Moving from compliance-based security to a risk-based security model
Peta Bunbury · Computer Fraud & Security · 2009
Companies have spent the past few years ticking the boxes to ensure that the regulators don't fine them for lax security. But is that really enough to keep attackers out? There are important differences between a bare-bones, minimal-requirements approach to security, and one that will save your data in the event of a targeted attack. Thinking like a blackhat may be the best way to stop them from attacking your network. How can security staff take a blackhat-like view of their networks to seal off the holes before others exploit them?