STE WILLIAMS

Emotet re-emerged toward the end of September, ending a months-long hiatus that gave banking Trojans and remote access Trojans (RATs) room to increase in the third quarter.

As a result of Emotet’s absence for the first 10 weeks of the third quarter, global combined malicious URL and attachment message volume decreased by nearly 40%, researchers explain in the “Proofpoint Q3 2019 Threat Report.” Despite this decline, overall volumes of banking Trojans and RATs increased by 18% and 55%, respectively, compared with the second quarter. Banking Trojans made up 46% of all malware in the third quarter, followed by RATs at 15%.

Emotet’s absence was notable because of its sheer size. Between mid-2017 and May 1, 2019, TA542 spread the Emotet botnet in hundreds of increasingly large campaigns that eventually spread through North and South America, Western Europe, Asia, and the Middle East, targeting organizations across industries with tens of millions of messages. Over time, Emotet evolved from banking Trojan to a modular botnet designed to spread different types of digital threats.

Emotet disappeared from the threat landscape at the end of May, shifting overall malware trends. To some extent, researchers say, banking Trojans and RATs in the third quarter were filling the gap Emotet left. Threat groups that Proofpoint tracked as TA556 and TA544 drove banking Trojan volumes with large Ursnif campaigns, which made up 20% of all banking Trojans. Other attackers distributed Trickbot (37%), and a group tracked as TA516 spread IcedID (26%).

More attackers regularly distributed RATs in Emotet’s absence – namely, a group tracked as TA505. “We noticed TA505 is a group that moves the needle,” says Chris Dawson, threat intelligence lead at Proofpoint. When they choose to distribute a threat, they do it in volumes. In the third quarter, it led the charge with FlawedAmmyy (45%) and FlawedGrace (30%).

Emotet’s reappearance in September brought another shift: When it emerged for the last two weeks of the month, it made up 11% of all malicious payloads for the entire third quarter. “Their absence impacted overall volume significantly,” says Dawson of Emotet’s temporary exit from cybercrime. “Now they’re back with a vengeance, doing what they do.”

There remains some speculation in the intelligence community as to where Emotet went and what its operators were doing, he explains. When major actors take a short break, it’s usually because they lost control of the botnet or need to do some retooling behind the scenes. But Emotet’s hiatus was long – a little over three months – and it’s unclear why its actors went dark.

When TA542 re-emerged with new Emotet campaigns on September 16, researchers noticed a few subtle shifts in how it operated. The group generally followed the same model researchers had historically observed: geographically targeted emails with local-language lures and brands. Messages often had financial themes and contained malicious attachments or links to malicious documents that, when targets enabled macros, installed Emotet onto their machines.

But in addition to its longstanding targets, which included the US, the UK, Canada, Germany, and Australia, TA542 expanded its target countries to include Italy, Spain, Japan, Hong Kong, and Singapore. It also used a “Snowden” lure in its email campaigns, going back to its older 2018 habit of using seasonal and topical email lures. Before it dropped off the map, Dawson says, it was using generic business-based lures in its attack messages.

“It says something more about how we see social engineering get better and better,” he explains, noting how even high-volume actors are getting smarter about geofencing and localization of languages when they craft malicious messages.

Related Content:

• 8 Tips for More Secure Mobile Computing
• Kaspersky Analysis Shines Light on DarkUniverse APT Group
• What a Security Products Blacklist Means for End Users Integrators
• The Uphill Battle of Triaging Alerts

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What a Security Products Blacklist Means for End Users and Integrators.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/ta542-brings-back-emotet-with-late-september-spike/d/d-id/1336302?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two separate incidents reported this week have once again highlighted how insiders with legitimate access to systems and data can be far more dangerous to enterprise security than external attackers.

On Thursday, the US Department of Justice announced indictments against two former Twitter employees for allegedly accessing private information tied to Twitter accounts belonging to several individuals of interest to the government in Saudi Arabia. A third individual based in Saudi Arabia was also indicted on related charges.

US national Ahmad Abouammo (age 41) of Seattle and Aliz Alzabarah (35) of Saudi Arabia are accused of using their Twitter employee credentials to collect information that helped Saudi officials identify individuals critical of the regime in the country. They are alleged to have provided the information — which included email addresses, phone numbers, IP addresses, and dates of birth — to officials working on behalf of the Saudi government and the Saudi royal family.

The charging documents described Abouammo as a former media partner manager at Twitter responsible for the Middle East and North Africa region.

In that role, he was involved in assisting notable Twitter accounts in the region — including those belonging to brands, journalists, and celebrities — with content and Twitter strategy as well as sharing best practices. Alzabarah was a site reliability engineer, with no authorized access to the Twitter account data. Even so, he is alleged to have accessed nonpublic data associated with more than 6,000 accounts, including 33 accounts for which Saudi officials had previously pressed Twitter for more information.

Abouammo allegedly received a luxury watch valued at more than $20,000 and hundreds of thousands of dollars in cash in return for the information. He was arrested in Seattle on November 5 and made his first court appearance today.

Alzabarah fled the country for Saudi Arabia after Twitter officials confronted him about his illegal activities. A federal warrant has been issued for his arrest and also that of a third individual, Ahmed Almutairi, 30, a Saudi-based individual who is alleged to have facilitated meetings between Saudi officials and the two former Twitter employees.

In a statement, a Twitter spokesman said the company is committed to protecting the privacy of individuals who use its platform to advocate for human rights, equality, and individual freedom. “We recognize the lengths bad actors will go to try and undermine our service,” the spokesman said. “Our company limits access to sensitive account information to a limited group of trained and vetted employees.”

Meanwhile, in a separate development, cybersecurity vendor Trend Micro on Wednesday said one of its employees had illegitimately accessed personal data belonging to about 68,000 of the company’s 12 million customers.

According to the security vendor, one of its employees used “fraudulent means” to access a customer support database containing names, email addresses, support ticket numbers, and, in some cases, the phone numbers of customers. He is alleged to have sold that information to a third-party malicious actor who then used it to attempt to scam Trend Micro customers. 

Trend Micro was alerted to the data theft in August after some customers of its consumer security products reported receiving scam calls for people purporting to be the security vendor’s support personnel. It wasn’t until October, however, that the company was able to identify the source of the leak. The employee has been terminated.

A Long-Standing Problem
Trend Micro and Twitter are the latest in a long and constantly growing list of victims of insider abuse — a problem that many security experts say poses at least as big a risk to enterprise security as external attacks. Twenty percent of the security incidents that Verizon’s breach response group handled in 2018, and 15% of the actual breaches it investigated, involved insiders. Nearly half of those incidents (47.8%) were motivated by financial gain and a surprisingly high 23.4% by people seeking “pure fun.”

Insider threats present a special challenge because most security is focused at protecting incoming traffic, says Warren Poschman, senior solutions architect at comforte AG. Internal, properly authorized users are expected to be able to access data because it is part of their job functions.

“The premise of ‘you can’t deny what is granted’ applies in that if an insider has legitimate access, then it is difficult to determine if a behavior is allowable,” Poschman says. True intent can be hard to determine until after damage is done because legitimate user behavior can often be erratic, he adds.

Several tools are available to address insider threats, including user behavior analytics and risk-based authentication products. Data-centric measures such as tokenization and format-preserving encryption can also help by limiting access to sensitive data for all users regardless of the permissions they have, Poschman says.

Terry Ray, senior vice president at Imperva, says trying to proactively restrict all employees to just the data they need can be complex and even next to impossible for enterprise security organizations. Even a zero-trust approach — where every access request to a network or app is vetted for trustworthiness — has limitations when it comes to malicious insiders, he says. “The only aspect of zero trust that might have benefited Trend Micro would be least privileged access — the idea that each individual should only have access to what they need for their role,” he says.

To be effective, insider controls have to be based on a continuous monitoring of all user access to protected data. To spot unusual behavior, organizations need to be constantly analyzing who accesses data, what they access, how they access it, from where, and whether they should they have access to it.

“Monitoring user activity on corporate data is not only fully accepted, it’s assumed by employees,” Ray says.

Few, though, implement full data monitoring, and when they do, typically only the regulated data is monitored. The reality is that unregulated data is becoming more relevant at companies as well. “Unregulated data may still be highly monetized by attackers and can have negative impact on organizations,” Ray notes, “regardless of a lack of regulatory fines.”

Related Content:

• How Do I Monitor for Malicious Insiders?
• Ignore the Insider Threat at Your Peril
• Insider Threats: An MA Dealmaker’s Nightmare
• 8 Microsegmentation Pitfalls to Avoid

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What a Security Products Blacklist Means for End Users and Integrators.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/twitter-and-trend-micro-fall-victim-to-malicious-insiders/d/d-id/1336301?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A threat campaign first spotted targeting Tibet and Uyghur activists in 2013 may have been much wider in scope than originally thought, a new analysis by Kaspersky has revealed.

The security vendor made the discovery when trying to identify an advanced persistent group the US National Security Agency (NSA) had been quietly tracking when the ShadowBrokers outfit leaked many of the spy agency’s offensive tools in 2017.

One of the leaked tools had been used by the NSA to check for traces of malware and other artifacts tied to specific APT groups on compromised systems. Kaspersky Lab’s analysis of the tool revealed the NSA was using it to track 44 separate APT groups, many of them unknown and not publicly described at the time.

Researchers from the security firm decided to see what they could find about one of the APT groups the NSA was tracking, identified only as “framework #27” in the tool.

In a report Tuesday, Kaspersky said its investigation showed the group — which it has dubbed “DarkUniverse” — targeted organizations in Middle Eastern and African countries, as well as entities in Russia and Belarus. 

Kaspersky was able to identify at least 20 victims, including medical institutions, atomic energy bodies, telecommunications firm, and military organizations. DarkUniverse appears to have operated between 2009 and 2017 and then ceased activities altogether following the ShadowBrokers leak, Kaspersky said.

“After the publication of [the ShadowBrokers] leak, no traces of this specific activity surfaced,” says Alexander Fedotov, malware analyst at Kaspersky Lab. “It is possible that the group is still active but now uses other instruments.”

DarkUniverse used spear-phishing emails to spread a malware tool that was designed to collect a wide range of information from infected systems, include keystrokes, emails, screenshots, and files from specific directories. The spear-phishing emails were customized for each target. Kaspersky said its analysis showed the malware had been built from scratch and then constantly modified and updated to the point where the samples the group used in 2017 were completely different from the 2009 samples.

“Each malware sample was compiled immediately before being sent and included the latest available version of the malware executable,” Kaspersky said in its report this week.

Sophisticated Threat Actor
Fedotov describes DarkUniverse’s malware as relatively sophisticated and involving the use of at least one zero-day exploit (CVE-2013-0640) involving a security issue in Adobe Reader. Some of the techniques the group employed, including its use of the WebDev protocol to send stolen data to legitimate cloud services, were, in fact, adopted by other groups, he says.

“This report shows that there are actors with enough resources to develop a variety of similar-in-functionality and yet quite complex instruments at the same time and use them independently,” Fedotov says.

According to Fedotov, what makes DarkUniverse’s activity significant is the group’s apparent ties to the operators of ItaDuke, malware that first surfaced in multiple Uyghur- and Tibetan-themed attacks six years ago. Those attacks also involved the use of the same Adobe Reader 0-day exploit to drop ItaDuke on target systems. The attackers also used Twitter accounts to store command-and-control URLs.

Several unique code overlaps between the malware DarkUniverse developed and ItaDuke strongly suggest a link between the two.

“ItaDuke represented a very complex malware,” Fedotov says. “With this new discovery of a malware connected to ItaDuke and similar in its level of sophistication, we observed that the real scale of ItaDuke operation is much wider than it was previously considered.”

Fedotov wouldn’t speculate on whether DarkUniverse was likely nation-state-backed or which country it operated from, citing challenges associated with attributing threat activity to a specific actor or location.

Related Content:

• The Shadow Brokers: How They Changed ‘Cyber Fear’
• Ex-NSA Contractor Was a Suspect In Shadow Brokers Leak
• APT Groups Make Quadruple What They Spend on Attack Tools
• Threat Actors Muddy Waters in Middle East with APT Hijacks, Fake Leaks in Q2 2019

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What a Security Products Blacklist Means for End Users and Integrators.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/kaspersky-analysis-shines-light-on-darkuniverse-apt-group/d/d-id/1336292?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Two point eight million. That’s how many cybersecurity professionals are laboring in most of the world’s major economies to keep malware writers, fraudsters, nation-state actors, and assorted script-kiddies at bay. It’s a security force that’s not nearly big enough for the job, but according to a new survey, it’s a force armed with knowledge, skill, and a general sense of satisfaction with their work.

(ISC)2’s “2019 Cybersecurity Workforce Study” shows that the global cybersecurity workforce needs to grow by 145% if it’s to meet the existing needs. That means a cybersecurity workforce of 6.82 million professionals globally. And the picture the study paints of the existing landscape provides some insight into how — and whether — that 4.07 million professional gap can be bridged.

“I don’t want to paint a gloom-and-doom picture,” says Wesley Simpson, (ISC)2’s chief operating officer. “We need to think about how we close the gap differently. What we’re doing today to get new cybersecurity professionals into the industry isn’t working fast enough.”

To close the gap, Simpson says the security industry needs to look outside its traditional thinking about what a security professional looks like. “Typically in the past, everyone wants a cybersecurity expert who wants five years and a CISSP. There are only about 130,000 people who fit that worldwide,” he explains. 

The answer, Simpson says, is for organizations to grow their own cybersecurity pros. Simpson has several suggestions for steps the organizations can take in order to create their own cybersecurity professionals. At one level, he suggests steps like creating apprenticeship programs within the organization so that those who aren’t already skilled in cybersecurity can gain expertise in the field.

“Cast a big net. We need people from all different backgrounds and degrees,” Simpson says, “Don’t focus on STEM- or [computer science]-educated people.”

One of the advantages of adding those with liberal arts educations to the cybersecurity team, says Simpson, is that they excel at telling the security story. Cybersecurity teams complain about not getting the resources they need, he says, but they can be quite bad at telling a convincing story about the work they do and the needs they face.

“The liberal arts people are better at telling the story, crafting the story, and talking to all the people they need to talk with to build the story,” he says.

Challenge for the Ages
One of the study findings that goes against the stereotype of the young hacker is that relatively few cybersecurity professionals are in the early stages of their careers. While 34% of professionals are Millennials or younger, only 5% belong to Gen Z (born between 1996 and 2010). Simpson believes that cybersecurity’s image is one reason young professionals aren’t flocking to the field.

“Google cybersecurity and in the first three images you’ll get the hacker in the dark hoodie. The image is very negative,” he says.

In addition, there’s a negative image to the life cybersecurity professionals lead.

“The stereotype of cybersecurity is very negative — long hours, burnout, not appreciated, and not listened to,” Simpson explains. In addition, he says, the industry has created the perception that cybersecurity is a very difficult field to enter.

“The industry has grown up so fast that we’ve made it very confusing for the new candidate,” Simpson says. “There’s a lack of consistency and commonality around career paths, taxonomy, job description, tasks, and other things.”

When that lack of consistency hits the HR department that’s involved in hiring, the result is a sort of buzzword bingo that ends up filtering out many great candidates, Simpson says. Instead of working to filter candidates out, he says that companies should be working to show what a great career cybersecurity can be.

“We need to say that we value, train, and develop the individuals,” he says.

Digging In
It’s notable that the issue is in attracting new cybersecurity professionals, not retaining those already in the field. Those responding to the survey had an average of nine years in an IT role, with six years at their current organizations, and five years in a cybersecurity role. Two-thirds (66%) of respondents report they are either somewhat satisfied (37%) or very satisfied (29%) in their jobs, and 65% intend to work in cybersecurity for their entire careers.

Among those responding to the survey, 30% were women, with women making up 23% of those with cybersecurity-specific titles. The key to getting more women, and more younger professionals, into the field is in answering a key question, Simpson says: “How do we create a cybersecurity culture that’s wanted, is listened to, has a career path, and is appreciated?”

Answering those questions will help bring cybersecurity professionals in from other fields. Already, just 42% of respondents indicate they started their careers in cybersecurity, meaning 58% moved into the field from other disciplines. 

Related Content:

• What Has Cybersecurity Pros So Stressed — And Why It’s Everyone’s Problem
• Rethinking Cybersecurity Hiring: Dumping Resumes Other ‘Garbage’
• 2019 State of the Internet: Security — Phishing (from Akamai)
• Major Employers Commit to Build a Stronger Cybersecurity Workforce Pipeline
• How Intel Unlocks the Powerful Potential of Diversity in Cybersecurity

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/find-new-talent-dont-fight-over-cissps-insights-from-(isc)2-coo/b/d-id/1336291?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

PayPal was the most frequently spoofed brand in the third quarter of 2019, unseating Microsoft, phishers’ usual favorite, which held the top spot for more than a year, Vade Secure reports.

Microsoft has been the most impersonated brand for five consecutive quarters, or as long as Vade Secure has published its quarterly Phishers’ Favorites report. PayPal has consistently been a popular target; however, this year saw an uptick in PayPal attacks. Unique PayPal phishing URLs spiked 167.8% and 111.9% year-over-year in the first and second quarters, respectively. This quarter saw 69.6% growth with 16,547 unique PayPal phishing URLs, or nearly 180 per day.

Several factors edged the world’s most popular payment service into the top spot. Its massive user base is one: Active PayPal accounts exceeded 286 million in the second quarter. PayPal also announced in July it would play a role in Facebook cryptocurrency Libra, though it later backed out. The company also announced plans to expand Xoom, a money transfer platform it bought in 2015, to 32 countries, including Austria, France, Germany, Italy, Spain, and Portugal.

Phishing campaigns have capitalized on PayPal’s popularity. One discovered by Vade researchers targeted more than 700,000 people, primarily located in Europe, with emails threatening legal action and requesting a small amount of money from recipients.

Microsoft phishing URLs totaled 13,849, marking a 31.5% drop from the second quarter and its lowest total since the first quarter of 2018. Researchers don’t suggest a singular reason for the decline – it could be seasonal, they note – but say Office 365 phishing attacks are still “widely popular,” with more than 150 unique URLs per day. Attackers have begun to focus on email construction and randomization techniques to bypass defenses. The new tactics mean there is less need to create a unique URL for each email because they can reuse the same URL across many.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What a Security Products Blacklist Means for End Users and Integrators.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/paypal-upsets-microsoft-as-phishers-favorite-brand/d/d-id/1336295?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Capital One Financial Corp. reportedly has moved its current chief information security officer to an advisory role as the bank begins a search for his replacement.

The Wall Street Journal reported this week that Michael Johnson, who had served as the firm’s CISO since 2017, will temporarily be replaced by Capital One’s CIO Mike Eason. Capital One suffered a data breach of 106 million payment card accounts this year, but didn’t learn of the attack until several months after it had occurred.

According to the WSJ report, Capital One employees previously had raised concerns of cybersecurity woes at the firm, including heavy turnover in its security team.

Read more here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/capital-one-shifts-its-ciso-to-new-role/d/d-id/1336296?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The definition of success and the accurate measurement of the indicators of that success are business imperatives. In some fields, they are easily recognized and fairly simple to measure — for example, measuring sales volumes, return on investment (ROI), or customer satisfaction survey results.

However, in fields such as preventive medicine or aviation safety — where success is measured by diseases avoided or disasters averted — executives face the challenge of proving a negative to determine success. Cybersecurity is a prime example of this, with security teams struggling to succinctly demonstrate the ROI from not getting hacked last month or from not losing valuable customer data from the breach that never happened.

Proving the “crisis averted” makes it hard to demonstrate value in a way that traditional corporate executives can understand. However, given how organizations are prioritizing a number of digital transformation initiatives to increase efficiencies and simplify environments in both scope and proximity to core business operations, the mandate for doing so is increasingly urgent. The way to drive the value proposition of cyber beyond just the walls of the IT office and onto the value assurance and risk management agendas of top organizational leaders is by framing the data into a format they can quickly process. CISOs can do this by tying security investments to business impacts through a cyber balance sheet.

The resulting impact of a cyber incident can be widespread and long lasting. Therefore, investments in cyber-risk solutions should be substantiated and correlated to these business impacts. And, the cost estimation of these impacts should evolve to meet today’s reality. Historical calculations (such as server downtime) and recovery time objectives are no longer enough.

Executives need to be able to consume the complexities of cyber-risk in business terms and receive repeatable, meaningful metrics upon which to base risk decisions. Often, the information being provided by CISOs and security teams to update management on their cyber exposure is highly complex and generated in a technical lexicon. This thwarts the ability of management to truly understand much less calculate value regarding cyber-risk, and ultimately puts them at a disadvantage regarding their ability to effectively prioritize, govern, and execute on cyber programs that can have operational, financial, and reputational impacts.

Let’s dig into the proposed cyber balance sheet. Balance sheets, and financial statements in general, exist to provide a broad view of the financial performance of an entity. They are based on a standard framework that takes vast amounts of data from many different sources and systems and consolidates that information down to a cohesive view of financial performance that is easily understood by those who consume it. The demands of cyber-risk reporting are analogous; large amounts of technical risk data need to be consumed from many systems and synthesized down to easily understandable, meaningful business risk terms to allow a variety of stakeholders to make decisions.

Using financial modeling, companies can adopt approaches for estimating both the direct and hidden intangible costs associated with cyber-risk and express those risks in traditional financial terms. These models should be based on industry-accepted frameworks (e.g., FAIR, NIST, etc.). A cyber balance sheet incorporates these financial models and related tools to gauge the impact differential between, say, two hours of downtime for an online merchant website versus two hours of downtown for a complex manufacturing line. While the former could mean lost customer data, the latter could cause a vast ripple effect on production and even shut down your just-in-time global supply chain because expensive infrastructure was sabotaged and destroyed.

Organizational Steps Toward More Cyber Visibility and Investment
Against this backdrop, cyber-risk should be structured and measured beyond mere threats, vulnerabilities, and probability — and into the realm of fully assessing the nature and severity of risks; the “materiality” of threats for prioritizing remediation; and the decision support for both tactical judgments and larger strategic business decisions that affect the whole company.

Here are two examples that showcase the value of security in ways that executives understand and care about.

Demonstrating how a needed software or workflow improvement will solve not just an immediate security problem in one department but also solve everyone’s problem in numerous departments if the approach is adopted organizationwide would likely be well received and offer a more federated approach to governance.

A government agency CIO could show how new FedRAMP security templates to inherit data from trusted multitenant cloud-based identity access management platforms cannot just plug security holes and reduce reporting violations but also boot efficiencies by reducing redundant compliance validation on applicants that use such services.

If leadership views the CISOs and their teams as more operational and focused only on technology or information risks, the cyber team could be treated as less of a strategic asset and will become more of a strategic adviser. Ultimately, tying security investments to business impacts, and measuring those effects with a cyber balance sheet approach will help elevate cyber-risk understanding and commitment for executives and boards.

Related Content:

• 7 Tips for Communicating with the Board
• Raising Security Awareness: Why Tools Can’t Replace People
• Quantifying Security Results to Justify Costs
• Why It’s Imperative to Bridge the IT OT Cultural Divide

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “What a Security Products Blacklist Means for End Users and Integrators.”

Andrew Morrison is a principal in Deloitte Touche LLP’s Cyber Risk Services practice and specializes in assisting clients with the risk associated with cyber threats. Andrew currently serves as the US leader of Deloitte’s Cyber Strategy, Defense, and Response practice. In … View Full Bio

Article source: https://www.darkreading.com/cloud/to-prove-cybersecuritys-worth-create-a-cyber-balance-sheet/a/d-id/1336251?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple