IT Governance

• COBIT

Control Objectives for Information and Related Technology (COBIT) is a framework created by ISACA for information technology (IT) management and IT governance. It is a supporting toolset that allows managers to bridge the gap between control requirements, technical issues and business risks.
ISACA published the current version, COBIT 5, in 2012
http://en.wikipedia.org/wiki/COBIT

• The COBIT - Control Objectives for Information and related Technology corresponds to a structure that embraces all the activities related to the "informatics" for the Information Technology (IT) governance, while the ITIL - Information Technology Infrastructure Library helps in the definition of the processes associated to the IT services which complements the initiative of businesses processes. In general, the ITIL is centered on the best practices in order to ensure the delivery and support of the IT services. These two frameworks (or guidelines) are widely recognized by their complementarity for the IT governance. In this context, after the applicability of the certification of quality services (in particular the ISO 9001 standard) in a Portuguese Private School of the basic and secondary levels, this work was centered in the study, implementation and use of ITIL and COBIT frameworks with the purpose of management and control the IT and in this way, ensure the IT and Information Systems (IS) governance in the institution. The implementation of these frameworks in the institution made possible the management and control of the IT and IS, bringing advantages in terms of performance and efficiency of the quality of the services, as well as a more efficient monitoring in the control of the technological infrastructure, namely through the reduction of 23% in the number of time spent on the accomplishment of tasks; in the reduction of 25% in the number of incidents that were solved and closed by the several information technology services, as well as in the reduction of 10% in the number of reopened incidents.

http://ieeexplore.ieee.org/document/6263073/

• COSO Framework

The COSO framework was updated in 2016 to provide the approach of an applied risk management for internal controls. It applies to both internal and financial reporting, where its framework encompasses these five strategic pillars.

Strategy and Objective Setting – goals of risk tolerance must be measured objectively.
Governance and Culture – to oversight enterprise risk management daily.
The Performance Segment- risks should be prioritized for effective reporting.
Information, Communication and Reporting- proper communication internally and externally
Review and Revision – continuous internal audit and measuring to revise measures

Just like COSO, COBIT has its 5 strategic principles, with varying purposes and goals, as follows.

Covering Enterprise End-to-End – Apart from focusing on the IT function, ERM incorporates applications, assets and all technologies and information.
Meeting Stakeholder Needs- Determines resources needed based on people bearing risks and those receiving benefits.
Applying a Single Integrated Framework –multiple standards are mapped out to the framework of single governance and management.
Enabling a Holistic Approach- has the interconnection of information, policies, infrastructure, people, organizational structures, culture and all processes.
Separating Governance and Management –analyzing needs to set objectives with clear direction while severing tracking duties from governance authority

Difference between COBIT 5 and COSO
COSO establishes the guiding principles for organizations to institute risk tolerance and reduce fraud. On the other hand, COBIT 5 delivers the framework for organizations to build controls of best practices.
Companies that use COSO for establishing their risk reporting approaches can employ COBIT 5 to organize their control ecosystem
COBIT 5 sets the plans of COSO in real action so that companies can secure their IT and reporting departments.

Why do organizations need both COSO and COBIT?
COSO and COBIT 5 need to work together on risk governance and a controlled landscape for companies to comply with security requirements.
https://knowtechie.com/what-are-the-differences-between-cobit-coso/

• What is the COSO Framework?

The COSO Framework, most recently updated in 2016, provides an applied risk management approach to internal controls. Applicable to both financial reporting and internal reporting, the COSO framework focuses on five interrelated strategic points.

What are the differences between COBIT 5 and COSO?
COSO acts like the building plans for a new house. The framework lays out the general locations of rooms. COSO allows an organization to frame the building. However, walking through a framed home only shows an outline of how the final plan will look.
COBIT 5 shows organizations where to put the electrical systems, plumbing, and then puts up the drywall. This framework sets the COSO plan into action with details that allow organizations to secure the IT environment.
https://reciprocitylabs.com/what-are-the-differences-between-cobit-coso/

• COSO is a model for corporate governance, and COBIT is a model for IT governance

COSO deals more at the strategic level, while COBIT focuses more at the operational level.
COBIT is a way to meet many of the COSO objectives, but only from the IT perspective.
COSO deals with non-IT items also, as in company culture, financial accounting principles, board of director responsibility, and internal
communication structures

Frameworks such as the Control Objectives for Information and related Technology (CobiT) and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework aid regulatory compliance, but don't provide actual risk management methodologies. Instead they include some high-level goals for risk management as part of their overall scope. While CobiT helps a company define risk goals at an operational level, COSO helps a company define organizational risks at a business level.
While CobiT is a model for IT governance, COSO is a model for corporate governance. CobiT was derived from the COSO framework
COSO focuses on the strategic level, while CobiT focuses more on the operational level. You can think of CobiT as a way to meet many of the COSO objectives, but only from the IT perspective.
http://www.pearsonitcertification.com/articles/article.aspx?p=1594876&seqNum=2

• What is the ISO 27000 series of standards?

The ISO/IEC 27000 family of information security standards, also known as the ISO 27000 series, is developed and published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) to provide a globally recognised framework for best-practice information security management.
https://www.itgovernance.co.uk/blog/what-is-the-iso-27000-series-of-standards

• What is an ISMS and 9 reasons why you should implement one

What is an ISMS?
A centrally managed framework for keeping an organisation’s information safe.
A set of policies, procedures, technical and physical controls to protect the confidentiality, availability and integrity of information.
Not an IT function but a business management process.
An ISMS can be certified to the international best-practice information security standard ISO 27001. Achieving accredited certification to the Standard demonstrates to your clients, customers, regulators and stakeholders that your organisation is following information security best practice and your data is sufficiently protected.
https://www.itgovernance.co.uk/blog/what-is-an-isms-and-9-reasons-why-you-should-implement-one

• NIST SP 800-37 Rev. 2

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization’s information systems and inherited by those systems.
https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

• What is NIST SP 800-53? Definition and Tips for NIST SP 800-53 Compliance

NIST SP 800-53 is a set of standards and guidelines to help federal agencies and contractors meet the requirements set by the Federal Information Security Management Act (FISMA).
The SP 800-53 guidelines were created to heighten the security of the information systems used within the federal government. The guidelines themselves apply to any component of an information system that stores, processes, or transmits federal information.
https://digitalguardian.com/blog/what-nist-sp-800-53-definition-and-tips-nist-sp-800-53-compliance

• What is HIPAA Compliance? 

HIPAA, the Health Insurance Portability and Accountability Act, sets the standard for protecting sensitive patient data. Any company that deals with protected health information (PHI) must ensure that all the required physical, network, and process security measures are in place and followed.
http://www.onlinetech.com/resources/references/what-is-hipaa-compliance

• HIPAA Compliance Checklist

If your organization has access to electronic Protected Health Information (ePHI), it is recommended that you review our HIPAA compliance checklist. The purpose of our HIPAA compliance checklist is help ensure that your organization complies with the HIPAA regulations covering the security and privacy of confidential patient data.
http://www.hipaajournal.com/hipaa-compliance-checklist/

• What is HITRUST vs. HIPAA?

While HIPAA is an act that details standards for compliance, HITRUST is an organization that helps you achieve those standards. The major difference is that HIPAA is simply a set of regulations while HITRUST assists companies with achieving compliance to those regulations

Additionally, it is important to be aware of how the two relate. HITRUST can be of service to those who are looking to use multiple service vendors while ensuring HIPAA compliance

https://www.givainc.com/blog/index.cfm/2017/2/6/What-is-HITRUST-vs-HIPAA

• ISO/IEC 27001 ISMS requirements
• ISO/IEC 27002 Code of practice for information security management
• ISO/IEC 27003 Guideline for ISMS implementation
• ISO/IEC 27004 Guideline for information security management measurement and metrics framework
• ISO/IEC 27005 Guideline for information security risk management
• ISO/IEC 27006 Guidance for bodies providing audit and certification of information security management systems

• TOGAF Model and methodology for the development of enterprise architectures developed by The Open Group

• ITIL Processes to allow for IT service management developed by the United Kingdom’s Office of Government Commerce

• Six Sigma Business management strategy that can be used to carry out process improvement

• Capability Maturity Model Integration (CMMI) Organizational development for process improvement developed by Carnegie Mellon

• GDPR

General Data Protection Regulation
The European Data Protection Regulation is applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe.
https://gdpr-info.eu/

• PCI DSS

Maintaining payment security is required for all entities that store, process or transmit cardholder data. Guidance for maintaining payment security is provided in PCI security standards.
https://www.pcisecuritystandards.org/pci_security/

• FedRamp

FedRAMP simplifies security for the digital age by providing a standardized approach to security for the cloud.
The FedRAMP Program Management Office (PMO) mission is to promote the adoption of secure cloud services across the Federal Government by providing a standardized approach to security and risk assessment.
https://www.fedramp.gov/

• About the BSIMM

Bringing science to software security
The Building Security In Maturity Model (BSIMM, pronounced “bee simm”) is a study of existing software security initiatives. By quantifying the practices of many different organizations, we can describe the common ground shared by many as well as the variations that make each unique.
BSIMM is not a how-to guide, nor is it a one-size-fits-all prescription. Instead, it is a reflection of software security.
https://www.bsimm.com/about.html

•  BSIMM is made up of a software security framework used to organize the 116 activities used to assess initiatives. The framework consists of 12 practices organized into four domains.

 https://www.bsimm.com/framework.html

Beyond ISO Intel's Product Security Maturity Model (PSMM)

Varonis and the Building Security in Maturity Model (BSIMM)

• What Is SSAE 16?    

SSAE 16 stands for Statements on Standards for Attestation Engagements No. 16.  Effective in mid-2011, this new auditing standard superseded the SAS 70 standard. According to AICPA, the SSAE 16 requires companies, like data centers, to provide a written report that describes any and all controls at organizations that provide services to customers when those controls are likely to be relevant to user entities internal control over financial reporting.  In May of 2017, SSAE 16 was super-ceded by SSAE 18.

What Is SSAE 18?

the AICPA’s Auditing Standards Board (ASB) completed the clarity project, the result of which was the issuance of SSAE 18, “Concepts common to all Attestation Engagements”.  As the SOC 1 is an attestation engagement, the SSAE 18 standard will apply to SOC 1’s and supersedes the SSAE 16 standard.

What Is SOC 1?

The SSAE 18 SOC 1, sometimes just stated as SOC 1, is the report you get when you are audited for SSAE 18.  The SOC 1 Type 1 report focuses on a service provider’s processes and controls that could impact their client’s internal control over their financial reporting (ICFR). The examination helps ensure that both the system and personnel responsible for these controls at the third-party provider are doing their job in a manner that will not adversely affect their client’s ICFR. This report is key with respect to services such as payroll and taxation since when performed by a third-party provider, such services will have a direct impact on a client’s ICFR. For example, if you outsource payroll management to a provider that doesn’t have the proper controls in place, you risk payroll errors in your internal data. This will come with problematic consequences since, in the end, you will be held accountable for those errors.

What Is SOC 2?

The SOC 2 is a separate report that focuses on controls at a service provider relevant to security, availability, processing integrity, confidentiality, and privacy of a system. It ensures that your data is kept private and secure while in storage and in transit and that it is available for you to access at any time.

This is a crucial report for any type of data that you entrust with a third-party provider, whether it includes large video files or confidential medical records. 

If you use a third-party CRM provider, for instance, the SOC 2 report will verify the provider’s ability to keep the records online and the identity of your customers secure and in line with your own Privacy Policy.

The SOC 1 and SOC 2 reports come in two forms: Type I and Type II. Type I reports evaluating whether proper controls are in place at a specific point in time. Type II reports are done over a period of time to verify operational efficiency and effectiveness of the controls.

https://www.atlantic.net/hipaa-compliant-hosting/ssae-16-soc-1-soc2-care/

• CISA

Certified Information Systems Auditor (CISA) is a professional certification for Information Technology Audit professionals sponsored by ISACA, formerly the Information Systems Audit and Control Association. Candidates for the certification must meet requirements set by ISACA on educational qualification and professional experience.

• CISSP® - Certified Information Systems Security Professional

The vendor-neutral CISSP certification is the ideal credential for those with proven deep technical and managerial competence, skills, experience, and credibility to design, engineer, implement, and manage their overall information security program to protect organizations from growing sophisticated attacks.

https://www.isc2.org/cissp/default.aspx

• CISM

Certified Information Security Manager (CISM) is a certification for information security managers awarded by ISACA (formerly the Information Systems Audit and Control Association)

Why Employers Hire CISMs?

Enterprises and government agencies increasingly recognize, require and expect their IS and IT professionals to hold CISM certification.

CISM employees:

    Identify critical issues and customize company-specific practices to support the governance of information and related technologies

    Bring credibility to the enterprise for which they are employed

    Take a comprehensive view of information systems security management and their relationship to organizational success

    Demonstrate to enterprise customers their commitment to compliance, security and integrity; ultimately contributing to the attraction and retention of customers

    Ensure that there is improved alignment between the organization's information security program and its broader goals and objectives

    Provide the enterprise with a certification for Information security management that is recognized by multinational clients and enterprises, lending credibility to the enterprise

http://www.isaca.org/Certification/CISM-Certified-Information-Security-Manager/What-is-CISM/Pages/default.aspx

• Certified in Risk and Information Systems Control (CRISC)

Why Employers Hire CRISCs 

CRISCs bring additional professionalism to any organization by demonstrating a quantifiable standard of knowledge, pursuing continuing education, and adhering to a standard of ethical conduct established by ISACA.

CRISC employees:

    Build greater understanding about the impact of IT risk and how it relates to the overall organization

    Assure development of more effective plans to mitigate risk

    Establish a common perspective and language about IT risk that can set the standard for the enterprise

ISACA draws on a global network of leading professionals to develop its certification programs. With access to experts around the world, ISACA is defining how IT risk is managed in current and future business environments.

http://www.isaca.org/Certification/CRISC-Certified-in-Risk-and-Information-Systems-Control/What-is-CRISC/Pages/The-Benefits-of-CRISC.aspx

• CISSP 

Certified Information Systems Security Professional (CISSP) is an independent information security certification governed by International Information Systems Security Certification Consortium

• Global Information Assurance Certification (GIAC) is the leading provider and developer of Cyber Security Certifications.

Global Information Assurance Certification (GIAC) is the leading provider and developer of Cyber Security Certifications. GIAC tests and validates the ability of practitioners in information security, forensics, and software security 
https://www.giac.org

• ISO/IEC 27001

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology – Security techniques – Information security management systems – Requirements.
http://en.wikipedia.org/wiki/ISO/IEC_27001

• FIPS 140-2

The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government computer security standard used to accredit cryptographic modules
The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components
Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module.
http://en.wikipedia.org/wiki/FIPS_140-2

• what is PCI-DSS certification?

The Payment Card Industry (PCI) Data Security Standard (DSS) is an information security standard defined by the Payment Card Industry Security Standards Council.
PCI certification is required for organizations (merchants) that process credit card payments.
The certification is designed to prevent credit card fraud through increased controls around data and its exposure to compromise

• The PCI Data Security Standard specifies twelve requirements for compliance, organized into six logically related groups called "control objectives".

Each version of PCI DSS has divided these twelve requirements into a number of sub-requirements differently, but the twelve high-level requirements have not changed since the inception of the standard.
https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

• What is a PCI Validated Service Provider?

Service providers are organizations that process, store, or transmit cardholder data on behalf of clients, merchants, or other service providers.
http://www.commercev3.com/3232/pci-dss-level-1-certification-faq#1

• The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step.

www.pcisecuritystandards.org

• The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. The PCI DSS was created jointly in 2004 by four major credit-card companies: Visa, MasterCard, Discover and American Express.

• the Critical Infrastructure Protection in the Information Age, re-designating the National Security Telecommunications and Information Systems Security Committee (NSTISSC) as the Committee on National Security Systems

The CNSS defines several standards, which include standards on training in IT security. Current certifications include:

    NSTISSI-4011 National Training Standard for Information Systems Security (INFOSEC) Professionals

    CNSSI-4012 National Information Assurance Training Standard for Senior Systems Managers

    CNSSI-4013 National Information Assurance Training Standard For System Administrators

    CNSSI-4014 Information Assurance Training Standard for Information Systems Security Officers

    NSTISSI-4015 National Training Standard for Systems Certifiers

    CNSSI-4016 National Information Assurance Training Standard For Risk Analysts

https://en.wikipedia.org/wiki/Committee_on_National_Security_Systems

• The Gramm-Leach-Bliley Act (GLB Act or GLBA) is also known as the Financial Modernization Act of 1999. It is a United States federal law that requires financial institutions to explain how they share and protect their customers’ private information. To be GLBA compliant, financial institutions must communicate to their customers how they share the customers’ sensitive data, inform customers of their right to opt-out if they prefer that their personal data not be shared with third parties, and apply specific protections to customers’ private data in accordance with a written information security plan created by the institution

BENEFITS OF GLBA COMPLIANCE

    Private information must be secured against unauthorized access.

    Customers must be notified of private information sharing between financial institutions and third parties and have the ability to opt out of private information sharing.

    User activity must be tracked, including any attempts to access protected records.

https://digitalguardian.com/blog/what-glba-compliance-understanding-data-protection-requirements-gramm-leach-bliley-act

• Recapping the End of Safe Harbor

Safe Harbor refers to the set of principles developed between 1998 and 2000, which were designed to ensure the EU sufficient data security while maintaining open transport for data and commerce for the U.S. There were 7 principles outlined in this agreement that U.S. companies were required to comply with, and they included:

    Notice: The purpose behind data collection and usage must be fully disclosed.

    Choice: Opt-out opportunities must be provided to all individuals, and sensitive information must require an opt-in.

    Onward Transfer: All future data transfers must follow Safe Harbor Privacy Principles or another comparable directive.

    Security: Information must be adequately protected.

    Data Integrity: All personal data gathered must be relevant, and the data’s reliability should be verified.

    Access: If an individual’s personal information has been gathered, they must have the right to access and modify or remove inaccurate information.

    Enforcement: The compliance of these rules by each organization must be feasible – with sanctions readily available to be handed out to those who do not follow through on their data privacy commitments.

Moving on to GDPR

After the grace period for Safe Harbor was up, the act that was put into place was the General Data Protection Regulation, or GDPR. The main aim of this was to give control back to European citizens over their personal data, while also simplifying the regulatory environment for international businesses.

https://www.nefiber.com/blog/gdpr-changes-safe-harbor-mean-businesses/

• NIST SP800-171 or just 800-171 is a codification of the requirements that any non-Federal computer system must follow in order to store, process, or transmit Controlled Unclassified Information (CUI) or provide security protection for such systems.  This document is based on the Federal Information Security Management Act of 2002 (FISMA) Moderate level requirements. 

    https://www.cmu.edu/iso/compliance/800-171/index.html

• What is DFARS and NIST SP 800-171?

It was published as a Defense Federal Acquisition Regulation Supplement, or the cyber DFARS clause 252.204-7012

The NIST Special Publication 800-171 requirement was developed to ensure that those working in conjunction with Department of Defense would have methods in place to protect sensitive information. 

https://www.cybersaint.io/the-definitive-guide-to-dfars-compliance-and-nist-sp-800-171

• All DoD contractors that process, store or transmit Controlled Unclassified Information (CUI) must meet DFARS minimum security standards or risk losing their DoD contracts.

DFARS provides a set of adequate security controls to safeguard information systems where contractor data resides. Based on NIST Special Publication 800-171 “Protecting Controlled Unclassified Information in Non-Federal Information Systems and Organizations”, manufacturers must implement these security controls through all levels of their supply chain. 

https://www.nist.gov/mep/cybersecurity-resources-manufacturers/dfars-compliance

• CMMC stands for “Cybersecurity Maturity Model Certification”. The CMMC will encompass multiple maturity levels that ranges from “Basic Cybersecurity Hygiene” to “Advanced/Progressive”. The intent is to incorporate CMMC into Defense Federal Acquisition Regulation Supplement (DFARS) and use it as a requirement for contract award.

https://www.acq.osd.mil/cmmc/faq.html

• The CMMC Framework

The CMMC model framework organizes processes and cybersecurity best practices into a set of domains. For each of the 17 domains, there are processes that span five levels of cybersecurity maturity. Additionally, each of the domains contain one or more capabilities spanning the five levels. And, for a given capability, there are one or more practices that must be demonstrated. 

The 17 Domains

Each domain is comprised of processes and capabilities across the five levels.  The domains include:

Access Control (AC)

Asset Management (AM)

Awareness and Training (AT)

Audit and Accountability (AU)

Configuration Management (CM)

Identification and Authentication (IA)

Incident Response (IR)

Maintenance (MA)

Media Protection (MP)

Personnel Security (PA)

Physical Protection (PE)

Recovery (RE)

Risk Management (RM)

Security Assessment (CA)

Situational Awareness (SA)

System and Communication Protection (SC)

https://www.mstech.com/cmmc-version-one/

• ISO/IEC 15288

The ISO/IEC 15288 is a systems engineering standard covering processes and lifecycle stages.

https://en.wikipedia.org/wiki/ISO/IEC_15288

• A software development process, also known as a software development life cycle (SDLC), is a structure imposed on the development of a software product.

Similar terms include software life cycle and software process

It is often considered a subset of systems development life cycle.

ISO/IEC 12207 is an international standard for software life-cycle processes

Software life cycle processes is an international standard for software lifecycle processes.

https://en.wikipedia.org/wiki/ISO/IEC_12207

Data leak/loss prevention

Data loss/leak prevention solution is a system that is designed to detect potential data breach / data ex-filtration transmissions and prevent them by monitoring, detecting & blocking sensitive data while in-use (endpoint actions), in-motion (network traffic), and at-rest (data storage)

Some other terms associated with Data Leakage Prevention are
Information Leak Detection and Prevention (IDLP),
Information Leak Prevention (ILP),
Content Monitoring and Filtering (CMF),
Information Protection and Control (IPC),
and Extrusion Prevention System (EPS)

http://en.wikipedia.org/wiki/Data_loss_prevention_software

• With Symantec Data Loss Prevention, you can discover where data is stored across your cloud, mobile, and on-premises environments; monitor how it’s being used on and off your corporate network; and protect it from being leaked or stolen

http://www.symantec.com/data-loss-prevention/

• McAfee Total Protection for Data Loss Prevention (DLP) safeguards intellectual property and ensures compliance by protecting sensitive data wherever it lives—on premises, in the cloud, or at the endpoints. McAfee Total Protection for DLP is delivered through physical or virtual low-maintenance appliances and the McAfee ePolicy Orchestrator platform for streamlined deployment, management, updates, and reports.

http://www.mcafee.com/us/products/total-protection-for-data-loss-prevention.aspx

• Data Loss Prevention Software Blade

Check Point Data Loss Prevention (DLP) Software Blade combines technology and processes to revolutionize DLP, helping businesses to pre-emptively protect sensitive information from unintentional loss, educating users on proper data handling policies and empowering them to remediate incidents in real-time
http://www.checkpoint.com/products/dlp-software-blade/

layout engines

• Trident 

Trident (layout engine)
Trident (also known as MSHTML) is the name of the layout engine for the Microsoft Windows version of Internet Explorer.
http://en.wikipedia.org/wiki/Trident_%28layout_engine%29

• WebKit

WebKit is layout engine software designed to allow web browsers to render web pages.
It powers the Apple Safari and Google Chrome browsers
Opera have announced that their browser will also move to use it
It is also used as the basis for the experimental browser included with the Amazon Kindle e-book reader, as well as the default browser in the Apple iOS, Android, BlackBerry 10, and Tizen mobile operating systems
http://en.wikipedia.org/wiki/WebKit

• Gecko 

Gecko (layout engine)
Gecko is a free and open source layout engine used in many applications developed by Mozilla Foundation and the Mozilla Corporation (notably the Firefox web browser), as well as in many other open source software projects
It is designed to support open Internet standards
http://en.wikipedia.org/wiki/Gecko_%28layout_engine%29

Cascading Style Sheets (CSS)

• Cascading Style Sheets (CSS)

Cascading Style Sheets (CSS) is a style sheet language used for describing the presentation semantics (the look and formatting) of a document written in a markup language.
Its most common application is to style web pages written in HTML and XHTML, but the language can also be applied to any kind of XML document, including plain XML, SVG and XUL.
http://en.wikipedia.org/wiki/Cascading_Style_Sheets

• HTML is meant for Content (Model), CSS is meant for Style (View), JavaScript is meant for Interaction (Controller)

stackoverflow.com/questions/4937371/html-tab-interface-using-only-css

java script beautifiers

• beautify javascript or html

Beautify, unpack or deobfuscate JavaScript and HTML, make JSON/JSONP readable, etc.
http://jsbeautifier.org/

• Notepad++ JS Beautifier

http://erickrdch.com/2011/09/notepad-js-beautifier.html

• YAML  is a human-readable data serialization format that takes concepts from programming languages

such as C, Perl, and Python, and ideas from XML and the data format of electronic mail
Yet Another Markup Language
http://en.wikipedia.org/wiki/YAML
YAML is a data serialisation language designed to be directly writable and readable by humans.
It’s a strict superset of JSON, with the addition of syntactically significant newlines and indentation, like Python. Unlike Python, however, YAML doesn’t allow literal tab characters for indentation.
https://learnxinyminutes.com/docs/yaml/

• YAML is the abbreviated form of “YAML Ain’t markup language” is a data serialization language which is designed to be human -friendly and works well with other programming languages for everyday tasks.

Prerequisites
The pre-requisites of this tutorial include basic knowledge of HTML, XML and JSON. YAML was specifically created to work well for common use cases such as configuration files, log files and cross language sharing files and data sharing.
https://www.tutorialspoint.com/yaml/index.htm

• Features

YAML includes a markup language with important construct, to distinguish data-oriented language with the document markup. The design goals and features of YAML are given below −
    Matches native data structures of agile methodology and its languages such as Perl, Python, PHP, Ruby and JavaScript
    YAML data is portable between programming languages
    Includes data consistent data model
    Easily readable by humans
    Supports one-direction processing
    Ease of implementation and usage

https://www.tutorialspoint.com/yaml/yaml_introduction.htm

• Rules for Creating YAML file

When you are creating a file in YAML, you should remember the following basic rules −
    YAML is case sensitive
    The files should have .yaml as the extension
    YAML does not allow the use of tabs while creating YAML files; spaces are allowed instead
https://www.tutorialspoint.com/yaml/yaml_basics.htm

• Rules for Creating YAML file

When you are creating a file in YAML, you should remember the following basic rules −
    YAML is case sensitive
    The files should have .yaml as the extension
    YAML does not allow the use of tabs while creating YAML files; spaces are allowed instead

Synopsis of YAML Basic Elements
    The synopsis of YAML basic elements is given here: Comments in YAML begins with the (#) character.
    Comments must be separated from other tokens by whitespaces.
    Indentation of whitespace is used to denote structure.
    Tabs are not included as indentation for YAML files.
    List members are denoted by a leading hyphen (-).
    List members are enclosed in square brackets and separated by commas.
    Associative arrays are represented using colon ( : ) in the format of key value pair. They are enclosed in curly braces {}.
    Multiple documents with single streams are separated with 3 hyphens (---).
    Repeated nodes in each file are initially denoted by an ampersand (&) and by an asterisk (*) mark later.
    YAML always requires colons and commas used as list separators followed by space with scalar values.
    Nodes should be labelled with an exclamation mark (!) or double exclamation mark (!!), followed by string which can be expanded into an URI or URL.
https://www.tutorialspoint.com/yaml/yaml_basics.htm

• Indentation of YAML

YAML does not include any mandatory spaces. Further, there is no need to be consistent.
https://www.tutorialspoint.com/yaml/yaml_indentation_and_separation.htm

• Configuration

yamllint uses a set of rules to check source files for problems. Each rule is independent from the others, and can be enabled, disabled or tweaked. All these settings can be gathered in a configuration file.
https://yamllint.readthedocs.io/en/latest/configuration.html

Dynamic JavaBeans

• Dynamic JavaBeans

By creating a DynamicBean, you can reduce the effort to the definition of an interface and create instances using a bean factory like
http://lib.ribomation.com/riboutils/dynamicbean/

High Order Language

• High Order Language (HOL)

Higher-order programming
Higher-order programming is a style of computer programming that uses functions as values.
It is usually instantiated with, or borrowed from, models of computation such as lambda calculus which make heavy use of higher-order functions.
http://en.wikipedia.org/wiki/Higher-order_programming

• Higher Order Programming Is Easy!

If you have ever passed a function or method as a parameter to another function or method, then you have done higher order programming.
If you have ever used a function pointer in C or a delegate in C# or some kind of callback mechanism, then you have done higher order programming.
http://www.programmersheaven.com/user/pheaven/blog/133-Higher-Order-Programming-Is-Easy/

MapBasic

• MapBasic

MapBasic is a programming language for creation of additional tools and functionality for the MapInfo Professional geographical information system.
MapBasic also allows programmers to develop software in popular programming languages such as C, C++ and Visual Basic and use these with the MapInfo Professional GIS to create geographically based software, such as electronic mapping.
http://en.wikipedia.org/wiki/MapBasic

Difference between ArrayList vs LinkedList

• Difference between ArrayList vs LinkedList 

1) Data Structure
ArrayList Array
LinkedList LinkedList

2) LinkedList implements Deque
LinkedLis implements deque and list interfaces

7) Memory
LinkedList uses a wrapper object, Entry,  which is a static nested class for storing data and two nodes next and previous while ArrayList just store data in Array. So memory requirement seems less in case of ArrayList than LinkedList except the case where Array performs re-size operation, when it copies content from one Array to another.
If Array is large enough it may take lot of memory at that point and trigger Garbage collection, which can slow response time.

http://java67.blogspot.com/2012/12/difference-between-arraylist-vs-LinkedList-java.html

social network security

• www.ghostery.com

Ghostery looks for third party page elements (which we call "3pes") on the web pages you visit.
These can be things like social network plugins, advertisements, invisible pixels used for tracking and analytics, etc.
Ghostery notifies you that these things are present, and which companies operate them.
You can learn more about these companies, and if you wish, choose to block the 3pes they operate.

• disconnect.me

nce installed on your Web browser, these extensions will tell you how many trackers they have blocked

• www.secure.me

24/7 check of all posts
Protection from dangerous links and viruses
Monitoring of all photos, friends and activities

• privacyfix.com

check your privacy settings across Facebook, Google and the other websites and companies collecting your data. Get to the fix with one click. Know when policies change.

• simplewa.sh

It is called Simplewash, formerly Facewash, and it looks for profanity, references to drugs and other faux pas that you do not necessarily want, say, a law school admissions officer to se

• socioclean.com

Socioclean is another application that scours your Facebook posts.

• Social Network Analysis

Social network analysis [SNA] is the mapping and measuring of relationships and flows between people, groups, organizations, computers, URLs, and other connected information/knowledge entities. The nodes in the network are the people and groups while the links show relationships or flows between the nodes. SNA provides both a visual and a mathematical analysis of human relationships. Management consultants use this methodology with their business clients and call it Organizational Network Analysis [ONA].

http://www.orgnet.com/sna.html

• Sentiment analysis uses

Sentiment analysis is extremely useful in social media monitoring as it allows us to gain an overview of the wider public opinion behind certain topics. Social media monitoring tools like Brandwatch Analytics make that process quicker and easier than ever before, thanks to real-time monitoring capabilities.
https://www.brandwatch.com/blog/understanding-sentiment-analysis/

• Powerful social listening

Add context to the billions of conversations happening online every day. Brandwatch Analytics tells you more about the opinions, trends and people impacting your business.
https://www.brandwatch.com/brandwatch-analytics/?utm_expid=69193390-33.eKwp4nn8QDGu7MAr35s0Sg.0&utm_referrer=https%3A%2F%2Fwww.brandwatch.com%2Fblog%2Funderstanding-sentiment-analysis%2F

• Sentiment analysis (sometimes known as opinion mining or emotion AI) refers to the use of natural language processing, text analysis, computational linguistics, and biometrics to systematically identify, extract, quantify, and study affective states and subjective information. Sentiment analysis is widely applied to voice of the customer materials such as reviews and survey responses, online and social media

https://en.wikipedia.org/wiki/Sentiment_analysis

• Basic Sentiment Analysis with Python

you can check out the code on Github
http://fjavieralba.com/basic-sentiment-analysis-with-python.html

• This tutorial steps through a Natural Language API application using Python code. The purpose here is not to explain the Python client libraries, but to explain how to make calls to the Natural Language API. Applications in Java and Node.js are essentially similar. Consult the Natural Language API Samples for samples in other languages (including this sample within the tutorial).

https://cloud.google.com/natural-language/docs/sentiment-tutorial

• Introduction to Sentiment Analysis Algorithms

Sentiment Analysis is the use of natural language processing, statistics, and text analysis to extract, and identify the sentiment of text into positive, negative, or neutral categories.
http://blog.algorithmia.com/introduction-sentiment-analysis-algorithms/

• Sentiment analysis is also called opinion mining since it includes identifying consumer attitudes, emotions, and opinions of a company’s product, brand, or service.Sentiment Analysis is the use of natural language processing, statistics, and text analysis to extract, and identify the sentiment of text into positive, negative, or neutral categories.

http://blog.algorithmia.com/introduction-sentiment-analysis-algorithms/

• Sentiment analytics involves the analysis of comments or words made by individuals to quantify the thoughts or feelings intended to be conveyed by words. Basically, it’s an attempt to understand the positive or negative feelings individuals have toward a brand, company, individual, or any other entity. In our experience, most of the sentiment collected around topics tends to be “neutral” (or convey no positive or negative feelings or meanings). It’s easiest to think about sentiment analytics when we look at Twitter data (or any other social site where people express a single thought or make a single statement). We can compute the sentiment of a document (such as a wiki post or blog entry) by looking at the overall scoring of sentiment words that it contains. For example, if a document contains 2,000 words that are considered negative versus 300 words that are considered positive in meaning, we may choose to classify that document as overall negative in sentiment. If the numbers are closer together (say 3,000 negative words versus 2,700 positive words or an almost equal distribution), we may choose to say that document is neutral in sentiment .The sentiment analysis being done by software is usually based on a sentiment dictionary for that language. The basic package comes with a predefined list of words that are considered as positive. Similarly, there is also a long list of words that can be considered negative. For many projects, the standard dictionary can be utilized for determining sentiment. In some special cases, you may have to modify the dictionary to include domain-specific positive and negative words. For example, the word Disaster can be a negative sentiment word in a majority of contexts, except when it is used to refer to a category of system such as “Disaster Recovery Systems.”

http://social-media-strategy-template.blogspot.com.tr/2016/04/sentiment-analysis-basics.html

• sentiment analysis is the attempt to derive the emotion or 'feeling' of a body of text. The field of sentiment analysis and opinion mining usually also involves some form of data mining to get the text.

http://sentdex.com/sentiment-analysis/

• Mining Twitter Data with Python (and JS) – Part 7: Geolocation and Interactive Maps

https://marcobonzanini.com/2015/06/16/mining-twitter-data-with-python-and-js-part-7-geolocation-and-interactive-maps/

• The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering

https://www.trustedsec.com/social-engineer-toolkit/ 

• What Is Website Cloaking?

A simple definition of the word cloaking is to conceal, hide or cause to be invisible. In the world of web design cloaking refers to showing different page content to regular users than what is shown to Google bot or other search engine crawlers.
Why is cloaking bad? Cloaking is frowned upon because it is a high risk violation of quality guidelines and accepted best practices for web page design. It also provides a level of deception as well as a bad user experience. The bad user experience is due to the search engine results not matching the actual page content. Also, in some cases cloaking is a method for transmitting malicious code to unsuspecting users.

https://impactsocialmedia.net/what-is-website-cloaking/

code sample question 1

int x = 10;  x += x--;  value of x?



x += x--;

This is equivalent to:
x = x + x--;

Which is equivalent to:

int a1 = x; // a1 = 10, x = 10
int a2 = x--; // a2 = 10, x = 9
x = a1 + a2; // x = 20

So x is 20 afterwards - and that's guaranteed by the spec.

• 1) subexpressions are always evaluated left to right. Period. Evaluation of a subexpression may induce a side effect.

2) execution of operators is always done in the order indicated by parentheses, precedence and associativity. Execution of operators may induce a side effect.

The "x" to the left of the += is the leftmost subexpression, and therefore rule (1) applies. Its value is computed first -- 10.

The x-- to the right of the += is the next one in left-to-right order, so it is evaluated next. The value of x-- is 10, and the side effect is that x becomes 9. This is as it should be, because -- is of higher precedence than +=, so its side effect runs first.

Finally, the side effect of += runs last. The two operands were 10 and 10, so the result is to assign 20 to x.

I get questions about this all the time. Remember, the rules are very straightforward: subexpressions left-to-right, operators in precedence order, period.

• a difference between --x and x-- here. 

If you had written x += --x;
this would be equivalent to x = x + --x;
then you would get 19.
This is because the value of x is decremented and the resulting value is used in the expression
(unlike x-- where the original value of x is used in the expression).

This expression x = x + --x + x will give 28 because the third timefourth time (see comments) x is evaluated it is 9.



http://stackoverflow.com/questions/2299437/int-x-10-x-x-in-net-why

Two-dimensional array

int[,] array2D = new int[,] { { 1, 2 }, { 3, 4 }, { 5, 6 }, { 7, 8 } };

// Accessing array elements.
System.Console.WriteLine(array2D[0, 0]);
System.Console.WriteLine(array2D[0, 1]);
System.Console.WriteLine(array2D[1, 0]);
System.Console.WriteLine(array2D[1, 1]);
System.Console.WriteLine(array2D[3, 0]);
System.Console.WriteLine(array2Db[1, 0]);
System.Console.WriteLine(array3Da[1, 0, 1]);

http://msdn.microsoft.com/en-us/library/2yd9wwz4.aspx

Static Classes

A class can be declared static, indicating that it contains only static members. It is not possible to create instances of a static class using the new keyword. Static classes are loaded automatically by the .NET Framework common language runtime (CLR) when the program or namespace containing the class is loaded.
http://msdn.microsoft.com/en-us/library/79b3xss3%28v=vs.80%29.aspx

sealed class

A sealed class cannot be inherited. It is an error to use a sealed class as a base class. Use the sealed modifier in a class declaration to prevent inheritance of the class.

Abstract Class in C#

An abstract class cannot be instantiated. The purpose of an abstract class is to provide a common definition of a base class that multiple derived classes can share. For example, a class library may define an abstract class that is used as a parameter to many of its functions, and require programmers using that library to provide their own implementation of the class by creating a derived class.
http://msdn.microsoft.com/en-us/library/ms173150%28v=vs.80%29.aspx

Harvard architecture

Harvard architecture
The Harvard architecture is a computer architecture with physically separate storage and signal pathways for instructions and data.
The term originated from the Harvard Mark I relay-based computer, which stored instructions on punched tape (24 bits wide) and data in electro-mechanical counters. These early machines had data storage entirely contained within the central processing unit, and provided no access to the instruction storage as data.
Programs needed to be loaded by an operator; the processor could not boot itself.
Today, most processors implement such separate signal pathways for performance reasons but actually implement a modified Harvard architecture, so they can support tasks such as loading a program from disk storage as data and then executing it.
http://en.wikipedia.org/wiki/Harvard_architecture

CISC

CISC
A complex instruction set computer CISC
A complex instruction set computer (CISC) is a computer where single instructions can execute several low-level operations (such as a load from memory, an arithmetic operation, and a memory store) and/or are capable of multi-step operations or addressing modes within single instructions.
The term was retroactively coined in contrast to reduced instruction set computer (RISC)

Examples of CISC instruction set architectures are System/360 through z/Architecture, PDP-11, VAX, Motorola 68k, and x86.
http://en.wikipedia.org/wiki/Complex_instruction_set_computing

RISC

RISC
Reduced instruction set computing, or RISC  is a CPU design strategy based on the insight that simplified (as opposed to complex) instructions can provide higher performance if this simplicity enables much faster execution of each instruction.
A computer based on this strategy is a reduced instruction set computer, also called RISC.
The opposing architecture is known as complex instruction set computing, i.e. CISC.

Well known RISC families include DEC Alpha, AMD 29k, ARC, ARM, Atmel AVR, Blackfin, Intel i860 and i960, MIPS, Motorola 88000, PA-RISC, Power (including PowerPC), SuperH, and SPARC
http://en.wikipedia.org/wiki/Reduced_instruction_set_computing

Fuzzy logic

Fuzzy logic
Fuzzy logic iss a form of many-valued logic or probabilistic logic; it deals with reasoning that is approximate rather than fixed and exact.
Compared to traditional binary sets (where variables may take on true or false values) fuzzy logic variables may have a truth value that ranges in degree between 0 and 1.
Fuzzy logic has been extended to handle the concept of partial truth, where the truth value may range between completely true and completely false
http://en.wikipedia.org/wiki/Fuzzy_logic

• Fuzzy Logic (FL) is a method of reasoning that resembles human reasoning. The approach of FL imitates the way of decision making in humans that involves all intermediate possibilities between digital values YES and NO.

The conventional logic block that a computer can understand takes precise input and produces a definite output as TRUE or FALSE, which is equivalent to human’s YES or NO.
http://www.tutorialspoint.com/artificial_intelligence/artificial_intelligence_fuzzy_logic_systems.htm

• In this work, we focus   the   detection   and   prediction   mechanism   against DDoS  attacks  in  IEEE  802.15.4  using  Fuzzy  logic  system. The   main   contribution   of   Fuzzy   based   detection   and prediction system (FBDPS) is to detect the DDoS attackers

by comparing the energy consumption of sensor nodes.
http://ijcsi.org/papers/IJCSI-10-6-1-293-301.pdf