Privacy

GUEST ESSAY: Why rigorous vulnerability management is crucial to protecting critical systems

By Trishneet Arora

As companies accelerate their reliance on agile software development, cloud-hosted IT infrastructure and mobile applications, vulnerability management (VM) has an increasingly vital security role to play.

Not only does VM contribute to the safety and security of an organization’s network and infrastructure, it also helps ensure infrastructure performance is optimized.

An efficient VM solution will reduce the time and manpower resources required to maintain an effective cybersecurity infrastructure, thereby reducing the risk for enterprises.

VM is a well-known and mature segment of cybersecurity. Despite this, many organizations manage incomplete or out-of-date VM technologies to protect critical data assets.

When creating new strategies for VM, it is important to consider a few best practices:

•VM includes multi-layered capabilities, requires a “continuous improvement” mentality, and must be implemented enterprise wide (including mobile, internet-based applications and cloud assets) to be effective.

GUEST ESSAY: The case for acknowledging — and bridging — the security gap between IT vs OT

By Christopher Britton

My many years working with companies dealing with significant disruptions in the cybersecurity space has taught me a lot. The more I learn, the more I understand the inherent vulnerabilities facing organizations across the world.

The convergence of information technology (IT) and operational technology (OT) is a double-edged sword for critical infrastructure sectors – despite all its benefits, IT/OT convergence is not without its risks. These risks have become even more pronounced as ransomware attacks reach record-breaking highs.

Critical infrastructure sectors, such as energy and water, have never seemed more in the crosshairs – so much so that they have become the focus of recent Biden administration cybersecurity initiatives. In case of crisis, organizations need a plan, which begins with alignment between teams.

Crossing the Chasm

It has been more than a decade since Gartner first highlighted the challenges and benefits of IT/OT convergence. The promises of IT/OT convergence include lower costs, enhanced performance and the orchestration of systems through integration and automation, but the challenges include increased complexity, limits with scalability, and new cybersecurity risks. For example, OT environments include devices installed with legacy operating systems, which can be difficult to integrate and secure.

GUEST ESSAY: Here’s why penetration testing has become a ‘must-have’ security practice

By Abhishek Kokate

A reported loss of $171 Million. Huge sum, right?

Yes, and that is what Sony exactly lost when they were hacked and the personal info of every one of its customers leaked in 2011. This came to the news because Sony is one of the biggest names on the planet. Every second, even while you are reading this article, a hacker is trying to hack a site.

Many do not make it to the news, many close down and many are no way concerned, because they think they are safe. I am sure you do care for your site and digital assets. And, that is why you are here, thank you for being here. Let us run you through the various aspects of penetration testing, or pen test, and why it is a critical component to protect a company’s network.

A pen test is a simulated cyber attack on your systems to identify the loopholes that hackers can exploit. These can be applications, IoT, Networks, API etc.

Now, let me give you a few reasons, why pen testing has emerged as a “must-have” security practice.

GUEST ESSAY: 6 steps any healthcare organization can take to help mitigate inevitable cyber attacks

By Don Boian

The headlines are disturbing: Breach of patient records; Surgeries and appointments cancelled due to IT outage; and even, Death attributed to ransomware attack on hospital.

The risks are real, and the impact of cybersecurity events continues to grow.

A cyber catastrophe may seem inevitable, but there are basic practices and actionable steps any healthcare organization can take to begin reducing the clear and present risk of being impacted by a cybersecurity event.

Note that I say, “reduce your risk,” not eliminate it. While some product and sales professionals may try to convince you they can eradicate the chance your data will be breached or systems infected with malware, that’s unfortunately too optimistic and short-sighted given today’s threat landscape.

However, all is not lost if your healthcare organization is starting its cybersecurity journey, or even if you have a mature cybersecurity program.

GUEST ESSAY – Here’s how web-scraping proxies preserve anonymity while aiding data access

By Andy Larson

Data helps digital businesses make meaningful decisions and fast-track their growth in a global market so that companies that are skilled at harvesting data regularly and consistently tend to grow faster than those that only involve data scantily in making decisions.

This has made data extraction one of the most crucial aspects of what makes a company strive in today’s economy.

Due to this importance and the fact that web scraping comes with its many challenges, several tools have been developed to make the process easier and less cumbersome.

Some of these tools are proxies. While there are several types of proxies, we can easily group them into two categories based on the types of internet protocols (IP) they offer.

These two categories are data center and residential proxies. And today, we will see what they are, how they are used, and whether there is a much better alternative to these proxies.

Proxies defined

Proxies are servers or computers that act as intermediaries and help route your requests to target destinations.

They stand between internet users and their target and help to accept connections, conceal the user’s IP address and deliver the connections to the target servers discreetly.

GUEST ESSAY: The case for shifting to ‘personal authentication’ as the future of identity

By John Callahan

I currently have over 450 accounts that use passwords combined with a variety of two-factor authentication methods.

I don’t know every password; indeed, each password is long, complex and unique.

In effect, my passwords are now “keys” — and I must authenticate across many accounts, multiple times per day, on a variety of device platforms.

Only a dozen or so of my accounts get authenticated via self-hosted services. This is an emerging form of personal authentication, if you will, that represents the future of identity.

These accounts share a common authentication manager, also self-hosted, that uses OpenID Connect (OIDC). When I try to log into one of these self-hosted accounts, such as an address book web app, I am redirected, via OIDC, to the self-hosted identity manager and prompted to login.

After a successful login, I am redirected back to my original self-hosted account (e.g., the address book web app). It is my own “login with me” service implemented as a personal login-as-a-service (LaaS) like “Login with Google” or “Login with Facebook” but self-hosted instead.

GUEST ESSAY: Here’s why EDR and XDR systems failed to curtail the ransomware wave of 2021

By Eddy Bobritsky

Looking back, 2021 was a breakout year for ransomware around the globe, with ransoms spiking to unprecedented multi-million dollar amounts.

All this while Endpoint Detection and Response system (EDR) installations are at an all-time high. EDR systems are supposed to protect IT system endpoints against these very malware, ransomware, and other types of malicious code

Despite investing in some of the best detection and response technologies, companies with EDRs are still experiencing ransomware attacks. Surprisingly, during the same timeframe in which EDRs became more popular, not only have malware and ransomware attacks become more frequent, it now takes an average of 287 days to detect and contain a data breach, according to IBM’s 2021 Cost of a Data Breach Report 2021.

Infection required

So, why is this happening if so many companies are adopting EDR and XDR solutions, which are supposed to neutralize these threats?

In short, it’s just about the way EDRs and XDRs work. EDRs, by design, aren’t really equipped to prevent 100 percent of malware and ransomware attacks.

When most EDRs detect malicious behavior, they develop a response in order to stop the attack from causing more damage.

« Newer Articles

Older Articles »

The Last Watchdog