[From the desk of Paul Davis – his opinions and no-one else’s]
Apart from the reporter’s opinions 😉
So onto the news:
3 security questions to ask when vetting a vendor that needs company data
In my role as senior vice president of engineering, I frequently work closely with the CIOs of large, industrial companies implementing prescriptive sales solutions. As these solutions require the use of company data, ensuring the data remains secure through each and every touch point is critical. Each company that becomes a customer is unique, but data security needs are universal. Below are some of the imperative questions that a CIO should address before implementing any technology from a vendor that requires access to secure company data.
1. Security in the data center: understanding how the data flows into and out of the data center.
2. Physical security: is the vendor’s office space secure?
3: Mobile security
Link: http://paulgdavis.us3.list-manage1.com/track/click?u=45bf3caf699abf9904ddc00e3&id=125d4402b6&e=20056c7556
Five reasons threat intelligence fails today, and how to overcome them
Effective use of threat intelligence is a way for businesses to pool their resources and overcome internal technical or resource limitations. Theoretically, it allows companies to “crowd source” security and stay one step ahead of malicious entities.
But that only holds true if it can be consumed as actionable intelligence. Unfortunately for many organizations, disjointed security solutions and departmental silos have made threat intelligence hard to implement across the organization and consequently, ineffective. Without the means to make threat intelligence actionable, it’s just data. Data won’t save your company from a targeted attack when human analysts are unable to quickly make use of it throughout decision support tools across the organization.
There are five common reasons threat intelligence fails today:
Link: [ – See more at: http://paulgdavis.us3.list-manage2.com/track/click?u=45bf3caf699abf9904ddc00e3&id=48ef67c843&e=20056c7556 ] ( – See more at: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=1dc98bf4ad&e=20056c7556 )
Cybersecurity Standards and Your Enterprise
Our recommendation is to focus on your business needs first, but then select the right body of standards for your organization and your mission. Once you select your corporate approach to standards, remember you will get what you measure. Enforce your standards.
Link: http://paulgdavis.us3.list-manage1.com/track/click?u=45bf3caf699abf9904ddc00e3&id=bb3ae43321&e=20056c7556
Rethinking cyber security in the age of the hacker
For organisations to make headway in this unequal contest they need to dramatically rethink their approach to cyber security by embracing the uncomfortable truth that no organisation is safe and that breaches are inevitable.
Importantly, companies need to recognise that their historic focus on perimeter security has only limited value. What matters is not how deep the moat is, but the agility of your strategies to limit potential damage once an attacker has already breached the fort.
Link: http://paulgdavis.us3.list-manage1.com/track/click?u=45bf3caf699abf9904ddc00e3&id=d3a1c9ab70&e=20056c7556
Harnessing The Power Of Cyber Threat Intelligence
Here are six real-world examples of how changing your modus operandi from reactive to proactive can drive rapid response to the threats that matter.
Link: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=1e5bdd623a&e=20056c7556
RUSSIA AND CHINA SIGN MUTUAL NO-HACKING PLEDGE
“Russia and China signed a cyber-security deal on Friday, which experts say could firm up Russia’s ties with the east and may become a foundation for binding cyber security ties in the future,” writes the WSJ.
Link: http://paulgdavis.us3.list-manage1.com/track/click?u=45bf3caf699abf9904ddc00e3&id=cd8ee12adb&e=20056c7556
Eight Things You Need to Know Before Deploying a Cyber-Threat Intelligence Solution
Protecting against cyber-attacks is proving to be a real challenge. A few years ago, defense-in-depth was the recommended methodology to successfully fight cyber-attacks. Despite the proliferation of defense-in-depth mechanisms, a large number of high profile cyber-attacks are still observed. According to a survey by Forrester’s Forrsights Security Survey in 2013, 75% of 490 companies agreed that cyber-threat intelligence was a priority. The recent 2015 Global Megatrends in Cybersecurity report suggested that most companies will deploy cyber-threat intelligence over the next three years as a measure against cyber-attacks.
Cyber-threat intelligence (CTI) can be categorized into the tactical intelligence that will help CISOs, CIOs and CEOs support the security strategies of their environment, and operational intelligence that can be used by analysts to manage attacks on a daily basis. Having used a good number of the so-called CTI solutions, I have observed that many companies do not understand what they are paying for. Here are eight key areas worth considering before deploying a CTI solution.
Link: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=da7f8d7901&e=20056c7556
AlienVault OSSIM, USM platform vulnerabilities exposed
Detailed on Full Disclosure, the security flaw is found within the vulnerability management section of the UI, which allows users to upload a Nessus vulnerability scan — in an NBE format — to the system. If this NBE file is specially crafted, users can exploit multiple vulnerabilities and conduct XSS, SQLi, and command execution attacks.
Link: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=5e9b1d2876&e=20056c7556
The moving target defense: Turning the tables on polymorphic malware
Indeed, polymorphism is just a new way of describing what many academic security researchers have long been calling a “moving target defense” and something that has been studied for quite some time. An Association of Computing Machinery (ACM) conference last November in Arizona covered many ways of implementing such a defense, such as with game theory and other advanced algorithms. Another academic paper goes into greater implementation detail here.
Link: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=35bdb913a8&e=20056c7556
Defend your network from APTs that exploit DNS
By investing in a DNS firewall, for example, organizations can utilize their DNS to block any of the stages noted in the description of the APT attack above, either temporarily or permanently. A key weapon in the defence arsenal is the fact that the cyber criminals trust relatively few intermediate servers and networks. Consequently, these collusive servers and networks tend to get reused over and over again.
Link: http://paulgdavis.us3.list-manage.com/track/click?u=45bf3caf699abf9904ddc00e3&id=d1d98155aa&e=20056c7556
============================================================
Feedback, questions? Our mailing address is: ** dailynews@paulgdavis.com (mailto:dailynews@paulgdavis.com)
If someone forwarded this email to you and you want to be added in,
please click this: ** Subscribe to this list (http://paulgdavis.us3.list-manage1.com/subscribe?u=45bf3caf699abf9904ddc00e3&id=e09452545a)
** Unsubscribe from this list (http://paulgdavis.us3.list-manage1.com/unsubscribe?u=45bf3caf699abf9904ddc00e3&id=e09452545a&e=20056c7556&c=5a236a0541)
** Update subscription preferences (http://paulgdavis.us3.list-manage1.com/profile?u=45bf3caf699abf9904ddc00e3&id=e09452545a&e=20056c7556)