Richard Starnes, CISO at Six Degrees, discusses the increasingly pivotal role of today’s CISOs and why, in the face of growing danger from an ever-expanding variety of cyber-attacks, every modern enterprise needs one in place.
In an increasingly tech-savvy world, businesses are redefining the very core of transactions – the signature. With the rise of remote work and global digital transactions, the need for secure and efficient document processing has elevated electronic signatures into a near business-critical fundamental.
You must be a Free member to access this content.
The cybersecurity industry seems addicted to research but isn’t all that good at it. Mining the massive amount of data produced is daunting but crucial to everyone.
Surveys and studies are an important part of marketing form the cybersecurity industry. Cyber Protection magazine receives a lot of them. We read them all. In the two months before the RSA Conference, more than one a day came into our inbox. However, they are not a great source of independent data and insight.
Ignoring the cherry-picked data highlighting a particular company’s product or service, there are a few nuggets that, taken together, produce some interesting insights. Out of 60+ reports, we took a pass on any that were repetitive, were suspect methodologically, or effectively plagiarized from another source. We chose to look at seven with a solid methodology, representation of industry-wide concerns, and originality. The reports came from Dynatrace, Black Kite, SlashNext, Metomic, Originality AI, Logicgate, and Sophos. We found three common themes: The impact of AI on security, government regulation compliance, and understanding of security concerns on the C-suites and board levels.
Understanding security issues.
Almost every study has a common complaint. CISOs say application security is a blind spot at the CEO and board levels. They say increasing the visibility of their CEO and board into application security risk is urgently needed to enable more informed decisions to strengthen defenses.
However, Dynatrace’s study said CISOs fail to provide the C-suite and board members with clear insight into their organization’s application security risk posture. “This leaves executives blind to the potential effect of vulnerabilities and makes it difficult to make informed decisions to protect the organization from operational, financial, and reputational damage.”
Recent news shows the study may have a point. Marriott Hotels admitted that a 2018 breach was the result of inadequate encryption of customer data. In 2018 the company claimed their data was protected by 128-bit AES encryption when customer identity was only protected by an outdated hashing protocol. One can imagine the discussion between the CEO and the IT department:
CEO: is our data encrypted?
IT manager: Yeah, sort of.
CEO: OK, good enough
If the CEO doesn’t understand the difference between a hash and AES encryption, that’s a problem.
And there many be evidence that ignorance is widespread. Apricorn reported that the number of encrypted devices in surveyed companies had dropped from 80 percent to 20 percent between 2022 and 2023. Some of that could be attributed to work-from-home (WFH) growth in companies. It is also likely that companies over-reported what was encrypted simply because they did not understand what “encryption” meant. Once they learned the meaning, adjustments were made.
That lack of a foundational security technology could be a reason for the devastating growth in ransomware in the past two years.
APIs are often overlooked when it comes to securing a company's landscape. We sat down with Andy Grolnick, CEO at Graylog,to discuss the rapidly growing market of API security.
The digital age has ushered in a golden era for small businesses (SMBs).…… Purchase RequiredThis content requires that you purchasemore...
This content requires that you purchase additional access. The price is $1.00 or free for our Premium members.
The name WannaCry still invokes memories of chaos and disaster amongst anyone in the technology world. The anniversary of this widespread attack in May each year has been named Anti-Ransomware Day, to encourage organisations to back up their data and adopt necessary security protections.
Read more...
Ethics in AI is an afterthought in development, making adoption a risky proposition. New industry standards, such as ISO/IEC 42001, and rigorous testing for generative AI models, guided by established ethical principles in AI management, can ease apprehension surrounding the advancement of this truly transformative technology.
Huge hazards and pitfalls loom in AI adoption without adequate safeguards and guardrails. There’s potential for perpetuating stereotypes, spreading misinformation, advancing hate speech, hallucinating, exposing private data, and unforeseen harm. The potential for facing legal and financial consequences due to the inappropriate use of generative AI is genuine with devastating outcomes.
You must be a Free member to access this content.
For any cybersecurity or data protection strategy to succeed, organisations need to rely on strong internal collaboration and communication processes. In particular, the CIO/CISO dynamic can have a significant impact on both short- and long-term decision making, from strategic investment decisions to leading the response to security incidents.
You must be a Free member to access this content.
The fourth annual Identity Management Day (April 9) brought the opportunity to assess and evaluate the shifting environment plaguing Identity and Access Management (IAM).
Identity plays a pivotal role in all facets of business functions. Overseeing identity and access presents challenges in determining who should have access to what.
This process requires a contextual understanding of the roles and duties of numerous individuals within an organization, ranging from system owners and supervisors to IT, security, and compliance personnel. Managing access between all these stakeholders and decision-makers while mitigating human error, minimizing excessive permissions, and preventing inappropriate access configurations presents a formidable task.
As workforces evolve, managing access privileges becomes even more complex, raising the risk of insider threats and unauthorized access. Understanding identity management is crucial across all business activities, especially with the rise of hybrid and remote work setups.
A strong IAM strategy requires enterprises to maintain a centralized and consistent view of all devices, resources, data, and users, along with timely provisioning of access to different users. When any of these elements are insufficiently operated, both the level of cybersecurity and the quality of user experience are jeopardized.
Read more...
It’s World Backup Day. The technology landscape has changed, with (generative) AI all over the place and more cloud offerings on the market. What does that mean for Backups and how do companies ensure they have a solid backup strategy? We put together some commentaries on the subject…
Read more...