[From the desk of Paul Davis – his opinions and no-one else’s, apart from the reporter’s opinions ]<\/p>\n
* NIST to release new guidance for strengthening hospital cybersecurity
\n* Measure your Readiness \u2013 Incident Response Program
\n* Implementing Disaster Recovery as a Service to Avoid Losing your Business
\n* Why a layered defense is your best protection against malware
\n* AGA American Gas Association : Natural Gas Utilities Value Effective Security Partnership with TSA
\n* Nasscom Cyber Security Project Embraces over a Million Job Opportunities
\n* Australia ready to hit back at foreign cyber attacks as $230m security strategy launches
\n* Tips for detecting ransomware and other malware before it cripples your network
\n* Council of Europe adopts guidelines to protect journalists
\n* Understanding the Key Drivers for the Data Center Business Segment
\n* US leads Europe for malicious websites, banking trojans still at large
\n* Bangladesh Bank exposed to hackers by cheap switches, no firewall: police
\n* CGU launches revolutionary new cyber product into the Australian market
\n* These CISOs explain why they got fired
\n* Osterman Research Study Finds Most Organizations Lack Necessary Visibility Into Data and Database Assets
\n* Nebraska Amends Data Breach Notification Law
\n* Vast majority of tested applications have at least one vulnerability: cyber security report
\n* Singapore penalises firms for data breaches
\n* South Korea Sharpens the Teeth of Its Privacy Law
\n* Boston Cybersecurity Map Shows Deep, Diverse Local Sector
\n* Logicalis US Asks 10 Tough Security Questions Every CIO Must Be Able To Answer
\n* Cyber insurance penetration grows 27%: Report
\n* Threat Spotlight: Exploit Kit Goes International Hits 150+ Countries
\n* Integrated Threat Defenses and Why Connection is Crucial
\n* Maritime Cybersecurity: The Old and New
\n* Docker security: How to monitor and patch containers in the cloud<\/p>\n
NIST to release new guidance for strengthening hospital cybersecurity
\nThe National Institute of Standards and Technology is poised to deliver new cybersecurty guidance, according to NIST fellow Ronald Ross.
\nRoss likened the NIST framework, developed for the federal government under the Federal Information Security Modernization Act, to a very large catalog of privacy and security controls to safeguard the enterprise form hostile cyberattacks.
\nAnd the latest iteration comes as the proliferation of advanced technologies is rapidly exceeding healthcare executives\u2019 ability to protect their organizations from cyberthreats, Ross added, because every new system or device expands an organization\u2019s attack surface.
\nTo that end, the guidance will include best practices for buidling software and systems that are both secure and trustworthy.
\nIn the forthcoming guidance he said that NIST is working to reduce complexity of systems security engineering.
\nLink: http:\/\/paulgdavis.us3.list-manage1.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=104f84142c&e=20056c7556<\/p>\n
Measure your Readiness \u2013 Incident Response Program
\nInspired by other well-known maturity models, in this article I depict a new framework that is a combination of analytical and operational capabilities, processes, governance and metrics that together can enable all types of organizations to assess, shape and accelerate the continuous process improvements of their Incident Response program and benchmark it against the industry.
\nLevel 1 \u2013 Initial (Processes unpredictable, reactive)
\nLevel 2 \u2013 Managed (Processes developed but inconsistent, often reactive)
\nLevel 3 \u2013 Defined (Processes consistent across the organization, and are proactive)
\nLevel 4 \u2013 Quantitatively Managed (Processes measured and controlled)
\nLevel 5 \u2013 Optimizing (Focus on process improvement)
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=d72685c00f&e=20056c7556<\/p>\n
Implementing Disaster Recovery as a Service to Avoid Losing your Business
\nWith data increasingly being stored and transferred digitally, the risk of cyber breaches is deemed to be at an all-time high.
\nIf zero-day viruses, Cryptolocker-type trojans or ransomware hit data could be at risk of permanent damage.
\nField tests suggest that with a holistic recovery and backup system in place, downtime is minimised, impact on lost revenue is reduced and associated costs are limited.
\nConsidering that business disasters commonly derive from either hardware failure, human or software error, a holistic approach to disaster recovery and storage protection ensures that vital files and systems don\u2019t suffer from long-term damage.
\nData insurance is as crucial as insuring your health or your home.
\nSuch a Disaster Recovery as a Service (DRaaS) strategy can maintain employee productivity and a business\u2019s ability to generate revenue.
\nIf implemented at the right time, minimised downtime coming from the agile security of Disaster Recovery as a Service helps to preserve a business\u2019s reputation with customers and partners whilst preventing a business from losing out to competitors.
\nWith the Disaster Recovery as a Service market expected to grow considerably by 2020, protecting virtual business data needs to be as important as protecting your physical business to ensure business continuity.
\nWithout securing data, a business could lose stakeholder assurance, lose out to competitors, lose customer trust and loyalty, and ultimately lose the business itself.
\nBy working with networking experts and implementing a holistic Data Recovery as a Service and storage strategy, businesses can be confident they can continue to function even when a disaster strikes.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=e4c56c3d64&e=20056c7556<\/p>\n
Why a layered defense is your best protection against malware
\nThere are a lot of misconceptions about malware, so here are some of the key things we do know.
\n1. Malware exploits a system vulnerability or user vulnerability for access
\n2. Malware runs code in system memory
\n3. Malware modified the registry or WMI for persistence
\n4. Malware generates network traffic to a C&C node
\n5. Malware possibly drops file(s) onto the system
\nThe key take away here is to use a layered defense to make it as difficult as possible for bad guys to implant a remote access Trojan and mess with your computer (stealing or encrypting your data).
\nPatching and updating your system and applications, keeping your antivirus up-to-date, using web protection or network intrusion prevention system to prevent command and control signals.
\nMaintaining robust system and data backups will allow you to recover quickly if the bad guys get through all your cyber defenses.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=fb86109f7a&e=20056c7556<\/p>\n
AGA American Gas Association : Natural Gas Utilities Value Effective Security Partnership with TSA
\nWashington, D.C. – Keeping America’s pipelines safe from physical harm and cyber attacks are top priorities for natural gas utilities.
\nKathy Judge, Director, Risk & Compliance, Corporate Security at National Grid testified today on behalf of the American Gas Association before the U.S.
\nHouse of Representatives Committee on Homeland Security, Subcommittee on Transportation Security.
\nShe said that the Transportation Security Administration’s Pipeline Section of the Office of Security Policy and Industry Engagement plays a pivotal role in keeping natural gas customers and the communities that they live in secure and safe.
\nGas utilities employ numerous strategies to ensure pipeline security, including but not limited to: site-specific security and crisis management plans to ensure operations are reinforced with workforce and system redundancies; embedding security requirements into pipeline design and construction; weaving security requirements into corporate governance, participating with Information Sharing and Analysis Centers to improve situational awareness; coordinating with Federal, state, and local first responders to ensure effective incident prevention and response; and partnering with Federal security partners at TSA, Department of Energy, and Federal Bureau of Investigation to better understand potential threats.
\nThe American Gas Association has developed the Downstream Natural Gas Information Sharing and Analysis Center (DNG-ISAC) as an online platform for sharing cyber and physical threat intelligence and tools to help further enhance the security of natural gas utilities.
\nAGA also chairs the Oil & Natural Gas Sector Coordinating Council Cybersecurity Working Group, an operators’ forum supported by the U.S.
\nDepartment of Energy, in coordination with the U.S.
\nDepartment of Homeland Security, to promote effective security strategies and activities, policy and communication across the oil and natural gas sector to achieve the nation’s homeland security mission.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=7d09601137&e=20056c7556<\/p>\n
Nasscom Cyber Security Project Embraces over a Million Job Opportunities
\nA report that has been published in The Economic Times says about Nasscom\u2019s declaration of cyber attacks and data protection project efforts globally, and is expected to make about $ 2.5 – 3 Billion revenue opportunity in Indian IT sector.
\nOn the other hand, the sector is on track to reach USD 350 Billion by 2025.
\nFurther, here is a glimpse of the estimated report by NASSCOM.
\nThe NASSCOM Cybersecurity project will not only help companies from cyber attack but also bring a huge employment opportunity for millions of people.
\nRajendra Pawar, Chairman, Cyber Security Task Force, NASSCOM says that the forthcoming startup plans of another important project includes almost 1,000 new start-ups to be established in this arena.
\nIt has been noticed that several investors to be interested in this field because of the incidents of cyber-attacks.
\nThe report specifies about the recent release of \u2018National Occupational Standards\u2019 by Nasscom\u2019s Data Security Council of India along with Security Software Company – Symantec.
\nIt spoke about the 10 Cybersecurity job roles and the aim to deliver Certified Cyber security professionals across India.
\nAdditionally, the qualification packs for these job roles has been developed in assistance with the consultation services including financial, consultancy advisory and IT services.
\nR Chandrashekhar, President of Nasscom says, \u201cThis initiative has a two-pronged approach – it contributes to containing the spurt of cybercrime and also enhances the employability of the workforce.
\nThe launch of 10 QPs & the courseware for QP Analyst-Application Security is the collective effort of the industry and is going to be a landmark in empowering women while fighting major issues such as cybercrime.\u201d
\nLink: http:\/\/paulgdavis.us3.list-manage1.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=eb36d5f813&e=20056c7556<\/p>\n
Australia ready to hit back at foreign cyber attacks as $230m security strategy launches
\nThe message that the government is ready to “deter and respond to malicious cyber activities”, comes amid a $230 million cyber security strategy to be announced by Prime Minister Malcolm Turnbull on Thursday.
\nThe first update to the nation’s cyber attack plan since 2009 will largely be spent recruiting 100 more police and cyber specialists to boost the fight against “foreign adversaries”, both state-sponsored and those linked to organised crime, and also widen information sharing between business and government.
\nChina, Russia, North Korea and Iran are among the nations suspected to be the most active in launching daily “cyber crime intrusions” against government, business and people in Australia.
\nMr Turnbull will appoint a new minister assisting the prime minister on cyber security and a new special adviser on cyber security in his department.
\nForeign Minister Julie Bishop will appoint Australia’s first cyber ambassador.
\nThe 46-page strategy document confirms that resources have already gone into “offensive cyber capabilities”.
\nLink: http:\/\/paulgdavis.us3.list-manage1.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=c0214d4e6a&e=20056c7556<\/p>\n
Tips for detecting ransomware and other malware before it cripples your network
\nTo successfully detect malware, healthcare CIOs, CISOs and other executives must create a strategy, a plan of attack \u2013 or in the case of malware, counterattack.
\nOne important part of an effective detection strategy, Pollard added, is the underlying assumption that an organization\u2019s protection layer has failed.
\nJohn Fowler, deputy information security officer at Henry Ford Health System, says when healthcare executives are formulating malware detection strategies, they need to channel ancient Chinese general and military strategist Sun Tzu, who famously said, \u201cIf you know the enemy and know yourself, you need not fear the result of a hundred battles.\u201d
\nA good place to start when creating and effecting a malware detection strategy is to inventory all hardware and software within a healthcare organization, Chuck Kesler, chief information security officer at Duke Health, recommended.
\n\u201cOrganizations need good intrusion detection software and intrusion prevention software, which are very good at detecting indicators of malware and compromises and can generate alerts to staff \u2013 and with the prevention systems, take action on alerts,\u201d Duke Health\u2019s Kesler said. \u201cSometimes IDS and IPS systems are bundled in with next-generation firewalls.
\nThese IDS systems incorporate behavioral characteristics as opposed to just straight signatures and as a result are very good at finding those needles in the haystack.\u201d
\nWhen it comes to detection and general security technologies, the latest acronym to hit the scene is EDR, which stands for end-point detection and remediation.
\nThe two biggest names in the EDR market today are Carbon Black and Tanium, said Firstbrook of Gartner.
\nLink: http:\/\/paulgdavis.us3.list-manage2.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=0f92097d3e&e=20056c7556<\/p>\n
Council of Europe adopts guidelines to protect journalists
\nThe FINANCIAL — The Council of Europe has adopted a set of guidelines aimed to ensure the protection of journalism and the safety of journalists in its 47 member states.
\nIn a Recommendation supported by the European Federation of Journalists (EFJ), the Committee of Ministers \u2013 the organisation\u00b4s decision-making body \u2013 encouraged states to review their national legislation and practice concerning media freedom to make sure they are in conformity with the European Convention of Human Rights.
\nThe guidelines contain specific measures to be taken by states to prevent violations of media freedom \u2013 including physical violence against journalists \u2013 to effectively protect journalism and journalists, and to prosecute crimes committed against them.
\nIt also offers guidance to states on how to fulfill their obligations, combining legal, administrative and practical measures.
\nTo protect journalists, the recommendation stresses that whenever there is a threat to journalists, states should adopt preventive measures, such as police protection or voluntary evacuation to a safe place.
\nThey should encourage the creation or create themselves hotlines or emergency contact points that journalists and other media actors under threat can have immediate access.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=eefb49a730&e=20056c7556<\/p>\n
Understanding the Key Drivers for the Data Center Business Segment
\nThe revolution of digitizing enterprises generates huge amounts of data over networks.
\nThis forces network providers to find alternate approaches to their existing network architectures.
\nAccording to Cisco Systems\u2019 (CSCO) Global Cloud Index total data center, traffic is expected to reach 10.4 zettabytes in 2019 from 3.4 zettabytes in 2014.
\nData center traffic from the cloud will likely account for 83% of the total data center traffic in 2019, as compared to 61% in 2014.
\nMachine-to-machine communication should also proliferate data flow across devices, along with BYOD (bring your own device).
\nIn turn, these will create a requirement for network and computing platforms.
\nKelly Ahuja, Cisco\u2019s Senior Vice President, stated that \u201cservice providers are looking to leverage the operational best practices established in massively scalable computing environments and marry them with their own networking reach to compete and innovate faster.\u201d
\nThe SDCC (software-defined data center) market is also forecasted to rise to ~$77.2 billion in 2020 from nearly $21.8 billion in 2015, a CAGR (compounded annual growth rate) of 28.8%.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=050c4d2486&e=20056c7556<\/p>\n
US leads Europe for malicious websites, banking trojans still at large
\nAccording to a new report from German security company G DATA, more malicious websites were hosted in the US in 2015 than in any other country, originating around 57 per cent of recorded attacks.
\nChina, Hong Kong, Russia and Canada are also major hosts of malware, though Europe is little in evidence, only Germany and Italy making the top seven and accounting for just six per cent between them.
\nIt also shows that there has been an increase in malicious websites purporting to be gambling portals, up from 13th place in the rankings to first in just six months, accounting for 18.7 per cent of malicious sites.
\nIn second place are blog sites on 12.9 per cent followed in third by technology and communications sites on 12.8 per cent.
\nThere has been a shift in the methods of attack on banking targets, with the banking Trojan Swatbanker, which was responsible for the highest number of averted attacks in the first half of 2015, having almost completely disappeared from the picture in the second half.
\nA new piece of malware called Sphinx \u2013 a variant of the ZeuS banking Trojan \u2013 contributed to a rise in attacks in the second half of the year but was short lived.
\nBy December attack levels were back up to July levels due to the Dridex banking Trojan being distributed in emails supposedly containing invoices.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=aec0a4cac7&e=20056c7556<\/p>\n
Bangladesh Bank exposed to hackers by cheap switches, no firewall: police
\nDHAKA (Reuters) – Bangladesh’s central bank was vulnerable to hackers because it did not have a firewall and used second-hand, $10 switches to network computers connected to the SWIFT global payment network, an investigator into one of the world’s biggest cyber heists said.
\nThe shortcomings made it easier for hackers to break into the Bangladesh Bank system earlier this year and attempt to siphon off nearly $1 billion using the bank’s SWIFT credentials, said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police’s criminal investigation department.
\nCyber criminals broke into Bangladesh Bank’s system and in early February tried to make fraudulent transfers totaling $951 million from its account at the Federal Reserve Bank of New York.
\nMost of the payments were blocked, but $81 million was routed to accounts in the Philippines and diverted to casinos there.
\nMost of those funds remain missing.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=8ff5d65631&e=20056c7556<\/p>\n
CGU launches revolutionary new cyber product into the Australian market
\nCGU Insurance has launched a new cyber defence product aimed at mitigating the rising tide of cyber-attacks.
\nThe company believes its new offering CGU Cyber Defence, developed with SME customers in mind, will protect businesses from cybercrimes such as privacy breaches, system damage, extortion, computer viruses, crime and hacking.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=cbbf24b6de&e=20056c7556<\/p>\n
These CISOs explain why they got fired
\nToday\u2019s Chief Information Security Officer (CISO) leads an increasingly precarious life.Since the emergence of the job title in the late 1990s, the CISO job has become more complex – and demanding – by the day.
\n\u201cCISOs have an incredibly difficult job in that they are responsible for something they can never provide 100 percent assurance on, i.e. securing the enterprise.
\nAll it takes is one missed vulnerability, one insider or one accidental “insecure” process.
\nSackings rarely make the headlines
\nOne CISO, who previously worked in the UK financial services sector, says that his dismissal was ultimately came down to \u201ca difference of opinion\u201d between him and the CIO.
\nAnother CISO, working in the US pharmaceutical industry, explained why he resigned after blowing the whistle on insider fraud following an M&A.
\nSo, how do CISOs avoid getting the chop.
\nHere are three tips:<\/p>\n
\u201cDefinitely know your scope, and your boundaries, plus where you can break [the business] and where you can add value\u201d.
\n\u201cUnderstand the business and be clear what the priorities of the business are\u201d
\n\u201cTry and make it real for executives.
\nIf they understand it and it challenges them, then you’re less likely to be sacked!\u201d
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=5de33b4d4c&e=20056c7556<\/p>\n
Osterman Research Study Finds Most Organizations Lack Necessary Visibility Into Data and Database Assets
\nSAN DIEGO, CA–(Marketwired – Apr 20, 2016) – Osterman Research, an industry analyst firm focused on research in messaging, collaboration and related areas, and DB Networks\u00ae, a leader in database cybersecurity, today announced the results of Osterman Research’s first-of-its-kind database security industry report.
\nThe study found that only 19 percent of organizations have what the organization considers to be “excellent” visibility into their data and database assets.
\nThis level of visibility is necessary to rapidly identify a data breach.
\nFurthermore, 47 percent of those surveyed do not have an assigned team or even an individual to oversee the security of their databases.
\n“This study reveals there’s a clear shift beginning to occur in information security away from total reliance on perimeter security toward a greater emphasis on database security,” said Michael Osterman, president of Osterman Research. “Identifying compromised database credentials and insider threats will likely receive far more investment in the future.
\nAnd, the actual rate of successful infiltrations or other leakage events is likely greater than discussed in this report due to inadequate organizational systems for tracking successful threats.”
\nAdditional key findings of the study include:
\nIn addition to most survey respondents lacking excellent visibility into their organizations’ data and databases, 59 percent of respondents lack a high degree of certainty about which applications, users and clients are accessing their databases.
\nWhen asked what database security issues are of most concern, compromised credentials was the top concern of half of the survey respondents.
\nThirty-nine percent of organizations surveyed lack the necessary tools to allow them to identify a database breach resulting from compromised or abused credentials.
\nOnly 21 percent of survey respondents indicated they can discover such a data breach almost immediately.
\nThirty-eight percent of organizations surveyed revealed they do not have the mechanisms and controls in place to allow them to continuously monitor their organization’s databases in real time.
\nOnly 20 percent of organizations surveyed conduct database activity assessments on a more or less continuous basis.
\nLink: http:\/\/paulgdavis.us3.list-manage1.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=8af88c65f9&e=20056c7556<\/p>\n
Nebraska Amends Data Breach Notification Law
\nLast week, Nebraska Governor Pete Ricketts signed into law LB 835, which makes the following amendments to the state\u2019s data breach notification statute:<\/p>\n
Adds to the definition of \u201cpersonal information\u201d a user name or email address, in combination with a password or security question and answer, that would permit access to an online account.
\nRequires notice to the Nebraska Attorney General no later than notice is provided to Nebraska residents.
\nClarifies that data is not considered encrypted, defined as \u201cconverted by use of an algorithmic process . . . into a form in which the data is rendered unreadable or unusable without use of a confidential process or key,\u201d if the confidential process or key was or is reasonably believed to have been acquired as a result of the breach.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=76111af46a&e=20056c7556<\/p>\n
Vast majority of tested applications have at least one vulnerability: cyber security report
\nCyber criminals are increasingly making use of malware-as-a-service, an issue of concern given that 97% of applications tested by Trustwave in 2015 had at least one vulnerability, note findings from the 2016 Trustwave Global Security Report.
\nWhile the lion\u2019s share of applications tested last year had at least one vulnerability, 10% of the vulnerabilities discovered were rated as critical or high risk, notes the report, based on hundreds of real-life data breach investigations, billions of security and compliance events and thousands of penetration tests across 17 countries in 2015.
\nThe median number of vulnerabilities discovered per application by Trustwave\u2019s security testing service was 14.
\nThe report points out that 64% of the applications had session management vulnerabilities, up from 58% in 2014. \u201cSession management vulnerabilities can allow an attacker to take over or eavesdrop on a user session, which can place sensitive information at risk,\u201d it explains. [Click on image below to enlarge)
\nIn all, 42% of the malware observed by Trustwave used obfuscation, while 33% used encryption.
\nPerhaps less surprising are the types of businesses being targeted.
\nRetail was the most compromised industry, accounting for 23% of Trustwave investigations, followed by hospitality at 14%, and food and beverage at 10%.
\nThe report notes that in 10% of the cases examined, the attackers simply sought to destroy or damage information rather than to collect it. \u201cOther attackers sought proprietary information (11%), financial credentials (7%), and personally identifiable information (4%).
\nIn some cases, multiple types of data were exposed and targeted, meaning that the exposure of any one type of data does not reflect the totality of the breach.\u201d [Click on image to enlarge]
\nThe report highlights some stark geographical differences, including that 24% of breaches in North America were discovered by law enforcement agencies in 2015 compared to 0% elsewhere in the world. \u201cThe longer a data compromise lasts, the more harm the attacker can do, and the more costly the breach can be,\u201d it emphasizes.
\nOverall, 59% of breach victims did not detect breaches themselves, although self-detection increased from 19% in 2014 to 41% in 2015.
\nSelf-detection leads to quicker containment of a breach.
\nStill, for self-detected breaches in 2015, a median of 15 days elapsed from intrusion to containment.
\nThe median time between intrusion and detection for externally detected compromises was 168 days in 2015, up from 126 in 2014, the report notes.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=831b39cde8&e=20056c7556<\/p>\n
Singapore penalises firms for data breaches
\nSeveral organisations in Singapore have been fined and issued warnings for breaching the country’s Personal Data Protection Act (PDPA), including local IT retail chain Challenger Technologies and Chinese handset maker Xiaomi.
\nThe Personal Data Protection Commission (PDPC) said Thursday that it had imposed financial penalties of various amounts to four organisations, which had failed to implement adequate security measures to safeguard the personal data of its customers.
\nLink: http:\/\/paulgdavis.us3.list-manage1.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=ef12729fee&e=20056c7556<\/p>\n
South Korea Sharpens the Teeth of Its Privacy Law
\nThe Act on the Promotion of Information Communication Network Utilization and Information Protection (\u201cPICNUIA\u201d) has been amended to include potential punitive damages for South Korean businesses that provide services over the internet.
\nFrom 23 September this year, any serious data breach experienced by such businesses will lead to financial liability of up to three times the actual damages suffered by their customers.
\nThe amendments to the PICNUIA were announced by the Korea Communications Commission (\u201cKCC\u201d) in March, and they authorise the KCC to impose corporate sanctions against top management in data breach cases, and order companies to delete any personal data exposed in such breaches.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=e2e6e66947&e=20056c7556<\/p>\n
Boston Cybersecurity Map Shows Deep, Diverse Local Sector
\nJust how big is the local cluster.
\nXconomy surveyed the landscape and found more than 60 firms within an hour\u2019s drive of downtown Boston, including locally based companies and outposts of firms based elsewhere.
\nWe mapped them out below and listed them in a table with key facts and figures about each company.
\nThe map and accompanying data illustrate the local sector\u2019s diverse and dynamic nature.
\nThere are security arms of big companies, like EMC-owned RSA Security, IBM Security, and Lockheed Martin Industrial Defender.
\nLongstanding companies like Rapid7, Carbon Black (formerly Bit9), Digital Guardian, Veracode, and CyberArk have raised vast sums from venture capitalists and the public markets in a quest for industry domination.
\nWell-funded startups like Cybereason, Recorded Future, and Threat Stack are advancing new techniques for combating threats.
\nAnd a bevy of small startups like Cybric, Lexumo, and Seceon are just getting started.
\nInvestors have pumped about $1.7 billion into local cybersecurity companies on our list, and that amount counts only the firms that haven\u2019t been acquired or gone public.
\nMeanwhile, local cyber exits (both IPOs and acquisitions) have generated a total of around $3.6 billion\u2014again, a conservative number since many of the purchase prices for the deals on this list weren\u2019t disclosed publicly.
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=f224e969c0&e=20056c7556<\/p>\n
Logicalis US Asks 10 Tough Security Questions Every CIO Must Be Able To Answer
\nCybercrime is an insidious business; it happens in plain sight, avoids detection and causes damage quickly.
\nThere are even cybercrime-as-a-service offerings available to criminals who lack the technical know-how to reap the big jackpots capable of totaling tens of millions of dollars.
\nSo, how do you prepare your organization to overcome an eventual attack.
\nAccording to Logicalis, the solution begins by answering 10 important questions:<\/p>\n
If you knew that your company was going to be breached tomorrow, what would you do differently today?
\nHas your company ever been breached.
\nHow do you know?
\nWhat assets am I protecting, what am I protecting them from (i.e., theft, destruction, compromise), and who am I protecting them from (i.e. cybercriminals or even insiders)?
\nWhat damage will we sustain if we are breached (i.e., financial loss, reputation, regulatory fines, loss of competitive advantage)?
\nHave you moved beyond an \u201cinside vs. outside\u201d perimeter-based approach to information security?
\nDoes your IT security implementation match your business-centric security policies.
\nDoes it rely on written policies, technical controls or both?
\nWhat is your security strategy for IoT (also known as \u201cthe Internet of threat\u201d)?
\nWhat is your security strategy for \u201canywhere, anytime, any device\u201d mobility?
\nDo you have an incident response plan in place?
\nWhat is your remediation process.
\nCan you recover lost data and prevent a similar attack from happening again?
\nLink: http:\/\/paulgdavis.us3.list-manage.com\/track\/click?u=45bf3caf699abf9904ddc00e3&id=0a7686c268&e=20056c7556<\/p>\n
Cyber insurance penetration grows 27%: Report
\nAccording to \u201cBenchmarking Trends: Operation Risks Drive Cyber Insurance Purchases\u201d from brokerage giant Marsh, there has been a 27% increase in cyber purchases in the US \u2013 up 32% in 2014 over 2013, and up 21% in 2013 over 2012.
\nThat yearly increase shows organizations\u2019 commitment to managing cyber, rather than relegating the task to IT departments, Marsh said \u2013 particularly as r<\/p>\n","protected":false},"excerpt":{"rendered":"
[From the desk of Paul Davis – his opinions and no-one else’s, apart from the reporter’s opinions ] * NIST to release new guidance for strengthening hospital cybersecurity * Measure your Readiness \u2013 Incident Response Program * Implementing Disaster Recovery as a Service to Avoid Losing your Business * Why…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[],"class_list":["post-2487","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/2487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=2487"}],"version-history":[{"count":1,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/2487\/revisions"}],"predecessor-version":[{"id":4974,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/2487\/revisions\/4974"}],"wp:attachment":[{"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=2487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=2487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cybersecurityinstitute.com\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=2487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}