Home Blog Page 166

Personal Data of Over 540,000 Sports Referees Leaked in Failed Ransomware Attack

Ransomware attacks, LockBit Ransomware

ArbiterSports, an official software provider for the NCAA and other sports leagues, revealed that it is a recent victim of a failed ransomware attack, which leaked the personal information of over 540,000 referees and registered members. In an official statement, the company stated that its security teams identified the unauthorized access to certain systems in its network and an attempt to encrypt them.

Foiled Ransomware Attack

Despite detecting and blocking the attackers from encrypting the systems, ArbiterSports stated that hackers pilfered a backup copy of its database. The exposed database contained data from ArbiterGame, ArbiterOne, and ArbiterWorks web applications used by sports leagues to manage their schedules. The compromised data included account usernames and passwords, names, addresses, birth dates,  email addresses, and Social Security numbers. The passwords and Social Security numbers were encrypted in the file, but the unauthorized party was able to decrypt the data.

“Although we were able to prevent devices from being encrypted, the unauthorized party demanded payment in exchange for deleting the files that were obtained. We reached an agreement and obtained confirmation that the unauthorized party deleted the files,” ArbiterSports said.

ArbiterSports notified the law enforcement authorities for further investigation. It is also implementing additional security measures to avert further attacks.

Ransomware: A Lucrative Attack Model

A report published by Coalition, a provider of cyber insurance services in North America, revealed that ransomware incidents accounted for 41% of cyber insurance claims filed in the first six months of 2020. The “H1 2020 Cyber Insurance Claims Report” highlighted that the average ransomware demand increased by 100% from 2019 through 2020. Several organizations stated that ransomware attacks are the most prevalent and destructive of all cyberthreats.

“The severity of ransomware attacks increased by 47%, with a 100% spike from 2019 to Q1 2020. New and malicious strains of ransomware variants such as Maze and DoppelPaymer are leveraged to demand heavy ransom and expose organizational data. An average Maze demand is six times larger than the overall average ransom demand,” the report stated.

Nearly Half the Employees Access Corporate Data on Personal Devices

BYODs

Nearly half the employees access corporate data on their personal devices. According to Trend Micro’s study titled “Head in the Clouds,” 42% of workers in India and 46% of workers in New Zealand use their personal devices to access company data often via services and applications hosted in the cloud. The study showed that home devices and their apps are representing a major weak link in the corporate cybersecurity chain as the lines between work and home life increasingly blur.

At a time when the workforce has been functioning remotely, and attacks against companies and employees with privileged access are on the rise, the trend of employees using personal smartphones, tablets, and laptops may be less secure compared to their corporate equivalents. There are also higher chances that their home network is exposed to vulnerable IoT apps and gadgets.  The report also highlighted that more than a third of 13,000 remote workers surveyed did not have basic password protection on all personal devices.

The study also found that more than half of remote workers have IoT devices connected to their home network, where a sizable number of employees are using lesser-known brands. The problem with lesser-known brands is the vulnerability it poses like unpatched firmware vulnerabilities and insecure logins.

“IoT has empowered simple devices with computing and connectivity, but not necessarily adequate security capabilities”, said Bharat Mistry, Principal Security Strategist at Trend Micro. “They could actually be making hackers’ lives easier by opening backdoors via which they could compromise corporate networks. This threat is amplified as an age of mass remote working blurs the lines between private and company devices, putting both personal and business data in the firing line. Now more than ever, it is important that individuals take responsibility for their cybersecurity and that organizations continue to educate their employees on best practice.”

A Cyberpsychological Issue

According to Dr. Linda K. Kaye, an expert in cyberpsychology, “The fact that so many remote workers use personal devices for accessing corporate data and services suggests that there may be a lack of awareness about the security risks associated with this. Tailored cybersecurity training which recognizes the diversity of different users and their levels of awareness and attitudes around risks would be beneficial to help mitigate any security threats which may derive from these issues.”

More than Half of Singapore Businesses Admit that Cybersecurity is on the Back Burner

Singapore

Remote workforce has made business resilience and operations easier. Businesses have reshaped strategies and are now moving forward like a well-oiled machine. They have tried their best to even secure the extended periphery of cybersecurity to the endpoints of the remote workforce. However, with the battle against COVID-19 not seeming to end any time soon and with many businesses being bootstrapped to continue its operations, reports suggest cybersecurity is going on the back burner instead of being in the driver’s seat.

According to a Barracuda report, Singapore, which ranks in the top 5 for the most prepared in cybersecurity readiness, is also feeling complacent with more than half (51%) of the businesses saying that cybersecurity is now a secondary consideration despite the sharp rise in the number of threats to the remote workforce.

 Key Highlights

  • 43% of Singapore organizations have cut their cybersecurity budgets to save costs as they responded to the pandemic.
  • 39% lacked IT resources or time to upgrade their IT infrastructure in the shift to a remote working model.
  • 48% of respondents said their employees are not properly trained in the cyber risks associated with remote working.
  • 80% plan to provide improved online cybersecurity training and awareness for remote working staff.

Causes for Complacency

The report revealed that more than complacency, it was the shoestring budget that turned out to be the key factor in this case. The findings showed that 43% of Singapore businesses and organizations cut their cybersecurity budgets to save costs while responding to the pandemic. Additionally, 39% of the businesses had inadequate IT resources or little to no time to upgrade their IT infrastructure in the shift to a remote working environment. This highlights that spending on critical controls needs prioritization in the budget discussions held across various board rooms. Organizations can consider consolidating cybersecurity measures by investing in specialized third-party vendors, adopting SaaS-based tools, or assessing how automation could help free budget and resources for security.

The Need for Added Protection

Singapore cybersecurity
Barracuda Report Findings

Employees are often more distracted when working remotely and couple that with a lack of protection on BYOD devices and networks, it makes them more susceptible to cybersecurity attacks. Singapore also reported staggering numbers when it came to reporting cyber incidents. Nearly 51% of the organizations surveyed reported a minimum of at least one data breach or cybersecurity incident since the shifting to remote work. Of these, 51% reported that email phishing attacks was the primary source of attacks, which also emphasizes the need of additional security training for remote workers as human is generally considered as the weaker link in the cybersecurity chain.

Talking about training, 48% of Singapore respondents said their employees are underprepared or not properly trained in the cyber risks associated with remote working. In addition to this, 50% said they lacked confidence in the security of their web applications, which is another major target for malicious actors seeking access to corporate networks and data.

Barracuda Report Findings

The Silver lining

The good news, however, is that most Singapore decision makers are already aware of the problems related to the cybersecurity posture of their remote workforce. This brings clarity and makes the job easier for them to design steps for improvement.

88% of the respondents said that they will need to upgrade their IT infrastructure to improve visibility and productivity, while 85% already knew that cross-industry collaboration was key to improving security standards. Additionally, for being better prepared, 80% respondents were planning to provide improved online cybersecurity training and awareness for remote working staff.

Minnesota Health Care Institutions Affected by Blackbaud Cybersecurity Incident

Minnesota cyberattacks

Blackbaud, a third-party cloud-based service provider, reported a data breach incident in mid-July. However, thousands of Minnesotans are experiencing the ripple effect of the incident as they are receiving the breach notification through email. The letters are being sent to only those individuals whose data, including certain personally identifiable information (PII), fundraiser info, and/or hospital and clinic visit details, have been compromised.

 Key Highlights 

  • Blackbaud security incident affected more than 3 million people around U.S.
  • Certain charities and universities in the U.K. have also been affected by it.
  • An unknown ransomware gang was attempting to encrypt Blackbaud’s systems but were pushed out of the network by Blackbaud’s vigilant security team.
  • The cybercriminals, however, stole an unencrypted data subset from Blackbaud’s systems, which resulted in the massive data breach.

Blackbaud’s Cybersecurity Incident

Blackbaud is particularly known to provide cloud-based fundraising donor management software and database services to thousands of organizations around the world. Its clientele includes some of the top universities, social service nonprofits, health care systems, charitable trusts, and philanthropic organizations of all kinds.

On July 16, 2020, Blackbaud’s internal IT team discovered unauthorized access to its systems. The malicious actor, whose identity is still unknown, reportedly stayed active in Blackbaud’s system between February 7 and May 20, 2020, and may have acquired backups of databases used by its customers. On learning about this incident, Blackbaud informed its customers to stay alert and correspondingly informed the law enforcement authorities about it. On further investigating the incident with the help of cyber forensic experts, Blackbaud’s cybersecurity team linked the malicious actor to a ransomware gang who were attempting to encrypt data on Blackbaud’s system.

Due to the keen observation of some of Blackbaud’s internal cybersecurity personnel, this ransomware attack was averted. However, it was found that certain unencrypted datasets of Blackbaud’s clients were stolen from their systems. This subsequently resulted in one of the biggest data breaches in the state of Minnesota.

Minnesotan Double Whammy

As reported earlier, Blackbaud has a clientele working in health care and non-profit organizations. Thus, two Minnesota based organizations, “Children’s Minnesota Foundation” and “Allina Health” have been severely affected by this data breach. Allina Health has gone forward and informed more than 200,000 of its patients and donors whose data may have been breached in the process. The leaked information of the two organizations potentially contained:

  • Full names
  • Postal addresses
  • Date of birth
  • Appointment dates and doctor names
  • Locations visited, etc.

However, this leaked subset of data did not include:

  • Credit/Debit card information
  • Bank account information
  • Social security numbers (SSN)
  • Any additional medical information, such as diagnosis or treatment plan

Blackbaud takes its commitment to cybersecurity very seriously, and this is evident from how they stopped the ransomware attack before the cybercriminals could encrypt the data. Since it values the privacy of its client’s data, Blackbaud paid the cybercriminal’s demand with a confirmation that the copy they removed from their systems had been destroyed. Blackbaud, with the help of other cybersecurity experts, is now further strengthening their cybersecurity posture to avoid such attacks in the future.

CYBERSEC: Europe’s Most Anticipated Cybersecurity Conference is Here

CYBERSEC Global Cybersecurity Forum 2020

September end will witness one of the most important cybersecurity events in the EU. The 6th edition of the CYBERSEC Global Cybersecurity Forum 2020 will be held from September 28-30, 2020 online. It is one of the most anticipated events covering cybersecurity and cyber policies, and this year, the event goes virtual and is free for everyone. This edition also has a global focus – speakers and attendees from other countries will discuss their cybersecurity challenges.  With an impressive line-up of speakers from NATO, the European Parliament, and other authoritative institutions, the event is well attended every year. This year, the President of the Republic of Estonia, Her Excellency, Kersti Kaljulaid will be one of the principal speakers. One can register for the event here: https://cybersecforum.eu/

This year’s CYBERSEC leitmotif (theme) is: “Together Against Adversarial Internet.” This is aligned to the forum mission which is to enhance cooperation of like-minded countries to secure digital transformation. The event will have four thematic streams (tracks) with prominent figures among the speakers.  The open access to the conference will enable any interested person from all over the world to take part in the event, get insights from big cybersecurity names, and hear about remedies for current cybersecurity dilemmas accelerated by the COVID-19 pandemic.

We live in unprecedented times when the novel Coronavirus pandemic shows clearly the bright and dark sides of digital transformation, as well as the need to cooperate in building a safe cyberspace. “In that light this edition of CYBERSEC will be held under the leitmotif ‘Together Against Adversarial Internet’ – meaning that technologies, although their primary goal is to benefit societies, sometimes play another role as they enable individuals with malicious intent to use them in an adversarial manner, one that hurts rather than benefits societies and economies, and that only an alliance of like-minded partners can stem the rise of malicious actors and authoritarian models of technology deployment as well as secure the cyberspace,” says Izabela Albrycht, Chair of The Kosciuszko Institute and President of the Organizing Committee of the European Cybersecurity Forum – CYBERSEC.

Albrycht is also part of the Advisory Group on emerging and disruptive technologies appointed by NATO Secretary General Jens Stoltenberg.

NATO’s Interest in CYBERSEC

The upcoming CYBERSEC is going to be fundamentally important for the public debate on technology development directions as regards to not only EU but also NATO. Many technologies are dual-use, with both civilian and military applications, hence for some time, NATO has been putting heavy emphasis on establishing policies on innovative solutions, consulting in strategic aspects of disruptive technologies, and trailblazing inventive research. These are the main tasks of the twelve-strong Advisory Group on emerging and disruptive technologies appointed by NATO Secretary-General Jens Stoltenberg; among its members is Izabela Albrycht. In NATO, the person responsible for this process is Deputy Secretary-General of NATO Mircea Geoană, who along with CYBERSEC Chair will be one of the main guests to inaugurate this year’s conference.

Conference Streams

Mirroring past editions, this year’s CYBERSEC will be composed of four thematic streams/tracks. The first one, the State Stream, will focus on the multi-faceted problem of how tech should be regulated for it to develop in a secure manner without slowing down its natural progress. Topics in this Stream include global surveillance, digital governance, and decoupling in the digital supply chain.

The second one, the Future Stream, deals with finding a measured approach to emerging and future technologies and the possibilities and challenges they’ll likely bring to the fore. It will tackle important issues such as quantum computing, threats to digital identity, and human-level artificial intelligence.

Next to it comes the Business Stream, focused on the private sector – the main provider of technology and as such remaining on the very frontline of innovation, research, and development. Here the debates will home in on themes such as countering adversity in the data-driven economy, the role of technology providers in ensuring a peaceful internet, COVID-19 redefining critical sectors of economies.

Finally, there’s the Defence Stream focusing on the technological developments of the military sector and its implications for international security. Attendees can expect subjects such as the military use of 5G, information warfare, and cybersecurity of outer space among others to be discussed on this Stream.

Speaker Line-up

On the speaker front, this year CYBERSEC features personalities such as Margrethe Vestager (EVP, European Commission), Mircea Geoană (Deputy Secretary-General, NATO), Sir Julian King (Former European Commissioner for Security Union), Flavio Aggio (Chief Information Security Officer, WHO), Carine Claeys (EU Special Envoy for Space; Head of the Space Task Force, EEAS), Michael Chertoff (Co-Chair, Global Commission on the Stability of Cyberspace; Former US Secretary of Homeland Security), and from Asia and Pacific region: Samir Saran (President, Observer Research Foundation (ORF), India), Abigail Bradshaw (Head, Australian Cyber Security Centre),  Tobias Feakin (Ambassador for Cyber Affairs and Critical Technology, Australia), Magda Chelly (Head, Cyber Risk Consulting Marsh Asia, Founder of WoSEC Singapore, Brand Ambassador of CYBERSEC FORUM 2020), and Shin Oya (Senior Consulting Fellow, Asia Pacific Initiative).

Global Focus

While historically, this conference has been centered on Europe, this year’s event will extend its range to discuss and tackle truly global strategic cybersecurity challenges by including high-profile names from Australia, New Zealand, Japan, South Korea, Taiwan, Singapore, India, South Africa, Israel, and the UAE.

It will be also open and free for everyone interested in broadening their knowledge and getting insights about cybersecurity and how new technologies affect geopolitical shifts and strategic competition between global players. For more information about the CYBERSEC Global 2020 and for the registration process, visit https://cybersecforum.eu

CYBERSEC Through the Years

EUROPEAN CYBERSECURITY FORUM – CYBERSEC is one of the leading cybersecurity conferences in Europe, organized by the Kosciuszko Institute since 2015. Throughout its six years of history, CYBERSEC has partnered with important international institutions such as NATO, European Commission and European Parliament and has organized 11 editions of CYBERSEC Forums in Europe (Warsaw, Kraków, Katowice and Brussels) and in the United States (Washington) including the participation of renowned figures from different walks of life invested in bringing awareness to cyber threats.

It has also been involved in other region-wide group efforts to provide a secure and safe framework to navigate cyberspace, chief among them the Three Seas Initiative. Furthermore, the EUROPEAN CYBERSECURITY FORUM has been an important advocate voice for a secure rollout of the 5G network, knowledge sharing and upholding good practices in the field of data privacy, and promoting respect in the EU for the NIS Directive among other endeavors.

Through the years, CYBERSEC has hosted 748 speakers from more than 45 countries, more than 400 accredited journalists, enjoyed the support of 293 Partners and Patrons and welcomed more than 5580 participants.

CISO MAG is Media Patron for CYBERSEC Global Cybersecurity Forum 2020.

 

 

Dark Web’s End is Near! Sting Operation Leads to Arrest of 179 Illegal Vendors

BigBasket Allegedly Suffers Data Breach, Customer Data on Dark Web for Sale

An international sting operation by the U.S. and the European law enforcement agencies led to the arrest of 179 darknet vendors and seizure of millions of dollars in cash and virtual currencies, weapons, drugs, and other illegal assets. The operation dubbed as “DisrupTor” was performed in collaboration with the judicial agencies of Austria, Germany, the Netherlands, Sweden, Australia, Canada, the U.K., and the U.S.

The Collaborative Effort

According to a statement released by Europol, officials seized over $6.5 million in both cash and virtual currencies, 64 illicit firearms, including 500 kilograms of drugs like fentanyl, oxycodone, hydrocodone, heroin, cocaine, and other addictive substances. The culprits were arrested in the U.S. (121), Germany (42), the Netherlands (8), the U.K. (4), Austria (3), and Sweden (1). The investigations are still underway as they are yet to find the criminals involved in buying and selling illicit goods on dark web forums.

“This operation follows the takedown in May of last year of Wall Street Market, the world’s then second largest illegal online market in the dark web. Led by the German Federal Criminal Police (Bundeskriminalamt) with the support of the Dutch National Police (Politie) Europol, Eurojust and various U.S. government agencies, this takedown provided investigators with quantitative data and materials to identify suspects behind dark web accounts used for illegal activity,” Europol said.

Say No to Dark Web Market

Europol also warned not to buy illegal goods on the dark web, which expose the victims to dangers like:

  • Dangerous illegal drugs such as fentanyl or counterfeit substances could kill you
  • Become a victim of cyber scammers who are only after your money
  • Exposing your device to damaging malware

The agency also stated that they can track illicit transactions of both buyer and seller on the dark web, and individuals who purchased illicit goods from these sites will be at risk of prosecution globally.

“Law enforcement is most effective when working together, and today’s announcement sends a strong message to criminals selling or buying illicit goods on the dark web: the hidden internet is no longer hidden, and your anonymous activity is not anonymous. Law enforcement is committed to tracking down criminals, no matter where they operate – be it on the streets or behind a computer screen,” Europol added.

Cybersecurity vs Remote Work! CISOs Ignore Security Over Remote Working

active directory
active directory

A research from cybersecurity solutions provider Netwrix revealed the responses of several security leaders globally about the current cyberthreat scenario and how the pandemic and remote working conditions changed their security landscape. The research “2020 Cyber Threats Report” revealed that every fourth organization is concerned that they are exposed to more cyberattacks than before the pandemic.

Surprisingly, 85% of CISOs admitted that they had sacrificed cybersecurity due to a sudden shift to remote work conditions. While 63% reported an increase in the number of cyberattacks, 60% said they found new security gaps due to the distributed work environment. Phishing (48%), admin mistakes (27%), and improper data sharing by employees (26%) are reported as the most common cyberthreats since the transition to remote working.

Other findings include:

  • 25% reported suffering a ransomware or other malware attack during the first three months of the pandemic, while 47% were able to spot it in minutes.
  • Though only 14% of organizations encountered data theft by employees, 66% are anxious about this scenario, compared to just over half, pre-pandemic.
  • Supply chain compromises took the longest to detect; 55% needed days, weeks or even months to flag these incidents.
  • 54% of CISOs admit to lacking the visibility needed to ensure proper data protection.
  • 66% of the IT professionals surveyed regularly report to their executive leadership on the state of cybersecurity. The most common measure used is incident statistics; less than a quarter of respondents calculate financial metrics for their security projects.

The research findings are based on the responses from 937 security decision makers working globally.

Steve Dickson, CEO of Netwrix, said, “The broad disruption to businesses and swift transition to work-from-home caused by the pandemic forced many organizations to prioritize service availability over security. Now that we are all more comfortable with the new normal, IT and security pros should re-examine their earlier decisions with the goal of closing security gaps. This requires identifying sensitive information and reducing its exposure, gaining visibility into user activity, and automating change and configuration auditing to ensure rapid incident detection.”

Also Read: 4 Critical Responsibilities of a CISO Post COVID-19

Ransomware Paralyzes a German Hospital; Patient Dies due to Delayed Aid

Health care data breaches

In a first of its kind, a ransomware attack has been directly held responsible for a person’s death. In view of the consequences of the cyberattack, German prosecutor and police have asserted charges of “Negligent Homicide” in the ongoing investigation against ransomware attackers of Düsseldorf University Hospital. As reports suggest, the attack was unintentional and meant for another University. On realization, the ransomware gang provided the decryption key without demanding a ransom, but not before it led to someone’s fatality.

 Key Highlights 

  • On September 10, 2020, University Hospital Düsseldorf (UKD) was hit by a ransomware attack, mistakenly. The attackers were targeting another University with a similar name.
  • Nearly 30 internal servers were affected in this attack, which limited the health care operations of the hospital to an extent that it had to deregister itself from emergency care providers list.
  • A 78-year old lady in need of immediate critical care was asked to be taken to another hospital in Wuppertal, nearly 19 miles (30kms) away. This delay in medical assistance and re-route to another medical facility probably led to her death.

What Happened

On September 11, 2020, a 78-year old lady from Düsseldorf required emergency medical attention as she faced a ruptured aorta. The lady’s medical history was known and stored on the systems of the health care providers at the Düsseldorf University Hospital. However, the University Hospital was under a ransomware attack that locked out their systems while the lady was being transported to the emergency ward. With the entire hospital system being under a lockdown caused by the cyberattack, the emergency responders in the ambulance carrying the patient were told to shift her to another hospital in Wuppertal, nearly 19 miles (30kms) away. With the unavailability of the patient exact records and data, the doctors at Wuppertal could not do much and the lady, unfortunately, breathed her last.

However, the doctors who attended the lady explained that delay in getting critical medical aid was the primary reason behind her unfortunate demise. It was a no brainer to drive so long when a patient was in dire need of emergency services, but the medics were still following their protocols.

Asserting “Negligent Homicide”

Christoph Hebbecker, a cybercrime prosecutor in the German city of Cologne, told the local media that his office was treating this as a case of “Negligent Homicide” against the ransomware attackers and are further investigating into the matter.

Hebbecker said, “An initial suspicion with regard to negligent homicide is justified”. So far, the investigation for attempted blackmail and computer sabotage has been underway. Further, the exact circumstances that led to the woman’s death will be investigated which will help draw conclusive evidence. But if the delay in services is the primary cause of death then the ransomware attackers can very well be charged with negligent homicide.

McAfee Consumer Security Portfolio Integrates Social Media and Tech Scam Protection

blockchain-based social media, Parental Consent for Minors, Iranian Facebook accounts

With the home, school, and the office now becoming a common space for employees, the attack surface broadens to includes consumers and endpoints. Employees tend to spend more time on social media and are susceptible to tech scams and phishing attacks. To address this, McAfee today announced its latest consumer security portfolio and said the enhanced offering has new features, including integrated social media and tech scam protection. Meeting consumers in their current realities, these new functionalities are designed to protect users from current threats as they navigate professional and personal life from home.

“With the convergence of home, office, and school, today’s consumers need end-to-end device and web protection that secures every aspect of their digital lives,” said Venkat Krishnapur, Vice President of Engineering and Managing Director, McAfee India. “Tailored to the increasingly connected world in which we live, McAfee’s evolved product suite is a holistic approach to securing every facet of the connected consumer’s life.”

Security and Privacy Get a Boost 

According to the McAfee COVID-19 Threat Report: July 2020, from McAfee Labs, there was an average of 375 new threats per minute via malicious apps, phishing campaigns malware, and more.

To address these threats and combat emerging Coronavirus-related scams, McAfee’s product lineup includes the following updates and enhancements:

  • Tech Scam Protection: McAfee WebAdvisor now provides a warning when visiting websites that can be used by cybercriminals to gain remote access to your PC, combatting the reported 128 crore total online fraud loss in India.
  • Advanced Malware Detection: McAfee enhanced its machine learning capabilities to improve overall time to detect emerging threats across devices as well as added protection against file-less threats.

Improving Customer Experience

Consumers default to convenience over security, making protecting themselves online an afterthought until it is too late, and they become compromised. Despite the increase in online frauds during the pandemic, online payments in India have soared, with UPI (Unified Payment Interface) recording close to 1.5 billion transactions in July 2020.

At a time where returning to previous routines is still uncertain and internet usage continues to climb, McAfee recognizes consumers need intuitive solutions that allow them to devote attention to what matters most to them right now, including:

  • A Better User Experience: An improved PC and app experience with easier navigation and readable alerts, and clear call to actions for faster understanding of potential issues.
  • Updated Password Protection: Access iOS applications even faster with automatically filled in user account information and passwords in both apps and browsers on iOS devices.

Safety Now – and Into the Future

As consumers globally continue to settle into a new way of operating, they rely on the internet to live their connected lives- to get work done, seek entertainment, connect with friends and family, conduct purchases, schooling, and more.

Key Features

  • Optimized Product Alerts: Redesigned product alerts, so consumers are better informed about possible security risks, with a single-click call to action for immediate protection.
  • Social Media Protection: To help prevent users from accidentally visiting malicious websites, McAfee now annotates social media feeds across six major platforms – Facebook, Twitter, YouTube, Instagram, Reddit, and LinkedIn.
  • Enhanced App Privacy Check: Consumers can now easily see when mobile apps request personal information, with app privacy now integrated into the main scan of Android devices.

Disclaimer: CISO MAG did not evaluate the products mentioned in this news report. Facts mentioned here were drawn from a McAfee Press Release and CIO MAG shall not be held liable for the performance of this product.

 

 

Key Questions for Implementing Strong Security and Compliance Programs

cybersecurity compliance

To arrive at the right answers, one first needs to ask the right questions! CISOs who discover that their actions do not generate the desired results to strengthen security and compliance postures may not be asking the right questions. Effectively managing data, information risk, and compliance is complex and ever-changing. There are many components and considerations in developing and implementing a robust program that encompasses and integrates all the elements needed to manage risk and achieve one’s compliance objectives effectively. A critical component is making sure to ask the right questions of the right people.

By Jason Taule, Vice President of Standards & CISO, HITRUST

The right questions include those that CISOs should ask themselves as well as the management team, the operations team, and other key stakeholders, including the Board of Directors. CISOs who come up with the questions on their own will likely tailor the questions to their situation and environment — often driven by functional and operational priorities that may not directly line up with the top-line business objectives. More specifically, an ad-hoc approach usually overlooks some of the
core questions that matter in establishing a strong security and compliance posture.

Answer the Right Questions to Drive Business Results

By collaborating with people from across the organization and asking questions focused on risks and controls tied directly back to the business, CISOs can drive decisions that truly get at what the organization needs to achieve the security and compliance postures the business is seeking. This, in turn, leads to an action plan to produce the desired business results.

The ad-hoc approach perpetuates managing the security and compliance program in a reactive fashion — where the focus is only on the immediate situation at hand. How should CISOs avoid situations where they have to ask themselves, “Where did I fail the business?” They can do this by taking a results-driven, proactive approach adopted by others in their industry. They can work with internal stakeholders to adopt a set of questions that demonstrate how to get to the “why” behind their security and compliance programs.

The Pitfalls of Creating Risk Profiles Based Purely on the Technical Environment

A key responsibility for every CISO is to seek the necessary information to understand their company’s security and compliance risks. The resulting risk profile can then be translated into recommendations and options that the internal security team and executive team members can understand, throw their support behind, and take action. Ultimately, it’s about the action; and action must have a purpose more significant than the technical elements that technology leaders lean on.

Early in a CISO’s career, it may seem that the questions to ask to find such information must be explicitly created for the technical environment that’s being secured and the business environment is supported. This, however, could lead to many issues:

  • Misaligned or missing questions
  • Baited or ill-timed questions
  • Yes/no questions that do not provide context
    • Questions that do not go deep enough or don’t connect to tell the full story
  • Questions that do not drive an understanding to get buy-in to act from the business

Instead, what is needed is a list of questions, in the right order, and a projection of what the answers could be, might be, and should be. Projecting the answers helps make sure the questions are on target and presented in an order that will elicit contextualized thinking. This may also result in the need to re-visit the questions once previous assumptions are confirmed or refuted.

Another critical facet is deciding when to ask the questions of each stakeholder. The results of each interview could influence the questions of subsequent discussions. So, the order in which the CISO connects with the stakeholders is critical. And after collecting the answers, the CISO needs to validate the information and investigate unforeseen responses to find out what is reasonable and if any of these provide incorrect information.

Similar to the assumptions made above, the more you understand as you move along this journey, the more likely you’ll want to re-visit other decisions taken along the way. CISOs need to find a delicate balance that is appropriate for their organization, which enables them to ask the right questions first, and methodically answer the questions through an investigatory process that appropriately assesses vulnerabilities. There is no room for poor decision making and misaligned actions.

Questions that Drive Security Action Plans

While well-constructed questions and a strategy for conducting interviews with key stakeholders will produce highly valid answers, there’s still no one-size-fits-all response to risk and security management. However, a consistent, transparent approach that spurs conversation as the organization assesses risk and drives toward decisions and actions will bring your organization closer to reaching the expected/desired responses.

Before engaging others, CISOs should consider their own high-level perspective: What is the organization’s security and compliance posture? Where do those postures need to be? How does the organization get there? Thinking along these lines helps CISOs digest what they hear from others to probe for issues surrounding compliance, risk, and assurance in a way that leads to the “why”:

  • What is our current risk exposure and security posture? What level of risk exposure is acceptable, and what security posture is desirable?
  • Do we have the most appropriate framework?
  • How do we compare to other organizations in our industry?
  • Where do we need to be? How do we select a program and tools that will scale within the organization?
  • Is what we are doing sufficient and, if not, what level of resources do we need to apply?
  • To which partners and customers do we need to provide or obtain security assurances, and what are our processes to do so?
  • What do we need to do to fulfill our due diligence expectations?
  • What do we need to do to qualify for cyber insurance? Can we obtain a better policy and/or reduce our premiums?
  • How do we keep up with new business services, expanded industry/market profiles, emerging threats, and changing regulatory requirements?

The above is just a consolidated sampling of crucial questions that have been an important starting point in my role as a CISO. Every CISO should identify their own set of questions along these lines, and evaluate each of them per the audiences they are meant for. This can include the executive team, the Board of Directors, partners, customers, third-party vendors, and the internal IT security team. The answers will give the CISO a broad perspective on what actions require the highest priority for bolstering the organization’s security, compliance, and privacy postures. We do not need to reinvent the wheel, thanks to others who have demonstrated methods and approaches that can be leveraged – not only to save time, but to ensure the right plans are put in place for the business.

Action Plans Help Implement Mitigating Controls to Manage Risk

While taking this approach, it’s vital to utilize a standard, proven approach—the HITRUST Approach™, as one example. It includes questions created and maintained by risk management experts in conjunction with industry leaders tied to a comprehensive privacy and security framework and world-class assurance program. This helps generate the required answers to drive actions while also identifying and understanding security risks transparently and accurately. The CISO can then better communicate the risks and mitigation options, and the required security and compliance controls and information risk posture.

A two-way approach with all relevant stakeholders combined with a self-assessment approach gives me the answers to do my job as CISO. To promote this I set up a campaign coined as the “Just ask Jason” program. It allows everyone to receive and contribute information and be part of the risk and security management solution. I even printed up buttons that read, “Just ask Jason” and handed them out to the Board as a reminder to keep an open channel for security communication.

It’s all about driving actions that result in implementing controls to manage risk. Each stakeholder within the organization has an answer to one or more questions that will help tell the story and paint the picture an organization needs to achieve security and compliance posture. Once the questions have been asked, we then analyze the answers to understand the necessary controls — using a consistent, independently-proven, and validated approach. CISOs will find that an ad-hoc approach will produce random results. Conversely, CISOs that answer the ultimate question “why?” via an approach described above, will find the results to be closer to what they desire and expect.

To develop strong security and compliance postures, every organization needs a “Just Ask Jason” campaign. For advice on how to set up a similar program for your organization, “Just Ask Jason” Taule by reaching out to him at [email protected] or visiting https://hitrustalliance.net/

About the Author

Jason Taule is an information security luminary who has served in most capacities within the industry. He started in the intelligence and government sectors first consulting to Federal agencies and then serving as inside Chief Security / Privacy Officer both within the Government and at large systems integrators like General Dynamics and CSC. Mr. Taule helped build the original DARPA CERT, helped develop the first computer security programs at the VA and NASA, and revised the Risk Assessment Methodology still used throughout DHHS. He enabled hundreds of systems to earn their accreditations and remain free from compromise. Mr. Taule currently serves as HITRUST VP of Standards and CISO overseeing the development and evolution of the HITRUST CSF to ensure its relevancy and continued sufficiency while also ensuring that HITRUST continues to earn and keep the confidence our customers and third parties who have entrusted us with the safekeeping of their data.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

1...165166167...410Page 166 of 410