Why is ISO 27001 so important for US technology firms?

by Rob Freeman

At IT Governance, we have long known that compliance with the ISO 27001 information security management standard is essential for all US companies that wish to do business with the rest of the world. This requirement is fuelled by the ever growing threat of cybercrime and the increasing awareness of the data privacy rights of all individuals in target markets globally.

Win international business

To win and maintain international business, your firm needs to demonstrate that it takes cybersecurity and data privacy seriously, and fully complies with all of the relevant laws and regulations.

This is particularly true for US technology companies, many of which deliver services and products using online web-based channels. Modern Internet marketing and sales methodology demands the acquisition of large databases of customers’ personal data. In return for purchasing goods and services, these customers expect that their data will be secured, stored, and used in an appropriate manner. From the big guys like Microsoft or Salesforce.com to the little guys trading internationally on Ebay, ensuring the data security and privacy of customers is just as important as delivering a great product.

Although now a little dated, I can recommend that you view the August news release from InsideView, a CA-based market intelligence company, which announced “InsideView Expands ISO/IEC 27001:2013 Certification to Include ISO/IEC 27018”. This somewhat innocuous headline is hiding a really big message that is buried in the second paragraph:

A global priority

Protection of personal information has become a globally recognized priority. Emerging regulations and frameworks, such as European Union Data Protection Directive (GDPR) and the US Department of Commerce Privacy Shield, will require data processors to provide specific protections and rights of access regarding personal information.

“This extension of our ISO 27001 information security management system to include the ISO 27018 controls for personal data shows that InsideView is leading the market in preparation for new privacy regulations,” said Jenny Cheng, Chief Product Officer at InsideView.

If you are not aware of the importance of ISO 27001, I can recommend that you purchase and read this textbook: IT Governance – An International Guide to Data Security and ISO27001/ISO27002, Sixth Edition.

Leave a Comment

vsRisk™ risk assessment

vsRisk Standalone 3.0 – Brand new vsRisk™ risk assessment software available now

vsRisk is fully aligned with ISO 27001:2013 and helps you conduct an information security risk assessment quickly and easily. The upgrade includes three key changes to functionality: custom acceptance criteria, a risk assessment wizard and control set synchronization. This major release also enables users to export the asset database in order to populate an asset management system/register.

Price: $745.00

Buy now

Leave a Comment

Top rated InfoSec books to broaden your horizon

There are plenty of good books out there, feel free to share your favorite InfoSec books in the comment section

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.  – Bruce Schneier

Explore vast selection of Information Security Books

Leave a Comment

Discover the prank caller with reverse phone search

The availability of free reverse mobile phone lookup services on the web may prove to be useful in future. The service comes with a number of benefits especially when a comparison with paid directories is made. Many people are getting to know that the cell phone lookup services are getting not only more common but also more available.

The method is a fantastic as it can be used to find friends or other people who have been out of the life of other people for a while. Any person who is being sought will definitely be found given that he or she has a cell phone.

You can easily track someone down with the help of the free reverse phone number service. Within a fraction of a minute, you will be at a position to know the age, address and also the location of the person whom you are trying to find.

All of those involved in this process should look for a service which offers the necessary protection for private information, information about criminal records and many more. This is a necessary deterrent against scam and fraud. There are people who may use your sensitive information to commit fraud therefore it is necessary in today’s digital economy that you perform the necessary check and take advantage of this protection. The key is to perform necessary safeguard to protect your digital identity before it is too late.

Many companies offering this service claim that they can help you find any phone number. Since the system is a bit new, it is imperative that you look for a reliable provider. Locating the perfect company for this service enables you find the information that you need quickly.

The company buys cell phone numbers from large databases hence making it the best way to track down callers who have become unnecessary nuisance. With an internet connection, you can start finding the identity of the prank callers now.

Reverse Phone LookUp

Reverse Phone Checkup & Trace Any Phone Number – Include Phone Numbers, Addresses and Background check

Reverse Phone Ferret – Include Phone Numbers, Addresses & Background check including sex offender

 

Leave a Comment

Security Awareness

Security awareness is the knowledge and attitude members of an organization possess regarding the protection of the physical, and especially informational, assets of that organization. Many organizations require formal security awareness training for all workers when they join the organization and periodically thereafter, usually annually.

Topics covered in security awareness training may include:

Being security aware means you understand that there is the potential for some people to deliberately or accidentally steal, damage, or misuse the data that is stored within a company’s computer systems and throughout its organization. Therefore, it would be prudent to support the assets of the institution (information, physical, and personal) by trying to stop that from happening.

According to the European Network and Information Security Agency, ‘Awareness of the risks and available safeguards is the first line of defence for the security of information systems and networks.’

‘The focus of Security Awareness consultancy should be to achieve a long term shift in the attitude of employees towards security, whilst promoting a cultural and behavioral change within an organisation. Security policies should be viewed as key enablers for the organisation, not as a series of rules restricting the efficient working of your business.’

If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.  – Bruce Schneier

Top Rated Security Awareness Books

Leave a Comment

CISSP Books

Top Rated CISSP Books

Leave a Comment

Secure usb flash drive – password protected and Encrypted

Encrypted Flash Drives

Top Rated
Kingston Digital 8GB Data Traveler AES Encrypted

Leave a Comment

Fragmented cybersecurity regulation threatens organizations

Fragmented cybersecurity regulation threatens organizations

Organizations across the United States have a number of cybersecurity regulations to comply with, and need to show that they take protection of sensitive data seriously.

Consumer data in the US is currently protected by a patchwork of industry-specific, federal, and state laws, the scope and jurisdiction of which vary. The challenge of compliance for organizations that conduct business across all 50 states is considerable.

Forbes summarizes the issue:

“Increased regulatory fragmentation unduly diverts focus and resources, and ultimately threatens to make us more vulnerable to cyber attacks. Instead of a fractured approach by state, we need a coordinated national strategy for regulating cybersecurity.”

For example, NY financial institutions will be required to implement security measures in order to protect themselves against cyber attacks from March 1, 2017. They will need to not only maintain a cybersecurity policy and program, appoint a CISO, and implement risk assessment controls and an incident response plan, they will also have to provide regular cybersecurity awareness training, conduct penetration testing, and identify vulnerabilities.

Organizations also have the National Institute of Standards and Technology (NIST) Cybersecurity Framework (NIST SP 800-53) for guidance on helping reduce cybersecurity risks, and many organizations are required by contract or by law to implement the framework.

Complying with multiple cybersecurity regulations

ISO 27001 Cybersecurity Documentation Toolkit

Fulfil multiple cybersecurity obligations and benefit from international information security best practice to produce a solid framework with the ISO 27001 Cybersecurity Documentation Toolkit.

Covering state, national, and international cybersecurity frameworks, this toolkit will enable you to produce a robust management system that complies with:

  • NIST SP 800-53
  • New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies
  • Massachusetts 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth
  • ISO 27001, the internationally-recognized cybersecurity framework

Comply with multiple cybersecurity regulations

Pre-order now >>

Top Rated ISO 27001 Books

Leave a Comment

Top 5 excellent Antivirus Protection of 2017

Excellence is achievable but perfection is not. Find an excellent anti-virus product based on your requirements.

 

Malware are evolving faster than ever, so it’s encourging to discover that the latest generation of antivirus (AV) are better equipped to handle this evolving pace of change. Information security best practice recommends that every PC should run at least antivirus (antimalware), antispyware, and a firewall, and you keep it up to date. So if you’re not running an anti-virus, or may feel your anti-virus could do a bit more, take a look at the list below  and find an anti virus solution which fulfill your current needs based on the modern day threats.

 

All five antivirus solutions below includes On-Demand Malware Scan, On-Access Malware Scan, Website Rating, Malicious URL Blocking, Phishing Protection and Behavior-Based Detection.

 

1) McAfee Antivirus plus

Unlimited protection for Windows, Android, macOS, and iOS devices. New behavior-centric antivirus engine. Essential antivirus protection for PCs, Macs, smartphones, and tablets.

 

 

2) Webroot Secure Anywhere Antivirus

For Cloud Security it will analyze files, phishing sites, malicious web pages, IP addresses, and mobile apps providing a real time view of current threats and enabling protection from zero day attacks.Can recover files encrypted by ransomware. Uses tiny amount of disk space. Very fast scan. Handles unknown malware. Includes firewall.

 

 

3) Bitdefender Antivirus Plus

Effective ransomware protection. Many bonus features including password manager, secure browser, and file shredder. Wi-Fi Security Advisor. Always secure on the go.

 

4) Symantec Norton Antivirus Basic

Protection is always up-to-date to defend against spyware, malware, and unsafe websites, while safeguarding your identity and online transactions. Powerful intrusion prevention. Norton Power Eraser blasts persistent malware. Password management.

 

5) Kaspersky Antivirus

Kaspersky Anti-Virus helps protect against viruses, spyware & more. Great for antiphishing and speedy full-system scan.

 

Our recommendation is based on The best Antivirus protection of 2017

Top Rated Antivirus Protection

Leave a Comment

5 Surprising Signs Your Employee is fibbing on their resume

Your resume is often the first impression employers get of you prior to the initial meeting. First impression is often considered the deciding factor in whether you may receive an interview call for the position.

To make a best first impression, it is tempting for the candidate sometime to fib with their experience, skills and qualifications and hope they will the one to get a call for that interview.

However, this may have serious consequences on your career in the long run. With social media word can spread quickly about applicants who aren’t being honest, and have their hard earned reputation ruined.

If you are unsure about something, if it doesn’t belong on your resume, please don’t use alternative facts.

Here are 5 common lies in resume.

If you’re convinced that your prospective employee is lying, you may be right! After all, your intuition is not often wrong. But if you’re going to accuse your prospective employee of lying, you definitely need proof. So, how can you find out for sure? What are the most accurate warning signs that your employee is lying? Lastly, and possibly most importantly, what can you do to catch your employee red-handed without breaking the bank?

By now, you’re probably convinced that he or she’s lying. But you need proof, Here’s your chance to get it.

1. Educational background Check

Competing with a educated workforce in US can be sometime frustrating, especially when you don’t have college degree. Perhaps for this reason some job seekers may opt to add false statements to the qualification area of their resume.

Checking qualification has become relatively easy these days, and perhaps the first thing most human resources departments will check. If someone is caught fibbing on their resume, the result can include termination after background check is complete and you will be automatically denied a possible position.

2. Technical skills 

Having certain relevant technical skills may make you a very desirable candidate for a job, but it will be hard to backup your lie once you get the the job.

Your interview based on skills set you mentioned in your resume, and if you can not answer relevant questions regarding that specific skill may raise a red flag, which may prevent you from landing or keeping the job.

At end of the day honesty is the best policy and you may be able to learn some specific technical skills while at the job

3. False employment dates

After a while, It can be difficult to remember when you started or left an employment.

Employment dates are very important to include on your resume, but if you can’t recall the exact month you started job, you may be better off listing just the year.

4. Salary history

It’s best to leave information about your previous salaries off your resume. Perhaps it is best if you do not include the salary history in your resume. However, some employers may ask for it.

Just like employment dates, this information can be confirmed with a phone call, and imprecision may be taken as sign of falsehood.

5. No need to over impress

If you claim to have worked with a famous name or big name company in your previous position, you should be ready to have that claim verified. You never know whom you may interview with and they may happen to know them.

Interviewer may trust you but will verify the inaccuracies of your resume through (Android) background check.

Reverse Lookup & Trace Any Phone Number – Include Phone Numbers, Addresses & Background check including sex offender

Automated background check service 🙂

 

Top Rated Background Screening Books

Leave a Comment

The new CISO role: The softer side

 

English: Risk mitigation action points

English: Risk mitigation action points (Photo credit: Wikipedia)

By Tracy Shumaker

In order for CISOs to stay relevant in their field today, they must add communication and soft skills to their list of capabilities. Traditionally, their role has been to take charge of IT security. Now CISOs oversee cybersecurity and risk management systems. They must manage teams and get leadership approval in order to successfully implement a system that aligns with overall business goals.

Speak in a common business language

The CISO will need to appoint both technical and non-technical individuals to support a risk management system, which requires communication in a language that everyone can relate to. Additionally, senior executives’ approval is required and this will involve presenting proposals in non-technical terms.
Being able to communicate and having the soft skills to manage people is a challenge CISOs face. For CISOs to reach a larger audience, they need to clearly explain technical terms and acronyms that are second nature and translate the cybersecurity risks to the organization into simple business vocabulary.

Get the tools to gain the skills

IT Governance Publishing books are written in a business language that is easy to understand even for the non-technical person. Our books and guides can help you develop the softer skills needed to communicate in order to successfully execute any cybersecurity or risk management system.

Develop your soft skills with these books >>

Discover the best-practice cyber risk management system, ISO 27001

This international standard sets out a best-practice approach to cyber risk management that can be adopted by all organizations. Encompassing people, processes, and technology, ISO 27001’s enterprise-wide approach to cybersecurity is tailored to the outcomes of regular risk assessments so that organizations can mitigate the cyber risks they face in the most cost-effective and efficient way.

Find more information about ISO 27001 here >>

Top Rated CISO Books

Leave a Comment

Cyber Insurance – an essential part of risk mitigation strategy?

CyberInsurancepng

By Foundstone Services

Advancement of technology is deriving proliferation of threat landscape rapidly which extend attack vectors. With proliferation of automated tools available for cyber criminals; it’s not a matter of “if” but “when” there will be a security breach. There are two types of organizations in this category, those who’ve been hacked, and those who don’t know they have been hacked. The likelihood that your organization is next is not very unlikely. Is your organization prepared for a target of information security breach?

That will depend on if you have an operational Security Program which is functional enough to manage risk of a potential security breach. Now, the million-dollar question may be, is your Security Program resilient enough to sustain the risk and can it afford to absorb losses for future security breach. The security threats are evolving on daily basis and there are unknown threats like zero day threats where you need to add cyber insurance (which provides coverage from losses resulting from data breach or loss of confidential information) as a part of risk management strategy to tackle unnecessary disruptions to your business. As a part of risk management program, organizations regularly determine which risks to avoid, accept, control or transfer. This where transferring risk to cyber insurance take place and it can compensate for some residual risk.

Some may argue that they got liability insurance, which should cover security breach. Those days are behind us when organizations thought liability insurance were enough to cover the security breaches. Sony thought their general liability insurance covered them, but the court confirmed that policy did not have specific clauses to cover the security breach which was estimated $170M. Another highly publicized security breach of Target cost the retailer about $348M but the retailer had only $100M in cyber insurance coverage from multiple underwriters.

To read the remaining article…

Top Rated Cyber Insurance Books

Leave a Comment

Encryption keeps you safe from malware

 

Cryptographically secure pseudorandom number g...

Cryptographically secure pseudorandom number generator (Photo credit: Wikipedia)

The Electronic Frontier Foundation aims to protect Web traffic by encrypting the entire Internet using HTTPS. Chrome now puts a little warning marker in the Address Bar next to any non-secure HTTP address. Encryption is important, and not only for Web surfing. If you encrypt all of the sensitive documents on your desktop or laptop, a hacker or laptop thief won’t be able to steal your identity, or takeover your bank account, or perhaps steal your credit card information. To help you select an encryption product that’s right for your situation, we’ve rounded up a collection of current products.

 

Available Encryption Software to protect your information assets:

 

Folder Lock can lock access to files for quick, easy protection, and also keep them in encrypted lockers for serious protection. It combines a wide range of features with a bright, easy-to-use interface. Read the full review ››

 

Cypherix PC creates encrypted volumes for storing your sensitive files. Lock the volume and nobody can access the files. It does the job, though it lacks secure deletion. Read the full review ››

 

Cypherix SecureIT  handles the basic task of encrypting and decrypting files and folders in a workmanlike fashion, but it lacks advanced features offered by the competition.  Read the full review ››

 


Leave a Comment

Implementing an ISMS: where should you start?

ISO27ktoolkit

With the number of ISO 27001 certifications rising fast in the US, organizations will be looking to implement an ISO 27001-compliant information security management system (ISMS) quickly, before any of their competitors.

However, the hardest part of achieving ISO 27001 certification is providing the documentation for the ISMS. Often – particularly in more complex and larger businesses – the documentation can be up to a thousand pages. Needless to say, this task can be lengthy, stressful and complicated.

IT Governance Publishing’s (ITGP) ISO 27001 toolkits offer this documentation in pre-written templates, along with a selection of other tools to:

  • Help save you months of work as all the toolkits contain pre-written templates created by industry experts that meet ISO 27001:2013 compliance requirements.
  • Reduce costs and expenses as you tackle the project alone.
  • Save the hassle of creating and maintaining the documents yourself.
  • Accelerate your management system implementation by having all of the tools and resources you need at your disposal.
  • Ensure nothing is left out of your ISMS documentation.

When an organization’s need help with their ISMS projects, they’re normally at a loss.

The two major challenges they face are creating supporting documentation and performing a risk assessment.

With wide range of fixed-price toolkits, these toolkits can provide you with the official ISO 27000 standards, implementation guidance, documentation templates, and risk assessment software to aid your project.

  • Do you know how to implement an ISMS?
  • What steps should you take?
  • How long will it take?


Leave a Comment

Six steps to reboot your cyber security strategy

Cyber Security Strategy

By Marika Samarati

SecurityStrategy

The High Performance Security Report 2016 published by Accenture Security unearthed a clear disconnection between how companies perceive cyber threats and the reality of the situation. According to the report, 75% of security executives surveyed said they were confident in their cyber security strategies, and 70% reported that their organisations have successfully adopted a culture of cyber security fully supported by their top executives – yet one in three targeted attacks succeeded, resulting in a breach.

It’s time to face reality rethink-cyber-security-strategy

To close the gap between perception and reality, the report invited companies to “reboot their approaches to cybersecurity”. Here is the report’s six-steps to help you rethink your cyber security strategy:

1. Define cyber security success

One reason perceptions don’t match reality comes from the misalignment of cyber security strategies and business imperatives. Identify the best cyber security strategy for your company based on your assets and capabilities, which cyber threats it should secure your company from, and how you can measure its success or its failure in business terms.

2. Pressure-test security capabilities the way adversaries do

Get into the criminals’ shoes: engage ethical hackers to run attack simulations and realistically assess your ability to defend your company from external threats. IT Governance is a CREST member and its suite of penetration tests have been verified as meeting the high standards mandated by CREST. Moreover, all of our penetration testers hold the Certified Ethical Hacker (CEH) qualification.

3. Protect from the inside out

The only difference between internal and external attackers is that the first know where key assets are located. Prioritize securing your key assets from insider threats, which usually have the greatest impact. If you want to know more about insider threat, read the bestselling Insider Threat – A Guide to Understanding, Detecting, and Defending Against the Enemy from Within.

4. Invest to innovate and outmaneuver

The wider and more diversified your strategy is, the easier it is to stay ahead of cyber criminals. Instead of spending money in existing programs, widen your suite of programs by investing in seven key cyber security domains: business alignment, strategic threat context, extended ecosystem, governance and leadership, cyber resilience, cyber response readiness, and investment efficiency.

5. Make security everyone’s job

According to the report, “Fully 98 percent of survey respondents said that for breaches not detected by the security team, the company learned about them most frequently from employees.”. Consequently, a staff that is up to date with the latest cyber threats and cyber security best practices improves your threat detection capabilities and reduces the chances of staff-related security incidents. Implement a staff awareness program based on e-learning courses to empower your staff and make it part of your cyber security strategy.

6. Lead from the top

Cyber security should be discussed in the C-suite on a daily basis, not confined to the IT room. The CISO needs to proactively engage with enterprise leadership and make cyber security a top priority.


Leave a Comment