Attacks/Breaches

Breach Awareness Made Easy

50%
50%

What if companies had to disclose breach history in the same way food companies display nutritional information?

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
ODA155
0%
100%
ODA155,
User Rank: Ninja
10/9/2014 | 3:12:02 PM
Re: Security Seals of approval (or disapproval)
I think you're looking for a simple solution to a very complicated problem. So, my question, who explains to the consumer what a CrossSite Scripting attack is... DDoS or SQL Injection?

Instead, I would recommend something like this, although government sponsored. If you want to get people attention they will need to know what you're talking about and if you search this DB you will see the shock value it could have if more people (consumers) were aware of its existance.

 

Chronology of Data Breaches Security Breaches 2005 - Present

https://www.privacyrights.org/data-breach

 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/6/2014 | 2:09:01 PM
Re: Security Seals of approval (or disapproval)
@Marilyn  Definitely hard to argue against more transparency when it comes to breaches. One thing that's going to take some time to do, though, is to educate the general public.so that they'd actually understand what the heck the data meant. Maybe things like "cross-site scripting vulnerabilities" on an app security box would only matter to IT people anyway. But a breach disclosure box for the general public would have to be a bit simpler.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/6/2014 | 1:54:21 PM
Re: Security Seals of approval (or disapproval)
That appsec lable, is cool, isn't it? Would be a litte trick to implemment for web apps, to be sure. But it's hard to argue against the idea of more transparency when it comes to breach disclosure.... 
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/6/2014 | 12:47:21 PM
Re: Security Seals of approval (or disapproval)
@Marilyn  Ooo I like the OWASP version with app security too. The tricky thing with doing it for Web apps is that you could only focus on the app and not the implementation on the Website, since looking for vulnerabilities on someone else's site is illegal without permission.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 8:02:03 AM
Re: Security Seals of approval (or disapproval)
Agreed, Robert. More so, I think a public disclosure of breach history would put security right where it belongs -- on the front burner of the C-suite which sould give security teams much more clout and visibility for getting the resources they need to be proactive.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
9/28/2014 | 1:29:52 PM
Re: Security Seals of approval (or disapproval)
Not only would it make the information more digestable and understandable for consumers, it would additionally drive business away from the poorest performers and shepard business to the most secure companies.   I like it.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 4:27:01 PM
Security Seals of approval (or disapproval)
This isn't totally analagous but Jeff Williams creator of the OWASP Top 10 came up with a similar idea for application security. I'm sure something similar could come be fashioned for data breach disclosure. Check it out: 

on security. Take a look 

 
5 Reasons the Cybersecurity Labor Shortfall Won't End Soon
Steve Morgan, Founder & CEO, Cybersecurity Ventures,  12/11/2017
Oracle Product Rollout Underscores Need for Trust in the Cloud
Kelly Sheridan, Associate Editor, Dark Reading,  12/11/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Gee, these virtual reality goggles work great!!! 
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.