A Review of the Best News of the Week on Cybersecurity Management & Strategy
Pitfalls to Avoid in Ransomware Incident Response Plans (SecurityWeek, Sep 03 2019)
Unfortunately, these types of attacks show no signs of slowing down anytime soon, having an adequate incident response (IR) plan prepared is essential. Here are some common pitfalls to avoid when developing your ransomware IR plan
What is MITRE ATT&CK and how is it useful? (WeLiveSecurity, Sep 03 2019)
An introduction to the MITRE ATT&CK framework and how it can help organize and classify various types of threats and adversarial behaviors.
An Inside Look at How CISOs Prioritize Budgets & Evaluate Vendors (Dark Reading, Sep 04 2019)
In-depth interviews with four market-leading CISOs reveal how they prioritize budgets, measure ROI on security investments, and evaluate new vendors.
One of My Favorite Things
Since I started this curated newsletter in June 2017, I’ve clipped ~10,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share today’s post on Twitter Facebook LinkedIn
Snake oil or genius? Crown Sterling tells its side of Black Hat controversy (Ars Technica, Aug 29 2019)
In an exclusive interview with Ars, execs of controversial crypto company explain everything.
It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs (Dark Reading, Sep 03 2019)
Todd Fitzgerald wrote the books on being a chief information security officer. Here he offers tips on what to do and what not to do in the first few months of a new CISO job.
Exploit Sellers Say There are More iPhone Hacks on the Market Than They’ve Ever Seen (VICE, Sep 03 2019)
There are caveats and the sellers are only a slice of the exploit market, but two exploit brokers say they’re seeing more iOS attacks now.
Everything We Know About the Capital One Hacking Case So Far (Wired, Aug 29 2019)
A new indictment against alleged Capital One hacker Paige Thompson includes a few fresh details about the case.
How to Know if Your Cybersecurity Tools Are Actually Working (IBM Security Intelligence, Aug 30 2019)
more than half of enterprise security leaders don’t know if their security tools are working, according to a new report from the Ponemon Institute and AttackIQ. What’s more, only 39 percent of respondents believe they’re getting full value from their security investments.
CISO priorities: Implementing security from the get-go (Help Net Security, Aug 30 2019)
Organizations should also stop asking themselves whether they are secure (there’s no such thing as absolutely secure) and start asking how quickly they can identify a new problem and react and whether they can move faster than attackers.
Ransomware Bites Dental Data Backup Firm (Krebs on Security, Aug 29 2019)
PerCSoft, a Wisconsin-based company that manages a remote data backup service relied upon by hundreds of dental offices across the country, is struggling to restore access to client systems after falling victim to a ransomware attack.
Attacking the Intel Secure Enclave (Schneier on Security, Aug 30 2019)
“Interesting paper by Michael Schwarz, Samuel Weiser, Daniel Gruss. The upshot is that both Intel and AMD have assumed that trusted enclaves will run only trustworthy code. Of course, that’s not true. And there are no security mechanisms that can deal with malicious enclaves, because the designers couldn’t imagine that they would be necessary. The results are predictable.”
McAfee CEO Chris Young Contemplates The Future Of Cyber Security (Forbes, Sep 03 2019)
In this interview, Young explains how the cybersecurity industry faces a duel challenge of keeping up with the transformations that happen within core technologies while simultaneously tracking the innovative nature of cyber attackers.
Why cybersecurity is a big problem for small businesses (TechRepublic, Sep 03 2019)
User training platforms are not very expensive. They’re usually cost per user, and they’re inexpensive. They’re in dollars per user type of thing. To get a good a security, social awareness platform in place would be one of the first things I would recommend for a business.
North Korea Denies Making $2bn from Cyber-Attacks (Infosecurity Magazine, Sep 03 2019)
North Korea brushes $2bn hacking claims off as “ill-hearted rumors”
US Lawmakers Propose Bill to Fortify Federal Cybersecurity (Infosecurity Magazine, Sep 04 2019)
Congress to consider bill that will codify federal cybersecurity program.
Dutch agency recruited Iranian mole to help U.S. and Israel plant Stuxnet virus (SC Magazine, Sep 04 2019)
The 2007 Stuxnet virus attack perpetrated against Iran’s then-budding nuclear program was made possible after U.S. and Israeli intelligence coordinated with Dutch intelligence agency AIVD to recruit an Iranian engineer as a mole who could infect Iran’s enrichment plant near Natanz, Yahoo News reported this week.
The zero trust model explained (SC Magazine, Sep 04 2019)
At its core, Zero Trust marks a move away from the binary security model that focuses on keeping the good guys in and bad guys out, to one that validates every interaction before granting access to resources.
Huawei Accuses US of Cyberattacks, Coercing Employees (SecurityWeek, Sep 04 2019)
Chinese telecom equipment maker Huawei accused U.S. authorities on Wednesday of attempting to break into its information systems and of trying to coerce its employees to gather information on the company.
Palo Alto Networks intends to acquire Zingbox for $75M (TechCrunch, Sep 04 2019)
With Zingbox, the company gets IoT security chops, something that is increasingly important as companies deploy internet-connected smart devices and sensors.