Comments
UK Banks Must Produce Backup Plans for Cyberattacks
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/9/2018 | 8:05:59 PM
Re: NIST analog?
@REISEN: Conversely, the NIST Cybersecurity Framework -- like any framework -- is not exactly perfect, and has its own weaknesses. At least it's something to get started with, however.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/9/2018 | 2:39:31 PM
Re: NIST analog?
Of more significance is that backup and restoration plans ARE PART of normal IT functionality and business purpose.  The data centers do not operate in a run-only vacuum.  There have to be plans to reconstruct and rebuild in any event, whether ransomware or hurricane, flood, loss of power, etc.  That it must be mandated by law is insane!  Good yes, but OMG this is It 101 basics folks!!!  
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/5/2018 | 2:26:12 PM
NIST analog?
On the surface, this sounds like pretty basic stuff already covered under the NIST Cybersecurity Framework in the US -- which effectively acts as "pseudo-law" for financial institutions in the US. Seems like the only financial institutions in the UK that might have issue are those that have not crossed the pond -- and, even then, given the dramatic increase in collaboration on security matters throughout the finance sector over the past few years, this should not be too terribly burdensome, I suspect.


White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10869
PUBLISHED: 2018-07-19
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
CVE-2018-10870
PUBLISHED: 2018-07-19
redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
CVE-2018-12959
PUBLISHED: 2018-07-19
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
CVE-2018-14336
PUBLISHED: 2018-07-19
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses.
CVE-2018-10620
PUBLISHED: 2018-07-19
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code t...