Fragmented cybersecurity regulation threatens organizations

Jun 18 2020

Facebook sues developer over alleged data scraping abuse

Category: Data mining,data security — DISC @ 10:36 am

The lawsuit alleges that a data scraper took login credentials from about 5,500 people and then harvested phone numbers of their friends.

Source: Facebook sues developer over alleged data scraping abuse

What Is Web/Data Scrapping ? How To Scrap Large Data From A Website
httpv://www.youtube.com/watch?v=bp73TqGcY9c

Would like to know more on InfoSec Awareness…

Would like to know more on InfoSec Awareness…

Jun 17 2020

AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever | ZDNet

Category: DDoS,Information Security — DISC @ 12:34 pm

The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, recorded in March 2018.

Source: AWS said it mitigated a 2.3 Tbps DDoS attack, the largest ever | ZDNet

Was the US hit by a massive ‘DDoS attack’?
httpv://www.youtube.com/watch?v=54IJil_rZkY

What is DDOS? Is America Under a Foreign Cyber Attack?!
httpv://www.youtube.com/watch?v=Sp5ZgIGunTc

Would like to know more on InfoSec Awareness…

Jun 16 2020

CyberSecurity Awareness Quiz

Category: cyber security,Security Awareness — DISC @ 2:16 pm

Take an InfoSec awareness quiz to test your basic cybersecurity knowledge

Loading…

Source: Elite CIA unit that developed hacking tools failed to secure its own systems, allowing massive leak, an internal report found.

Jun 16 2020

Elite CIA unit that developed hacking tools failed to secure its own systems, allowing massive leak, an internal report found

Category: Cyber Attack,Cyber Espionage,Cyber resilience,cyber security,Cyber Threats,Cyber War,Cybercrime — DISC @ 10:19 am

The publication of ‘Vault 7’ cyber tools by WikiLeaks marked the largest data loss in agency history, a task force concluded.

The theft of top-secret computer hacking tools from the CIA in 2016 was the result of a workplace culture in which the agency’s elite computer hackers “prioritized building cyber weapons at the expense of securing their own systems,” according to an internal report prepared for then-director Mike Pompeo as well as his deputy, Gina Haspel, now the current director.

Wikileaks Vault 7: What’s in the CIA Hacking Toolbox?
httpv://www.youtube.com/watch?v=X45Bb8O-gMI

CIA Hacking Tools Released in Wikileaks Vault 7 – Threat Wire
httpv://www.youtube.com/watch?v=5LYSjLwkAo4

Take an awareness quiz to test your basic cybersecurity knowledge

Jun 15 2020

Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More

Category: AWS Security,Security Breach — DISC @ 2:37 pm

3somes, Gay Daddy Bear, and Herpes Dating are among the nine services that leaked the data of hundreds of thousands of users. Researchers find a developer running multiple dating services left 845GB of explicit photos, chats, and more exposed in AWS buckets

Source: Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More

Take an awareness quiz to test your basic cybersecurity knowledge

Best Practices for Amazon S3 Security with S3 Access Management Tools and S3 Block Public Access
httpv://www.youtube.com/watch?v=7M3s_ix9ljE

AWS S3 Bucket Security 👮- Restrict Privileges🔒to User using IAM Policy | Grant User Access
httpv://www.youtube.com/watch?v=vtz3ruCebH8

Jun 14 2020

Tech firms suspend use of ‘biased’ facial recognition technology

Category: Access Control,Information Privacy,Information Security — DISC @ 1:07 pm

Amazon, IBM and now Microsoft ban the sale of facial recognition technology to police departments and are urging for federal laws to regulate its use.

Source: Tech firms suspend use of ‘biased’ facial recognition technology

Subscribe to DISC InfoSec blog by Email

Why Cities Are Banning Facial Recognition Technology | WIRED
httpv://www.youtube.com/watch?v=sYftT5YgwVI

Facial-recognition technology: safe or scary?
httpv://www.youtube.com/watch?v=-yvxbi5GMnA

ARTIFICIAL INTELLIGENCE Dangers to Humanity: AI, U.S., China, Big Tech, Facial Recogniton, Drones, Smart Phones, IoT, 5G, Robotics, Cybernetics, & Bio-Digital Social Programming

Jun 13 2020

Lamphone attack lets threat actors recover conversations from your light bulb | ZDNet

Category: Cyber Espionage,Cyber Threats,Threat detection — DISC @ 12:13 pm

Academics record light variations in a light bulb to recover the sound waves (speech, conversations, songs) from a room 25 meters (80 feet) away.

Source: Lamphone attack lets threat actors recover conversations from your light bulb | ZDNet

Jun 12 2020

Facebook contest reveals deepfake detection is still an “unsolved problem”

Category: Deepfakes — DISC @ 12:30 pm

Facebook says deepfakes are not currently a big issue, but it wants to be prepared.

Source: Facebook contest reveals deepfake detection is still an “unsolved problem”

Best Of Deep Fakes Compilation
httpv://www.youtube.com/watch?v=xkqflKC64IM

Funniest DeepFakes *Compilation* II.
httpv://www.youtube.com/watch?v=RpRlrrNwr4U

Jun 11 2020

The importance of encryption and how AWS can help | Amazon Web Services

Category: AWS Security — DISC @ 10:13 pm

Encryption is a critical component of a defense-in-depth strategy, which is a security approach with a series of defensive mechanisms designed so that if one security mechanism fails, there’s at least one more still operating. As more organizations look to operate faster and at scale, they need ways to meet critical compliance requirements and improve […]

Source: The importance of encryption and how AWS can help | Amazon Web Services

Why is Encryption Important? – Why is Cybersecurity Important Episode 1
httpv://www.youtube.com/watch?v=EZSjs8A7lmA

Tags: encryption

Jun 10 2020

Deepfakes Are Going To Wreak Havoc On Society. We Are Not Prepared.

Category: Deepfakes,Information Security — DISC @ 4:44 pm

In the months and years ahead, deepfakes threaten to grow from an Internet oddity to a widely destructive political and social force.

Source: Deepfakes Are Going To Wreak Havoc On Society. We Are Not Prepared.

Best Of Deep Fakes Compilation
httpv://www.youtube.com/watch?v=xkqflKC64IM

Funniest DeepFakes *Compilation* II.
httpv://www.youtube.com/watch?v=RpRlrrNwr4U

Jun 09 2020

Windows Group Policy flaw lets attackers gain admin privileges

Category: Windows Security — DISC @ 6:13 pm

Microsoft has fixed a vulnerability in all current Windows versions that allow an attacker to exploit the Windows Group Policy feature to take full control over a computer. This vulnerability affects all Windows versions since Windows Server 2008.

Source: Windows Group Policy flaw lets attackers gain admin privileges

Windows Security: The dashboard for device protections
httpv://www.youtube.com/watch?v=e_Z2bk7Cp1g

Download a Security Risk Assessment steps paper!

Jun 08 2020

Amid Pandemic and Upheaval, New Cyberthreats to the Presidential Election

Category: Election Security,Voting Machine — DISC @ 10:50 am

Fear of the coronavirus is speeding up efforts to allow voting from home, but some of them pose security risks and may make it easier for Vladimir V. Putin, or others, to hack the vote.

Source: Amid Pandemic and Upheaval, New Cyberthreats to the Presidential Election

Tech giants meet with government agencies to talk 2020 election security
httpv://www.youtube.com/watch?v=iXpL7A35hX0

The Trouble With Election Security
httpv://www.youtube.com/watch?v=TgKPkfuNV4s

Download a Security Risk Assessment steps paper!

Jun 06 2020

5 principles for effective cybersecurity leadership in a post-COVID world

Category: cyber security,Security Risk Assessment — DISC @ 6:32 pm

As more people work from home due to COVID-19, cybersecurity operations are facing tremendous challenges. These five principles can help Chief Information Security Officers (CISOs) and cybersecurity leaders ensure effective business continuity in the “new normal.”

Source: 5 principles for effective cybersecurity leadership in a post-COVID world

7 Security Risks and Hacking Stories for Web Developers
httpv://www.youtube.com/watch?v=4YOpILi9Oxs

Tags: COVID-19, worrisome risks

May 22 2020

Security executives succeeding in the chaotic coronavirus world

Category: CISO — DISC @ 5:29 pm

What a crazy world we live in – employees working from home, “dirty” personal devices being used to access corporate data, furloughed employees still maintaining corporate IT assets and access – all while the quantity and variety of cyberattacks and fraud is drastically increasing. Corporate security executives have never had a harder set of challenges to deal with.

Source: Security executives succeeding in the chaotic coronavirus world

What is your greatest security concern right now?

The collective response to this question is that security executives are most worried about the increase in phishing campaigns and fraud, especially with distracted employees who aren’t as diligent with security hygiene while working from home. As one executive stated, “My greatest concern right now is social engineering resulting from cyberattacks on people wherever they are. High stress means reduced cognitive functions, so attackers may find it easier to do social engineering, which opens the door to everything else.”

Other major concerns include mitigating the impact of an increased attack surface and the need to enhance remote access controls to make certain organizational security levels are met despite a large majority of employees working remotely. For example, one executive further explained that she was most focused on mitigating the impact of this increased attack surface, particularly enhancing remote access controls such that the organization would be secure even if 100% of the employees were now remote. Enhancements to firewall, NAC, DLP and other solutions were required. Vendor risk also was a much greater concern for this executive, with third parties potentially now more vulnerable.

Virtual CISO and Security Advisory – Download a #vCISO template!

Virtual CISO and CISO – Checkout a vCISO/CISO latest titles

10 Tenets of CISO Success

httpv://youtu.be/L0uQplBNTt4

Comments (2)

Feb 17 2017

Fragmented cybersecurity regulation threatens organizations

Category: ISO 27k,IT Governance — DISC @ 11:10 am

Fragmented cybersecurity regulation threatens organizations

Melanie Watson

Organizations across the United States have a number of cybersecurity regulations to comply with, and need to show that they take protection of sensitive data seriously.

Consumer data in the US is currently protected by a patchwork of industry-specific, federal, and state laws, the scope and jurisdiction of which vary. The challenge of compliance for organizations that conduct business across all 50 states is considerable.

Forbes summarizes the issue:

“Increased regulatory fragmentation unduly diverts focus and resources, and ultimately threatens to make us more vulnerable to cyber attacks. Instead of a fractured approach by state, we need a coordinated national strategy for regulating cybersecurity.”

For example, NY financial institutions will be required to implement security measures in order to protect themselves against cyber attacks from March 1, 2017. They will need to not only maintain a cybersecurity policy and program, appoint a CISO, and implement risk assessment controls and an incident response plan, they will also have to provide regular cybersecurity awareness training, conduct penetration testing, and identify vulnerabilities.

Organizations also have the National Institute of Standards and Technology (NIST) Cybersecurity Framework (NIST SP 800-53) for guidance on helping reduce cybersecurity risks, and many organizations are required by contract or by law to implement the framework.

Complying with multiple cybersecurity regulations

Fulfil multiple cybersecurity obligations and benefit from international information security best practice to produce a solid framework with the ISO 27001 Cybersecurity Documentation Toolkit.

Covering state, national, and international cybersecurity frameworks, this toolkit will enable you to produce a robust management system that complies with:

NIST SP 800-53
New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies
Massachusetts 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth
ISO 27001, the internationally-recognized cybersecurity framework

Comply with multiple cybersecurity regulations

Pre-order now >>

Top Rated ISO 27001 Books

Nov 08 2016

Six steps to reboot your cyber security strategy

Category: cyber security — DISC @ 2:49 pm

Cyber Security Strategy

By Marika Samarati

The High Performance Security Report 2016 published by Accenture Security unearthed a clear disconnection between how companies perceive cyber threats and the reality of the situation. According to the report, 75% of security executives surveyed said they were confident in their cyber security strategies, and 70% reported that their organisations have successfully adopted a culture of cyber security fully supported by their top executives – yet one in three targeted attacks succeeded, resulting in a breach.

It’s time to face reality rethink-cyber-security-strategy

To close the gap between perception and reality, the report invited companies to “reboot their approaches to cybersecurity”. Here is the report’s six-steps to help you rethink your cyber security strategy:

1. Define cyber security success

One reason perceptions don’t match reality comes from the misalignment of cyber security strategies and business imperatives. Identify the best cyber security strategy for your company based on your assets and capabilities, which cyber threats it should secure your company from, and how you can measure its success or its failure in business terms.

2. Pressure-test security capabilities the way adversaries do

Get into the criminals’ shoes: engage ethical hackers to run attack simulations and realistically assess your ability to defend your company from external threats. IT Governance is a CREST member and its suite of penetration tests have been verified as meeting the high standards mandated by CREST. Moreover, all of our penetration testers hold the Certified Ethical Hacker (CEH) qualification.

3. Protect from the inside out

The only difference between internal and external attackers is that the first know where key assets are located. Prioritize securing your key assets from insider threats, which usually have the greatest impact. If you want to know more about insider threat, read the bestselling Insider Threat – A Guide to Understanding, Detecting, and Defending Against the Enemy from Within.

4. Invest to innovate and outmaneuver

The wider and more diversified your strategy is, the easier it is to stay ahead of cyber criminals. Instead of spending money in existing programs, widen your suite of programs by investing in seven key cyber security domains: business alignment, strategic threat context, extended ecosystem, governance and leadership, cyber resilience, cyber response readiness, and investment efficiency.

5. Make security everyone’s job

According to the report, “Fully 98 percent of survey respondents said that for breaches not detected by the security team, the company learned about them most frequently from employees.”. Consequently, a staff that is up to date with the latest cyber threats and cyber security best practices improves your threat detection capabilities and reduces the chances of staff-related security incidents. Implement a staff awareness program based on e-learning courses to empower your staff and make it part of your cyber security strategy.

6. Lead from the top

Cyber security should be discussed in the C-suite on a daily basis, not confined to the IT room. The CISO needs to proactively engage with enterprise leadership and make cyber security a top priority.

Tags: cyber security strategy

RESILIA™ Cyber Resilience Best Practices

Jun 19 2015

Cyber Resilience Best Practices

Category: Cyber Insurance,cyber security,Cybercrime — DISC @ 11:07 am

Cyber Resilience

RESILIA™ Cyber Resilience Best Practices

AXELOS’s new guide RESILIA™ Cyber Resilience Best Practices provides a methodology for detecting and recovering from cyber security incidents using the ITIL lifecycle

Best guide on Cyber Resilience on the web – Cyber Resilience Best Practices
is part of the AXELOS RESILIA™ portfolio.

RESILIA™ Cyber Resilience Best Practices is aimed at anyone that is responsible for staff or processes that contribute to the cyber resilience of the organization.

The methodology outlined in this manual has been designed to complement existing policies and frameworks, helping create a benchmark for cyber resilience knowledge and skills.

Designed to help organizations better prepare themselves to deal with the increasing range and complexity of cyber threats.
Provides a management approach to assist organizations with their compliance needs, complementing new and existing policies and frameworks.
Developed by experts in hands-on cyber resilience and systems management, working closely with subject and technology experts in cyber security assessment.
Supports the best-practice training and certification that is available to help organizations educate their staff by providing a defined benchmark for cyber resilience knowledge and skills.
Aligned with ITIL®, which is the most widely accepted service management framework. The best practice is equally suitable for organizations to adopt within other systems, such as COBIT® and organization-specific frameworks.

Target market

Managers who are responsible for staff and processes where cyber resilience practices are required – for example those processing payment card information, sensitive commercial data or customer communications.
IT service management teams, IT development and security teams, cyber teams and relevant team leaders that operate the information systems that the organization relies on.
IT designers and architects, those responsible for the design of the information systems and the controls that provide resilience.
The chief information security officer (CISO), the chief security officer (CSO), IT director, head of IT and IT managers.

Buy this guide and gain practical guidance on assessing, deploying and managing cyber resilience within business operations.RESILIA™ Cyber Resilience Best Practices

Tags: Chief Information Security Officer, CISO, Computer security, CSO, cyber crime, Cyber Defence, Cyber Insurance, Cyber protection, Cyber Resilience, cyber security, Cyber Security countermeasures, Cyber Security Safeguards, cyber threats, data security, Information Security, Information Technology Infrastructure Library, ISO, iso 27001, iso 27002

May 27 2015

10 Facts Every Cyber Security Professional Should Know

Category: Security Professional — DISC @ 5:04 pm

If you hold any job related to security operations analysis and reporting, you’ve likely been inundated with news stories about data breaches and attacks by hackers on businesses of all sizes across numerous verticals. But with all that noise, it can be difficult to sort out the information that truly matters, like the hard data that helps you decide which solutions to adopt, gives you a powerful case to bring to your executive team for a larger cyber security budget next quarter, or simply reassures you that your peers are facing similar challenges.

For that reason, SwinLane.com have assembled some of the most impactful, telling statistics related to information security in one place

1. Cyber attacks cost businesses $400 billion every year—Lloyd’s of London, 2015

2. Some 42 percent of survey respondents said security education and awareness for new employees played a role in deterring a potential criminal. — “US cybercrime: Rising risks, reduced readiness; Key findings from the 2014 US State of Cybercrime Survey,” PwC

3. There are more than 1 million unfilled information security jobs globally; by 2017 that number may be as high as 2 million — “2014 Annual Security Report,” Cisco; UK Parliament Lords’ Digital Skills Committee witness interview

4. The malware used in the Sony hack would have slipped past 90 percent of defenses today. — Joseph Demarest, assistant director of the FBI’s cyber division, during a U.S. Senate hearing

5. The average U.S. business deals with 10,000 security alerts per day. — “State of Infections Report Q1 2014,” Damballa

6. A significant 90 percent of CISOs cite salary as the top barrier to proper staffing. — “State governments at risk: time to move forward,” Deloitte/NASCIO

7. About 43 percent of businesses experienced a data breach in 2014. — “Is Your Company Ready for a Big Data Breach? The Second Annual Study on Data Breach Preparedness,” Experian/Ponemon Institute

8. Just 21 percent of IT professionals are confident that their information security technologies can mitigate risk. — “2015 Vulnerability Study,” EiQ Networks

9. As many as 75 percent of breaches go undiscovered for weeks or months. — Michael Siegel, research scientist at MIT, at a recent cyber security conference

10. In an effort to combat the growing threat of cybercrime, the U.S. Department of Homeland Security increased its cyber security budget 500 percent during the past two years; and President Obama included $14 billion for cyber security spending in his 2016 budget. — GCN.com, 2015