A Review of the Best News of the Week on Cybersecurity Management & Strategy
2018 Data Breach Investigations Report – Read it! (Verizon, Apr 10 2018)
Within the 53,000+ incidents and 2,200-odd breaches you’ll find real takeaways on what not to do, or at the very least, what to watch for.
How security researchers deal with risks stemming from their activities (Help Net Security, Apr 11 2018)
It’s difficult to quantify the effect, but Joseph Lorenzo Hall and Stan Adams of the US-based non-profit Center for Democracy & Technology have attempted to reveal the worries and choices of security researchers in the current climate by interviewing twenty of them.
Cybersecurity Insurance (Schneier on Security, Apr 12 2018)
Good article about how difficult it is to insure an organization against Internet attacks, and how expensive the insurance is.
Sponsored by LogRhythm
SIEM Magic Quadrant
Gartner Positions LogRhythm in SIEM Leaders Quadrant for 5th Consecutive Year. Get the report
Thousands of Google employees call for company to cancel Pentagon work (Naked Security – Sophos, Apr 09 2018)
Google’s helping the Pentagon to build AI for drones, and a vocal group of employees have asked the company to drop the project.
GAO report recommends stronger security controls for third parties that receive Medicare beneficiary data (SC Magazine, Apr 09 2018)
The U.S. Government Accountability Office (GAO) last week publicly released a report warning that the Centers for Medicare and Medicaid Services (CMS) has failed to provide specific security controls guidance to research organizations with whom it shares Medicare beneficiary data.
Uber Agrees to New FTC Settlement Over 2016 Breach Disclosure (Dark Reading, Apr 12 2018)
Uber has agreed to an updated settlement with the FTC after news of its massive 2016 data breach.
Great Western Railway (GWR) Resets Passwords After Accounts Are Accessed (Infosecurity Magazine, Apr 13 2018)
Around 1000 accounts affected, says UK train operator
Cloudflare’s Plan to Protect the Whole Internet Comes Into Focus (Wired, Apr 12 2018)
One of the internet’s biggest infrastructure companies is expanding its protections beyond the web.
20 Ways to Increase the Efficiency of the Incident Response Workflow (Dark Reading, Apr 10 2018)
Despite all the good intentions of some great security teams, we are still living in a “cut-and-paste” incident management world.
U.S. Department of Interior CIO office fails IG cybersecurity inspection (SC Magazine, Apr 10 2018)
The U.S. Department of the Interior Office of the Chief Information Officer (OCIO) essentially received a failing grade from its own Office of the Inspector General (IG) when it comes to following NIST for incident detection and response.
The Digital Security Exchange Is Live (Schneier on Security, Apr 11 2018)
“Last year I wrote about the Digital Security Exchange. The project is live: The DSX works to strengthen the digital resilience of U.S. civil society groups by improving their understanding and mitigation of online threats.”
Trump Signs FOSTA, Igniting Online Censorship Concerns (PCMag, Apr 11 2018)
President Trump has signed a controversial bill that’s intended to help stop online sex trafficking but has privacy advocates concerned that it will instead trigger internet censorship and put sex workers at risk.
NCSC: New Categorization Framework Will Improve Cyber-Response (Infosecurity Magazine, Apr 12 2018)
A new cyber-incident categorization framework will help government agencies and law enforcers collaborate and respond to attacks more effectively, the National Cyber Security Centre (NCSC) has announced today.
RSA Conference 2018 AdvancedU expands security education to new audiences (Help Net Security, Apr 13 2018)
One of the most notable components of RSAC AdvancedU is the RSAC Security Scholar Program, which works with participating universities to identify 60 college students to attend RSA Conference to learn about the evolving information security industry, forge lasting connections within the community, engage with industry luminaries and participate in unique learning and team building events.
What to look for at the RSA Security Conference (Gartner Blog Network, Apr 12 2018)
Effectively navigating the RSA Security conference next week will be a challenge – there’s always so much to see, so much to learn, and so many people to connect with face to face.
Federal Agency Data Under Siege (Dark Reading, Apr 13 2018)
Seventy-one percent of IT security professionals in US federal agencies have reported breaches in their organizations.
Security Product Management at Large Companies vs. Startups (Lenny Zeltser, Apr 09 2018)
In case you ever want to go work for (or already do) a vendor: “Numerous differences between startups and large companies affect the experience of working in these firms. The distinction is highly pronounced for product managers, who oversee the creation of the solutions sold by these companies.”
Steps executives are taking to increase security while launching new ways to pay (Help Net Security, Apr 10 2018)
More than 80 percent of organizations that have been impacted by a data breach have introduced a new security framework and 79 percent have reduced employee access to customer data, according to new benchmark data, “2018 Global Payments Insight Survey: Bill Pay Services,” from ACI Worldwide and Ovum.
The U.S. still doesn’t have a cybersecurity doctrine (Axios, Apr 10 2018)
The country’s ability to fight back against cyberattacks is limited.
Carbon Black Files IPO, Plans to Raise $100M (Dark Reading, Apr 11 2018)
The endpoint security firm filed a registration statement with the Securities and Exchange Commission on April 9.