Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Infosec Resolutions For The New Year
Newest First  |  Oldest First  |  Threaded View
LysaMyers
LysaMyers,
User Rank: Author
1/6/2015 | 6:33:24 PM
Re: Malware: Everything old is new again -- the human factor
@Marilyn Cohodas - Consider where we were in terms of safety 20 years after cars became a common phenomenon. These things take time, especially when there are few people who adequately understand the technology. I don't expect a sea change any time soon, but I see a hunger in the general populace for better information, which it is our obligation (as people who know what's up, and can communicate well) to fill.
LysaMyers
LysaMyers,
User Rank: Author
1/6/2015 | 6:29:07 PM
Re: "Expedience at the expense of security"
@RyanSepe - Thank you!

Expedience, in this case, is not necessarily the same as ease of use. It's a combination of expertise, effectiveness, and expense, with an element of ease of use. Finding all 4 of those things is not necessarily easy, you kind of have to put some effort into finding them. If you don't make the effort, you may be taking the easy route in the short term, but you're likely to pay for it in the end. 
LysaMyers
LysaMyers,
User Rank: Author
1/6/2015 | 6:23:19 PM
Re: What about VDI and DaaS?
@kbannan100 - Virtual/snapshot-style desktops can be a great boon for security, but cloud-based implementations may not work for all organizations. Beyond that, many breaches happen due to lost credentials or files, especially on mobile devices/laptops. Every different configuration has its own level of risk, and I don't think we should abandon any well-worn technology entirely, in favor of newer or less-tested technologies. 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
1/6/2015 | 9:06:25 AM
Re: Malware: Everything old is new again -- the human factor
Totally agree with you @Ryan that hardening humans is really the essential problem. And the enterprise is only one part of the solution. Schools, banking, entertainment, retail all have a stake in educating the public about basic cyber hygiene. But I don't see a groundswell of support for such a comprehensive initiative....
RyanSepe
RyanSepe,
User Rank: Ninja
1/6/2015 | 9:01:10 AM
Re: Malware: Everything old is new again -- the human factor
Thats a very difficult topic to theorize. It seems that user security education is rearing its head across the enterprise level, which I think is due to employee negligence being one of the largest causes of an event, in the form of security awareness training. But security awareness training is not prevalent at the academic level unless your have a track of computer related academics. Which is not completely comprehensive to say the least. At the everyday technology user level security features are merely an option and not mandated. I think to truly have everyone realize the importance of security, hardened systems and best practices need to become the baseline. Most people will choose the easiest method of performing something if they have never been exploited before because the danger has not yet become real for them. This last comment is directed at device configuration. I think the only way to reach everyone as to why security is so important is to make their devices mirror these principles.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
1/5/2015 | 3:42:28 PM
Malware: Everything old is new again -- the human factor
I wonder what the critical mass in user education needs to be to shift the balance in favor in favor of the security professionals versus the cybercriminals. Are we making any progress in this area?
RyanSepe
RyanSepe,
User Rank: Ninja
12/31/2014 | 12:44:42 PM
Re: What about VDI and DaaS?
@kbannan100. The security risk would decrease under those configurations but would not eliminate it. Snapshot methodology can help against malware from a desktop perspective but there are still logical instances and can be infiltrated because they have factors a physical infrasture would have such as IP address and the way the OS handles data transit is similar. This is because virtual infrastructure was designed to minimize the physical aspect and cut costs so it was modeled closely after. However, there have been break throughs with these configurations that do vastly increase security posture. Such as what I referenced above, physical access control(eliminated), etc.
RyanSepe
RyanSepe,
User Rank: Ninja
12/31/2014 | 12:40:30 PM
"Expedience at the expense of security"
"Expedience at the expense of security"

It is a common misconception that ease of use and security are contrasting ideals. Whenever a technology is implemented there is a planning phase regardless if security is even on the docket. Following an agile methodology would dictate that security be ingrained at the initial phases. An efficient organization versed in change management can attest to the implementation of security into a product or hardware implementation will not add an extensive amount of time to the endeavor and in fact in the long run could utilize more man hours as the referenced organizations are experiencing.


The 4 InfoSec resolutions are well founded. Those without a knowledge of history are doomed to repeat it and it seems that enterprise infrastructure is not experiencing the required changes quick enough.
kbannan100
kbannan100,
User Rank: Moderator
12/30/2014 | 1:35:39 PM
What about VDI and DaaS?
What do you think about taking desktops out of the equation -- at least traditional ones? Users are constantly doing stupid things. (Or at least short-sighted things.) By switching people over to DaaS or VDI instead of a traditional desktop doesn't the security risk go down, too?

--KB
Karen J. Bannan, commenting on behalf of IDG and VMware.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37491
PUBLISHED: 2023-02-07
An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive information via CWallet::CreateTransaction() function.
CVE-2023-0707
PUBLISHED: 2023-02-07
A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been rated as critical. Affected by this issue is the function delete_record of the file function.php. The manipulation of the argument id leads to sql injection. VDB-220346 is the identifier assigned to this v...
CVE-2022-21953
PUBLISHED: 2023-02-07
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
CVE-2022-31249
PUBLISHED: 2023-02-07
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 an...
CVE-2022-43755
PUBLISHED: 2023-02-07
A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.