Information Security Today

6 Methods to Create a Secure Password (You'll Actually Remember)

2018-04-02T10:04:00.003-04:00

This infographic from Mike's Gear Reviews displays the anatomy of an unbreakable password and gives you six methods to create a secure password you'll actually remember.

802.1X Authentication Has Never Been So Easy

2018-02-15T11:21:00.000-05:00

Stronger authentication is possible with 802.1X although several challenges currently exist for IEEE 802.1X NAC and authentication. For the most part, the challenges relate to the need for costly hardware, the complexity of integration, and other issues such as authorization and device compliance. 802.1X confers multiple benefits, including enhancements in security that is not dependent on PSKs (pre-shared keys), easy installation and setup of access permissions, and fully integrated management functionality. Given these pros and cons, 802.1x Network access control is a must-have when formulating solutions based on this authentication system. But how can this be achieved easily while not compromising security? Read more here ....

From Science Fiction to Reality: U.S. Navy Technology and Innovation

2018-01-03T11:07:00.001-05:00

From Science Fiction to Reality: U.S. Navy Technology and Innovation

By David Smalley, Office of Naval Research

From the 1930s on, science fiction comics, books and movies had plenty of futuristic portrayals of “ray guns” shooting some kind of mysterious energy.

Decades later, Star Wars and Star Trek helped captivate millions more with the idea. But all along, the Office of Naval Research (ONR) has been steadfastly developing the real thing. Starting in the 1950s, ONR sponsored research that ultimately led to the first “lasers” (light amplification by stimulated emission of radiation). Today, ONR is working on high-energy, solid-state laser weapons. The Laser Weapons System (LaWS), a prototype, was fitted on a ship in the Arabian Gulf in 2014 and proved the ability of this test platform to shoot down UAVs in the air, and surface targets on the waves. Laser capabilities and power are growing every year. Coming soon to a theater (of operations) near you!

Like ray guns, robots have dominated popular imagination for decades.

And as with the development of lasers, yesterday’s science fiction has really become today’s science fact. Today robots perform complex duties on factory floors, clean floors in our houses and even deliver meals to your hotel room. But robots can also save lives. Think shipboard fires. Take lots of Sailors or Marines, add gunpowder and tight quarters where maneuverability is limited, and shipboard fires are a deadly threat – and extraordinarily dangerous to combat. As Sailors learn in firefighting training: In a fire at sea, there is no place to run. What if, ONR scientists thought, we could lessen the dangers of firefighting aboard ships? Using decades of investment into robotics (in 1963, ONR sponsored Shakey the robot, the first to reason through what actions it should take to fulfill a command), ONR researchers are developing SAFFiR – the Shipboard Autonomous Firefighting Robot. This human-sized robot can find and suppress even extreme shipboard fires, keeping Sailors out of harm’s way. Here’s hoping SAFFiR never has to do his (its?) job – but it’s nice to know it will be on watch.

Additional examples include augmented reality systems and advanced wireless networks that were among the technologies shown during the Ship-to-Shore Maneuver Exploration and Experimentation Advanced Naval Technology Exercise (S2ME2 ANTX) 2017, a set of amphibious exercises at Marine Corps Base Camp Pendleton in California last spring.

S2ME2 ANTX focused on five capability areas of amphibious operations: ship-to-shore maneuver; weapons fire support and effects; clearing assault lanes; command and control; and information warfare. Demonstrated technologies included unmanned and autonomous vehicles equipped with sensors to gather intelligence in the air, on land and underwater.

During each amphibious beach demonstration, unmanned surface and underwater vehicles approached the shore first, collecting intelligence about battlespace conditions-including threats and obstacles-providing an accurate picture of what warfighters would face when leaving their vessels and vehicles.

Hardly a day goes by without a news story that shows driverless cars, UAVs delivering holiday packages, or other uses of autonomy in modern life.

Many of these capabilities are possible because of ONR investments in autonomy. The ability for unmanned systems to take on dull, dirty or dangerous tasks has been a priority for ONR engineers. The Office of Naval Research recently developed a hardware and software suite and put it on swarms of unmanned small boats. Once equipped with the autonomy package – called the Control Architecture for Robotic Agent Command and Sensing, or CARACaS – the boats could collaboratively communicate; detect an intruding vessel in their area of responsibility; approach it; determine whether or not the intruder was a threat; and convey the information to the Sailors on a manned vessel outside the patrol zone. Think safer mine clearance, delivery of supplies in hot zones, ship escort and more.

When you think “virtual reality,” you may imagine Tony Stark from the “Iron Man” movies, hands raised and moving virtual displays in the air.

Well, Navy engineers are working hard to bring that to life. The Battlespace Exploitation of Mixed Reality (BEMR) Lab features a host of advanced virtual reality capabilities that will help warfighters train and operate in the future. ONR’s Jim Blesse recalls the moment of inspiration. “Someone came in and told us his two-year-old had a tantrum that morning because the television screen didn’t function the way his tablet did. A two-year-old! We looked at each other and said ‘Wow. What is that kid going to expect from technology when he’s 18? We need to envision that, now.'” ONR sponsored the BEMR Lab at SPAWAR Pacific to develop virtual reality technologies that are already impacting how the future force trains. (You can even get real-life dizzy looking down from the virtual crow’s nest.)

Introduction to Blockchain and Its Applications in FinTech

2017-12-20T11:43:00.000-05:00

This excerpt from FinTech: The Technology Driving Disruption in the Financial Services Industry by Parag Y. Arjunwadkar explains the basic of blockchain and then reviews how Fintechs are adopting blockchain for security and transparency.

2018 Industrial IoT Predictions

2017-12-12T09:44:00.000-05:00

Paul Myer, CEO, Veracity Industrial Networks makes these predictions about the industrial IoT for 2018:

There will be a nation-state cyber-attack on our critical infrastructure in 2018

There has been an increase in the number of attacks on our nation’s infrastructure, such as our power grid. Now, these systems are secure and we have not seen a widespread attack be successful, but as the old saying goes, the bad guys only have to be “right” once; those defending these institutions have to be “right” every time.

In October, the DHS and FBI warned that the nuclear, energy, aviation, water and critical manufacturing industries have been targeted along with government entities in attacks dating back to at least May. They also reported that some of those hackers were successful in compromising the networks. All this evidence points to an increasing risk that an attacker will be successful in the near future.

The “industrial cybersecurity” space will see record investment in 2018

Cybersecurity has been attracting significant investment for years now, however the bulk of that investment has been in the traditional “IT security” world where the most action is. During 2018, we expect to see a shift where more investment goes toward companies addressing the industrial cybersecurity needs that are becoming critical.

The industrial side of cybersecurity has lagged the “IT security” world in development of tools and procedures. Reliance on “air-gapping” as a security measure has run its course. This will bring a new group of industrial cybersecurity-based solutions looking for investment. We predict that investment will be large and immediate.

The lack of trained cybersecurity personnel will become acute in 2018

There has been considerable discussion about the lack of trained cybersecurity professionals and the issue this causes. The growth of our cybersecurity needs has far outpaced the development of training programs and the number of new experts we are creating. Things will be worse before they get better and 2018 will likely shine a light on this intellectual shortfall.

This “shortage” will be more acute in industrial networks as there are less training options for those professionals. Also, the lack of viable networks security tools on the industrial network side make the actions of trained network security professionals all the more important.

The “ransomware” business model will be applied to more hacks

The advent of “ransomware” attacks, where your data is held hostage by a hacker that has compromised your computer until you pay a ransom. This new revenue source for today’s cyber criminals has broadened the targets for hackers geometrically. Suddenly, companies and individuals that house no data suitable for sale on the dark web have become targets. Locking up a grandmother’s photos could produce revenue now.

Part of the ransom phenomena is made possible by the anonymous nature of bitcoin as a currency. We predict that hackers will spread the ransomware business model to the industrial space by holding parts of OT/ICS networks hostage, in 2018.

The Top Game Changing Data Trends for 2018

2017-12-11T15:54:00.001-05:00

The Convergence of Data Management Technologies, Growth of Metadata Management and the Increased Focus on AI Make Up the Most Impactful Trends for 2018

NAPERVILLE, Ill. (PRWEB) November 14, 2017 -- Infogix today identified pivotal data trends that will impact businesses in 2018 and beyond.

“Metadata management and ensuring data privacy for regulations such as GDPR joins earlier trends like AI and IoT, but the unexpected trend of 2018 will be the convergence of data management technologies,” said Emily Washington, senior vice president of product management at Infogix. “Big data has been the next big technology phenomenon for a long time, but businesses are increasingly evaluating ways to streamline their overall technology stack if they want to successfully leverage big data and analytics to create a better customer experience, achieve business objectives, gain a competitive advantage and ultimately, become market leaders.”

The top data trends for 2018 were assembled by business leaders at Infogix who have decades of experience in information technology. The major trends include:

2018: The Year of Converging Data Management Technologies

Use cases have proven that leveraging data requires a multitude of separate tools for tasks like data quality, analytics, governance, data integration, metadata management and more.
To extract meaningful insights and increase operational efficacy, businesses will increasingly demand flexible, integrated tools to enable users to quickly ingest, prepare, analyze, act on, and govern data—while easily communicating insights derived.

Increased Importance of Data Governance

The deluge of data is growing, government regulations are increasing and teams have much greater access to data within an organization. Add to this the increasing need to leverage advanced analytics, and data governance has become more critical than ever.
Data governance capabilities have evolved in a way that provides complete transparency into a business’s data landscape—allowing them to combat increasingly complex regulatory and compliance demands and the shifting tides of business policies and business alignment.

The Continued Rise of the Chief Data Officer (CDO)

In today’s data-intensive environment, a CDO is more important than ever to navigate regulatory demands, successfully leverage data and manage enterprise-wide governance.
A CDO helps businesses manage unstructured and unpredictable data, while successfully leveraging advanced analytics and maximizing the value of data assets across the business enterprise.

Ensuring Data Privacy for Regulations such as the General Data Protection Regulation (GDPR)

When GDPR goes into effect in May 2018, it will strengthen and unify data protection rules for all organizations processing personal data for European Union (EU) residents.
Through analytics-enabled data governance, a business can not only locate personal data enterprise-wide, but monitor compliance, usage, approvals, and accountability across the organization.

The Proliferation of Metadata Management

Metadata is a growing trend for 2018. This “data about data” contains the information necessary to understand and effectively use data such as business definitions, valid values, lineage, and more.
Using such ontologies, organizations can understand the relationship between data sets, as well as enhance discoverability in metadata. Metadata management is critical in enterprise data environments to support data governance, regulatory compliance and data management demands.

The Monetization of Data Assets

Organizations recognize that data is either a liability or an asset. Metadata can be used to enable a deeper understanding of the most valuable information.
We are seeing more organizations using a combination of logical, physical, and conceptual metadata to classify data sets based on their importance, and businesses can apply a numerical value to each data classification, effectively monetizing it.

The Future of Prediction: Predictive Analytics to Improve Data Quality

With the continued concerns with data quality, and the volumes of data increasing, businesses are enhancing data quality anomaly detection with the use of machine-learning algorithms.
By using historical patterns to predict future data quality outcomes, businesses can dynamically detect anomalies in data that might otherwise have gone unnoticed or only found much later through manual intervention.

IoT Becoming More Real

Each passing year marks an increase in the number of connected devices generating data and there is a steep rise in focusing on extraction of insights from this data.
We are starting to see more and more defined IoT use cases leveraging data—from newer connected devices like sensors, and drones for analytics initiatives. With this, there is a growing demand for streaming data ingestion and analysis.

“As more data is generated through technologies like IoT, it becomes increasingly difficult to manage and leverage. Integrated self-service tools deliver an all-inclusive view of a business’s data landscape to draw meaningful, timely conclusions,” said Washington. “Full transparency into a business’s data assets will be crucial for successful analytics initiatives, addressing data governance and privacy needs, monetizing data assets and more as we move into 2018.”

2018 Security Predictions: It's Still the Wild, Wild West

2017-12-11T09:00:00.000-05:00

The last US presidential election revealed the dangers and the difficulties of prognostication. But that doesn't deter those determined to look ahead at what we may face in 2018. We reached out to several security mavens to learn what worries them about the coming year. It's interesting how broad their concerns are, and how little they overlap. Yes, 2018 will be an interesting year. You can read the predictions here.

Webinar: Is Cognitive Computing the Next Step to Help Fight Cybercrime?

2017-11-27T15:18:00.004-05:00

On December 7, 2017, at 10 AM EST, James Bone, author of Cognitive Hack: The New Battleground in Cybersecurity ... the Human Mind, is conducting a webinar on "Is Cognitive Computing the Next Step to Help Fight Cybercrime?"

No-Shock: Worst Year For Vulnerabilities Already – Only Through Q3 2017

2017-11-15T14:44:00.003-05:00

2017 has officially become the worst year on record with over 16,006 disclosed vulnerabilities.

RICHMOND, VA, November 14, 2017 -- Risk Based Security today announced the release of its Q3 2017 VulnDB QuickView report that shows there have been 16,006 vulnerabilities disclosed through September 30th this year. This is the highest number of disclosed vulnerabilities at the end of the third quarter on record and represents a 38% increase over the same period in 2016. In addition, cataloged vulnerabilities in the first nine months of 2017 have exceeded the total vulnerabilities for all of 2016 (15,832). The 16,006 vulnerabilities cataloged by Risk Based Security’s VulnDB research team eclipsed the total covered by the CVE and National Vulnerability Database (NVD) by 6,295.

“When hearing that so many vulnerabilities are missing from CVE/NVD, most security professionals want to justify the gap by trying to convince themselves that the vulnerabilities missed can’t possibly impact their organization and if they do they must be low risk. However, just as our previous reports have indicated this isn’t the case. 44.1% – over 2,700 – of the vulnerabilities not published by NVD/CVE have a CVSSv2 score between 7.0 and 10, which include widely deployed software used by many organizations. Any security product or tool that relies on CVE/NVD is putting your organization at serious risk.” said Jake Kouns, Chief Information Security Officer for Risk Based Security.

“As Equifax dominated the data breach headlines, it was revealed that due to a series of delays they were unable to patch the exploited flaw, now commonly known as Struts-Shock, in a timely fashion. What the media missed is that there have been a total of 75 vulnerabilities in Apache Struts, and 5 new vulnerabilities since Struts-Shock was disclosed. It makes you wonder if there were any other delays in correcting those issues as well, and if Equifax has additional unpatched vulnerabilities”, added Kouns.

The newly released 2017 Q3 2017 report from Risk Based Security shows that 39.9% of total reported vulnerabilities received CVSSv2 scores above 7.0. This means that not only is the number of vulnerabilities on the rise, but the severity of the vulnerabilities disclosed remains high. What is more concerning for organizations is that 31.6% of the vulnerabilities disclosed have public exploits available and 47.9% can be exploited remotely.

The VulnDB QuickView report also highlights the relationships between researchers and vendors, showing that they are continuing to work together. Vulnerabilities disclosed in a coordinated fashion continues to be around 43%, on par from the mid-year report. In addition, 6.1% of the vulnerabilities disclosed in software products were coordinated through vendor and third-party bug bounty programs.

“While our proprietary Vulnerability, Timeline, and Exposure Metrics (VTEM) show that not all vendors are prioritizing and fixing vulnerabilities as quickly as we would prefer, the good news is that 75.8% of 2017 vulnerabilities through September do have a documented solution”, says Kouns.

Top 5 Predictions for ICS Security in 2018

2017-11-14T13:30:00.001-05:00

Nozomi Networks has comprised the top 5 predictions for ICS Security in 2018.

1. ICS malware moves beyond Windows exploits to ICS-specific malware. Up to now, most malware that has infected ICS have used Windows vulnerabilities or protocols to infect and spread. For example, in 2017, WannaCry, Industroyer and Dragonfly 2 all used the Windows protocol, SMB, as a key infection and proliferation mechanism. Malware attacks using OT device software, such as PLC software, will start to occur adding to the sea of Windows-dependent attacks.

2.The cuffs will come off of Internet connectivity for ICS systems as IT technology is increasingly integrated with ICS systems to achieve operational efficiencies. Progressive companies will implement new technologies and procedures necessary to not only bridge IT and OT, but also to defend their ICS from this source of cyber threats.

3. Artificial intelligence becomes more mainstream for ICS systems to provide next generation security to fight cyber threats. Organizations grappling with ICS cybersecurity staffing and skills shortages are turning to AI solutions to achieve security and productivity goals. AI powered monitoring tools are now able to discover breaches automatically and provide information on remediation.

4. The shortage of ICS cybersecurity skills will open the door for vendors to provide full security services. These services will move beyond risk assessments to become more full service.

5. Security-by-Design will start to improve ICS Security. Major companies will increase their demands that security be included in new automation equipment purchases; for example, requiring that RTUs have encrypted software. Cybersecurity certification will also rapidly grow and major automation vendors will have their products tested for the ISA Secure certification.

For more, see these books:

Cyber Security for Industrial Control Systems: From the Viewpoint of Close-Loop

Cybersecurity for Industrial Control Systems: SCADA, DCS, PLC, HMI, and SIS

Research on BadRabbit Ransomware

2017-10-25T11:23:00.003-04:00

From Eskenzi PR:

"Nozomi Networks has taken a look into the BadRabbit Ransomware that hit Russia and Ukraine yesterday affecting systems at three Russian websites, transport systems in Ukraine, including an airport and an underground railway in Kiev.

"Moreno Carullo, Co-Founder and Chief Technical Officer for Nozomi Networks says, “Our research shows that the group behind Bad Rabbit have spent considerable time creating their ‘infection-network,’ going back at least to July, with the majority of sites relating to media and news.When a victim visits what they believe is a legitimate site, they are instructed to download an Adobe Flash installer/update. Given that the attackers are targeting media and news sites, that have previously employed Flash to enhance the visitor experience, this request may not immediately arouse suspicion – but it should! If the user follows the redirection the attack begins and the ransomware dropper (distributed from: hxxp://1dnscontrol[.]com/flash_install.php) downloads.”

"Moreno explains,“As soon as the victim executes the dropper, for which admin privilege is needed, a malicious DLL named infpub.dat is saved and is then run using the usual utility rundll32. Our experience executing the infpub.dat file is that it then seems to try to brute-force NTLM [NT LAN Manager] login credentials and download an executable dispci.exe, which appears to be derived from the well-known utility DiskCryptor code - a disk encryption module. The execution of the last file downloaded begins the encryption phase and the replacement of the bootloader as already seen in previous NotPetya attacks.

"According to Moreno, “Prevention is always better than cure as, if infected, it is never advisable to pay the ransom as it is not guaranteed that the criminals will honor the agreement and restore systems/data. Organizations need tools that will help them immediately identify when something ambiguous is happening within the infrastructure. Applying artificial intelligence and machine learning for real-time detection and response, organizations can monitor for malware to rapidly discover and act to remove malicious code and the risks posed before harm is done.”

"Michael Patterson, CEO of Plixer says, “Many times ransomware infections go unreported. Employees who make the mistake and click on something they shouldn’t are usually very embarrassed about the infection. Security teams need to be aware of all infections in order to grasp the scale of the intrusion. Unreported infections can often be discovered using network traffic analytics. By profiling the Bad Rabbit communication behavior other machines reaching out to the Internet with similar behaviors can be identified.”"

EU-U.S. Data Transfer Pact Passes First Annual Review

2017-10-19T10:18:00.000-04:00

Reuter's reports that the EU-U.S. data transfer pact passes its first annual review.

EU data privacy protection rules are getting tougher all the time and they're not shy about imposing fines for violations.

Are you responsible for data privacy in your organization? Do you conduct business in Europe? If either answer is "yes," you should read Paul Lambert's The Data Protection Officer: Profession, Rules, and Role and Understanding the New European Data Protection Rules.

How Israel Caught Russian Hackers Scouring the World for U.S. Secrets

2017-10-11T09:38:00.002-04:00

According to the New York Times, "What gave the Russian hacking, detected more than two years ago, such global reach was its improvised search tool -- antivirus software made by a Russian company, Kaspersky Lab, that is used by 400 million people worldwide, including by officials at some two dozen American government agencies.

I seems I warned of this in 2012 in this post: Kaspersky, ex-KGB, Is Tool of Putin.

Why CISOs Fail: The Missing Link in Security Management--and How to Fix It

2017-09-26T09:24:00.000-04:00

Why CISOs Fail: The Missing Link in Security Management--and How to Fix It provides insight as to why and how current security management practices fail at their basic foundation, resulting in overall dissatisfaction by practitioners and lack of success in the corporate environment. Barak Engel examines the reasons and how to fix them. The resulting improvement is highly beneficial to any corporation that chooses to pursue this strategy and from a bottom-line and business operations perspective, not just in technical operations. This book transforms the understanding of the role of the CISO, the selection process for a CISO, and the financial impact that security plays in any organization.

New Release! Big Data Analytics in Cybersecurity

2017-09-25T09:10:00.003-04:00

Big data analytics provide more accurate, timely, and actionable decisions for both cybersecurity and IT management. Big Data Analytics in Cybersecurity gives you a comprehensive coverage of state-of-the-art big data analytics in cybersecurity and IT management. The topics include threat analysis, vulnerability identification, mission analysis, network monitoring, network management, visualization, and cybertraining. Each topic is examined in detail in a case study. Written and edited by leading experts from industry, academia, and government, the book is an indespensible reference for academics and professionals.

Survey Reveals the "5 Deadly Sins" That Increase the Risks of a Data Breach

2017-09-20T09:23:00.001-04:00

Despite prioritizing privileged access management, a majority of enterprises fail to prevent the abuse or misuse of privileged credentials

PHOENIX, September 20, 2017 -- BeyondTrust today announced its annual Privileged Access Management survey which identified "The Five Deadly Sins of Privileged Access Management," and how they prevent organizations from effectively protecting sensitive information.

For years, security experts have outlined best practices for privileged access management (PAM) in an effort to reduce problems associated with the abuse of privileged credentials. Despite this, IT organizations continue to struggle with privileged access management.

To understand why, BeyondTrust recently surveyed nearly 500 IT professionals from around the world with involvement in privileged access management. Because so many attacks start with the misuse of privileged accounts, it is not surprising that respondents rated the following three security measures as somewhat to extremely important to their efforts:

Privileged access management (83%)
Privileged session management (74%)
Privilege elevation management (74%)

When asked what issues keep them awake at night, respondents most often cited the misuse of personally identifiable information (86%), downtime of computing systems (85%), and loss of intellectual property (80%).

Yet, despite these widespread concerns, Forrester research finds that 80 percent of data breaches are the result of the abuse or misuse of privileged credentials[1]. The BeyondTrust survey finds "The Five Deadly Sins of Privileged Access Management" are to blame for this contradiction between the fact that so many IT organizations struggle to secure sensitive information despite their high levels of awareness and commitment to PAM:

Apathy: When asked to list the top threats associated with passwords, respondents listed employees sharing passwords with colleagues (79%), employees not changing default passwords their devices ship with (76%), and using weak passwords like "12345" (75%). Despite knowing better, respondents admitted that many of these same bad practices are common within their organization. A third of the respondents report users routinely share passwords with each other, and a fourth report the use of weak passwords. Shockingly, one in five report many users don’t even change the default passwords!

Greed: Users often insist they need full administrative privileges over their devices, and that creates problems for IT. 79% of respondents cite allowing users to run as administrators on their machines as their biggest threat, followed by not having control over applications on users’ machines (68%). Yet, nearly two in five respondents admit it is common for users to run as administrators on their machines. It is no surprise that many respondents say these practices have directly caused downtime of computing systems.

Pride: As the saying goes, pride cometh before the fall. One in five respondents say attacks combining privileged access with exploitation of an unpatched vulnerability are common. Simply patching known system vulnerabilities can prevent most of today’s commonly-reported attack vectors. Yet, too often, IT does not stay current on their patches.

Ignorance: Two-thirds say managing least privilege for Unix/Linux servers is somewhat to extremely important. One popular option is Sudo. However, just 29 percent say Sudo meets their needs. The most commonly cited problems with Sudo include being time-consuming to use (32%), complexity (31%) and poor version control (29%). Despite this, the typical respondent runs Sudo on 40 workstations and 25 servers.

Envy: Enterprises are rushing to embrace cloud computing. Yet, more than a third report that they are not involved in protecting SaaS applications from privileged access abuse.

There are steps any organization can take to address the Five Deadly Sins of Privileged Access Management:

1. Deploy enterprise password management globally across all data centers, virtual and cloud. A centralized password management solution that includes built-in session monitoring will ensure that both important capabilities are met with strong workflow and ease of use.
2. Remove local admin rights from ALL Windows and MacOS end users immediately. 94% of Microsoft system vulnerabilities in 2016 can be attributed to users with admin rights. Once all users are standard users, IT teams can elevate a user’s access to specific applications to perform whatever action is necessary as part of their role without elevating the entire user on the machine.
3. Prioritize and patch vulnerabilities. Better prioritization and patching of vulnerabilities provides IT with better insight into whether to delegate privileges to an asset or application. The result is better intelligence and less risk of unknowns.
4. Replace Sudo for complete protection of Unix/Linux servers. With pressure on budgets, organizations may have to use Sudo, but it doesn’t offer the industrial-strength capabilities that today's security needs.
5. Unify privileged access management--on-premise, in the cloud--into a single console for management, policy, reporting and analytics.

As organizations race to adopt SaaS/PaaS/IaaS to keep pace with business demands, IT must provide the same level of protection to cloud-based systems as for on-premise systems. This includes capabilities such as enabling automation for DevOps; finding, grouping and scanning cloud assets; protecting virtual and cloud management consoles and instances; using a cloud access service broker to enable third-party access; and performing vulnerability assessments for hybrid and public cloud infrastructures.

Download the full report from the BeyondTrust web site.

GDPR: The Pandora’s Box Is Open for Enterprise Websites

2017-09-19T00:00:00.000-04:00

According to this article in Website Magazine,

"Compliance officers need to rein in the regulatory risks associated with their digital properties. The European Union's General Data Protection Regulation (GDPR) is a conversation starter for most companies looking to control compliance, reputational and revenue risks. However, while focus has been on identifying data elements--customer, partner and employee--held by the organization, most have overlooked the data collection activities occurring via the company’s websites and mobile apps. Just as with Pandora's box, there's a slew of GDPR-driven evil emitting from your digital properties."

Here are some books by Paul Lambert that focus on The EU's General Data Protection Regulation

The Data Protection Officer: Profession, Rules, and Role
https://www.crcpress.com/9781138031937

Understanding the New European Data Protection Rules
https://www.crcpress.com/9781138069831

What Businesses Need to Know in the Wake of the Equifax Breach

2017-09-18T14:40:00.002-04:00

What Businesses Need to Know in the Wake of the Equifax Breach

By Jason Tan, CEO of Sift Science

Online businesses everywhere are going to be dealing with the effects of the recent Equifax breach. It’s a tough truth to swallow, but these large-scale data breaches have become a fact of life – and it’s not just the breached business that pays the price. As fraudsters mine the valuable data that’s been compromised, all e-commerce sites and financial institutions need to be on alert.

Keep an eye out for signs of account takeover.

Last year, 48% of online businesses saw an increase in account takeover (ATO), according to the Sift Science Fraud-Fighting Trends report. And the Equifax breach is likely to exacerbate this trend, potentially flooding the dark web with names, addresses, Social Security numbers, and other personal information that fraudsters can leverage to gain access to a legitimate user’s account. They then make purchases with a stored payment method or drain value from the user’s account.

Some of the signals that could point to an ATO:

Login attempts from different devices and locations
Switching to older browsers and operating systems
Buying more than usual, or higher priced items
Changing settings, shipping address, or passwords
Multiple failed login attempts
Suspicious device configurations, like proxy or VPN setups

Keep in mind that taken individually, each of these signs may be normal behavior for a particular user. It’s only when you apply behavioral analysis on a large scale, looking at all of a user’s activity and all activity of users across the network, that you can accurately detect ATO.

Monitor for fake accounts and synthetic identity fraud.

Fraudsters can also take all of the different pieces of personal data leaked in the Equifax breach to steal someone’s identity and create new accounts. They may also pick and choose pieces from various people’s accounts – like a birthday, Social Security number, and name – and mix them together to create an entirely new ID.

To keep tabs on fake accounts, you can monitor new signups to look for risky patterns, like a sudden spike in new accounts that can’t be attributed to a specific promotion or seasonal trend. If the average time it takes a new user to sign up suddenly gets much faster, that may point to fraudsters using a script to quickly create accounts. And seeing multiple new accounts coming from the same IP address or device is a red flag for a single person creating many accounts.

Stay focused on maintaining user trust.

Even if a breach doesn’t happen on your site, any downstream fraud attacks still happen on your watch. If you don’t invest in protecting your users from the devastating effects of ATO, identity theft, and fraud, you will soon lose their trust. Trust is earned in drops, but lost in buckets.

At the same time, e-commerce businesses and financial institutions should make sure they aren’t overly cautious to the point where they’re rejecting good customers and denying legitimate accounts. Preventing fraud is a delicate balancing act, and the right technology – which looks at a range of data points to make an accurate prediction about what is and isn’t fraudulent – can help you strike the right balance.

About the Author:

Jason Tan is the CEO of Sift Science, a trust platform that offers a full suite of fraud and abuse prevention products designed to attack every vector of online fraud for industries and businesses across the world.

Information Security: The Dismal Discipline?

2017-09-11T09:45:00.000-04:00

Read this chapter from Why CISOs Fail: The Missing Link in Security Management--and How to Fix It and understand why the author likes to call information security the "dismal discipline," and why this perception needs to change.

Universities Still Struggle to Provide Cybersecurity Education

2017-08-31T14:59:00.006-04:00

The latest Global Information Security Workforce Study paints a grim picture, predicting that in five years, the number of unfilled cybersecurity jobs will raise to 1.8 million worldwide. The main reason is a lack of qualified personnel who can fill the role and a lack of universities providing cybersecurity education.

Chipping People: Are You Ready?

2017-08-28T11:18:00.002-04:00

Shelly Palmer notes that "Proponents of the technology tout its convenience and the idea that you never have to remember your wallet or a password, ever again. While they are technically correct, chipping people invokes a train of thought that quickly descends to the darkest of places."

Would you voluntarily submit to this? What if chipping was a term of employment?

There's a link to a survey at the end of the article. Although it's not my survey, I'm interested in the results.

New Research on "Pulse Wave" DDoS Attacks

2017-08-16T11:20:00.002-04:00

New findings from Imperva Incapsula researchers published today Attackers Use DDoS Pulses to Pin Down Multiple Targets details the emergence of a new assault pattern, which they’ve named Pulse Wave.

According to lead researcher Igal Zeifman, “Pulse Wave DDoS represents a new attack methodology, made up of a series of short-lived pulses occurring in clockwork-like succession, which accounts for some of the most ferocious DDoS attacks we mitigated in the second quarter of 2017. In the most extreme cases, they lasted for days at a time and scaled as high as 350 Gbps.”

The size of these attacks, and the amount of skill they exhibit, are likely the handiwork of skilled bad actors who have become practiced in portioning their attack resources to launch simultaneous assaults — meaning the intervals between each pulse are being used to attack a secondary target.

This new approach shows that some offenders have grown to understand that it is not necessary to hit a target continuously to take it offline; rather, repeated short bursts are enough to disrupt routers and servers, producing the same effect. By the time the systems have recovered from the first burst, or pulse, the hackers hit them again. In this way, they can double their resource utilization and pin down several targets.

With effective sniping, even more simultaneous attacks can be launched to pin down multiple targets and boost the offenders’ bottom line.

The existence of such capabilities spells bad news for everyone, as they enable bad actors to greatly increase their attack output. The pulse-like nature of these attacks, however, is especially harmful for appliance-first mitigation solutions, since it can cut down the communication between their two components, preventing effective failover from the appliance to the cloud. Specifically, the attacks have the capacity to delay the time it takes for the cloud component of the mitigation solution to kick in. This increases the likelihood of the target going down and being forced to initiate a prolonged recovery process. Moreover, the pulse wave assaults can prevent transition of data collected in the early attack stages from the appliance and into the cloud to further harm its responsiveness.

As the research points out, while Pulse Wave attacks constitute a new attack method and have a distinct purpose, they haven’t emerged in a vacuum. Instead, they’re a product of the times and should be viewed in the context of a broader shift toward shorter-duration DDoS attacks. Multiple industry reports—including the Imperva Incapsula quarterly DDoS Threat Landscape report— point to an increased number of short-lived DDoS events over the past year. As a result, the majority of all DDoS attacks today —both at the network and application layers— consistently last less than one hour. Moreover, the percentage of such short-burst attacks is growing each quarter.

“For a commercial organization, every such instance translates into tens of thousands of dollars in direct and indirect damages. For professional offenders—already inclined to split up their attack resources for optimized utilization—this serves as another reason for them to launch Pulse Wave DDoS assaults. Consequently, we expect to continue encountering such assaults. We also forecast them to grow larger and become more persistent, fuelled by botnet resource evolution and the previously described macro trends we’ve observed in the DDoS landscape,” Zeifman added.

The full Research Paper ”Attackers Use DDoS Pulses to Pin Down Multiple Targets, Send Shock Waves” presents a detailed dive into the nature of pulse wave attacks and the threat that they pose and their place in the DDoS threat ecosystem.

How Long Can Resources in Short Supply Last?

2017-06-26T09:06:00.004-04:00

Smart Energy: From Fire Making to the Post-Carbon World first traces the history of mankind's discovery and use of energy. It then reviews contemporary issues such as global warming, environmental deterioration, depletion of carbon energy sources, and energy disputes. Next, it evaluates technical innovations, system change, and international cooperation. Then, it tackles how civilization will continue to evolve in light of meeting future energy needs, how Smart Energy will meet these needs, and defines the global mission. The book closes with a summary of China’s dream of Smart Energy. This chapter considers how long petroleum, coal, and other carbon-based resources can last.

Understanding the Organizational Context for a Business Impact Analysis

2017-06-19T08:59:00.004-04:00

Understanding the Organizational Context for a Business Impact Analysis

Conducting a business impact analysis (BIA) for an organization makes it imperative for a practitioner to understand the business and the manifold dependencies and relationships and to study the enterprise as an extended enterprise. This chapter from Practitioner's Guide to Business Impact Analysis explains the organizational context for conducing a BIA.

What Is the Role of a CISO?

2017-06-12T09:00:00.003-04:00

This article discusses the role of the CISO, how it has changed over the years, and what tools and skills a CISO needs.

BTW, we have a slew of books on the roles of the CISO. You can find them here.