Mine Your Scanning / Audit Data

Like the article below suggests, orgs need to analyze the data from past endeavors focused on scanning / auditing for next-gen protections.

http://www.darkreading.com/analytics/the-new-security-mindset-embrace-analytics-to-mitigate-risk/a/d-id/1326812?

Anti-malware, user-behavior (anomaly detection), and signatures are great, but take interest with what scans / audits of your past have shown with gaps / attack vectors.

SPF, DMARC, or both?

Most orgs have email filtering in the way of sender policy framework (SPF: http://www.openspf.org/), though some seem to omit the use of domain-based message authentication reporting and conformance (DMARC: https://dmarc.org/).

While a belt and suspenders approach may not fit all budgets, in the wake of email-based malware, it may behoove orgs to use both...