Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Careers & People

12/12/2019
10:15 AM

Lessons from the NSA: Know Your Assets

Chris Kubic worked at the National Security Agency for the past 32 years, finishing his tenure as CISO. He talks about lessons learned during his time there and what they mean for the private sector.

Chris Kubic
Chris Kubic

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
DouglasF354
100%
0%
DouglasF354,
User Rank: Author
12/13/2019 | 12:48:28 PM
Know your assets
The 'blue collar' control that is 'asset management' doesn't get the love it needs. And that critically undermines the CISO and the security program. The 'asset management' problem to cyber security is like the 'high blood pressure' problem that leads to stroke. It's quiet, often undetected, not discussed commensurate to the risk. And it's a security killer.
  1. The ability to do 'basic cyber hygiene' is undermined when it's difficult to get a proper fix on in-scope assets. Threats will find what you didn't.
  2. Of course, it costs more to be able to understand the asset-scape better. And that has been a difficult budget pitch and win for security. It's generally easier to win budget for that cool new tech than it is for what is perceived as general maintenance.
  3. More insidious is the strategic problem of connecting with executives and the board. Having robust asset inventories is tactically critical, but strategically the pitch needs to be focused on protection of big impact/ high value business assets. That is the bullseye to gain executive buy in. If you cannot robustly connect high value business assets strongly to the asset inventories, then you cannot confidently pitch a strong protection result to executives. And that undermines CISO success and confidence.
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9268
PUBLISHED: 2020-02-18
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.
CVE-2020-9269
PUBLISHED: 2020-02-18
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.
CVE-2020-9270
PUBLISHED: 2020-02-18
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.
CVE-2020-9271
PUBLISHED: 2020-02-18
ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.
CVE-2020-9265
PUBLISHED: 2020-02-18
phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc_username.