cioinsight.com
Home > RSS Feeds > Security
  • The digital world creates security challenges that many (most?) business and IT leaders aren't equipped to handle—challenges that affect industry and society.

  • It doesn't take much research to know that 2016 was a bad year on the security front: A cursory review of the headlines tells the story. The year brought a new level of creativity and brazenness among cyber-criminals, who took things to a new level with expanded ransomware techniques, multi-million-dollar virtual bank heists, and even attempts to disrupt the U.S. presidential election. But a thoroughly detailed report can put things in a starker perspective, and Symantec's "2017 Internet Security Threat Report" makes it clear that the fast-changing threat landscape will challenge even the most diligent security teams well into 2017 and beyond. "New sophistication and innovation are the nature of the threat landscape, but this year, Symantec has identified seismic shifts in motivation and focus," said Kevin Haley, director of Symantec's Security Response unit. "Meanwhile, cyber-criminals caused unprecedented levels of disruption by focusing their exploits on relatively simple IT tools and cloud services." Email continued to be a favored platform, with Symantec finding that more than 400 companies are targeted by so-called business email compromise scams every day—a practice the FBI estimates has led to a loss of more than $3 billion over the past three years.

  • It's increasingly clear that the internet of things (IoT) presents new and sometimes remarkable opportunities. However, it also represents risks and potential security problems for organizations. "The Internet of Things (IoT): A New Era of Third-Party Risk," a new report from the Ponemon Institute that's sponsored by Shared Assessments, offers insights into the emerging space—particularly third-party factors. The survey of 533 business and IT executives involved with IoT and risk management processes found that while most organizations are aware that they are vulnerable to IoT attacks and breaches—in fact, most believe they will at some point fall victim to an IoT cyber-attack—few are adequately prepared. According to the research, companies rely on technologies and governance practices "that have not evolved to address emergent IoT threat vectors." These risks include the ability of criminals to harness IoT devices (such as botnets), to attack infrastructure and launch points for malware propagation, distributed denial of service (DDoS) attacks and anonymizing malicious activities. Here's a look at some of the key findings.

  • For most enterprises, it's not a question of whether they'll suffer a serious security breach, but when. A global survey by Bomgar, a provider of secure access solutions, found that security professionals recognize the threats posed by employees, contractors and third-party vendors with privileged access to systems and data. Yet the "2017 Secure Access Threat Report" reveals that organizations still allow such access, often without adequate monitoring and controls. Most companies trust their employees and don't expect them to act maliciously. But they do worry that staffers will skirt security practices to speed up productivity, or that a phishing attack might compromise employees' credentials. Meanwhile, risks from third parties are growing as organizations rely on more vendors and outsourcers. The survey highlights the need to better manage privileged access with solutions that prioritize productivity and usability without sacrificing security. Seamless integration into applications and processes already in use is also a must. Sam Elliot, Bomgar's director of security product management, advises: "Grant privileged access based upon the specific needs of employees or vendors to do their job, rather than giving them all-or-nothing access. Also, ensure that you monitor, record and analyze every support session so that you have a record of who is accessing which system, at which time and for what purpose." He advocates security solutions designed for ease of use by users and administrators alike, along with regular reviews of security policies and employee training. The survey covered 608 IT decision-makers in the United States, the United Kingdom, Germany and France.

  • The University of Massachusetts implements a centralized network security system and offers it as a managed service to other schools and businesses.

  • Malware continues to be a major factor in cyber-crime, and a growing volume contains ransomware. That's among the key findings of the 10th annual "Verizon 2017 Data Breach Investigations Report," which is based on data from 42,068 incidents and 1,935 breaches in 84 countries. Just three years ago, ransomware ranked 22nd among specific types of malware used. This year, it jumped to the fifth most-common type. Cyber-espionage is also on the rise, due largely to the proliferation of propriety research, prototypes and confidential personal data, which are hot-ticket items for cyber-criminals. Of the nearly 2,000 breaches analyzed for this year's report, more than 300 were espionage-related, and many of them originated as phishing emails. Pretexting—a scam in which a hacker pretends to need information to confirm a user's identity—is also increasing, predominantly via emails targeted at financial department employees. Marc Spitler, senior manager with Verizon Security Research and one of the lead authors of the report, urges businesses to implement the most up-to-date security protocols across their business. "There is no such thing as an impenetrable system, but getting the basics right makes a world of difference," he said. Spitler offered three quick tips: Grant system access only to staffers that need it for work; train employees to spot the warning signs of a breach; and patch promptly to guard against attacks.

  • Companies mulling their cyber-security spend should put less weight on employee education and more on advanced solutions—including artificial intelligence.

  • The arms war between hackers and the business world continues to escalate. Although security tools and methods have improved dramatically over the last few years, cyber-attacks have become increasingly sophisticated, and almost every enterprise is now on high alert—especially after the recent WannaCry ransomware attack, which affected organizations around the world. Cyber-security firm SentinelOne offers some perspective in its "Enterprise Risk Index." Among the key issues and trends shaping today's cyber-security landscape: Nation state actors increasingly trade infection sustainability for stealth; they rely on multiple attack vectors in one attack chain; and the price for a ransomware infection is rising. However, the cost for recovery can also be steep. To more accurately pinpoint risk, the study focused on detections at the endpoint, rather than the gateway or statistical data from cloud collection systems. It also used machine learning to study behavioral characteristics of attacks. Here are some of the key findings from the study, which examined filtered data collected from more than two million data agents running on Windows machines.

  • At a time when small and midsize businesses have access to technologies that allow them to compete with much larger rivals, there is one critical area of modern business in which they simply have not kept up: cyber-security. According to a cyber-security survey of 153 IT security professionals conducted by EiQ Networks, a hybrid security-as-a-service provider, nearly half of SMBs do not have a dedicated cyber-security budget, more than three in 10 don't have an IT security staff, and more than one-third said they're concerned that they've had a breach in the last 12 months that they didn't know about. The findings are a clear indication that SMBs aren't taking security seriously enough at a time when they should be taking it more seriously than ever. "One of the most striking results is how little SMEs are spending on cyber-security as compared to the overall IT budget—despite the very high risks they face daily from ransomware, phishing and zero-day attacks, to name just a few," said Vijay Basani, founder and CEO of EiQ Networks. "Without the IT security resources and expertise necessary to continually monitor, detect and respond to security incidents, SMEs are simply exposing themselves to loss of revenue, brand equity, IP and customer data on a daily basis."