Home Podcasts Videos Guest Posts Q&A My Take Bio Contact ☰
 

Best Practices

 

GUEST ESSAY: A roadmap for the finance teams at small businesses to improve cybersecurity

By Neil Taurins

If you’re a small business looking for the secret sauce to cybersecurity, the secret is out: start with a cybersecurity policy and make the commitment to security a business-wide priority.

Related: SMBs too often pay ransom

Small businesses, including nonprofit organizations, are not immune to cyberattacks. The average cost of a cybersecurity breach was $4.45 million in 2023, according to IBM’s Cost of a Data Breach Report, and over 700,000 small businesses were targeted in cybersecurity attacks in 2020, according to the Small Business Association.

Nonprofits are equally at risk, and often lack cybersecurity measures. According to Board Effect, 80% of nonprofits do not have a cybersecurity plan in place.

Given the risk involved, small businesses and nonprofits must consider prioritizing cybersecurity policies and practices to stay protected, retain customers, and remain successful. Financial information is one of the most frequently targeted areas, so it’s crucial

Comment | Read | September 25th, 2023 | Best Practices | Guest Blog Post | Privacy | Steps forward | Top Stories

MY TAKE: As network perimeters shift and ecosystems blend, the role of MSSPs solidifies

By Byron V. Acohido

Deepening interoperability of AI-infused systems – in our buildings, transportation grids, communications systems and medical equipment — portend amazing breakthroughs for humankind.

Related: The coming of optical infrastructure

But first businesses must come to grips with the quickening convergence of their internal and external computing resources. And that’s no small task.

I had the chance to discuss this with Shinichi Yokohama, NTT Global CISO and John Petrie, Counselor to the NTT Global CISO, at RSA Conference 2023. It was a rare opportunity to get the perspective of senior executives responsible for protecting a Fortune 100 global enterprise.

We discussed how the boundaries between in-company and out-of-company IT infrastructure have become increasingly blurred making network security more challenging than ever. For a full drill, please view the accompanying videocast. Here are a few takeaways:

A converged ecosystem

Cloud migration and rapid software development were both on a rising curve when Covid 19 hit and the global economy suddenly shut down in 2020. As companies adjusted in the post pandemic operating environment, Internet-centric services rose to the fore.

This accelerated the convergence of on-premises and cloud-hosted IT infrastructure. Today, data storage and processing power are prominently

Comment | Read | July 19th, 2023 | Best Practices | For technologists | Podcasts | Top Stories | Videos

STEPS FORWARD: Can ‘CNAPP’ solutions truly unify cloud, on-premises best cybersecurity practices?

By Byron V. Acohido

A fledgling security category referred to as Cloud-Native Application Protection Platforms (CNAPP) is starting to reshape the cybersecurity landscape.

Related: Computing workloads return on-prem

CNAPP solutions assemble a varied mix of security tools and best practices and focuses them on intensively monitoring and managing cloud-native software, from development to deployment.

Companies are finding that CNAPP solutions can materially improve the security postures of both cloud-native and on-premises IT resources by unifying security and compliance capabilities. However, to achieve this higher-level payoff, CISOs and CIOs must first bury the hatchet and truly collaborate – a bonus return.

In a ringing endorsement, Microsoft recently unveiled its CNAPP offering, Microsoft Defender for Cloud; this is sure to put CNAPP on a rising adoption curve with many of the software giant’s enterprise customers, globally. Meanwhile, Cisco on May 24 completed its acquisition of Lightspin, boosting its CNAPP capabilities, and Palo Alto Networks has continued to steadily sharpen its CNAPP chops, most recently with the acquisition of Cider Security.

At RSA Conference 2023, I counted at least 35 other vendors aligning their core services to CNAPP, in one way or another;

Comment | Read | July 17th, 2023 | Best Practices | For technologists | My Take | Privacy | Steps forward | Top Stories

GUEST ESSAY: Taking a fresh approach to privileged access management — to curtail abuse

By Ravi Srivatsav

To be productive in an interconnected work environment, employees need immediate access to numerous platforms, both on- and off-premises.

Related: Why SMBs need to do PAM well

Keeping track of user activity and effecting proper on- and off-boarding are becoming more and more difficult, even as unauthorized access via unused, expired, or otherwise compromised access credentials has become the number one cybersecurity threat vector.

Some nine out of ten cyberattacks are estimated to begin with a threat actor gaining unauthorized access to a computer system via poorly managed access credentials.

The sophistication of cyberattacks is perpetrated through unused, old, expired, and otherwise mismanaged access credentials are increasing by the minute, at the same time as it’s becoming challenging to respond to these attacks in an organized and timely manner.

Context needed

Organizations that are used to workflow-based access systems or ticket-based systems, i.e. traditional Privileged Access Management (PAM,) must now make a big cultural shift. PAM enables granular access and monitors, detects, and alerts instances of unauthorized access through policy guardrails.

However, while PAM and other legacy access management systems do alert to unauthorized access, these warnings lack a clear picture of the user’s intent and the context behind the alert.

Comment | Read | June 21st, 2023 | Best Practices | For technologists | Guest Blog Post | Privacy | Top Stories

News Alert: ThriveDX’s Cyber Academy for Enterprise meets talent shortage, promotes inclusion

Miami, Fla. – June 20, 2023 –  ThriveDX, the leader in cybersecurity and digital skills training, today announced the official launch of its new Cyber Academy for Enterprise. This innovative solution, part of the company’s Human Factor Security suite, empowers organizations to reskill and upskill employees for cybersecurity positions while also attracting diverse external candidates, simultaneously addressing the growing talent and diversity gaps in the cyber industry.

Cyber Academy for Enterprise is more than a cybersecurity training program – it’s a complete solution that enables businesses and government agencies to cultivate their internal talents while simultaneously attracting diverse external candidates for cybersecurity positions.

Designed for an end-to-end cybersecurity learning journey, the program offers pre-training screening, intensive training, and post-training matching to facilitate an efficient talent acquisition and development process.

“The cybersecurity talent shortage and lack of diversity, is one of the biggest challenges of human resources and cybersecurity leaders. Effective reskilling of employees demands considerable investment, and recruiting diverse talent requires a comprehensive understanding of

Comment | Read | June 20th, 2023 | Best Practices | For consumers | For technologists | Steps forward

News Alert: W3C advances technology to streamline payment authentication

Cambridge, Mass., June 15, 2023. The World Wide Web Consortium today announced a standardization milestone for a new browser capability that helps to streamline user authentication and enhance payment security during Web checkout. Secure Payment Confirmation (SPC) enables merchants, banks, payment service providers, card networks, and others to lower the friction of strong customer authentication (SCA), and produce cryptographic evidence of user consent, both important aspects of regulatory requirements such as the Payment Services Directive (PSD2) in Europe.

Publication of Secure Payment Confirmation as a Candidate Recommendation indicates that the feature set is stable and has received wide review. W3C will seek additional implementation experience prior to advancing this version of Secure Payment Confirmation to Recommendation.

Customer authentication

For the past 15 years, e-commerce has increased as a percentage of all retail sales. The COVID pandemic appears to have slightly accelerated this trend. Improvements to in-person payment security and other factors have led to ongoing increases in online payment fraud.

To combat online payment fraud growth, Europe and other jurisdictions have begun to mandate multifactor authentication for some types of payments. Though multifactor authentication reduces fraud, it also tends to increase checkout friction, which can lead to cart abandonment (cf. for example, Microsoft merchant experiences with SCA under PSD2).

In 2019 the Web Payments Working Group began work on Secure Payment Confirmation to help fulfill Strong Customer Authentication requirements with low checkout friction. Stripe conducted a pilot with an early implementation of SPC and, in March 2020 reported that, compared to one-time passcodes (OTP), SPC authentication led to an 8% increase in conversions at the same time checkout was 3 times faster.

W3C continues to receive feedback about Secure Payment Confirmation through pilot programs, including a second experiment by Stripe. The Web Payments Working Group anticipates more experimental data will be available by September 2023.

Comment | Read | June 15th, 2023 | Best Practices | Privacy | Steps forward | Uncategorized

News alert: Cybersixgill introduces generative AI for Dark Web threat intelligence gathering

Tel Aviv, Israel – June 14, 2023 – Cybersixgill, the global cyber threat intelligence data provider, announced today Cybersixgill IQ, its new generative AI, representing a significant breakthrough in cyber threat intelligence (CTI). Drawing from the company’s unmatched, deep, dark web data and intelligence, as well as Open Source Intelligence (OSINT) and organizations’ unique attack surface context, the solution stands out from other generative AI cybersecurity offerings and builds on Cybersixgill’s origins firmly rooted in AI.

Cybersixgill IQ leverages state-of-the-art generative AI technologies to serve a broad range of user personas and address an extensive set of business use cases, such as closing the skills gap, improving efficiencies with limited resources, and democratizing CTI for organizations of all sizes and security-maturity levels.

Further, while other generative AI solutions in the market rely on simple integrations with ChatGPT, Cybersixgill IQ leverages AI across its capabilities, enhancing every step of the intelligence process. The solution simplifies access to CTI, making it easier to answer complex intelligence-related questions with readily available, actionable insights.

With its new generative AI, Cybersixgill is redefining the CTI landscape, providing unprecedented access and insights within the industry.

“Generative AI can be a force multiplier, helping organizations derive value from threat intelligence. With Cybersixgill IQ, threat analysts and security professionals can now ask critical questions and get immediate, detailed answers, which can accelerate the value of CTI toward proactive investigations and understanding CVEs, exploits, IOCs and TTPs,” said Jon Oltsik, Distinguished Analyst and Fellow with Enterprise Strategy Group and the founder of the firm’s cybersecurity service. “Failed threat intelligence programs are often the result of threat research outputs that are irrelevant to the organization. With generative AI capabilities such as Cybersixgill IQ, organizations can tailor threat intelligence and generate curated reports customized for the various constituents consuming them, including CISOs, SOC engineers, business managers, and everything in between.”

Comment | Read | June 14th, 2023 | Best Practices | Privacy | Steps forward

Older Articles »