is also based on certain assumptions.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: Digital Trust—Automation and Its Impact

How we implement automation, the controls we establish, and the areas we choose for automation implementation, all influence the level of digital trust in our organizations.

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Orthopedics and Machines—It's an Orchestra

Of all industries, medicine is a centerpiece for the hope fostered by technical innovation.

Author: Cindy Baxter
ISACA Journal Article

Should We Be Relying on AI-Driven Mobile Robots?

AI and robots were created to assist humanity in its evolution. But robots unchecked have the potential to pose a danger to humanity.

Author: Larry G. Wlosinski
ISACA Journal Article

When Computer Says No

The risk inherent in AI systems can exacerbate the phenomenon of users having blind faith in technology. As AI becomes increasingly complex and autonomous, there is greater potential for unforeseen errors, biases, or ethical lapses to occur.

Author: Richard Clapton
ISACA Journal Article

Beyond the Cell Walls: Cybersecurity Insights Form The Shawshank Redemption

Inspiration can be drawn from the timeless tale of perseverance in the film The Shawshank Redemption by exploring the parallels between the prison walls of Shawshank and the digital fortresses constructed to protect data.

Author: Abdelelah Alzaghloul
ISACA Journal Article

The Pivotal Role of AI in Navigating the Cybersecurity Landscape

A holistic approach, merging AI with human expertise and robust governance, alongside continuous monitoring, is essential to effectively combat evolving cyberthreats.

Author: Robert Putrus
ISACA Journal Article

What is Resilience and How Does It Promote Digital Trust?

Resilience means moving away from technology to mitigate cyberrisk, and this requires collaboration among technology, people, processes, and enterprises.

Author: Alex Sharpe
ISACA Journal Article

Security Challenges and Opportunities of Crowdsourcing for Data Annotation

Many LLMs rely heavily on labeled data for training and have a high demand for annotated data, which crowdsourcing can help meet in a flexible and cost-effective manner. However, this approach also comes with several challenges.

Author: Pranav Kumar Chaudhary
ISACA Journal Article

Improving Cyberrisk Maturity, Governance, and Management in Boards of Directors

The BoD assumes a pivotal role in the orientation and direction of organizations to select the best business strategies that not only allow them to challenge current business plans, but also inspire the necessary transformations in the executive teams.

Author: Jeimy J. Cano M.
ISACA Journal Article

System Overload

Enterprises rely on systems, and systems sometimes fail. A system can either break down during one of its component processes or initiate processes that run smoothly but fail to produce the desired result/output.

Author: Kevin M. Alvero
ISACA Journal Article

From Humble Beginnings: How the CISO Role Has Evolved

The CISO role has undergone a considerable transformation, adapting to ever-changing technological advancements, regulatory requirements, emerging threats, and increasingly sophisticated threat actors.

Author: Brian Vasquez
Blog Post

CCOA Beta Program Equips Cybersecurity Professionals for Early-Career Success

ISACA's new Certified Cybersecurity Operations Analyst (CCOA) credential prepares early-career cybersecurity professionals for a range of in-demand roles in the field.

28 June 2024
Emerging Technology Article

Leveraging AI for Information and Cybersecurity

In an era dominated by digital advancements, the importance of accessible information and resilient cybersecurity practices cannot be overstated.

28 June 2024
Blog Post

ISO 27001 Shines Bright As a Beacon of Trust

The ISO 27001 Risk Assessment is not just a standard or certification; it can serve as a beacon of trust for a range of stakeholders.

27 June 2024
ISACA Journal Article

AI Risk and Mitigation: Tips and Tricks for Auditing in the AI Era

Inadequately controlled AI can make mistakes that are high-impact, yet subtle in their appearance. This can result in significant damage, especially if a human review is considered difficult or impossible.

Author: Spiros Alexiou
Blog Post

Building an AI Risk Management Program: A Security & Audit Team Perspective

Implementing trustworthy artificial intelligence requires enterprises to put in place a solid governance structure and a comprehensive framework of controls.

25 June 2024
Blog Post

European Union Artificial Intelligence Act: An Auditor’s Perspective

Organizations will need to identify the needed audit and governance resources and skill sets in order to make implementation of the EU AI Act successful.

24 June 2024
Podcast

The Cyber Standard Podcast: Episode 4

Welcome to Episode 4 of "The Cyber Standard Podcast"! Join host Ameet Jugnauth, Vice President of the London Chapter of ISACA, as he delves into the world of cybersecurity standardization.

21 June 2024
Blog Post

Navigating the Challenges of Cybersecurity in the Modern Data Landscape

With exponential growth in data, addressing the related privacy, risk and security implications on the data landscape needs to be a top priority for digital trust professionals.

20 June 2024
ISACA Journal Article

Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge

The transition to ISO/IEC 27001:2022 is a strategic process that requires careful planning and execution. 

Author: Jayakumar Sundaram
Blog Post

Governance Key to Taming Evolving Risk Landscape

The risk landscape continues to transform, highlighting the need for cross-functional collaboration, leveraging of frameworks and effective third-party risk management.

18 June 2024
ISACA Journal Article

Yet Another Risk Depiction (YARD)

Whether risk presents in a new form or one that has already been observed, a precise formula for predicting it has not yet been discovered.

Author: Luigi Sbriz
@ISACA Article

How to Maintain Your ISACA Certifications

Attaining an ISACA certification is crucial to anyone’s career and, as such, you wouldn't want to lose that certification that you have worked so hard to achieve.

17 June 2024
@ISACA Article

Integrating Climate Change Considerations into ISO Standards: A Paradigm Shift

In an era marked by growing environmental consciousness, organizations worldwide are reevaluating their business practices to align with sustainable principles.

17 June 2024
Blog Post

Security Professionals Face Big Challenge in Evolving Ransomware Landscape

The shifting ransomware landscape places responsibility on security professionals to keep pace with new attack types and trends that are especially targeting vulnerable industries.

17 June 2024
Blog Post

Managing AI’s Transformative Impact on Business Strategy & Governance: Strategies for CISOs

Gain a firmer handle on AI risks, controls design, needed detection and monitoring capabilities, and best practices for AI implementations.

14 June 2024
Security Article

Cloud Security Challenges in the Pharmaceutical Industry

Addressing the specific security concerns inherent in cloud computing within the pharmaceutical industry is pivotal for safeguarding sensitive data and ensuring regulatory compliance.

14 June 2024
ISACA Journal Article

Tech Regulations: How to Relieve the Burden of Supervisory Bodies and Reduce Risk for Investors

Cybersecurity adds complexity for investors, financiers, and buyers in the acquisition market, necessitating more thorough due diligence regarding an enterprise’s technology stack. There are three methods proposed herein to relieve this burden.

Author: Yuri Bobbert
Blog Post

The Numbers Whisper, But Stories Captivate: Rethinking Audit Communication

Auditors need to go beyond the cold, hard facts and incorporate time-tested storytelling methods to make their reports resonate more deeply with stakeholders.

11 June 2024
ISACA Journal Article

Agile: The X Factor of Internal Auditing

There is a need to make internal audits more adaptable and iterative beyond what a linear waterfall approach allows. Enhancing the adaptability and iterative nature of audits is essential to moving beyond the constraints imposed by a linear waterfall approach.

Author: Thomas J. Bell III
Blog Post

AI for Auditors: Challenges and Opportunities for Career Advancement

An ISACA training course on AI for auditors explores categories of AI algorithms that auditors will encounter, relevant regulations, how to audit third-party AI dependencies and more.

10 June 2024
Risk Article

Has the Digital Journey Added to the Risk of Using Third Parties?

In the swiftly advancing digital world, the role of third-party risk management (TPRM) has gained unprecedented importance.

7 June 2024
Blog Post

More Responsible Data Usage Through Privacy-Enhancing Technologies

ISACA's new white paper on privacy-enhancing technologies describes popular PETs, explores regulatory perspectives for using PETs for compliance and provides examples of how the technologies are being used.

6 June 2024
ISACA Journal Article

Cryptographic Advancements Enabled by Diffie–Hellman

Symmetric key cryptography was enabled by concepts first proposed in 1976 in “New Directions in Cryptography.” The concepts proposed have evolved; however, the core ideas remain relevant and can provide valuable insights into how the research community can address security needs.

Author: Srikanth Ambatipudi
Blog Post

A Toolkit to Facilitate AI Governance

ISACA's AI Audit Toolkit helps auditors to verify that artificial intelligence systems meet needed benchmarks for governance and ethical responsibility.

4 June 2024
ISACA Journal Article

The Virtuous Circle of the Adversary: Challenges and Threats for Modern Organizations

Enterprises must recognize and understand the virtuous circle of attackers, wherein adversaries generate asymmetries that create blind spots and enable cyberattacks, resulting in instability, uncertainty, and chaos across an organization.

Author: Jeimy J. Cano M.
@ISACA Article

Attaining Peace of Mind Under the Digital Trust Umbrella

Establishing digital trust with customers and stakeholders remains elusive for many organizations, as reinforced by new ISACA research.

3 June 2024
@ISACA Article

Five Tips for Success on ISACA Certification Exams

Five strategies for tackling ISACA certification exams in one shot .

3 June 2024
Blog Post

ISACA Member Finds Newfound Career Optimism Through Mentorship Program

ISACA member George Goodwin credits his ISACA Mentorship Program mentor, Karen Franklin, with giving him the confidence and encouragement he needed at a critical juncture of his career.

3 June 2024
Blog Post

Security-as-Code: A Key Building Block for DevSecOps

Security-as-Code can ensure that key security protocols and good practices are automated and integrated directly into all components of the software development lifecycle.

31 May 2024
Security Article

Understanding Sandworm, a State-Sponsored Threat Group

The Russian state-sponsored threat group Sandworm, operated by military cyberwarfare unit 74455, is one of the most formidable global cyberthreat collectives in recent memory.

31 May 2024
Blog Post

Password Hygiene: The Present and Future State

Best practices for password hygiene remain fluid as many professionals eye a future where passwords will no longer be a fixture on the security landscape

30 May 2024
ISACA Journal Article

Breaking Down Operational Barriers Between IT, Information Security, and the Business

Effective collaboration, rooted in clear and open communication, is not only crucial for the seamless operation of the organization but also essential to instill a sense of fulfillment and the satisfaction of a job well done.

Author: Kenneth Abbott
Blog Post

Bridging the Digital Trust Gap: An Urgent Imperative

Organizations that do not prioritize building digital trust open themselves up to significant business and reputational risks, as underscored by ISACA's 2024 State of Digital Trust research.

29 May 2024
Blog Post

Five Key Takeaways from the 2024 RSA Conference

The growing influence of artificial intelligence on the security landscape was top of mind for many presenters and attendees at the recent 2024 RSA Conference.

28 May 2024
ISACA Journal Article

AI-Infused Foresight: Unveiling Megatrends for Strategic Adaptation

AI plays a significant role in shaping megatrends, guiding enterprises to incorporate AI into strategic planning for a competitive edge, effective risk management, and innovation potential.

Author: Robert Putrus
Blog Post

Rethinking Cybernetics: Why and How

When it comes to the looming arrival of quantum computing, the creation of a new Turing machine will be the necessary starting point.

24 May 2024
Blog Post

AI AIn’t Human

Many of the guardrails that exist in the context of human thinking are not in place for artificial intelligence, which presents a range of significant challenges.

23 May 2024
ISACA Journal Article

Unlocking Data Collaboration: Use Cases of Secure Multiparty Computation in Advertising Technology

Secure platforms enabled by techniques such as secure multiparty computation (SMPC) allow partners to derive insights and optimize media campaigns without pooling or exposing raw data.

Author: Puneet Gangrade
Blog Post

Are We In Control of Our Digital Lives?

Technology is neither inherently good or bad, but it can be addictive, and digital trust professionals have a role to play in countering the harms that can result.

21 May 2024
Governance Article

Reinforcing IT Governance in the Face of Constant Threats

Today’s infosec teams often face new and complex challenges in an increasingly unpredictable digital environment. They are responsible for protecting an overwhelming amount of data across multiple systems.

21 May 2024
ISACA Journal Article

Resilience Challenges, Metrics, and Responses in Today’s Landscape

Although enterprises strive to take mitigating measures, the question remains: Will they be enough when—not if—a major disruption occurs?

Author: Spiros Alexiou
@ISACA Article

ISACA Releases New AI Insights, AI Training Courses

Three in five respondents to a new ISACA survey on artificial intelligence are worried or very worried that bad actors will exploit generative AI, yet only 35 percent say AI risks are an immediate priority for their organization.

20 May 2024
@ISACA Article

The 6 Key Questioning Methods for Internal Auditors

Internal auditors are vital guardians of organizational integrity, scrutinizing processes, identifying risks and suggesting solutions.

20 May 2024
@ISACA Article

The Reason Why Cybersecurity is Still Everyone's Job

As a cybersecurity professional, I have sat through many years of boring, bare-bones and dry security awareness training in which I learned enough to meet compliance requirement and pass the annual training to meet business metrics.

20 May 2024
Blog Post

Unlocking Digital Transformation in Pharma: A Least-Vendor Approach with the 3A-3C Framework

A least-vendor strategy can bring big benefits to organizations as they undergo digital transformation projects that otherwise can become complex and strain resources.

17 May 2024
Blog Post

Solving the First Conversation Problem in AI

Solving The First Conversation Problem in AI can go a long way toward companies having greater impact in leveraging the promising technology.

16 May 2024
ISACA Journal Article

Future Ready: Utilizing OKR for Audit Engagement Planning

Embracing balanced management approaches can position internal audit as a key player in driving organizational innovation.

Author: Noam Koriat
Blog Post

The Benefits of National Digital Health in a Short Story

When properly designed and implemented, patient-centric digital healthcare brings transformative potential to healthcare patients around the world.

14 May 2024
Blog Post

Navigating the AI Maze: An IT Auditor’s Guide Utilizing ISACA’s Digital Trust Ecosystem Framework

ISACA's Digital Trust Ecosystem Framework helps auditors and other digital trust professionals ensure that AI is implemented in a way that strengthens the organization and inspires trust with stakeholders.

13 May 2024
Blog Post

The $8,000 SOC 2 Conundrum

While the typical cost of a standard SOC 2 audit is going down, the skill level required for auditors to effectively perform them is increasing.

10 May 2024
Security Article

SAP Security Maturity: A Crash Course

Every journey to establish SAP security should begin with IT personnel identifying control weaknesses by bringing all stakeholders—security, audit, and compliance teams—into the fold.

9 May 2024
Blog Post

A Pathway to an Actionable AI Governance Roadmap

A new ISACA course on artificial intelligence governance can help professionals learn to design, develop, implement and monitor trustworthy AI within their organization.

8 May 2024
ISACA Journal Article

Building a Resilient and Successful Enterprise: Key Attributes and How to Measure Them

A manufacturing enterprise recently experienced disruption and near collapse after a fire destroyed its main production facility.

Author: Mahmoud Mohamed
Blog Post

A Better Path Forward for AI By Addressing Training, Governance and Risk Gaps

New ISACA survey data on artificial intelligence realities show that companies need to ramp up training and policies to deal with emerging risks from the powerful technology.

7 May 2024
@ISACA Article

Eight Overlooked Emerging Tech Risks and How to Mitigate Them

Emerging technologies refer to rapidly evolving advancements that can transform industries and society by introducing unique capabilities, processes or products. However, these technologies.

6 May 2024
@ISACA Article

The Role of the Risk Sin Eater

While cybersecurity professionals may be experts in cyberrisk and mitigation, business decision makers must weigh the pros and cons of the broader business interests against many forms of risk, of which cyber is only one.

6 May 2024
Blog Post

Unlocking AI’s Potential: How COBIT Can Guide Your Business Transformation

The COBIT framework can help organizations implement artificial intelligence more responsibly and in ways that ultimately will create more value for the enterprise.

2 May 2024
ISACA Journal Article

AI and Automation in Cybersecurity: Future Skilling for Efficient Defense

The ever-evolving threat landscape poses significant challenges, requiring innovative approaches to defend against sophisticated attacks. One approach gaining traction is the integration of artificial intelligence (AI) and automation into cybersecurity practices.

Author: Singirikonda Manikanta
ISACA Journal Article

Information Security Matters: The Inhibitors to Zero Trust Architecture

The essential premise of Zero Trust is that users must be verified every time they attempt to access information resources, not only at the point at which they sign in.

Author: Steven J. Ross
ISACA Journal Article

The Digital Trust Imperative: To Build Digital Trust, Start With Resiliency

The ties between resiliency and both technical architecture and security make sense. So how does digital trust apply to resiliency?

Author: K. Brian Kelley
ISACA Journal Article

IS Audit in Practice: Resilient Architecture

Today resiliency still means the business continuity and backup plans, but the buzz has moved to environmental considerations when one thinks of resilience.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Leveraging Application Service Architectures for Trust

There is often a disconnect between those of us chartered with fostering digital trust and optimizing risk and those tasked with building out the applications that service internal users, customers, partners, and other stakeholders.

Author: Ed Moyle
ISACA Journal Article

Overcoming Cyberresilience Design Challenge

From a risk perspective, cyberresilience is intended to help reduce the risk of dependence on cyber resources.

Author: Larry Marks
ISACA Journal Article

Case Study: Building a Cyber Line of Defense and Empowering Team Members

Global competition, technological disruptions, economic fluctuations, geopolitical threats, and public health crises have created an imperative for enterprises to become more resilient and adaptive if they hope to survive and thrive.

Author: Katie Teitler
ISACA Journal Article

European Financial Industry Shifts Toward Digital Operational Resilience

Digitalization is essential for financial institutions to remain competitive, meet evolving customer demands, and achieve sustainable growth in an increasingly digital environment.

Author: Kilian Trautman
ISACA Journal Article

Evaluating the Promise and Problems of Data Fabrics

The growing expanse of data makes it harder for analysts to find the right data, convert it, and archive it in a useful form using traditional database designs.

Authors: Nikos Orth and Gerald F. Burch
ISACA Journal Article

How to Build Digital Trust in AI With a Robust AI Governance Framework

The widespread adoption of AI brings forth multifaceted risk, including privacy breaches, data security vulnerabilities, and ethical dilemmas.

Authors: Carol Lee, Terence Law Tom Huang, and Lanis Lam
ISACA Journal Article

User Susceptibility to Malicious Push Notifications in Augmented Reality at the Workplace

As studies of AR security have primarily explored privacy concerns rather than social engineering and other threats, the combined risk factors of push notifications within an AR setting warrant deeper investigation.

Author: Sarah Katz
ISACA Journal Article

Navigating PCI DSS Compliance in the AWS Cloud

PCI DSS v4.0 introduces significant changes that are particularly relevant to cloud computing. These changes reflect the standard’s adaptation to the evolving digital payment landscape and the growing use of the cloud for processing payment data.

Author: Vijay Kasibhatla
Blog Post

2023 ISACA Annual Report Shows How ISACA is Fueling Future

The 2023 ISACA Annual Report provides updates on ISACA's finances, leadership and important progress made throughout the year by ISACA's global community.

30 April 2024
Blog Post

Three Reasons Why You Should Not Wait to Take the CISA Exam

There are several benefits for rising IT auditors to take the CISA exam even before they have the full years of experience required to complete their certification.

29 April 2024
Security Article

Navigating the Cyber Elephant in the Boardroom

The 5 Pillars of Security Framework offers a straightforward and business-friendly methodology for addressing cybersecurity challenges.

29 April 2024
Blog Post

Performing an ATM Security Audit

In preparing for an ATM security audit, auditors will need to prioritize understanding core governance and business processes impacting ATM management.

26 April 2024
Blog Post

ISACA Award-Winner Embraces Shared Vision for Safer Digital World

Sushila Nair, ISACA Technology for Humanity award-winner, sizes up the intersection of technology and humanity and what drew her to the cybersecurity field.

24 April 2024
ISACA Journal Article

The Deep Web and Games of Shadow: The Evolution of Cybercrime in the 21st Century

In the fast-developing digital landscape of the 21st century, the deep web is a baffling hidden world where cybercriminals orchestrate a variety of illicit activities.

Author: Azad Mammadov
Blog Post

The Need For AI-Powered Cybersecurity to Tackle AI-Driven Cyberattacks

Artificial intelligence can help security professionals counter the threats from cyberattacks that also are increasingly boosted by AI.

23 April 2024
Blog Post

Volunteer Appreciation Week: ISACA Volunteers Share Their Stories

ISACA volunteers share their motivations and career benefits they have received through their volunteer activities.

22 April 2024
Blog Post

Vanity Gone Rogue: The Rise of Exploits Targeting Custom Blockchain Addresses

The Vanity Address Attack is an under-the-radar automation capable of confusing blockchain users and opening the door to digital fraud.

19 April 2024
Blog Post

Audit Career Insights: Letter to My Younger Self

Embracing change, drawing inspiration from others and staying curious are among the recipes for success and longevity in the audit profession.

18 April 2024
Audit Article

Managing Compliance in 2024: Best Practices to Secure Cloud Access and Stay Audit-Ready

Cloud engineering and security leaders can implement streamlined solutions to protect their online environments without compromising productivity—while still achieving compliance.

18 April 2024
ISACA Journal Article

Enabling Security Success Through IT Partnerships

Former US President Harry Truman once said, “It is amazing what you can accomplish if you do not care who gets the credit.

Author: Seth Earby
Blog Post

Evolving Threats to Cloud Computing Infrastructure and Suggested Countermeasures

Cloud misconfigurations and insecure APIs are among the major threats to cloud computing infrastructure that need to be remediated.

16 April 2024
@ISACA Article

ISACA Puts Forward New Policy Template Library

A policy template library from ISACA provides enterprises with the ability to build and customize the principles needed for their specific environments and compliance requirements

15 April 2024
@ISACA Article

Navigating the Virtuous Path: Avoiding the 7 Deadly Sins of Internal Audit

Submitting incomplete work and auditing with an agenda are among the 'sins' that internal auditors should be sure to avoid.

15 April 2024
Blog Post

When it Comes to Controls, It’s the Little Things That Matter

Getting certain foundational, baseline control requirements right, including a tailored approach to risk management, benefits organizations of all types.

12 April 2024
Blog Post

How Will AI Impact Our Jobs in Digital Trust Fields?

Artificial intelligence can be a constructive force on the jobs landscape, especially for those in digital trust professions, with the right approach and commitment to ongoing learning.

10 April 2024
ISACA Journal Article

Cybersecurity Risk of AI-Based Applications Demystified

The introduction of OpenAI’s ChatGPT was a tipping point in the field of artificial intelligence (AI) and, perhaps, a watershed moment in history.

Author: Varun Prasad
Blog Post

DTEF Takes Center Stage in ‘Ask Me Anything’ Conversation with ISACA Hall of Famer

Digital Trust Ecosystem Framework expert Mark Thomas recently shared his perspective on DTEF and digital trust during an Ask Me Anything conversation on ISACA's Engage community.

8 April 2024
Security Article

Using a Functional Cybersecurity Exercise to Test Incident Response Plans

An FTX empowers enterprises to test their abilities and prepare their cyberrisk teams to defend against dreaded cyberattacks that occur far too often today.

8 April 2024
Blog Post

Why You Should Get Your CRISC

The evolving risk and technology landscapes has made the knowledge and expertise of the CRISC credential all the more valuable for risk practitioners.

4 April 2024
ISACA Journal Article

Analyzing and Adapting Cybersecurity Lessons: Safeguarding Organizations Through Strategic Alignment and Continuous Improvement

Security is everyone’s responsibility. And although instilling a security culture in an organization is not always easy, it is essential.

Author: Jayakumar Sundaram
Blog Post

Addressing Artificial Intelligence Threats and Risks from the Board of Directors Perspective Using COBIT 2019

The COBIT framework can be useful for enterprises as they look to responsibly operationalize and govern artificial intelligence.

2 April 2024
@ISACA Article

Creative Approaches to Gaining Cybersecurity Experience

Volunteering, joining industry associations and finding creative ways to gain hands-on experience can all position those interested in breaking into cybersecurity for opportunities in the field.

1 April 2024
@ISACA Article

Five Key Benefits of Using a Third-Party Incident Commander for Security Incident Response

Third-party incident commanders are able to coordinate and govern incident response resources effectively, along with bolstering incident response plans and capabilities

1 April 2024
Blog Post

The Struggle of IT Risk Management in Micro, Small and Medium-sized Enterprises

Limited resources, misaligned priorities, lack of awareness, complexity of IT ecosystems and regulatory pressures are among the factors that make risk management especially challenging for small and medium-sized enterprises.

29 March 2024
Blog Post

Shaping the Future with CMMI

The 2024 CMMI Conference will spotlight recent updates and improvements that position the CMMI community for increasingly high impact.

28 March 2024
Blog Post

Exploring the Cyber Commander’s Role in Enhancing Cybersecurity Governance

The ISACA China Hong Kong Chapter contributed to a panel discussion with a focus on the potential impact of cyber commanders in the security governance ecosystem.

27 March 2024
ISACA Journal Article

A Proposed High-Level Approach to AI Audit

Artificial intelligence (AI) has become ubiquitous in daily life, from healthcare and finance to virtual assistants and autonomous vehicles.

Author: Denis Piazzi
Blog Post

Meet ISACA’s Women’s Month Scholarship Winners

ISACA Foundation Women's Month Scholarship Award winners share their motivations and future ambitions for making their mark on digital trust professions

26 March 2024
Security Article

Five Steps to Secure an Enterprise Against Insider Threats

An organization’s employees are one of its most valuable assets and its most vulnerable cyberattack surface.

26 March 2024
Blog Post

Get Grounded in AI

A new ISACA resource on artificial intelligence provides valuable insights applicable both to those beginning their journeys in AI as well as those with knowledge and experience.

25 March 2024
Blog Post

How to Instill a Culture of Data in Internal Audit Function

Asking the right questions and meaningfully addressing business challenges through analytics can set internal auditors on the right path toward establishing a culture of data

20 March 2024
ISACA Journal Article

Enhancing Collaboration to Improve Cybersecurity Practices

The cyberthreat landscape is continually expanding as more enterprises and critical infrastructures increase their attack surfaces owing to their connectivity to the Internet.

Authors: Yasmin Nakhleh Jubran, Parsa Sadeghi, Kevin Melecio, Felipe Casabianca and Brian K. Ngac
Blog Post

Quick Scoping: How to Easily Frame Your Environment from a Compliance Lens

Lessons learned from theft prevention in a retail environment have surprising relevance when it comes to compliance and access management.

19 March 2024
@ISACA Article

Best Practices for Auditable Security Controls

Strong identity and access management practices enable organizations to build a strong security posture, as cloud security expert Varun Prasad explains in this Q&A interview.

18 March 2024
@ISACA Article

Common Sense Risk

Only by applying common sense can practitioners stop managing cybersecurity using the equivalent of mythology.

18 March 2024
Blog Post

Why AI Might Not Make the Best Coding Buddy

The information you upload in a public AI engine is public domain from the moment you press enter: what are the consequences for IT and corporate governance?

15 March 2024
Blog Post

How AI Is Transforming Audit, Risk and Compliance

Whether optimizing coverage in your compliance program, identifying similar risks across various business units or seeking more efficient risk management, AI-driven insight can help to connect the dots.

14 March 2024
Privacy Article

Optimize Enterprise Data and Uphold Privacy With ISACA’s DTEF

ISACA’s Digital Trust Ecosystem Framework (DTEF) can help enterprises ensure that broad organizational objectives and goals—including those relying on collecting and processing personal information—align with privacy objectives and compliance requirements.

14 March 2024
ISACA Journal Article

The Ethical Challenge of IT Silos

Enterprise governance of information and technology (EGIT) and business-IT alignment are crucial to create value and achieve the goals and objectives of IT. 

Author: Rajesh Srivastava
Privacy Article

Achieving Ethical Protection of Data Privacy

Adherence to data privacy protection standards is of the utmost importance to cyberprofessionals. On today’s technology-driven, information-intensive landscape, the information security function is made more complicated due to new sources of sociotechnology risk.

12 March 2024
Blog Post

The Symbolic Dance: Exploring the Role of AI in Cloud Computing

The convergence of artificial intelligence and cloud computing offers big opportunities for organizations alongside potential security and privacy risks.

11 March 2024
Blog Post

Refreshed Mission, Renewed Energy Around SheLeadsTech Program

ISACA's SheLeadsTech program has a refreshed focus and renewed commitment to offering expanded opportunities for women to make their mark on digital trust professions.

8 March 2024
@ISACA Article

Digital Trust Ecosystem Framework to Steer Organizations Toward Sturdier Relationships

A new framework from ISACA positions organizations to build more trustworthy relationships with customers while simultaneously operating more cost-efficiently and making better use of emerging technology.

6 March 2024
@ISACA Article

Do You Overthink? How to Avoid Analysis Paralysis in Decision Making

Establishing clear decision-making criteria can help organizations from becoming bogged down by regularly over-analyzing decisions.

6 March 2024
Blog Post

Countering Identity Takeover Incidents

Protecting individuals' identities in the aftermath of a privacy incident begins with important communication from banking, credit, government and employment organizations.

5 March 2024
Blog Post

Digital Trust Ecosystem Framework a Valuable Complement to COBIT, Other Frameworks

The Digital Trust Ecosystem Framework and COBIT work well in tandem, with each playing a significant role in allowing organizations to build a stronger foundation for success.

4 March 2024
ISACA Journal Article

Assertion-Based Financial Audit Procedures Related to Crypto Assets

Auditors must learn practical approaches and procedures for auditing crypto assets to manage the audit risk associated with such assets effectively.

Author: Kilian Trautmann
ISACA Journal Article

Information Security Matters: Information Security Architecture—From Access Paths to Zero Trust

Zero Trust Architecture will not stop all cyberattacks, but it can ensure that organizations do not fall victim to the easiest of attacks or fail to discover a breach for months or even years.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: How Managers Can Help Employees Thrive in Today’s Data Environment

No one faces the challenges of the data environment more than the front-line contributors in the audit and compliance professions.

Author: Cindy Baxter
ISACA Journal Article

The Digital Trust Imperative: The Data Bare Minimum Is Not Enough

If an organization has competitors willing to show that they go beyond the bare minimum, the organization doing just enough to be compliant is going to find it hard to compete.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Planning for the New Data Ecosystem

The rules of what we think we know about data are being rewritten. Several converging trends represent a seismic shift in our understanding of the technology ecosystem.

Author: Ed Moyle
ISACA Journal Article

Data Interoperability: Addressing the Challenges Placing Quality Healthcare at Risk

The data interoperability challenge in global digital health, as experienced in the context of the variety of national electronic health record (EHR) deployments around the world, should have been avoidable.

Author: Guy Pearce
ISACA Journal Article

Financial Clouds on the Horizon: Reassessing the Economics of Public Cloud Adoption for Financial Institutions

In an era characterized by rapid technological advancement and evolving customer demands, financial institutions face new challenges to remain competitive.

Author: Matthew Ryan
ISACA Journal Article

Addressing the Privacy, Security, Risk, and Operations Aspects of the Data Ecosystem

Data privacy, security, risk management and operations are complex aspects of the global data ecosystem, and enterprises should address them with solutions based on research and best practices.

Author: Mathura Prasad
ISACA Journal Article

Building Compliance Resilience Amid a Patchwork of Data Protection and Privacy Laws

Organizations operating across multiple states or countries must contend with multiple privacy laws and regulations consisting of nuanced, divergent or even conflicting obligations and requirements.

Author: Corlane Barclay
ISACA Journal Article

Key Considerations To Effectively Plan And Determine The Scope Of An ATM Security Audit Based On PCI DSS

ATMs have become more evolved self-service platforms, helping people pay bills, transfer funds, and exchange currencies. The increase in the number of services offered by ATMs also increases their risk.

Author: Aleksei Panov
ISACA Journal Article

Rethinking Cybernetics

The goal is by no means to reject the Turing machine, but rather to integrate it with a machine made more complex by the phenomenal advances in modern technology.

Authors: Jean Fayot,  Claude A. Laborde and Jean Claude Célestin
ISACA Journal Article

Blockchain Smart Contracts, Part 4: How to Audit

Traditional financial auditing practices must evolve as blockchain technology and Web 3.0 technology become standard.

Authors: Samuel Zaruba Smith and Andy Garcia
Blog Post

ISACA Award-Winner Stands at Crossroads of Theoretical and Practical

Oleksii Baranovskyi, of Ukraine, recipient of the ISACA Educational Excellence Award, is proud to simultaneously be a security professional and an educator.

29 February 2024
Blog Post

Harmony in Cyberleadership: Navigating the Gen Z Rhythm

Cybersecurity leaders should be mindful of the composition of their security teams, including common characteristics of Gen Z cyber professionals, when devising their approaches to leadership.

28 February 2024
ISACA Journal Article

A Factory Model Approach to Technology Control Testing

Technology control testing is a comprehensive evaluation of an enterprise’s technological infrastructure, systems and processes.

Author: Michael Powers, PH.D., CRISC
Blog Post

Third-Party Termination: Understanding Technology and Information Security Risks

Mitigating the technology and information security risks from terminating third parties calls for organizations to formulate nuanced security strategies.

27 February 2024
Security Article

The Top 5 Cybersecurity Threats and How to Defend Against Them

It is imperative to examine the top cyberthreats faced by enterprises today and consider what preventive measures can be taken to safeguard digital assets and privacy.

27 February 2024
Blog Post

Fallout from Viamedis, Almerys Attack Does Not End with the Data Leak

A major breach in France reinforces the need for sharpened security practices and the overarching imperative to drive toward strengthening digital trust.

26 February 2024
Blog Post

A Cybercriminal is Sentenced. Will It Make a Difference?

Ransomware often targets small-to-medium enterprises, so security teams need to take action to be more prepared for this potentially devastating line of attack.

23 February 2024
Blog Post

CMMC: A Global, Resilient Cyber Supply Chain Standard

The Cybersecurity Maturity Model Certification standard helps businesses to examine their computing ecosystem and enhance capabilities for stronger supply chain resilience.

22 February 2024
@ISACA Article

Strategies to Prepare for US State Privacy Law Compliance

Absent a major breakthrough on a federal privacy law, more US states are likely to enact privacy laws that will add to an already complex policy patchwork.

21 February 2024
@ISACA Article

The Commoditization of Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) is posing new, difficult challenges for organizations and law enforcement organizations alike.

21 February 2024
@ISACA Article

The Skills Combination We Need to Address the Global Cybersecurity Skills Gap

Embracing the right blend of hard and soft skills can position professionals to find opportunity in the cybersecurity profession.

21 February 2024
Blog Post

Broad, Regulatory Frameworks Needed to Responsibly Harness AI

As regulatory frameworks for the AI era continue to evolve, governments around the world will need to find a shared sense of purpose and collaborate on the best way forward.

21 February 2024
ISACA Journal Article

The Three Lines Model in Cybersecurity Governance and Risk Management

A solid cybersecurity governance structure (inclusive of cyberrisk management) should entail clear accountability for cybersecurity and unequivocal authority for cyber decision making within an organization.

Authors: Ivano Bongiovanni, PH.D., Sergeja Slapniičari, PH.D., CPA, Micheal Axelseni, PH.D., CPA and David Stockdalei, PH.D.
Blog Post

The Key Steps to Successfully Govern Artificial Intelligence

Accounting for key characteristics of trustworthiness and considering perspectives from a range of stakeholders are among the needed ingredients to strengthen AI governance.

19 February 2024
Blog Post

Eight Things NOT To Do When Preparing for the CISA

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

16 February 2024
Blog Post

The Digital Trust Game-changer: Get Ready for the Digital Trust Ecosystem Framework

Avoiding these light-hearted 'tips' for preparing for the CISA exam will put you in better position for a successful exam-day experience.

15 February 2024
Blog Post

The Surge in AI Development: Boon or Bane

Responsible development of artificial intelligence that recognizes the need for a balance between AI and human capabilities is the path to ensure the powerful technology's good outweighs the bad.

14 February 2024
Blog Post

Auditing Social Engineering: A Practical Approach

By asking the right questions around people, processes and technical controls, auditors can gather the evidence and documentations they need to successfully audit social engineering.

13 February 2024
Security Article

Navigating the Shifting Ransomware Landscape

Over the years, ransomware attacks have increasingly grown more common, costly and consequential, making it critical that organizations understand the latest threats and implement solutions to keep their (and their customers’) data secure—and their operations thriving.

13 February 2024
Blog Post

Securing the Future: Enhancing Cybersecurity in 2024 and Beyond

Prioritizing comprehensive cybersecurity strategy in support of overarching enterprise goals can position enterprises for success, even amid challenging threat and regulatory environments.

12 February 2024
Blog Post

AI and Patents: More Questions Than Answers

Court rulings that AI cannot be granted patents provided needed short-term clarity but there are still many open questions about how AI should be viewed in legal, ethical and practical contexts.

9 February 2024
ISACA Journal Article

Resilient GRC: Tackling Contemporary Challenges With a Robust Delivery Model

Organizations across a variety of industries can benefit from a well-planned GRC strategy.

Author: Robert Putrus
Podcast

A View into CTEM Exposure Management: Reducing your Attack Surface 3x

Organizations can no longer rely on legacy vulnerability management solutions to protect against even basic attacks.

7 February 2024
Blog Post

Digital Proficiency: Not Only for Individuals

Technology-minded countries around the world can learn a lot from Rwanda, which, despite limited resources, has become a digital benchmark through an impressive set of initiatives and ingenuity.

6 February 2024
@ISACA Article

Five AI Priorities for Digital Trust Professionals to Put on Their 2024 To-Do List

Greater awareness of potentially unethical AI usage and adapting to evolving AI regulations are some of the considerations that should be top-of-mind for digital trust professionals in 2024.

5 February 2024
@ISACA Article

US Congressman Visits ISACA for CMMI Update, AI Policy Discussion

A recent visit by a United States congressman to ISACA's office in Schaumburg included discussion of artificial intelligence policy and updates on how CMMI is sharpening enterprise performance.

5 February 2024
Blog Post

Threat Modeling and Secure-By-Design Applications

Identifying the flows, assets and vulnerabilities are among the key building blocks when threat modeling for software applications.

5 February 2023
Blog Post

Taking Action to Create a Future Where AI Benefits Us All

Artificial intelligence is a human creation that reflects the people who developed it, meaning we must guard against humans' shortcomings and biases resulting in AI furthering inequality and other societal harms.

2 February 2024
Security Article

How CISOs Can Take Advantage of the Balanced Scorecard Method

Enterprises require a balanced scorecard-based tool to proactively safeguard their assets from unforeseen threats.

2 February 2024
Blog Post

Global Experts Weigh in On Australia’s ‘Six Cyber Shields’ – Sharing Insights on Achieving a Safe Digital World

Global cybersecurity practitioners share their perspectives on Australia's new cyber shields strategy to provide more robust protection of digital assets in the coming years.

31 January 2024
ISACA Journal Article

Strengthening SIF Detection: Leveraging Social Media Footprints

SIF is a growing problem for financial institutions. At the same time, the monetary losses from SIF are difficult to quantify, with estimates ranging between US$20 billion and US$40 billion.

Authors: Mario Bojilov, PH.D, CISA, Kishore Singh, PH.D and Peter Best
Risk Article

Navigating the Treacherous Waters of IT Risk

The MOVEIt Transfer hacking campaign epitomizes the threats faced in an increasingly interconnected world.

30 January 2024
Blog Post

‘Just for Control’: the True Power of Controls

Ill-designed controls can waste organizations' time and resources, so make sure implementing controls is more than just a power move.

29 January 2024
Blog Post

Responsible AI Governance in Traditional and Emerging Ecosystems

Organizations implementing artificial intelligence into their operations will need strong governance in place to ensure transparency and trust in their AI usage.

25 January 2024
Blog Post

Executing A Well-Executed Risk and Control Self-Assessment

When executed properly, risk and control self-assessments become enablers for organizations to more effectively navigate the risk management landscape.

24 January 2024
ISACA Journal Article

Securing the First Line of Defense

Cybersecurity awareness for employees is nonnegotiable. It helps protect both individuals and organizations by mitigating cyberthreats and protecting sensitive information, which strengthens the overall security posture of an organization.

Author: Hadi Manasrah
Audit Article

Five Controls to Consider When Auditing a Vendor Management Program

Vendor management is a fundamentally critical function that impacts an organization's operational success, efficiency, reputation and risk exposure.

23 January 2024
Blog Post

The Top 10 Things Every Cybersecurity Professional Needs to Know About Privacy

As the intersection between cybersecurity and privacy increases, security professionals can benefit from gaining a solid understanding of core privacy terminology and privacy principles.

22 January 2024
Blog Post

Privacy in Practice: Dissecting the Global Trends That are Shaping the Profession

Challenges on the privacy landscape can be successfully addressed through upskilling, privacy by design principles and solid training and awareness programs.

18 January 2024
@ISACA Article

New Timing for ISACA Newsletter

The @ISACA newsletter will distribute on the first and third Mondays of the month in 2024, while a new monthly digest of top ISACA content will make its debut.

17 January 2024
@ISACA Article

Projecting 2024 Cybertrends and C-Suite Responsibilities

Anticipated trends on the 2024 cybersecurity landscape provide opportunities for C-suite leaders to position their organizations to effectively and securely leverage emerging technology.

17 January 2024
Blog Post

Mentorship: The Missing Ingredient in Your 2024 Goals?

The ISACA Mentorship Program has proven to be rewarding for mentors and mentees alike, allowing for valuable connections to propel ISACA members' careers to new heights.

17 January 2024
ISACA Journal Article

Increasing Security and Improving Performance With Network Managed Service Providers

Managing enterprise networks to meet increasing business requirements in the face of consistent cost reduction pressures can be demanding

Author: Oluwafemi Adeyemo Adeleke
Podcast

Leveraging Agile Concepts for Neurodiverse Auditors

In this ISACA Podcast episode, we’ll explore how leveraging Agile concepts can mitigate common workplace challenges for neurodiverse auditors.

17 January 2024
Blog Post

Post-Quantum Cryptography: Are We Ready for Q Day?

Focusing attention on understanding and building confidence in post-quantum cryptography now can save the security community major problems in the years to come.

16 January 2023
Audit Article

Six Benefits of a Cybersecurity Audit (and 6 Steps to Perform One)

A cybersecurity audit empowers organizations of all sizes to help identify and mitigate their cybersecurity risk.

16 January 2023
Blog Post

Nurturing Responsible Innovation: ISACA’s DTEF Recognized for Advancing Trust in AI Environments

ISACA’s Digital Trust Ecosystem Framework (DTEF) empowers organizations to build and sustain digital trust in the age of artificial intelligence and other impactful technological advancements.

12 January 2024
Blog Post

Modeling Identity Trust

An identity system based on trust in a third party could better protect personal data and improve trust throughout the digital ecosystem.

10 January 2024
ISACA Journal Article

Fog Computing and Edge Computing as Alternatives to the Cloud

Fog computing and edge computing have great potential to play major roles in the real-time processing of data.

Author: Kishan Sathyanarayanan
Security Article

Building Cybersecurity Resilience With the Power of Habit

In the digital age, cybersecurity is paramount for every organization, yet building a strong cybersecurity culture remains a challenge.

9 January 2024
Blog Post

ISACA’s Exciting 2024 is Underway

New ISACA digital trust resources, thought leadership, and upcoming events, both in-person and virtual, are among the coming attractions in 2024 for the ISACA community.

8 January 2024
Blog Post

Workforce Resilience: A Critical Asset for Organizations in Today’s Dynamic World

Promoting a culture of ongoing learning and upskilling is part of the equation for organizations looking to develop a more capable and resilient workforce

5 January 2024
Blog Post

Building a Great Security Operations Center

Defining and articulating a clear strategy for a security operations center (SOC) will make it much more likely that organizational leaders and other key stakeholders will support the SOC on an ongoing basis.

4 January 2024
@ISACA Article

Cultivating Digital Trust and Sustainability in IoT Devices

Explore strategies to secure your IoT devices in the aftermath of the holidays, in alignment with ISACA’s goal of ensuring digital trust.

3 January 2023
@ISACA Article

Emotional Cyberrisk Management Decisions

Emotions can complicate or even impair organizations' need for rational approaches to cyberrisk but that does not mean there is no place for emotion in the equation.

3 January 2024
Blog Post

The Intersection of Change Management and Cybersecurity: A Paradigm Shift in Protection

Given its focus on human behavior in an organizational change context, change management can lead to a fresh and valuable perspective on cybersecurity

2 January 2024
Podcast

Minimizing Risk and Audit Requests

With the increasing demand for audits and risk assessments, artifact requests will not be going away anytime soon. However, the burden these activities bring to the organization can be drastically reduced when audit and risk work together.

3 January 2024
ISACA Journal Article

Information Security Matters: Who Put the Zero in Zero Trust?

Zero trust is quite supportive of digital trust; they overlap to a great extent.

Author: Steven Ross
ISACA Journal Article

IS Audit in Practice: A Collaborative Approach to Assessing AI Risk

Ethical AI occurs when the business, risk and compliance teams not only evaluate the business opportunity that AI brings but carefully consider its impact by sitting in the shoes of users, policymakers and financial market managers.

Author: Cindy Baxter
ISACA Journal Article

The Digital Trust Imperative: AI’s Impact on Digital Trust

Given the proliferation of AI/ML solutions, it is important to understand potential areas of concern, especially ones that affect the reputation and trustworthiness of organizations and individuals within the digital ecosystem.

Author: K. Brian Kelley
ISACA Journal Article

The Bleeding Edge: Free Resources for Hardening AI and ML

If your organization is exploring ways to derive business value from AI and ML, even just maintaining an awareness of the space and becoming educated about the security, assurance, risk, and governance implications is helpful.

Author: Ed Moyle
ISACA Journal Article

Harnessing the Power of Large Language Models

Organizations must understand how to use these new large language models without creating negative societal impacts.

Authors: Meike Hofmann, Gerald Burch and Jana Burch
ISACA Journal Article

Securing the Future: Mitigating Data Security Concerns in Artificial Intelligence Models

Although AI can save time and effort, many users remain unaware of the potential risk to an enterprise’s sensitive data.

Author: Sharad Verma
ISACA Journal Article

Deploying Responsible AI

With the impending adoption of regulations such as the EU AI Act, organizations must adopt holistic responsible AI programs.

Author: Joshua Scarpino
ISACA Journal Article

The Potential Impact of New AI Regulations

There is a need for impactful regulations as well as a general awareness on how these regulations can positively improve the field of AI.

Author: Shini Menon
ISACA Journal Article

Subverting AI's Intellect: How to Thwart Data Poisoning

As AI systems proliferate and gain more widespread adoption, safeguards to thwart data poisoning attacks and ensure decisions that reflect human values become more important.

Author: Prithiv Roshan Sudhakar
ISACA Journal Article

Filling AI’s Cybersecurity Best Practice Gap

There are fundamental considerations necessary to creating a security and privacy risk management baseline for any AI implementation or deployment.

Authors: Joe Cozzupoli and John Salomon
ISACA Journal Article

Help Wanted: Evolving Privacy Roles and the Widening Privacy Skills Gap

This growing importance of privacy in organizations has led to a shift toward more technical privacy roles, where demand for such roles exceeds talent supply.

Author: Nandita Rao Narla
Blog Post

Cultivating a Culture of Inspiration: ISACA’s Member-Exclusive Speaker Series

Kristi Hedges, a Fortune 500 leadership coach and author, shared her perspective on how to inspire others during the ISACA Member-Exclusive Speaker Series.

29 December 2023
Blog Post

Supporting Privacy, Security and Digital Trust Through Effective Enterprise Data Management Programs

Organizational silos, poor data quality and improper data storage are among the challenges enterprises need to overcome to build effective data management programs and strengthen digital trust.

28 December 2023
Blog Post

ISACA Award Winner Advocates for ‘Life or Death’ Matter of Information Management

Castlepoint Systems, an Australian organization focused on data protection, compliance and risk management, was recognized with the 2023 ISACA Innovative Solutions Award.

27 December 2023
ISACA Journal Article

Securing the AI-Enabled Supply Chain With Vendor Management

Securing the AI-enabled supply chain will enable organizations to gain a competitive edge by ensuring a secure and reliable supply chain ecosystem.

Author: Anuj Choudhary
Blog Post

Top Management Considerations for Zero Trust

A new zero trust audit program from ISACA can help organizations transition from traditional network security architectures to ones that are better equipped to handle the modern threat landscape.

26 December 2023
Security Article

Track These 7 Trends for Proactive Cybersecurity in 2024

As 2024 looms near, digital threats are expected to increase in sophistication. Consequently, the tools and strategies cyberprofessionals use to counter them must also adapt.

26 December 2023
Blog Post

API Security: An Internal Auditor’s Quick Reference

Effective usage of Application Programming Interfaces (APIs) calls for diligence in related security controls and audit considerations.

21 December 2023
@ISACA Article

Defective CISOs: Lock Them Up?

The possibility of legal exposure for CISOs in the current climate reinforces the perils of an already stressful and difficult role.

20 December 2023
@ISACA Article

The Window of Exposure: A Critical Component of Your Cybersecurity Strategy

Understanding the nuances of the window of exposure when systems are at risk and is critical for security professionals to effectively protect their organizations.

20 December 2023
Blog Post

Significantly Improving Security Posture: A CMMI Case Study

Adopting CMMI has led to performance improvements across the board for Phoenix Defense, including a significant reduction in network attacks.

20 December 2023
ISACA Journal Article

Understanding CISO Management Styles

CISOs and CIOs can adopt a variety of management styles, depending on the individual’s personality and personal preferences, leadership styles, the organizational culture and context, and the specific needs of the enterprise.

Author: Jayakumar Sundaram
Blog Post

Protecting Your Organization from Cybersquatting

Registering and trademarking your internet domain, and monitoring for registrations with confusingly similar domain names, are among the ways organizations can protect themselves from cybersquatting.

19 December 2023
Security Article

Quishing: The Invisible Threat in QR Code Technology

When quishing occurs, unsuspecting individuals are lured into scanning malicious QR codes that link to fraudulent websites or malware downloads. Awareness surrounding this new threat must be raised to protect personal data and digital safety.

19 December 2023
Blog Post

How Business Leaders Can Responsibly Embrace Generative AI

A Forbes article by Phillimon Zongo lays out how enterprise leaders can help their organizations responsibly leverage generative artificial intelligence.

18 December 2023
Blog Post

Five Things for Governance Professionals to Put on Their 2024 To-Do List

In an era of increased complexity, formalizing data governance frameworks and data management protocols should be increasingly top-of-mind for governance professionals.

15 December 2023
Blog Post

Five Things for Privacy Professionals to Put on Their 2024 To-Do List

Gaining a better understanding of fast-evolving privacy regulations is a good starting point for privacy practitioners who are looking to position themselves for success in 2024.

14 December 2023
@ISACA Article

Serving Up Your 2024 To-do List

ISACA experts provide 2024 to-do lists for professionals looking to update their skill sets and expertise in the fields of IT audit, risk management, cybersecurity, privacy and IT governance.

13 December 2023
Blog Post

Five Things for Cybersecurity Professionals to Put on Their 2024 To-Do List

Incorporating artificial intelligence capabilities and sharpening the ability to architect security solutions in cloud settings can help cybersecurity professionals thrive in 2024.

13 December 2023
ISACA Journal Article

Using Security Controls to Mitigate Privacy Risk When Employees Use ChatGPT

If employees use generative AI, employers should implement effective information security controls and data protection measures and then monitor and assess the design and operating effectiveness of those controls to ensure compliance with security policies, contractual obligations and privacy regulations.

Author: Oluwafemi Adeleke
Blog Post

Five Things for Risk Professionals to Put on Their 2024 To-Do List

Embracing the role risk management can play in supporting the strategic growth of the business is among the items risk professionals should place on their 2024 to-do lists.

12 December 2023
Security Article

Rethinking Cybersecurity Training to Build a Resilient Workforce

There is much to be gained by exploring various approaches to ensuring benefits realization for any cybersecurity training program.

12 December 2023
Blog Post

Five Things for Audit Professionals to Put on Their 2024 To-Do List

Prioritizing upskilling, participating in mentoring programs and authentic engagement with stakeholders are among the approaches that can get IT auditors off to a good start in 2024.

11 December 2023
Blog Post

Secure Software Development Lifecycle Cannot Achieve its Purpose Without Third-Party Risk Management

Treating security as a core element of the design, build and implementation of software products takes intentional action, and understanding the impact that third parties play in achieving the desired level of product security is a step that not everyone is prepared for.

8 December 2023
Blog Post

Adapting Leadership for the Changing Technology and Cybersecurity Landscapes

The increasing prominence of technology in today's digital ecosystem calls for different approaches to organizational leadership, including creating an environment where innovative mindsets are encouraged.

7 December 2023
Blog Post

ISACA’s Top 10 Content Resources of 2023

Discover 10 ISACA resources from 2023 that resonated at a high level with our professional community

6 December 2023
@ISACA Article

Lions and Tigers and Office Politics – Part 2: How to Successfully Join a New Organization, Team or Function

Insights on addressing the learning of politics of a new organization and how to ensure you don’t make mistakes.

6 December 2023
Blog Post

The Leadership Benefits of Emotional Fluency and Vulnerability: ISACA’s Member-Exclusive Speaker Series

A recent installment of the ISACA Member-Exclusive Speaker Series focused on vulnerability and managing emotions in a workplace and leadership context.

6 December 2023
ISACA Journal Article

Lessons Learned From the Bangladesh Bank Heist

This cyberheist serves as a reminder that financial institutions worldwide need to rethink their cybersecurity strategies, risk management protocols and collaborative efforts to protect against similar cyberthreats.

Author: Mohammad Sami A Kabir
Blog Post

The Essentiality of Cybersecurity for Small Businesses: Applying Zero Trust Principles

Applying zero trust principles can be every bit as essential for smaller businesses to protect themselves as for large enterprises.

5 December 2023
Security Article

The Grim Reality of a Cyberattack: From Probability to Certainty

The outlook is grim for organizations that wish to keep their data secure. It is necessary to understand practical methods for reducing the impact of suffering from an attack.

5 December 2023
Blog Post

Diverse, Experienced Board a Must for ISACA to Be at its Best

Nominations and applications are being accepted for the ISACA Board of Directors for the 2024-25 term

4 December 2023
Blog Post

The Yellow Brick Road to Certifications: ISACA’s Mentorship Program and Exam Success

Finding a mentor through ISACA's Mentorship Program can help certification candidates on their path toward passing their exam, among a range of other benefits.

1 December 2023
Blog Post

How to Create a Healthy Security Culture

Incentivizing reporting, collaborating on solutions and reframing teaching points in positive fashion are all elements that can improve an organization's cybersecurity culture.

30 November 2023
@ISACA Article

Cybersecurity and Burnout: The Cybersecurity Professional's Silent Enemy

The demands on cybersecurity professionals can lead to mental health challenges, making it important that practitioners integrate mindfulness and proactively find ways to reduce burnout.

29 November 2023
Blog Post

The Benefits of Hiring Entry-level Cybersecurity Professionals

Many organizations are reluctant to hire relatively inexperienced people for cybersecurity roles but that approach is often misguided, according to recent ISACA Ask Me Anything expert Naomi Buckwalter.

29 November 2023
ISACA Journal Article

How to Build a Great SOC

It is imperative for the purpose, scope and objectives of an SOC to be clearly defined and communicated from the start, otherwise the investment in the SOC can be difficult to demonstrate and the SOC may not support the organization’s objectives.

Author: Grant Hughes
Blog Post

ISACA Advocacy Partnering with Policymakers to Work Toward More Trustworthy Digital Ecosystem

The ISACA Advocacy team spent recent months engaging with influential policymakers, with a focus on bolstering the cybersecurity workforce and creating a healthier digital ecosystem.

28 November 2023
Risk Article

Third-Party Risk Management: The Security Blind Spot No One Wants to Discuss

Third-party risk analysis services and customer security questionnaires are no longer sufficient for risk management. Trust professionals must explore alternative solutions for mitigating risk.

28 November 2023
@ISACA Article

Three Proactive Measures to Prevent Accounts Payable Fraud

As businesses grapple with complex transactions and multiple vendor relationships, the risks of accounts payable fraud grow, threatening both financial health and organizational reputation.

22 November 2023
@ISACA Article

‘Tsunamis’ to Change Course of Security Workforce

Emerging technologies, changes in the global economy and workforce transformations accelerated by the pandemic are reshaping the outlook for professionals in security and other digital trust fields.

22 November 2023
Blog Post

ISACA Advisory Groups Help Shape Programs

A range of volunteering opportunities through ISACA provide professionals meaningful opportunities to strengthen the profession while also earning CPE credits.

22 November 2023
Blog Post

My Journey to Cybersecurity and My Route to ISACA’s ITCA Certification

A journey to prepare for ISACA's ITCA credential was not without its challenges but ultimately proved to be transformative.

22 November 2023
ISACA Journal Article

The Risk and Control Self-Assessment

Risk and control self-assessments offer a vital framework for organizations to proactively identify, assess and mitigate risk.

Author: Anthony Oteri
Risk Article

Optimizing Risk Transfer for Systematic Cyberresilience

As security professionals navigate the present cyberthreat horizon, it is crucial to understand the emerging dangers and fortify digital defenses with cyberinsurance to ensure a secure digital future.

21 November 2023
Blog Post

Renovating Healthcare IT (or any IT): Building the Foundation for Digital Transformation

Modern systems, architectures and technologies, in addition to staff expertise in cloud, hybrid and on-premise solutions, are all important for organizations aiming to digitally transform, but getting there often requires an IT renovation.

20 November 2023
Blog Post

New Measures in Mainland China for Generative AI and Implications for Global AI Governance

New measures on generative AI in Mainland China have substantial implications for the evolution and use of generative AI not only in China but elsewhere around the world.

17 November 2023
Blog Post

Incorporating Agile Audit: Practical Tips

Establishing clear expectations and customizing the approach are among the steps that can facilitate a successful Agile audit implementation.

16 November 2023
Podcast

Scaling Your Threat Modeling Program

Understanding product security risk starts before a single code line is written. Teams can discover threats to the architecture of a system early in the development life cycle with Threat Modeling.

16 November 2023
ISACA Journal Article

The Benefits of Achieving Workforce Resilience

Organizations would benefit from focusing on how to use relevant frameworks and upskill their teams to build a resilient workforce.

Author: Hakan Kantas
Blog Post

Navigating Security Threats with IT Inventory Management

An efficient, current IT inventory is a foundational component of effective IT management and puts an enterprise in position to better leverage threat intelligence.

14 November 2023
Audit Article

Three Skills for Succeeding as an IT Auditor in the 21st Century

There are 3 skills that a modern IT auditor must possess to add value to the technology teams being audited and to avoid being seen through a negative lens by senior leadership.

14 November 2023
Blog Post

Using Machine Learning to Help Detect Sensitive Information

Leveraging machine learning has enabled Adobe to detect categories of sensitive documents and put in place automated real-time detection and response to properly flag any detected documents.

13 November 2023
Blog Post

Sustainability in Emerging Technologies: A Focus on Blockchain, AI

Implementations of artificial intelligence, blockchain and other emerging technologies should be done with sustainability considerations in mind.

10 November 2023
Blog Post

Raising Security Awareness in Cross-Cultural Work

In an increasingly complex and global security landscape, chief information security officers need to be in regular contact with the board and other key enterprise stakeholders to drive effective security culture and collaboration.

9 November 2023
@ISACA Article

Factors to Consider When Establishing a Cyberdefense: Part 2

Log management, malware defense, data recovery, security training and incident response are among the security areas for which organizations have to have solid approaches in place.

8 November 2023
@ISACA Article

How to Build Trust in a Distrustful Digital Era

Consistent and transparent communication, remaining committed to your brand values, and promoting the good things your company is doing can all help create trust in a distrustful digital era.

8 November 2023
ISACA Journal Article

Modeling an Identity Trust System

Basing digital identity recognition on trust is possible if the actors who request access and those who provide a service have the availability of a usable, secure and transparent mechanism.

Author: Luigi Sbriz
Blog Post

Is the CIO Just an IT Manager?

In a time when the rapidly evolving technology landscape is recalibrating business models, the CIO must balance internal IT activities with those that are outsourced, and map the needed controls accordingly.

7 November 2023
Security Article

From Chaos to Confidence: The Indispensable Role of Security Architecture

Similar to a high-rise building, a cybersecurity defense needs a solid foundation to avoid putting long-term stability at risk.

7 November 2023
Blog Post

DogeRAT: The Disturbing Malware Disguised as Your Favorite Apps

DogeRAT malware reinforces the growing sophistication and multi-faceted nature of cyberthreats, through its camouflage techniques, social engineering components, and its ability to imperil privacy and financial security.

6 November 2023
Privacy Article

What the Past Tells Us About the Future of Privacy in the United States

Because information can be replicated, exfiltrated or deleted in a matter of seconds, consumers and organizations need to implement steps to prevent, detect, respond to and remediate data breaches.

6 November 2023
Blog Post

Cyber Advisors, Security Services Providers Can Use Zero-Sum Game Theory Framework to Benefit Clients

The zero-sum game theory is worth considering for organizations, who should rethink the costs they face relative to the cybercriminals that often inflict damage without taking on any real risk.

3 November 2023
Blog Post

IT Risk and IT Audit: A Partnership

Providing leadership with pertinent data can go a long way toward building support for the cross-functional collaboration between the audit and risk functions that can put organizations in a much stronger position to succeed.

2 November 2023
Security Article

What Is Considered a Material Cyberrisk Under the New US SEC Rules?

The cyberevent disclosure rules introduced by the US SEC in July 2023 have sparked a wave of concern among cybersecurity professionals and BoDs.

2 November 2023
ISACA Journal Article

Learning While Earning: A New Way to Upskill the Workforce

Organizations must prioritize training and reskilling their workforces by implementing learning and development initiatives.

Author: Arjun Gopalakrishna
@ISACA Article

Key Considerations for Developing Organizational Generative AI Policies

Few organizations have comprehensive policies in place on the usage of generative AI, which could prove perilous with increasing usage of the powerful and popular technology.

1 November 2023
@ISACA Article

Lions and Tigers and Office Politics – Oh My

The term 'office politics' often makes people think about toxic or unethical workplace behavior, but office politics are actually a necessity that, if handled artfully, can boost people's careers and help drive progress.

1 November 2023
Blog Post

ISACA's Digital Trust World Europe Conference

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more.

1 November 2023
ISACA Journal Article

Three Top Cybersecurity Trends for the Next Decade

ISACA's recent Digital Trust World conference in Dublin, Ireland, featured timely expert insights on digital trust, artificial intelligence, security, risk, digital ethics, and more

Author: Shankar Nishant
ISACA Journal Article

Information Security Matters: A Little Security

Small enterprises need to adopt security at scale, consiering minimum security requirements first and additional tactics commensurate with level of risk.

Author: Steven J. Ross
ISACA Journal Article

IS Audit in Practice: Future Skills Needed in Audit, Cybersecurity, Privacy and Emerging Technology

Technology advances rapidly and practitioners must adopt a learning mentality to keep pace with change.

Author: Cindy Baxter
ISACA Journal Article

The Bleeding Edge: Embracing SDLC Controls and the Inevitability of Automation

Acceleration and automation of software development and release processes necessitates changes to how practitioners assure and secure the output of these processes.

Author: Ed Moyle
ISACA Journal Article

The Digital Trust Imperative: Skills Training—A Prerequisite for Digital Trust

One often overlooked aspect of digital trust is the appropriate skilling of staff and whether they are poised to succeed in an ever-changing technology landscape.

Author: K. Brian Kelley
ISACA Journal Article

Lifelong Learning: An Essential Attitude for Career and Life Success

The seeds and roots of lifelong learning should be planted and established so that people at all stages of their careers can embrace the lifelong learning journey.

Author: Grace Johnson
ISACA Journal Article

Developing Lifelong Learners to Ride the AI Wave

Taking advantage of the AI revolution benefits will require organizations to provide the necessary culture and resources that encourage individuals to become self-directed lifelong learners.

Authors: Katharina Schlembach, Norman Csavajda, Gerald Burch and Jana Burch
ISACA Journal Article

Emotional Intelligence Outweighs Technology Skills for Cybersecurity Teams

Prioritizing emotional intelligence over technology skills can help organizations identify the right talent for the right job and thus gain better visibility into their threat landscape.

Author: Christine Whichard
ISACA Journal Article

Optimizing a Career Trajectory Through Personal Accountability

GRC and cybersecurity professionals must demonstrate strength with regard to personal accountability to effectively manage their careers and ensure that they keep pace with technological advancements, associated risk factors and new techniques employed by bad actors.

Author: Adam Kohnke
ISACA Journal Article

To Fear or Not to Fear: How to Create an Optimal Security Culture

It is important to understand the different levels of employee fear, the factors that contribute to it at each level and the implications for security to effectively manage fear to create a culture of security within an organization.

Authors: John Batchelor, Timothy Spivey and Timothy McIlveene
ISACA Journal Article

Future Ready: Toward a Sound Agile Audit Framework

Agile is an essential practice to adopt and a critical competency that cultivates digital business agility, enabling internal audit to be highly aware, make informed decisions and act promptly.

Author: Noam Koriat
ISACA Journal Article

Case Study: Launching an SOC to Improve Cyberthreat Detection

Raython Missiles and Defense needed to build out a security operations center (SOC) alongside the technology used to prevent physical threats, with RMD’s cybercapabilities matching the level of security required for physical assets.

Author: Katie Teitler
ISACA Journal Article

Safeguarding Enterprises from Cyberrisk with ESG

Cybersecurity is a critical element of ESG and can be used to measure the maturity of the governance of an organization; thus, cybersecurity must be added to the ESG reporting framework.

Author: Rima Bose
ISACA Journal Article

How to Gamify Cybersecurity Learning on a Budget

Gamification makes cybersecurity learning more interactive and enjoyable because it adds elements of competition, rewards and progression, which can enhance motivation and engagement.

Author: an Soon Chew
ISACA Journal Article

The Intricate Web of Third-Party Cybersecurity Risk

IT security and risk management professionals must prioritize cybersecurity within their organizations by constantly advising management on best practices for protecting their organizations’ sensitive information and strategies to manage risk effectively.

Author: Jacob Peng
Blog Post

Sizing Up Some of the Spookiest Cybersecurity Incidents of 2023

2023 has been another frightful year on the cybersecurity landscape - explore some of the most perilous incidents and what security professionals can learn from them

31 October 2023
Security Article

The Importance of Security Logistics in Software Development

Organizations must understand how security measures work, are implemented and behave—and under which circumstances they fail.

31 October 2023
Privacy Article

Legally Permissible Does Not Mean Ethical

Treating compliance as an aspiration and collecting excessive amounts of information is harmful to consumers; privacy professionals must help their enterprises’ privacy practices be more ethically focused.

30 October 2023
Blog Post

Saluting ISACA Foundation's Cybersecurity Month Scholarship Winners

ISACA Cybersecurity Month Scholarship recipients share what motivated them to pursue careers in cybersecurity and how they see their futures in the field taking shape.

27 October 2023
Blog Post

Re-aligning Employees to Strategic Goals with Enterprise Training

An ISACA enterprise training instructor provides insights on some of the main benefits of team trainings and how enterprise training can enable organizations to elevate their performance.

26 October 2023
Emerging Technology Article

How Rising Professionals Can Obtain Coveted Expertise in Emerging Tech

Companies increasingly are on the lookout for new professionals with skills and background in emerging technologies and how to implement them in the enterprise setting.

26 October 2023
Blog Post

ISACA AI Survey Results: What Do Infosec Professionals REALLY Need to Know?

It is quite hard to find quality information about artificial intelligence (AI) right now, especially when it comes to how AI should and is being approached in the field of cybersecurity. Thankfully, ISACA has just completed a survey of thousands of members of the global infosec and digital trust community.

25 October 2023
ISACA Journal Article

Improving Information Security Through Organizational Change

To effectively combat cybercrime, CISOs must report to the highest level of the organizations they serve to ensure they are heard and their message is taken seriously by all stakeholders.

Author: Scott Rosenmeier
Blog Post

Risk Quantification 101: The Fundamentals to Getting Started

Tapping into existing risk data can enable organizations to build the needed infrastructure to put in place an effective cybersecurity risk management process.

24 October 2023
Blog Post

Collaborative Mindset Change from Compliance to Risk

Transitioning from a compliance-based focus to a risk-based approach is useful as enterprises aim to best align resources in the modern business and regulatory environments.

23 October 2023
Blog Post

Best Practices for Navigating Emerging Technologies: My Journey as an Auditor

Proactively learning about emerging technologies and understanding them in a business context can go a long way toward making auditors more effective in their engagements.

20 October 2023
Blog Post

In Cybersecurity, to Err Is Human, But to Err for No Reason Is a Shame

Organizations would be well-served to be more intentional about designing systems and processes with human factor engineering in mind, lessening the probability of people making mistakes that lead to cybersecurity incidents.

19 October 2023
@ISACA Article

Internal Auditors as Catalysts in DevSecOps

Internal auditors have an important part to play for organizations to implement DevSecOps successfully.

18 October 2023
@ISACA Article

Using COBIT and Google Maps to Integrate Any Framework, Standard or Model With Enterprise Apps

Mapping the functionality of popular applications can allow organizations to better understand how to make frameworks, standards and models support their apps and improve user experience.

18 October 2023
Blog Post

Proactive IT Risk Management in an Era of Emerging Technologies

As emerging technologies and new business models transform the business landscape, the need for proactive risk management practices should be top of mind for enterprise leaders.

17 October 2023
Security Article

What Enterprises Need to Know About ChatGPT and Cybersecurity

It is the responsibility of security professionals to act now to determine how to safely leverage AI—if they wish to do so at all.

17 October 2023
Blog Post

How Cybersecurity Best Practices are Evolving to Manage Ongoing Threats

Regular penetration testing and a culture of proactive threat analysis and management can help organizations evolve their cybersecurity programs in a difficult climate for cyber defenders.

16 October 2023
Emerging Technology Article

Generative AI With Cybersecurity: Friend or Foe of Digital Transformation?

Generative AI requires significant training and cultural change to ensure confidential data is not compromised, and the security data model training infrastructure requires significant investment and strong business support.

16 October 2023
Blog Post

Quantum-Resistant Cryptography Not a Matter of ‘If’ but ‘Right Now’

Establishing crypto-agility should be a major priority for organizations as advancing quantum computing capabilities are changing the paradigm of the threat landscape.

13 October 2023
Blog Post

Data Management Proficiency: Practical Insights for Quality, Security and Trust

Evaluating quality, security and trust in the context of emerging technologies and current business practices is critical for organizations to have effective data management and governance.

12 October 2023
@ISACA Article

Artificial Intelligence: Privacy and Information Security Risk Considerations

Gaining business benefits from artificial intelligence while also mitigating the related risks requires a holistic, multidisciplinary approach that draws upon the expertise of professionals from several disciplines.

11 October 2023
@ISACA Article

The Value of Near Misses in Risk Management

Like it or not, sometimes it takes a harrowing near miss for enterprises to learn what can become highly valuable lessons in risk management.

11 October 2023
Blog Post

CMMI Offers New Credentialing Pathway and Enhanced Flexibility, Resources

New CMMI credentialing pathway aligns with ISACA’s tools, systems and best practices.

11 October 2023
ISACA Journal Article

Raising Security Awareness in Cross-Cultural Work and Collaboration

Any organization can benefit from conducting an investigation before planning and organizing a security awareness program.

Author: Vanessa Britt Perez Revilla
Blog Post

Victory by Surveillance Isn’t Possible—To Win, Engage the Adversary

Traditional approaches to cybersecurity have not been enough to protect companies, so it's time to make attackers face real consequences for their malicious behavior.

10 October 2023
Security Article

Profiling a SAP Hacker

To mitigate the risk of cyberattacks, organizations must keep their SAP systems up-to-date with the latest security patches and updates.

10 October 2023