STE WILLIAMS

I love to grill chicken. Aside from the fact that I enjoy the spicing, marinating, and grilling process, I also very much enjoy the results. Unfortunately, sometimes a little bit too much. But what does a chicken barbecue have in common with information security? Let me explain:

1. Do you have the right ingredients? Even the best chefs will produce an inferior product if they begin with the wrong ingredients. In security, we need to make sure that we have the right data to meet our goals and mitigate the risk we’re most concerned about. With poor data, even the best security teams will struggle to produce results of any value.
2. Are your ingredients fresh? Data must be right, but it also must be available when needed. A security team that can’t get to the data it needs when it needs it isn’t going to succeed in running security operations or investigating and responding to security incidents.
3. Did you measure the ingredients properly? A security organization has access to an overwhelming amount of information. Unfortunately, some of that information adds no value to security operations and can have the opposite effect of reducing the effectiveness of the security team.
4. Do the flavors complement each other and work together to improve taste? A security organization is made up of a number of different teams. Each team has a different function, and each team is important to the overall effectiveness of the security organization. If there are teams that aren’t adding value or that don’t work well with others, it brings everyone down.
5. Do you have the right kitchen utensils? There are over 2,000 vendors in the security market. Some of them sell technology that will aid you in meeting your goals; others, less so. If a security organization doesn’t focus on acquiring the right technology to assist in meeting goals, it’s much harder for itself to achieve them.
6. Are you spicing and marinating with the right technique? Even the best tools won’t do an organization any good if they aren’t leveraged properly. It isn’t enough just to install great technology. Technology needs to be configured in line with your operational needs and operated and maintained appropriately.
7. Are you spicing and marinating for the right amount of time? All technology has a shelf life. As risk, threats, priorities, and business needs change, it would be naive to think that the same approaches and the same types of solutions will continue to fit the bill. Sometimes, an organization needs to take a step back and reassess.
8. Is the grill at the right temperature? Even the best grill will ruin chicken if not set to the right temperature. Security operations needs to be set up to run efficiently and at the right pace. Otherwise, the organization runs the risk of getting bogged down in activities that don’t add value, or on the flip side, miss important events all together.
9. Is the heat even? Setting the grill at the right temperature isn’t enough. The heat also needs to be distributed evenly. In security, there are many different activities that need to be given the appropriate attention. If attention shines disproportionately on one or a few activities, it takes away from other important activities.
10. Are you grilling for the right amount of time? No matter how well you’ve prepared the chicken, if you grill it for too little or too much time, it will not come out well. Similarly, spending too little or too much time on analysis and investigation will lead an organization to jump to conclusions that can’t be substantiated or spend an inordinate amount of time poring over data that won’t lead to any tangible results.
11. Did you dry out the chicken? There is such a thing as over-investigating an incident. If an incident can be analyzed, investigated, and resolved quickly, it should be.
12. Did you choose side dishes that go well with the chicken? Security organizations exist first and foremost to mitigate and minimize the information security risk to the business. This involves working together with the business and cultivating cooperative relationships rather than operating in a vacuum or trying to force security on the organization against its will.
13. Did you choose beverages that go well with the chicken? Business executives and the board need to make security a priority. Otherwise, without proper support, the security organization will be constantly be fighting an uphill battle it can’t win.
14. Did you ruin your precious spicing and marinating work with sauces? A good security program should stand on its own. A weak one will need to be supplemented.
15. Did you serve the chicken hot? A security team that provides timely and actionable information to the business serves the business well. The security team that arrives shaking its finger a day late and a dollar short doesn’t do anyone any good.
16. Was the food ready when the guests arrived? Customers care first and foremost about protecting their data. When they ask how the organization protects their data, they want to feel confident that the organization takes custodianship seriously with the right processes.
17. Did you invite the right mix of people? Security is a business function that requires the buy-in and collaboration of many different stakeholders: the board, executives, the business, customers, partners, and others. Make sure that the discussion around security is a constructive one that involves the right people at the table.
18. Does the conversation suit the meal? The organizational conversation around security needs to be one that empowers the business to succeed securely. It can’t be one of security always being the team of “no.” And it also can’t be one of the business doing whatever it wants without any regard to security.
19. Is there enough food for everyone? Resources are always constrained within a security organization. Projects, assets, and human resources need to be focused on value-added activities that can be sustained over time.
20. Is there dessert? If the members of a security organization enjoy working together, work efficiently and effectively toward mitigating risk, and are innovative in their approach to security, that’s pretty much the icing on the cake.

Related Content:

• Higher Education: 15 Books to Help Cybersecurity Pros Be Better 
• Good Times in Security Come When You Least Expect Them
• 8 Security Buzzwords That Are Too Good to Be True

Josh (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA and also serves as security advisor to ExtraHop. Prior to … View Full Bio

Article source: https://www.darkreading.com/perimeter/setting-the-table-for-effective-cybersecurity-20-culinary-questions/a/d-id/1333471?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

According to a new report, no crime is growing faster in the US than cybercrime, and it is increasing in size, sophistication, and cost.

The “Official 2019 Annual Cybercrime Report,” is based on research conducted by Cybersecurity Ventures and sponsored by Herjavec Group. It predicts that cybercrime will cost companies across the world $6 trillion annually by 2021, increasing from $3 trillion in 2015.

The report notes this will make cybercrime more profitable than the combined global trade of all illegal drugs and represents “the greatest transfer of economic wealth in history.”

On the defensive side, the report predicts more than $1 trillion will be spent globally on cybersecurity between 2017 and 2021. It also will require 3.4 million workers by 2021, up from 1 million in 2014. That growth will keep the cybersecurity unemployment rate hovering near 0%, according to the report.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/cybercrime-is-worlds-biggest-criminal-growth-industry/d/d-id/1333485?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Many organizations are still struggling to adopt a more risk-focused approach to cybersecurity, although the need for it has been recognized for years.

Some familiar issues have been holding them back, including infrastructure complexity, third-party risks, understaffing, resource shortages, and — most significantly — not measuring cyber-risks and their impact on business.

Security vendor Tenable recently commissioned the Ponemon Institute to evaluate how enterprises are measuring and managing cyber-risk.

The poll of 2,410 IT and security practitioners in the US and other countries showed that a depressingly large number of organizations are continuing to experience business-disrupting cyber incidents — some of them multiple times over a relatively short time. Ninety-one percent of the companies surveyed reported experiencing a damaging cyberattack over the past two years; 60% had two or more.

Thirty-one percent experienced a data breach involving 10,000 or more customer or employee records in the last two years. A substantially larger 52% — more than half of all organizations surveyed — expect they’ll experience a breach of this magnitude in 2019.

“At a time when business-disrupting cyber events are impacting almost all organizations, CISOs are unable to confidently quantify cyber-risk’s impact to business operations,” says Bob Huber, CISO of Tenable. “This is leaving the C-suite and boards of directors without actionable insight to make decisions” to alleviate business risk.

The Tenable survey showed that, with a couple of exceptions, the threats that organizations are most worried about are the same as they have been for the past several years. The top concerns this year were malware, with 48% saying they had experienced at least one malware attack in the past two years; third-party risks (41%); and leakage of emails and other business confidential information (34%).

Worries over some threats, however, appear to be spiking. Sixty-four percent — nearly two-thirds — ranked third-party risks as their top concern for 2019. The number is significantly larger than the 41% that actually reported a security incident involving a third party over the past two years.

Similar spikes were apparent in other areas as well. For example, 56% identified an attack on Internet of Things or operational technology (OT) assets as their biggest cybersecurity concern for 2019, though just 23% reported experiencing an actual attack of this type in the past 24 months. Economic espionage and attacks that disrupt OT infrastructure are also top-of-mind concerns for 2019.

Significantly, for all the hype around nation-state attacks, fewer organizations (13%) expect to experience one in 2019 than the 15% who said they already had become victims of one in the past two years.

The reasons for the overall pessimism appear tied to long-standing factors. Though organizations represented in the survey had 19 employees, on average, involved in vulnerability management, 58% still felt they did not have adequate staffing to scan for vulnerabilities — including publicly disclosed ones — in a timely fashion. Somewhat unsurprisingly, a nearly identical proportion (59%) said they had no set schedule for vulnerability scanning or did not scan at all.

The Tenable/Ponemon survey showed that a substantially high percentage of organizations are struggling to keep pace with the stealth and sophistication of attackers, reduce complexity in their IT security infrastructure, improve third-party controls, and control access to sensitive data.

While such factors have heightened the need for more risk-focused approaches to cybersecurity, Tenable’s survey showed that many organizations are still only just getting there.

Risk Measurement Management: Work in Progress
“While some organizations are making strides in improving their security maturity and mapping cybersecurity strategies to the business, there is still room for improvement,” Huber says.

For example, despite the enormous financial implications of data breaches and other security incidents, many organizations still have a poor understanding of the business costs of cyber-risks.

Less than half of the organizations represented in the survey — some 1,110 — claimed they measured and therefore understood the business impact of cyber-risks. Of that, only 41% were required to report that analysis to their board and business leaders. More than six in 10 did not believe their measures were very accurate.

In general, more respondents claimed to understand the importance of certain key performance indicators in understanding risk than are actually using them. For example, 70% and 64%, respectively, considered metrics about the time to remediate risk and the time to assess cyber-risk as important key performance indicators (KPIs). However, 46% and 49%, respectively, are using them.

The same gap was evident in the use of KPIs to measure the business impact of a cyber incident. Sixty-eight percent believed it was important to have a way to measure loss of revenue resulting from a cyber incident, but only 56% actually are using KPIs to do that. Seventy percent said KPIs for measuring loss of productivity were critical even though only 48% are actually using them.

Exacerbating the situation is the fact that the KPIs that organizations are using are designed for on-premises infrastructure and therefore are inadequate for current environments that include a mix of traditional IT, cloud, IoT, containers, and OT, Huber says.

Most KPIs are too technology focused and don’t fully take into account the financial and business implications, Huber says. Often, the metrics are tactical rather than strategic in nature and are not very effective at helping organizations mitigate risk, he says.

“Put another way, current cyber KPIs don’t consider business outcomes and fall far short of reflecting digital business and digital transformation,” Huber notes. “The most common KPIs for cyber-risk and business risk don’t correlate right now, and that’s a gap.”

While CISOs and other security leaders are typically responsible for deploying patches and managing vulnerabilities, they have relatively less influence in determining investments and strategies for vulnerability management. CISOs are most involved in evaluating cyber-risk at only 17% of the organizations represented in the survey — compared with CIOs at 36%.

“In the digital era, cyber-risk is now business risk, and that means CISOs must be able to measure their exposure and map it back to business outcomes,” Huber says.

Related Content:

• Why You’re Doing Cybersecurity Risk Measurement Wrong
• Stop Counting Vulnerabilities Start Measuring Risk
• How Well Is Your Organization Investing Its Cybersecurity Dollars?
• 7 Steps to Start Your Risk Assessment

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/despite-breaches-many-organizations-struggle-to-quantify-cyber-risks-to-business-/d/d-id/1333486?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As university students leave campus for holiday breaks, they may carry more than new knowledge home to family and friends. Recent research points out that colleges and universities are coming under more aggressive security attacks while their defenses struggle to keep up with growing demand.

In “Defending Networks at Higher Learning Institutions — Heroes Needed,” a report issued earlier this fall, researchers at InfoBlox pointed out that the complexity of the university network environment makes effective defense difficult. “Years ago we planned ‘one jack per pillow,’ and that’s changed in such a short period of time,” says Victor Danevich, Infoblox CTO. He believes that each student on campus represents approximately seven IP addresses, making most state and many private universities the home of hundreds of thousands of connected devices.

And while the complexity and levels of attacks are growing, the issues in higher education cybersecurity aren’t new. A report released by EdGuards, “A Brief History of Higher Education Insecurity,” walks readers through attacks from 2002 through 2018 to show how hackers have evolved. One of the growing issues is the size of the databases sought and compromised by criminals, with tens to hundreds of thousands of records exfiltrated in attacks on scores of schools.

That evolution is aided by legitimate university network users. More than half of the administrators surveyed by InfoBlox say that 25% of students arrive on campus with their devices carrying malware. “The 25% infected rate shows the devices that students are bringing from home,” Danevich says. “It’s not laptops. It’s IoT devices [and] mobile devices.” For university security teams, the implication is simple. “You can’t take a look at the security once a year. You have to be much more current because it changes so fast,” he explains.

While students are a common infection vector, they are not the ultimate target. “Business applications, such as HR, Financial and Campus Solutions by PeopleSoft or other vendors, are the main target, as they store the most critical data and are vulnerable to both hackers and malicious insiders,” the EdGuards paper states. 

University security teams hamstring themselves when they see security as a traditional perimeter game because new devices and techniques simply bypass classic perimeter defenses, Danevich says. He recommends defense at the network perimeter, in-network control, and thorough, constant monitoring with automated assistance.

“You can put up a blacklist, but now it has to be taken a step farther with a collection of information that’s come from a variety of devices hooked to a SEIM and passed to a Splunk or ArcSight,” he says. Ultimately, he explains, “We need to use more machine learning and be smarter with what we do.”

Related Content:

• Education Gets an ‘F’ for Cybersecurity
• UC Berkeley Launches Cybersecurity “Citizen Clinic”
• Higher Education: 15 Books to Help Cybersecurity Pros Be Better
• 7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/network-and-perimeter-security/universities-get-schooled-by-hackers/d/d-id/1333487?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple