Topic: Access Policy

When you say M06-16 to any government IT or security professional they all know you’re talking about two-factor authentication for any remote access.

It seems that just as we move forward in securing our networks, we take two steps back. Or do we?

In 2006, the Office of Management and Budget (OMB) required two-factor authentication and VPN technology through the M-06-16 memo. Departments and Agencies moved quickly to deploy both two-factor authentication as well as VPN technology.

Click to Download/Listen

Roland Cloutier, VP and CSO of EMC joins us on this week's Speaking of Security podcast.

Click to Download/Listen (14:00)

This week's Speaking of Security podcast presents a lively conversation with Shannon Kellogg, Director of Information Security Policy for EMC's Office of Government Relations on security related activity in Washington, DC.

In Art’s keynote last week at RSA Conference, he made a clear call to the industry.  We have to be more organized, more coordinated and more collaborative than either the enemy or than the industry has a history of being.  Art had three calls to action:

1. Integrate and Interoperate
2. Create and Adopt Standards
3. Share Technology

Click to Download/Listen (08:34)

This week's Speaking of Security podcast features an on-the-scene report from the Gartner Identity and Access Management Summit, one of the key shows on the security event calendar. The Summit was held last week in Orlando, Florida.

We often swallow ideas that we needn't or shouldn't. Take the onetime urging of nutritionists to substitute margarine for butter in the cause of cardiovascular health. When this advice was first circulating, most margarines contained high quantities of trans fats, concoctions that have turned out to be so harmful - to the heart, among other things - that they are now banned in restaurants in NYC. Similar dogma applies to the advice to drink eight eight-ounce glasses of water a day for overall good health. Everyone knows the advice. But no one seems to know where the 8x8 rule comes from or if it is good or bad. So what pieces of conventional wisdom in computer security are like margarine and the 8x8 water doctrine? I'd hold forth password expiration as a prime candidate.