Why CISOs must get better at connecting to the rest of the company

Corporate security experts need to emerge from behind their physical cubicles and their digital firewalls to ensure that new technologies don’t create new vulnerabilities that could threaten their jobs, according to two executive-focused panels Monday at the RSA cybersecurity conference in San Francisco. Firms often fail to implement security measures amid their transition to the cloud, or when they implement the accelerated software production strategy known as DevOps, because security leaders fail to communicate with other departments, panelists said. “Because [new tools] are enabling business in a more rapid fashion, CISOs need to figure out how to turn security from ‘the business of no’ into something that enables functions,” said Kurt Hagerman, an executive adviser at the consultancy firm Coalfire. “You have to tie the value of your security program to the business. And that’s a skill a lost of CISOs today lack.” Too few companies have leaders who work together […]

The post Why CISOs must get better at connecting to the rest of the company appeared first on CyberScoop.

Continue reading Why CISOs must get better at connecting to the rest of the company

IBM interns find 19 vulnerabilities in corporate check-in systems

A pair of precocious interns at IBM’s red-teaming unit has found 19 previously undisclosed vulnerabilities in the automated systems that companies use to check visitors into their facilities. A hacker exploiting the security flaws could access visitor logs, contact information, and other company data, and use that access to go after corporate networks, the IBM X-Force Red researchers said. The study of five popular visitor-management systems is a warning of the risk of automating common societal tasks without security precautions. These systems are supplanting security guards as an efficient way of enabling access to a building, and apparent negligence in their architecture leaves them vulnerable. The interns, Hanna Robbins and Scott Brink, are students at the University of Tulsa and the Rochester Institute of Technology, respectively, according to their LinkedIn profiles. Robbins and Brink found default administrative login credentials that would give attackers complete control of a visitor-management application. They […]

The post IBM interns find 19 vulnerabilities in corporate check-in systems appeared first on CyberScoop.

Continue reading IBM interns find 19 vulnerabilities in corporate check-in systems

Pay the ransom? Corporate lawyers say meeting some hackers’ demands may be worth it

Conventional wisdom says ransomware victims shouldn’t pay their attackers, but a panel of legal experts suggested Thursday that standing firm might not always be the smartest play in the real world. FBI officials, corporate bigwigs and public sector security bosses in recent years all have advised their colleagues to keep their wallets closed when ransomeware hits. There’s no honor among thieves, the logic goes, and even if you pay hackers to buzz off, who’s to say they will follow through on promises to unlock encrypted data? But there are scenarios in which small and medium-sized businesses should carefully consider their decision, Mark Knepshield and Matthew Todd said during a panel discussion at the Legalweek conference in New York. “I would say, if it’s small amount, pay it,” said Knepshield, a senior vice president at insurer McGriff, Seibels and Williams. “It’s likely just be the easiest way out of your situation.” In a poll surveying […]

The post Pay the ransom? Corporate lawyers say meeting some hackers’ demands may be worth it appeared first on CyberScoop.

Continue reading Pay the ransom? Corporate lawyers say meeting some hackers’ demands may be worth it

Meet the New Imperva – Defending Your Business Growth Today and Tomorrow

Today’s Imperva is a champion in the fight to secure data and applications, wherever they reside. The threat landscape is dangerous and ever-changing, but our thousands of customers know they can count on Imperva to protect them. No wonder our so… Continue reading Meet the New Imperva – Defending Your Business Growth Today and Tomorrow

Securing Social / Locking Login / Armoring Authentication

Authentication might be the single biggest hazard for web security over the next decade. It’s not that the fundamentals of authentication are particularly challenging; we’ve understood the basic principles behind password management, push-based authori… Continue reading Securing Social / Locking Login / Armoring Authentication

Securing Social / Locking Login / Armoring Authentication

Authentication might be the single biggest hazard for web security over the next decade. It’s not that the fundamentals of authentication are particularly challenging; we’ve understood the basic principles behind password management, push-based authorization, and device certificates for some time…. Continue reading Securing Social / Locking Login / Armoring Authentication

The smaller, the better: Corporate CISOs turn to invite-only meetings to compare notes

If you are a chief information security officer, the best place to meet your peers may not be at the big events in Las Vegas, San Francisco, or the traveling roadshow coming through your town. It may be at the restaurant around the corner. Corporate security executives are beginning to favor exclusive, invite-only meetings where they trade ideas with other security bosses on how to protect business secrets, mainly as a way to fight the fatigue that comes from an onslaught of sales pitches. Chief information security officers at Fortune 500 firms receive hundreds of sales calls, emails and LinkedIn messages every month from vendors hawking the latest technology promising to protect them from the next major breach. But many CISOs working 60-plus hours a week don’t have time to sit down to listen to a pitch and, when they do, the technology often fails to impress. So they’re seeking […]

The post The smaller, the better: Corporate CISOs turn to invite-only meetings to compare notes appeared first on CyberScoop.

Continue reading The smaller, the better: Corporate CISOs turn to invite-only meetings to compare notes