Share what you know with millions of people

Focus is the best place to turn what you know into remarkable content

×

Barry Schrager

Follow Following Unfollow

z/OS Information Security Leader & Architect, Barry Schrager, Inc.

85 points

Information Security Thought Leader, Business Executive, Member of Mainframe Hall of Fame with Thomas J. Watson, Gene Amdahl and Admiral Grace Hopper.

Designed and Developed the first commercially successful mainframe security product, ACF2, with sales of $1B+, which is still ...

Information Security Thought Leader, Business Executive, Member of Mainframe Hall of Fame with Thomas J. Watson, Gene Amdahl and Admiral Grace Hopper.

Designed and Developed the first commercially successful mainframe security product, ACF2, with sales of $1B+, which is still being used by the Executive Office of the President, the CIA, NSA, the Federal Reserve System and many other government and private installations

» read more » read less

Dec. 16, 2011

Andrew Baker selected a best answer for

Is Apple best served by punishing those who expose its security vulnerabilities?

http://www.forbes.com/sites/andygreenberg/2011/11/07/apple-exiles-a-security-researcher-from-its-developer-program-for-proof-of-concept-exploit-app/
Apple appears to have punished a security researcher for creating a proof of concept malware that exposes the vulnerability of their operating system (and, to some degree, their app store process).
Given that he appears to have reported the issue through proper channels, and is a ... more

Information Technology

Oct. 7, 2011

Barry Schrager is now following Dr Natalie Petouhoff and 1 other person

Aug. 2, 2011

Barry Schrager and 4 other people answered this question

What would be the benefit of cloud applications that accept a token instead of a password?

The problem you have with that approach is that a lost token (or a temporarily stolen one) opens up the doors to the kingdom. Forcing both a password and a token is a better solution because someone listening on the network will only get the ... more

Information Technology

Cloud Computing

Aug. 1, 2011

Barry Schrager and 7 other people answered this question

Is it possible to overdo security? How can you know?

When we started discussing data security in the early 1970's it became clear you had to start with the "closed" concept. I liked to use the phrase "error of omission" to discribe this. If you started with an "open" system and forgot to protect something, ... more

Information Technology

July 6, 2011

Barry Schrager and 4 other people answered this question

What is preventing organizations from taking security seriously?

Glen,
How do we convince the highest level of management (or actually the next levels of management) that this is an issue, esoteric as it may be, that they must address and invest in?
I have seen the technical level buy into this, but I have also ... more

General Management

Information Technology

Risk Management

July 4, 2011

Barry Schrager and 9 other people answered this question

How should CEOs prepare for and respond to cyber attacks?

John,
Unfortunately, I have to agree with Kevin on this. Executive management still has not bought into these investments in information security and protecting against cyber attacks. I don't know whether it is that they are oblivious to this, or that upper IT management is oblivious ... more

General Management

Information Technology

June 17, 2011

Barry Schrager and 4 other people answered this question

Should we consider moving beyond passwords and look for new identification technologies?

Brielle,
This is nothing new. In 1974, I gave a SHARE presentation in which I described the user validation as including Password Only, Password and Badge Reader in additon to saying that more exotic validation techniques could use fingerprints, voice prints, lip prints, etc. I ... more

Information Technology

June 10, 2011

Barry Schrager and 3 other people answered this question

After all of these recent security breaches, will we see an increase in demand for white hat hackers

What we should see is an increase in demand for overall security assessments and, if necessary to prove vulnerabilities, white hat hackers. Too often companies are oblivious to the risks that poor configuration and controls expose them to. Maybe with the recent security breaches, more ... more

Information Technology

April 5, 2011

Barry Schrager and 20 other people answered this question

Why are there no secure computers?

Maurene is correct. The mainframe model is the most “securable” platform. How? Well, in 1973, IBM made the commitment to system integrity. System integrity, which is the inability of a “normal” user/program to bypass the standard interfaces of the operating system, is a pre-requisite to ... more

Information Technology

April 4, 2011

Barry Schrager recommends this answer by Michael Dortch

How do you market to 'Influencers'?

Why should one view customers and influencers any differently, especially with customers increasingly becoming more prominent influencers thanks to social media? The goals with both are to engage, inform, persuade and invite. To engage influencers, convince them that you understand their value and specific area ... more

Influencer Marketing

Jan. 5, 2011

Barry Schrager and 3 other people answered this question

What are the biggest IT security concerns we need to prepare for in 2011? Why?

Organizations also must start really being concerned about the Insider Threat. We have spent a lot of time on being worried and reacting to the outsider threat, but the insider threat is real and increasing.
For example, there was a 2008 Strategic Counsel Survey which ... more

Information Technology

Data Protection

Nov. 29, 2010

Barry Schrager and 30 other people answered this question

Best Practices in Reducing Employee Turnover: What are your 3 tips for reducing employee turnover?

Invest in your employees (seminars, training, association meetings, etc.), treat them right and give them proper rewards. I also had a psychologist on call (all employees went through a 3 day interactive skills training class) who would meet with employees having conflicts with other employees, ... more

General Management

Human Resources

Employee Turnover

Nov. 26, 2010

Barry Schrager and 2 other people answered this question

When developing database applications, is it safe to use third-party code?

Yes, but ...
You should have it reviewed by an expert (either internal or, if you don't have one, external) who can review it for proper function and the absence of any security or integrity exposures. When you license a vendor product, you are looking ... more

Information Technology

Code Development

Security Assessment

Sept. 13, 2010

Barry Schrager and 4 other people answered this question

What type of security testing do you have done?

Key Resources, Inc. is now delivering a mainframe z/OS product that does vulnerability scans. Up until now, it was the assumption that the mainframe z/OS Operating System was absolutely secure in this area because of the IBM Integrity Statement. Well, there are integrity issues with ... more

Information Technology

Security Testing

Following 3 Topics

Information Technology

Following 2 People

Followed by 7 People

Knowledgeable in 4 Topics

#18 of 300

Information Technology

#180 of 2263

#7 of 36

#20 of 168