Home Podcasts Videos Guest Posts Q&A My Take Bio Contact ☰
 

Privacy

 

GUEST ESSAY: Cyber insurance 101 — for any business operating in today’s digital environment

By Cynthia Lopez Olson

Cyberattacks are becoming more prevalent, and their effects are becoming more disastrous. To help mitigate the risk of financial losses, more companies are turning to cyber insurance.

Related: Bots attack business logic

Cyber insurance, like other forms of business insurance, is a way for companies to transfer some of numerous potential liability hits associated specifically with IT infrastructure and IT activities.

These risks are normally not covered by a general liability policy, which includes coverage only for injuries and property damage. In general, cyber insurance covers things like:

•Legal fees and expenses to deal with a cybersecurity incident

•Regular security audit

•Post-attack public relations

•Breach notifications

•Credit monitoring

•Expenses involved in investigating the attack

•Bounties for cyber criminals

In short, cyber insurance covers many of the expenses that you’d typically face in the wake of cybersecurity event. …more

Comment | Read | January 20th, 2020 | Best Practices | For consumers | For technologists | Guest Blog Post | Privacy | Steps forward

MY TAKE: Why it’s now crucial to preserve PKI, digital certificates as the core of Internet security

By Byron V. Acohido

For decades, the cornerstone of IT security has been Public Key Infrastructure, or PKI, a system that allows you to encrypt and sign data, issuing digital certificates that authenticate the identity of users.

Related: How PKI could secure the Internet of Things

If that sounds too complicated to grasp, take a look at the web address for the home page of this website. Take note of how the URL begins with HTTPS.  The ‘S’ in HTTPS stands for ‘secure.’ Your web browser checked the security certificate for this website, and verified that the certificate was issued by a legitimate certificate authority. That’s PKI in action.

As privacy comes into sharp focus as a priority and challenge for cybersecurity, it’s important to understand this fundamental underlying standard.

Because it functions at the infrastructure level, PKI is not as well known as it should be by senior corporate management, much less the public. However, you can be sure cybercriminals grasp  the nuances about PKI, as they’ve continued to exploit them to invade privacy and steal data.

Here’s the bottom line: PKI is the best we’ve got. As digital transformation accelerates, business leaders and even individual consumers are going to have to familiarize themselves with PKI and proactively participate in preserving it. The good news is that the global cybersecurity community understands how crucial it has become to not just preserve, but also reinforce, PKI. Google, thus far, is leading the way. …more

Comment | Read | December 9th, 2019 | Best Practices | For consumers | For technologists | Privacy | Steps forward | Top Stories

Last Watchdog’s IoT and ‘zero trust’ coverage win MVP awards from Information Management Today

By Byron V. Acohido

I’m privileged to share news that two Last Watchdog articles were recognized in the 2019 Information Management Today MVP Awards. My primer on the going forward privacy and security implications of IoT — What Everyone Should Know About the Promise and Pitfalls of the Internet of Things — won second place in the contest’s IoT Security category.

In addition, my coverage of how the zero trust authentication movement is improving privacy and security at a fundamental level — Early Adopters Find Smart ‘Zero Trust’ Access Improves Security Without Stifling Innovation — won third place in the contest’s Hardware and Software Security category. I’ve been paying close attention to privacy and cybersecurity since 2004, first as a technology reporter …more

Comment | Read | December 5th, 2019 | For consumers | For technologists | My Take | Privacy | Top Stories

SHARED INTEL: How ‘memory attacks’ and ‘firmware spoilage’ circumvent perimeter defenses

By Byron V. Acohido

What does Chinese tech giant Huawei have in common with the precocious kid next door who knows how to hack his favorite video game?

Related: Ransomware remains a scourge

The former has been accused of placing hidden backdoors in the firmware of equipment distributed to smaller telecom companies all across the U.S. The latter knows how to carry out a  DLL injection hack — to cheat the game score. These happen to represent two prime examples of cyber attack vectors that continue to get largely overlooked by traditional cybersecurity defenses.

Tech consultancy IDC tells us that global spending on security hardware, software and services is on course to top $103 billion in 2019, up 9.4 percent from 2018. Much of that will be spent on subscriptions for legacy systems designed to defend network perimeters or detect and deter malicious traffic circulating in network logs.

However, the threat actors on the leading edge are innovating at deeper layers. One security vendor that happens to focus on this activity is Virsec, a San Jose-based supplier of advanced application security and memory protection technologies. I had the chance to visit with Willy Leichter, Virsec’s vice president of marketing, at Black Hat 2019.

“There are multiple vectors, lots of different ways people can inject code directly into an application,” Leichter told me. “And now we’re hearing about new threats, throughout the whole supply chain, where there might be malware deeply embedded at the firmware level, or at the processor level,  that can provide ways to get into the applications, and get into the data.”

For a full drill down of our discussion, give a listen to the accompanying podcast. Here are a few key takeways:

Firmware exposures

Firmware is the coding built into computing devices and components that carry out the low-level input/output tasks necessary to enable software applications to run. Firmware is on everything from hard drives, motherboards and routers to office printers and smart medical devices. …more

Comment | Read | November 20th, 2019 | Black Hat Podcasts | For technologists | Podcasts | Privacy | Top Stories

NEW TECH: Silverfort deploys ‘multi-factor authentication’ to lock down ‘machine identities’

By Byron V. Acohido

From the start, two-factor authentication, or 2FA, established itself as a simple, effective way to verify identities with more certainty.

Related: A primer on IoT security risks

The big hitch with 2FA, and what it evolved into – multi-factor authentication, or MFA – has always been balancing user convenience and security. That seminal tension still exists today even as the global cybersecurity community is moving to extend MFA as a key security component in much more complex digital systems spinning out of digital transformation.

One leading innovator in this space is Tel Aviv-based Silverfort. I’ve had a number of conversations with company co-founder and CEO Hed Kovetz over the past couple of years, and I had the chance to meet with him again at Black Hat 2019.

One thing I learned from Kovetz this time was that secure authentication seems destined to play a major role, going forward in verifying, not just human identities, but also machine identities. In terms of baking in security at a fundamental level of future systems, that’s very significant. For a drill down on why that’s so, give a listen to our full discussion in the accompanying podcast. Here are the key takeaways:

A machine’s world

Machines are taking over. A machine, in this context, is any piece of hardware or software that can accept and execute instructions. This includes the beefy servers humming along in vast data centers and providing the infrastructure for cloud services.

And it also include software: the modular “microservices” written by third-party developers; the software “containers” inside of which these microservices get mixed and matched; and the billions of APIs that enable two disparate machines to exchange data. In this realm, the identity of each and every machine must be verified, or chaos would rule.

Machine identities are verified by digital certificates that leverage the public key infrastructure (PKI), a framework for encrypting data and authenticating web entities. These identity certificates — and the encrypted keys to authenticate them – get issued bu Certificate Authorities (CAs) —  vendors that diligently verify the authenticity of websites. …more

Comment | Read | November 6th, 2019 | Black Hat Podcasts | For technologists | New Tech | Privacy

MY TAKE: How blockchain technology came to seed the next great techno-industrial revolution

By Byron V. Acohido

Some 20 years ago, the founders of Amazon and Google essentially set the course for how the internet would come to dominate the way we live.

Jeff Bezos of Amazon, and Larry Page and Sergey Brin of Google did more than anyone else to actualize digital commerce as we’re experiencing it today – including its dark underbelly of ever-rising threats to privacy and cybersecurity.

Related: Securing identities in a blockchain

Today we may be standing on the brink of the next great upheaval. Blockchain technology in 2019 may prove to be what the internet was in 1999.

Blockchain, also referred to as distributed ledger technology, or DLT,  is much more than just the mechanism behind Bitcoin and cryptocurrency speculation mania. DLT holds the potential to open new horizons of commerce and culture, based on a new paradigm of openness and sharing.

Some believe that this time around there won’t be a handful of tech empresarios grabbing a stranglehold on the richest digital goldmines. Instead, optimists argue, individuals will arise and grab direct control of minute aspects of their digital personas – and companies will be compelled to adapt their business models to a new ethos of sharing for a greater good.

At least that’s one Utopian scenario being widely championed by thought leaders like economist and social theorist Jeremy Rifkin, whose talk, “The Third Industrial Revolution: A Radical New Sharing Economy,” has garnered 3.5 million views on YouTube. And much of the blockchain innovation taking place today is being directed by software prodigies, like Ethereum founder Vitalik Buterin, who value openness and independence above all else.

Public blockchains and private DLTs are in a nascent stage, as stated above, approximately where the internet was in the 1990s. This time around, however, many more complexities are in play – and consensus is forming that blockchain will take us somewhere altogether different from where the internet took us.

“With the Internet, a single company could take a strategic decision and then forge ahead, but that’s not so with DLT,” says Forrester analyst Martha Bennett, whose cautious view of blockchain we’ll hear later. “Blockchains are a team sport. There needs to be major shifts in approach and corporate culture, towards collaboration among competitors, before blockchain-based networks can become the norm.”

That said, here are a few important things everyone should understand about the gelling blockchain revolution. …more

Comment | Read | November 4th, 2019 | For consumers | For technologists | My Take | Privacy | Steps forward | Top Stories

SHARING INTEL: Why full ‘digital transformation’ requires locking down ‘machine identities’

By Byron V. Acohido

Digital commerce has come to revolve around two types of identities: human and machine.

Great effort has gone into protecting the former, and yet human identities continue to get widely abused by cyber criminals. By comparison, scant effort has gone into securing the latter. This is so in spite of the fact that machine identities are exploding in numbers and have come to saturate digital transformation.

Related: IoT exposures explained

I’ve conversed several times with Jeff Hudson about this. Hudson is CEO of Salt Lake City, UT-based Venafi, a leading provider of machine identity protection solutions. Each time I’ve come away with a better grasp of how machine identities have come to play such a pivotal role in the IT systems taking us forward – and yet how vulnerable they remain to attack in the current environment.

We had a chance to meet again at Black Hat 2019. For a full drill down of our wide-ranging discussion please give a listen to the accompanying podcast. Here are a few key takeaways:

Machines on the march

Cloud computing and DevOps have given rise to a whirlwind of new types of machines. A machine, in this context, refers to any piece of hardware or software that can accept and execute instructions. The hardware servers humming along in vast data centers are, indeed, machines.

And so are the modular “microservices” written by far-flung third-party developers, who specialize in mixing, matching and reusing microservices assembled inside of software “containers,” which are another type of machine. APIs, the interface coding that allows two different machines to exchange data – for instance, an IoT device and a command server — are machines as well. This is how cool new digital services are getting spun up at high velocity. …more

Comment | Read | October 16th, 2019 | Black Hat Podcasts | For technologists | New Tech | Podcasts | Privacy | Top Stories

Older Articles »