STE WILLIAMS

Analysis Where to begin?

Former Trump foreign policy advisor George Papadopoulos – no, not that one – has been turned by ex-FBI director Robert Mueller as part of the latter’s investigation into Trump campaign team members. Mueller is probing allegations of obstruction of justice, money laundering and other financial crimes, and collusion with Russian government agents seeking to meddle with last year’s US presidential election.

Papadopoulos has been assisting Mueller’s special inquiry for several months, but word of this cooperation only emerged today when his guilty plea to making false statements to the FBI was unsealed.

Coincidentally, Trump’s former campaign manager Paul Manafort surrendered himself this morning to Mueller at his nearest FBI office, as requested, to answer allegations ranging from making false statements to acting as a foreign agent.

Ex-Trump campaign official Rick Gates, also accused of conspiracy and money laundering, handed himself in today, too. The indictment against the pair is here, and both deny any wrongdoing.

Among the wealth of details in Papadopoulos’ 14-page statement [PDF] is the fact that he used Facebook Messenger and Skype to communicate with a Russian government agent, called “the Professor,” who promised to provide damaging information on the Clinton campaign. Emails, no less.

“This isn’t like he [the Professor]’s messaging me while I’m in April with Trump,” Papadopoulos told the FBI. “I wasn’t even on the Trump team.” Except he was on the team in April 2016. The Feds noted in their court paperwork: “Defendant PAPADOPOULOS met the Professor for the first time on or about March 14, 2016, after defendant PAPADOPOULOS had already learned he would be a foreign policy advisor for the Campaign; the Professor showed interest in defendant PAPADOPOULOS only after learning of his role.”

And then there is extensive evidence – confirmed by Papadopoulos – that he acted as a go-between for the Trump campaign and the Russian government, including being supplied with damaging information on the Clinton campaign.

There are also emails from other Trump campaign staff – so far unnamed – that show explicit efforts to work with Russians in gathering damaging information on the real-estate tycoon’s political rival. In other words, efforts to engage a foreign power to swing a US presidential election.

But let’s take a quick look at Facebook.

For one, using Facebook to carry out highly dubious and potentially illegal activity is not a good idea. This is a social network that periodically changes account settings to keep up the pretense that it’s not gathering and selling every snippet of information it can get out of you. Anything you say on Facebook may go straight down a pipe to the NSA and a database searchable by the FBI. It’s called Section 702.

Papadopoulos is obviously not a man well versed in spy craft. Something that becomes more apparent when it’s revealed the day after he was pulled in for questioning, he deleted his entire Facebook account and started a new one. He also tried changing his phone number to sidestep the Feds.

You can just imagine Mueller’s team at their morning meeting: so how did the Papadopoulos interview go yesterday? Well, this morning he deleted his Facebook account. Great, now we know where to look.

Deactivated

Under the heading “Events Following PAPADOPOULOS’s January 27, 2017 Interview with the FBI” in the statement, this is relayed as follows: “The FBI interviewed defendant PAPADOPOULOS again on February 16, 2017. His counsel was present for the interview. During the interview, defendant PAPADOPOULOS reiterated his purported willingness to cooperate with the FBI’s investigation.

Trump lieutenants ‘use private email’ for govt work… but who’d make a big deal out of that?

READ MORE

“The next day, on or about February 17, 2017, defendant PAPADOPOULOS deactivated his Facebook account, which he had maintained since approximately August 2005 and which contained information about communications he had with the Professor and the Russian MFA Connection. Shortly after he deactivated his account, PAPADOPOULOS created a new Facebook account that did not contain the communications with the Professor and the Russian MFA Connection.”

Oh dear. It didn’t help either that Papadopoulous’ Facebook posts undermined numerous parts of his story. Papadopoulos told federal investigators in January this year he had met the Russian agents before joining the Trump campaign. Unfortunately, what he actually wrote on Facebook somewhat undermined his own account. Hoisted by his own petard, as they say.

Which leads us to the social medium of choice of the current US President: Twitter.

This morning, Trump’s son-in-law – and the man who we have no doubt will succeed in his task of creating peace in the Middle East – Jared Kushner, decided now was the best time to delete every single one of his tweets.

The timing is not in any way suspicious. And it has nothing to do with the fact that Papadopoulos’ social media postings were used to undermine his own account of events. Kushner has nothing to hide, not even about that meeting with the Russian agents that was about adopting babies and nothing else, certainly not the presentation that the Russian government had evidence that one of the Clinton campaign’s backers was a tax evader.

It also has nothing to do with the meetings that Kushner keeps remembering he held with Russians in revised security clearance forms.

Stone cold

As well as losing Kushner’s body of Twitter knowledge and insight (which, of course, the FBI will still have access to), we also lost another Trump confidante: Roger Stone.

Even Roger Stone doesn’t like Roger Stone, but it seems he finally crossed the line this weekend in a series of personally abusive tweets aimed at journalists reporting on the Mueller-Russia probe, and has been permanently banned from the website, joining such luminaries as Milo Yiannopoulos and Martin Shkreli.

CNN host Don Lemon “must be confronted, humiliated, mocked and punished,” Stone guffed on Twitter before being barred from the milliblogging service. Conservative pundit Bill Kristol was #porky and “pilling on the pounds.” CNN host Jack Tapper “must be held accountable for his lies and very severely punished.” And so on.

Of course, Stone took the opportunity of again being highlighted as a dreadful human being to try to get himself talked about. “This is just part and parcel of the tech left’s effort to silence conservative voices,” he blathered and then launched a campaign to get himself reinstated while also promoting a movie all about himself. And so on.

Which of course leads to Trump himself.

‘Critical’

“Today’s indictments against Mr Manafort, Mr Gates and Mr Papadopoulos are stark reminders of how the special counsel’s investigation is critical to the rule of law and our national security,” US Senator Ron Wyden (D-OR) told El Reg in a statement.

“The allegations against Mr Papadopolous come after previously confirmed ties between the Trump campaign and the Russians, and raise more questions about which campaign officials may have encouraged the expansion of these connections. The indictment against Mr Manafort and Mr. Gates confirm the importance of following illicit money trails wherever they may lead, including to pro-Russian Ukranian interests.

“Each of these allegations should be the subject of thorough investigation by Congress as well as the special counsel. Finally, the tax evasion and money laundering charges against Mr Manafort are a reminder that Donald Trump, in contravention of decades of bipartisan practice, still has not released his own taxes.”

The epitome of the man who can’t sit on a train without calling someone to tell them they’re on a train. Who can’t eat a hamburger without tweeting “I am NOT eating a hamburger.” The hulking id with the irrepressible ego.

Well, Trump turned to Twitter to confirm everything that everyone was saying about him – only he put the name “Hillary” in front of it all because that’s how deception works. “Never seen such Republican ANGER UNITY as I have concerning the lack of investigation on Clinton…”

“There is so much GUILT by Democrats/Clinton, and now the facts are pouring out. DO SOMETHING!“

“…Also, there is NO COLLUSION!“

And so on.

Holding down the ‘Fort

But at the center of all the discussion is Paul Manafort. His Twitter account is still there, although it’s not been used since December last year and he only set it up when he joined the Trump campaign. Manafort doesn’t seem to have a Facebook profile to delete. But what he does have is an indictment for a dozen allegations, ranging from money laundering to filing false reports, to false statements, to acting as an agent for a foreign principal, to “conspiracy against the United States.” None of which sound good.

And just to add a cherry to the top, Robert Mueller has asked for forfeiture on Manafort’s assets, including his house in the Hamptons (worth about $8m), his Brooklyn house ($4.5m) and his New York apartment ($3m) – which, it turns out, he placed on Airbnb and was charging thousands of dollars a week to rent out.

The homes were bought from the proceeds of money laundering, the indictment claims – which, surprisingly, is not a new claim. The Treasury Department in August said it was looking into all-cash purchases of New York real estate for possible money laundering.

When it comes to technology and social media is of course the man behind the entire investigation, Robert Mueller, who doesn’t give one iota of a shit about the swirling social media yelling that passes for modern political debate.

Twitter, Facebook, Skype: they are all wonderful sources of evidence. And today we have seen the first 45 pages of that evidence. More are sure to come. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/30/manafort_stone_trump_papadopoulos_kushner_mueller_russia/

It was a tough competition with more than 125 submissions, our largest field yet. And the winners are …

Clone13 — aka Robert Thompson, a compliance officer at Bayview Solutions LLC — took the top honors and a $25 Amazon gift card for his hysterical, malware, ransoware-themed caption, penned below by cartoonist John Klossner. Robert is no stranger to the Dark Reading cartoon caption contest; he was runner-up in a contest in the fall of 2016. 

Second prize — a $10 Amazon gift card — goes to justanotherengineer for “Now THAT is Penetration Testing!”

Many thanks to everyone who entered the contest with all their clever puns and observations, and to our loyal readers who cheered the contestants on. Also a shout out to our judges, John Klossner, and the Dark Reading editorial team: Tim Wilson, Kelly Jackson Higgins, Sara Peters, Kelly Sheriden, Dawn Kawamoto, and yours truly. If you haven’t had a chance to read all the entries, be sure to check them out today.

See more caption contest winners:

• Mobile (In)security: Dark Reading Cartoon Caption Contest Winners
• For The Birds: Dark Reading Cartoon Caption Contest Winners
• Substantially Above Par: DR Cartoon Caption Contest Winners

Marilyn has been covering technology for business, government, and consumer audiences for over 20 years. Prior to joining UBM, Marilyn worked for nine years as editorial director at TechTarget Inc., where she launched six Websites for IT managers and administrators supporting … View Full Bio

Article source: https://www.darkreading.com/endpoint/screen-sharing-dark-reading-caption-contest-winners/a/d-id/1330236?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

CEO points to an “information war” against his company as the cause of the revenue drop.

Kaspersky Lab expects its US revenue to drop by single digits this year as the company faces a backlash from allegations that it’s closely tied to the Kremlin, a Reuters report states.

The company anticipates US sales to fall by less than 10% this year and it will wind down KGSS, its Washington-area subsidiary because it no longer has plans to sell its antivirus products to the US government.

Last month, Pres. Donald Trump ordered US government agencies to halt purchases of Kaspersky Lab products, citing concerns that the Kremlin had influence over the company and its software posed a potential threat to national security. Major retailers Best Buy and Office Depot have also discontinued sales of Kaspersky products.

Kaspersky is facing an “information war” with the US and “we’ve done nothing wrong,” the company’s founder and CEO Eugene Kaspersky told Reuters in an interview.

Read more about Kaspersky’s comments here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/kaspersky-expects-us-sales-to-decline-in-2017/d/d-id/1330260?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

We scared up our most popular stories on Facebook, Twitter, and LinkedIn.

(Image: Twin Design via Shutterstock)

When you want to spread interesting content around the Internet, where do you share? Based on our numbers, it looks like you’re most active on LinkedIn – but Facebook is a close second. And if you don’t use Google Plus, you’re not alone. Not many people do.

We pulled data from the last three months to get a better sense of which Dark Reading stories are most frequently shared online and which social platforms are most commonly used among our readers. What we found were some exciting nuggets of data about how often stories are published, and an interesting throwback to news reports from this summer and fall.

Some of the most commonly shared articles related to topics keeping CISOs awake at night: malware-less attacks, the skills gap, insider threats, and data breaches. Some related to major cyberattacks from this year. One included parallels between cybersecurity and Game of Thrones.

Here, we share some of our social data with you. These ten articles were the most frequently shared on Facebook, Twitter, and LinkedIn during the months of August, September, and October 2017.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/endpoint/security-gets-social-10-of-dark-readings-most-shared-stories/d/d-id/1330262?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

We try not to guffaw at cybercrime, but sometimes – especially on a Monday just after the clocks have gone back to remind us that summer is very much over – we allow ourselves a wry smile.

As we did today on reading a report from our chums at Bleeping Computer in which a cybercrook turned on his fellow crooks by hacking their underground forum and saying he would expose them to the cops…

…unless they forked over $50,000:

MESSAGE TO BASETOOLS OWNER:

Hello, you have only 24 hours to pay 50.000$ OTHERWISE YOU WILL BE 
EXPOSED AROUND THE WORLD  ALSO WE HAVE TOO MANY PROOFS THAT WE HAVEN'T 
INCLUDED THEM HERE AND THOSE WE WILL SENT TO THE RELEVANT BODIES

The ebullient extortionist listed four examples of “relevant bodies”, all of them in the US: Homeland Security, the Treasury, the Department of Justice and, for good measure, the FBI. (We couldn’t help think that the Internal Revenue Service might be interested, too.)

According to Bleeping Computer, the crook uploaded some of his “proofs” to the Basetools hacking site itself, presumably to cause maximum embarrassment amongst the site’s criminal community.

These published “proofs” included a screenshot that’s supposed to show the web administration panel of the Basetools forum, listing the pseudonyms of the last 15 buyers and sellers, as well as the last 9 refunds.

Seems that the crooks have problems trusting each other on many different levels.

To pay or not to pay?

We don’t want to be seen as offering advice to cybercriminals, but we’d strongly urge against paying up in extortion cases like this.

It’s clear that the data has already been stolen – and some of it already shared with the world, let alone with US law enforcement – so paying now won’t do much good.

In ransomware demands, the extortion typically covers a decryption key for data that almost certainly wasn’t copied by the crooks – in other words, if you decide you aren’t going to pay up, the crooks have nothing further to squeeze you with.

But when the crooks already have copies of your data, and are threatening to besmirch, embarrass or defraud you by exposing it, paying the fee won’t do anything to stop them besmirching you anyway.

Or coming back for more money next week.

For what it’s worth, it seems that the Basetools site owners haven’t quite figured out what to do yet – at the time of writing [2017-10-30T12:00Z], their underground forum said:

One thing they definitely haven’t done yet is to read our highly educational article What you sound like after a data breach.

What to do?

Hackers hacking hackers sounds funny, and perhaps it is – but if hackers can be hacked, then so can you, if you aren’t careful.

We don’t know how this attack happened, but the obvious precautions you can take for your own online service include:

• Patch promptly. If the crooks know what server software version you are using, and it has a known security hole, they may very well be able to break in automatically. In other words, if you haven’t patched, you’re the low-hanging fruit.
• Choose decent passwords. If the crooks can guess your password, or if you used the same password on another site that already got hacked, then the crooks don’t need to do any hacking themselves – they can just login directly.
• Use two-factor authentication (2FA). A one-time code that changes every time you login means that just guessing or stealing your password isn’t enough. If the code is calculated on or sent to your phone, then the crooks need your phone (and its unlock code) as well, which is a higher bar to jump over.
• Check your logs. If you keep logfiles for auditing purposes, for example so you can check who logged in when, examine them proactively in order to find out about security anomalies sooner rather than later.

Honour amongst thieves, eh?

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/c08EjvCV2ZM/

Security startup Cryptonite dropped out of stealth ​late last week with a micro-segmentation-based technology designed to prevent​ ​hacker​ ​reconnaissance​ ​and​ ​lateral​ ​movement.

CryptoniteNXT​, the firm’s network​ ​appliance​, sits between an organisation’s perimeter firewall and internal networks, blocking​ ​malicious​ ​activities​ ​while​ ​at​ ​the​ ​same​ ​time​ ​preserving​ network ​performance​ ​and​ ​usability​. The appliance is designed to confound hackers and malware by obfuscating network topology.

“By preventing reconnaissance, CryptoniteNXT is automatically stopping the spread of an attack,” said Mike Simon, president and chief exec of Cryptonite. “This is done by having each endpoint have its own unique view of the network that is managed by our security platform.

“The endpoints view is session based and connects to the network via a temporary token which is a randomly generated IP address. Endpoints are restricted from maliciously scanning the network and seeing the network topology beyond their endpoint and our platform.”

The technology changes a static network into a dynamic moving target. Even if hackers gain a foothold on targeted networks they can’t go anywhere because they have no visibility or ability to run scans. The same approach works against insider threats, according to Cryptonite.

Policy-based control determines what a device or user is allowed to talk to and what resources are permitted to be accessed. Cryptonite’s micro-segmentation is placed inline to all enclave traffic. This form of segmentation assigns policy based on user, port and process. This approach prevents attacks such as ransomware from spreading throughout organisations.

Obscuring IP topology helps to prevent attacks on legacy or unpatched systems by thwarting any attempts by hackers to map exploitable vulnerabilities on a targeted network. CryptoniteNXT Net Guard, a key component of the technology, maps from an obfuscated network onto the real network.

Justin​ ​Yackoski,​ ​Cryptonite CTO, explained:​ ​”The​ ​network​ ​has​ ​become​ ​an​ ​easily​ ​infiltrated​ ​space​ ​that​ ​cannot​ ​be​ ​completely locked​ ​down.​ ​With​ ​CryptoniteNXT,​ we​ ​take​ ​away​ ​the​ ​attackers​ ​ability​ ​to​ ​’see’ ​within​ ​the network,​ ​making​ ​network​ ​attacks​ ​or​ ​data​ ​exfiltration​ ​attempts​ ​significantly​ ​more​ ​difficult​ ​and expensive​ ​for​ ​attackers.”

Simon PG Edwards, director of SE Labs and chair of the Anti-Malware Testing Standards Organization, said that remapping a network adds processor cycles and is bound to have a performance impact one way or another. “The claim that it can limit the network without any performance issues is one that needs testing,” he said.

Edwards spotted caveats about the technology within Cryptonite’s white paper.

“CryptoniteNXT Micro Shield Segmentation significantly reduces attack surfaces accessible via lateral movement. Users only have visibility to the servers and other devices necessary to support their daily work,” the firm said. This, Edwards pointed out, meant that it’s not fully a Zero Trust network because users can connect to servers.

Military industrial spinout

CryptoniteNXT is device and architecturally independent so it doesn’t require an upgrade in switching equipment. No software or server software agent is required for the technology to work. Deception-based technology from the likes of Illusive Networks and others as well as network-based intrusion prevention technology aims to combat similar threats. The closest comparable kit might be TrustSec, Cisco’s software-defined segmentation tech. Cryptonite claims it has no peers. “At this time, we have not engaged with competition for our network-based Moving Target Cyber Defense (MTD) offering,” it said.

Research​ ​and​ ​development​ ​into​ ​Cryptonite’s​ technology​ ​started​ ​with funding​ ​from​ the US ​Department of Defense​ ​and​ Department of Homeland Security.​ ​​​Spun​ ​out​ ​of​ ​a​ ​Maryland​ ​defence​ ​contractor,​ ​Intelligent​ ​Automation, Cryptonite​ ​is​ ​​backed​ ​by​ ​cybersecurity​ ​investors,​ ​including Ron​ ​Gula,​ ​founder​ ​of​ ​Tenable.

“I​ ​invested​ ​in​ ​Cryptonite​ ​because​ ​they​ ​uniquely​ ​prevent​ ​our​ ​adversaries​ ​from​ ​exfiltrating actionable​ ​information​ ​from​ ​our​ ​networks.​ ​The​ ​other​ ​key​ ​capability​ ​is​ ​their​ ​fine-grained micro-segmentation​, ​which​ ​stops​ ​east-west​ ​traffic​ ​that​ ​has​ ​enabled​ ​the​ ​spread​ ​of​ ​ransomware,” said​ ​Ron​ ​Gula,​ ​principal​ ​at​ ​Gula​ ​Tech​ ​Adventures.

Cryptonite has put together technology partnerships with HPE Aruba ClearPass and Palo Alto Networks, details of which are due to be announced over coming weeks. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/30/cryptonite/

Google is abandoning a next-generation web crypto technology it initially championed.

HTTP Public Key Pinning (HPKP) is a standard that allows a host to instruct browsers to only accept certain public keys when communicating with it for a given period of time. While HPKP can offer a lot of protection, the technology was open to potential abuse by hackers or accidental lockout if sysadmins misapplied it, as previously reported on The Register.

In a blog post last week, Google’s Chris Palmer announced plans to deprecate HPKP support by Chrome from May next year – when Chrome 67 is slated to be released to Stable – before removing it entirely at some as yet unspecified date.

Google introduced HPKP support for Chrome around two years ago back in September 2015. Edge and Safari have never supported HPKP and the removal of support by other browser software makers is not anticipated to cause any major upheavals.

“There is no compatibility risk; no website will stop working as a result of the removal of static or dynamic PKP,” according to Palmer who goes on to suggest possible alternatives to HPKP. “To defend against certificate misissuance, web developers should use the Expect-CT header, including its reporting function. Expect-CT is safer than HPKP due to the flexibility it gives site operators to recover from any configuration errors, and due to the built-in support offered by a number of CAs.”

Security researchers including Scott Helme previously criticised the technology as too cumbersome for mainstream use even among security-conscious organisations. Ivan Ristic of SSL Labs argued that HPKP was problematic because it failed to include a recovery mechanism rather than being an inherently bad idea.

“Two HPKP disappointments. First, that a half-baked standard got deployed to production. Second, [the] decision to kill it, rather than fix it,” Ristic said in reaction to Google’s decision. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/30/google_hpkp/

Detailed security arrangements for London Heathrow airport, including the Queen’s precise route every time she passes through, were found on a USB stick left in a West London street, according to reports.

The unencrypted USB stick was found lying under leaves on Ilbert Street, a leafy terrace near the famous Kensal Green cemetery – reportedly by an unemployed jobseeker on his way to a library.

Having plugged the stick into a computer, the man found a treasure trove of what appeared to be security-related documents, including routes and timings of security patrols, types of ID needed to access restricted areas, maps of CCTV cameras and otherwise hidden access shafts onto the Heathrow Express railway line that runs under the airport.

No passwords had been applied to the stick or any of its contents.

Curiously, the Sunday Mirror reported that some of the 2.5GB of documents on the stick were marked “confidential” or “restrictive” – security classification markings that were officially superseded in central government use four years ago. Most police forces have followed suit.

A reporter from the paper wrote: “Why was this sensitive material held on an unencrypted memory stick and taken off site? It’s a huge security breach and massively embarrassing for those in charge of security. The cumulative impact of having so many documents, videos, maps and images all in one place represents a security risk.”

The offending files were passed on to Heathrow security.

An airport spokeswoman told the Guardian that an internal investigation had been launched, adding: “We have reviewed all of our security plans and are confident that Heathrow remains secure. We have also launched an internal investigation to understand how this happened and are taking steps to prevent a similar occurrence in future.”

Wow. It’s like the 2000s all over again

This idiotic blunder by whoever took the USB stick out of Heathrow sounds like something from the bad old days of the previous decade, when confidential data was blithely left lying around on abandoned laptops, folders on trains, and all the rest of it.

One presumes that whoever did this will shortly be joining the person who found the USB stick on a job hunt.

As for the wider implications, they barely need spelling out: had the chance passerby been someone less kindly disposed towards the UK than the finder of the stick, the consequences could have been seriously bad. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/30/heathrow_usb_security_blunder/

The IT security industry needs more balance between disclosure of threats and discussion of defense practices – and greater sharing of ideas

For more than 11 years now, Dark Reading has annually reported major increases in cybersecurity spending, hiring, and technical innovation. Yet, almost every year, we have also reported more data breaches, of greater proportions, than the year before. And so the pattern goes on: defenders invest more budget and staff, yet they continue to lose data at an alarming rate.

It’s time to ask some hard questions. Are cybercriminals really ahead of the defenders? Or are there fundamental flaws in the strategies we’re using for defense?

These are among the core questions we’ll be exploring next month at Dark Reading’s INsecurity Conference, which will take place Nov. 29-30 at the Gaylord National Harbor near Washington, D.C. The conference — which features 32 sessions led primarily by CISOs and former CISOs of major organizations, as well as roundtable discussions and an exhibit floor – is designed to help IT and security professionals rethink the way they approach everyday security tasks, and get them talking about new strategies.

At INsecurity, we’re hoping to break some of the “circular thinking” that keeps our defenses behind. For example, most of today’s IT security conversations – and most security conferences – focus on the emerging threats and vulnerabilities that have been newly-discovered by researchers. This information is valuable in its immediacy, but it tends to skew the defenders’ focus toward the newest threats, rather than the most relevant or impactful. And in many cases, the “new disclosure” conversation is focused only on the threat itself, rather than the best defense against it.

At INsecurity, we’ll be putting aside the “latest threat” conversations for a couple of days and focusing on the strategies and practices that IT and security teams use for defense. If defenders are going to get better, they need to talk about what’s working and what isn’t. INsecurity’s speakers are security veterans who have been fighting the online battle for years and can share their experiences. The content is focused not on what attackers might do, but what they actually do every day – and how you can shift your everyday practices to stop them.

Similarly, most of today’s IT security conversations – and most IT security conferences – tend to happen through one-way presentations or in silos of interested professions. In the enterprise, security teams sometimes spend more of their day talking among themselves than to those with whom they’re exchanging data. Security strategies also tend to be internal, rather than across supply chains or shared infrastructure. Likewise, security conferences tend to focus most of their content on one-way PowerPoint talks by researchers or experts, rather than two-way discussions among colleagues.

At INsecurity, we want to open up the flow of conversation. Yes, some of our sessions will be traditional single-speaker talks, but the other half will be group discussions moderated by experts and protected by Chatham House Rules, in which attendees agree not to share the identities of the participants outside the room. There will also be numerous small roundtables of eight or ten security peers, enabling participants to dig into their specific challenges with colleagues – in a setting that’s intimate and protected. Our goal is to get IT and security people to have real conversations about real problems, rather than just listening to presentations in a dark room.

Even INsecurity’s exhibit floor will offer a different type of conversation. In addition to showing some of the new and latest technologies, the INsecurity Business Hall will feature a theater in which technology providers are encouraged to discuss industry issues and foster discussion, as well as selling their wares. The goal is to get the defenders talking with the tool providers, in hopes that the conversation will help both sides to do better at what they do.

If you’ve been in the cybersecurity industry for any length of time, you’ve probably been to conferences where you stepped out of the sessions in order to have meetings with business partners or discuss a specific issue with colleagues. But what if those conversations were part of the conference – and what if you could have them with some of the top experts and security leaders in the country? That’s the concept behind INsecurity, and our lineup of speakers should make those conversations truly useful, offering ideas for defense that you never had before.

We hope you’ll think about registering for the INsecurity conference. We think it’s time to rethink the security conversation – and find better ways to improve data defense.

Related Content:

• New Dark Reading Conference Will Focus on Defense
• Dark Reading INsecurity Conference Registration Now Open
• 20 Questions to Ask Yourself Before Giving a Security Conference Talk

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech’s online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one … View Full Bio

Article source: https://www.darkreading.com/endpoint/its-time-to-change-the-cybersecurity-conversation/a/d-id/1330254?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Board members pose a unique risk for business, but proper planning helps.

Within any organization, certain employees have access to information that could tip the scales of risk for the business. If a cybercriminal were to gain access to a company’s most sensitive information through stealing credentials from one of these employees, the business could face serious financial and reputational repercussions. Board members, though typically not employees, are included in this group of vulnerable targets for two key reasons:

• They possess materially important data. Board members have access to information that is materially important to the business; yet because they typically aren’t employees of the business, they don’t go through the same security training or have company-issued devices. Consequentially, they may not have the same level of security on those devices to protect the sensitive data they access.

• They have an ability to influence. Often a hacker will impersonate an executive when sending a phishing lure to intended victims. Given the role and influence of board members, it’s likely that a recipient will pay attention to a phishing email if it appears to be sent by one of them. Although this makes board members especially valuable to cybercriminals, it also puts them in a prime position to set the tone for security and ensure that organizations are taking the right steps toward preventing credential theft.

Credential Theft Prevention Checklist
According to the 2017 Verizon Data Breach Report, 81% of hacking-related breaches leveraged either stolen and/or weak passwords, up from 63% reported in prior years. Given that credential theft is the most common element across cyberattacks, it’s no longer an option to delay conversations with security leaders on the topic. To be proactive, board members should reference this checklist:

Understand how data is accessed. As a first step, boards should ask themselves the following questions:

•  What is the value of the information to which we have access?

•  How are we getting access to that information?

•  How is that information protected?

•  Given the sensitivity of the information, do we think it is protected enough?

After going through this exercise themselves, they can pose these same questions throughout the organization to ensure that employees with access to the most sensitive data are properly protected.  

Ask about multifactor authentication. Passwords alone are never enough. A practical example of multifactor authentication is withdrawing money from an ATM. Banks always require both a card and a password, and it’s hard to imagine a world where only one of these requirements would be needed. The same concept should apply to accessing data, making it important to ask:

•  How does the company ensure that, when someone authenticates, it authenticates who they really are? 

Be familiar with the company’s overarching information security strategy. Credential theft is one tactic cybercriminals use, and how a company addresses this is part of its overarching cybersecurity strategy. Conversations about this strategy should include questions like:

•  Has the company invested in cybersecurity training for its employees? Familiarity with what a creative phishing lure looks like should be part of a larger cybersecurity awareness program about credential theft. 

•  What kind of technology is the company investing in to prevent not only credential theft-based attacks but also other types of cyberattacks? 

Board members are in a unique position as highly influential leaders — and as potential victims — to keep the scales of business risk steady. When thinking critically about the significance of credential theft, they can ensure they are doing their part to prevent successful cyberattacks by avoiding falling victim themselves.

Related Content:

• 10 Social Engineering Attacks Your End Users Need to Know About
• Why Data Breach Stats Get It Wrong
• How Systematic Lying Can Improve Your Security

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Rinki Sethi is Senior Director of Security Operations and Strategy at Palo Alto Networks. She is responsible for building a world-class security operations center that includes capabilities such as threat management, security monitoring, and threat intelligence. Rinki is also … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/preventing-credential-theft-a-security-checklist-for-boards/a/d-id/1330233?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple