In-depth looks at the basics of information security, physical and corporate security, business continuity, and more.
By Derek Slater
April 01, 2009 — CSO — Whether you're new to the field of security, expanding your skill set or just keeping your fundamentals sharp, these primers will do the trick. These Security Basics articles are compiled from expert input on CSOonline or contributed directly by subject-matter specialists.
Security Basics categories (click to skip to a category)
Understanding information security policy, cloud security, social media, IT audit, penetration tests and more.
Penetration test basics
Pen tests need to accomplish business goals, not just check for random holes. Here's how to get the most value for your efforts.
Cloud security: the basics
SaaS, IaaS and PaaS and their security implications.
Log management basics
How to choose the right type of log management system—and use it for business intelligence.
by David Torre
Software security for developers
Best practices and key concepts for writing secure code.
by Mark Merkow and Lakshmikanth Raghavan
Software security for application development managers
How to deliver more code at lower cost—by building security into the application development process. Also by Merkow and Raghavan.
Vulnerability management: The basics
A three-part series covering vulnerability management tactics and tools, plus how penetration testing fits in.
Social media security risks: the basics
TMI, tweet rage, "friend" scams and many more risks to avoid on social media and social networking sites.
IT risk assessment frameworks: an introduction
OCTAVE, FAIR, NIST RMF, and TARA—a look at the strengths and weaknesses of four formal methodologies for risk assessment.
How to write an information security policy
Where to start, what to cover and how to make your overall information security policy effective.
by Jennifer Bayuk
Information system audit basics
What should you expect from an IS audit? Here's a step-by-step walkthrough.
by Jennifer Bayuk
Network security: basic concepts
Defense in depth, role-based access control, and other critical network concepts to understand before you get lost in the bits and bytes
by Stephen Northcutt, SANS Institute
Wireless security basics
Encryption and authentication are the key to securing wireless networks, regardless of protocol
by Galen Gruman
Incident detection, response and forensics
How to build a robust function for dealing with computer security incidents
by Richard Bejtlich
VoIP security basics
Dealing with vishing, SPIT and other voice-over-IP (VoIP) threats
by Bob Bradley, Sonus Networks
Service-Oriented Architecture (SOA) security
Threats and defensive techniques in SOAP/WSDL and REST-based architectures
by Mark O'Neill, Vordel
Phishing: the basics
How to foil identity theft and other phishing attempts
Identity management basics
Providing IT managers with tools and technologies for controlling user access to critical information within an organization
by John Waters