Authority to Operate (ATO) is a process that certifies a system to operate for a certain period of time by evaluating the risk of the system's security controls. ATO is based on the National Institute of Standards and Technology’s Risk Management Framework (NIST 800-37). In this podcast, Shane Ficorilli and Hasan Yasar, both with the Carnegie Mellon University Software Engineering Institute, discuss continuous ATO, including challenges, the role of DevSecOps, and cultural issues that organizations must address.
Managing Security Vulnerabilities Based on What Matters Most
Identifying Software Security Requirements Early, Not After the Fact
Making Information Security Policy Happen
Becoming a Smart Buyer of Software
Building More Secure Software
Connecting the Dots Between IT Operations and Security
Getting in Front of Social Engineering
Using Benchmarks to Make Better Security Decisions
Protecting Information Privacy - How To and Lessons Learned
Initiating a Security Metrics Program: Key Points to Consider
Insider Threat and the Software Development Life Cycle
Tackling the Growing Botnet Threat
Building a Security Metrics Program
Inadvertent Data Disclosure on Peer-to-Peer Networks
Information Compliance: A Growing Challenge for Business Leaders
Internal Audit's Role in Information Security: An Introduction
What Business Leaders Can Expect from Security Degree Programs
The Path from Information Security Risk Assessment to Compliance
Computer Forensics for Business Leaders: Building Robust Policies and Processes
Business Resilience: A More Compelling Argument for Information Security
Create your
podcast in
minutes
It is Free