A Review of the Best News of the Week on Cybersecurity Management & Strategy
Gartner Identifies Top 10 Trends for Infrastructure, Operations in 2019 (eWEEK, Dec 04 2018)
Gartner analysts on Dec. 4 presented these findings during the Gartner IT Infrastructure, Operations and Cloud Strategies Conference
What the Marriott Breach Says About Security (Krebs on Security, Dec 01 2018)
“We don’t yet know the root cause(s) that forced Marriott this week to disclose a four-year-long breach involving the personal and financial information of 500 million guests of its Starwood hotel properties. But anytime we see such a colossal intrusion go undetected for so long, the ultimate cause is usually a failure to adopt the most important principle in cybersecurity defense that applies to both corporations and consumers: Assume you are compromised.”
Magecart Delivers Malware to 1-800-FLOWERS (Infosecurity Magazine, Dec 05 2018)
1-800-Flowers’ Canadian website is the latest victim in card-skimming malware attacks.
Without data, your security strategy is just a guess.
The Mosaic Security Research Market Intelligence Platform provides the data you need for OWASP’s Cyber Defense Matrix. Learn a new way to conduct a strategy assessment.
First Lawsuits Filed in Starwood Hotels’ Breach (Dark Reading, Dec 03 2018)
Class-action suits have been filed on behalf of guests and shareholders, with more expected.
Why Leading Software Vendors Are Dumping GRC for IRM (Gartner Blog Network, Nov 29 2018)
One of the most common questions I receive from software vendors has to be “what’s the difference between governance, risk and compliance (GRC) and integrated risk management (IRM) solutions?”
Australia Set to Pass Sweeping Cyber Laws Despite Tech Giant Fears (SecurityWeek, Dec 04 2018)
Australia’s two main parties struck a deal Tuesday to pass sweeping cyber laws requiring tech giants to help government agencies get around encrypted communications used by suspected criminals and terrorists.
Bad Consumer Security Advice (Schneier on Security, Dec 04 2018)
There are lots of articles about there telling people how to better secure their computers and online accounts. While I agree with some of it, this article contains some particularly bad advice: 1. Never, ever, ever use public (unsecured) Wi-Fi such as the Wi-Fi in a café, hotel or airport.
Starwood Breach Reaction Focuses on 4-Year Dwell (Dark Reading, Dec 05 2018)
The unusually long dwell time in the Starwood breach has implications for both parent company Marriott International and the companies watching to learn from.
Evidence in Starwood/Marriott Breach May Point to China (Dark Reading, Dec 06 2018)
Attackers used methods, tools previously used by known Chinese hackers.
Kaspersky Lab’s US Ban Appeal Thrown Out (Infosecurity Magazine, Dec 03 2018)
US court says products will remain off-limits to federal government
Lenovo Pays $7.3 Million to Settle Superfish Adware Lawsuit (SecurityWeek, Dec 03 2018)
Lenovo has agreed to pay $7.3 million to settle a consumer class action lawsuit related to the Superfish adware scandal from 2015.
Knowing Value of Data Assets is Crucial to Cybersecurity Risk Management (SecurityWeek, Dec 03 2018)
Understanding the value of corporate assets is fundamental to cybersecurity risk management. Only when the true value is known can the correct level of security be applied.
Nonprofits on Facebook Get Hacked—Then They Really Need Help (Wired, Dec 04 2018)
Facebook is an enormous platform for charitable giving, but some nonprofit leaders say there aren’t enough resources when something goes wrong.
Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP (Microsoft Secure, Dec 03 2018)
MITRE tested the ability of products to detect techniques commonly used by the targeted attack group APT3 (also known as Boron or UPS). To isolate detection capabilities, as part of the testing, all protection and prevention features were turned off. In the case of Windows Defender ATP, this meant turning off blocking capabilities like hardware-based isolation, attack surface reduction, network protection, exploit protection, controlled folder access, and next-gen antivirus.
Situational awareness: Real-time decision making to improve business operations (Help Net Security, Dec 05 2018)
Although the term situational awareness usually pertains to the military and first responder space, it also plays a crucial role in the efficiency of public and private organizations such as large-scale businesses, government agencies, transportation and logistics, and many other industries.
Are Lawyers the Best Judge of Cybersecurity? (Infosecurity Magazine, Dec 05 2018)
It’s not just lawmakers who sometimes seem ill equipped when it comes to cybersecurity; lawyers can be far from perfect in this regard too.
Ukraine: We Blocked Major Russian Attack on Judiciary (Infosecurity Magazine, Dec 05 2018)
SBU claims phishing email was loaded with malware
House GOP Campaign Arm Targeted by ‘Unknown Entity’ in 2018 (SecurityWeek, Dec 05 2018)
Thousands of emails were stolen from aides to the National Republican Congressional Committee during the 2018 midterm campaign, a major breach exposing vulnerabilities that have kept cybersecurity experts on edge since the 2016 presidential race.
Security Risks of Chatbots (Schneier on Security, Dec 05 2018)
Good essay on the security risks — to democratic discourse — of chatbots….
55% of Companies Don’t Offer Mandatory Security Awareness Training (Dark Reading, Dec 06 2018)
Even those that provide employee training do so sparingly, a new study finds.