Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How NOT To Be The Next Sony: Defending Against Destructive Attacks
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
McDaveX
100%
0%
McDaveX,
User Rank: Strategist
1/9/2015 | 5:32:24 AM
because...
Every attack was "unprecidented". Even if its the third time you were compromised by the same unpatched bug. :)
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/9/2015 | 9:11:26 AM
Re: because...
Super analysis, Sara. Your analogy about aproaching destructive attacks more like a physical disaster (flood, explosion, etc.) than a digital one is really apt. And what happened to Sony presents an object lesson in what needs to be in place to support essential services while the damage is being contained. 
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2015 | 9:40:58 AM
Re: because...
The Sony breach was a painful example of how crucial it is for an incident response plan to be part and parcel of a security strategy. Sony's Lynton reportedly (according to the NYT) told his staff in the aftermath: "There is no playbook for us to turn to." But that's only because they didn't have a full-blown IR plan in place. If so, Sony might have had a better and quicker response, with less carnage.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/9/2015 | 9:57:31 AM
Re: because...
Speaking about Incident Response plans, look no further than our latest flash poll (click or mosey over the right side, column and scroll down) to see that IR is not exactly a pressing priority within the Dark Reading community. 40 percent of respondents say they don't even have a plan!
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
1/9/2015 | 10:03:46 AM
Single Point of Failure
I am a strong advocate for not allowing a single point of failure. Some corporations may find an excessive overlapping of responsibilities redundant. The contrary not only represents a security hole but also a valid business risk as your employees do have the right to take off, leave the corporation, etc. There are many issues involved with a single point of failure. Enterprise needs to realize people are not as predicatable as computation. For that reason and a few others such as a knowledge challenge there needs to be responsibilities that overlap.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 10:40:43 AM
Re: because...
@McDaveX  :)  Yeah, I think that organizations would rather focus on the "unprecedented" damage than admit to the fact that they got compromised by the same, old ordinary methods.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 10:47:52 AM
Re: Single Point of Failure
@RyanSepe  I think that a lot of security pros out there need to take your comments to their CEO/CFO to help them get approval for a bigger IT security staff.  :)
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 11:04:36 AM
Re: because...
@Kelly  Yeah, I mean I'm sympathetic to Sony's disaster recovery plight, because I'm sure they didn't think that an information security breach could cause that much damage. It definitely makes the point that the same people who build DR plans for natural disasters need to be working on DR plans for digital disasters.
ArthurTisi
50%
50%
ArthurTisi,
User Rank: Apprentice
1/10/2015 | 3:40:06 PM
We need to expand awareness to home users more
Recent pieces written by Brian Krebs reinforces how opportunitstic groups like LizardSquad are using botnets to infultrate not only corporate network devices but home devices as well.  Homeusers need to practice a little more discipline with passwords and the like, using the default is not a viable option.

Arthur Tisi

 
aaaaaaaadfzdfazef
50%
50%
aaaaaaaadfzdfazef,
User Rank: Apprentice
1/12/2015 | 9:52:15 AM
Helping avoid being the next Insider Threat story
Your right. The Insider Threat is not just about corporate data or financial reward. Today's world offers many different opportunties for the insider threat. Critical services that society relies on are dependent on computers and seen as potentially vulnerable to security attacks. To avoid being the 'next' Sony Insider Threat story, insider threats need to continue to move in priority and become an executive and board-level concern. 

The good news is that there is a lot that organizations can do now. Building an Insider Threat Program helps move an organization from paranoia to protection. This means involving a sophisticated tool set, staff and manager's awareness and an efficient process. 
Page 1 / 2   >   >>


10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13611
PUBLISHED: 2019-07-16
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
CVE-2019-0234
PUBLISHED: 2019-07-15
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of ...
CVE-2018-7838
PUBLISHED: 2019-07-15
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP C...
CVE-2019-6822
PUBLISHED: 2019-07-15
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
CVE-2019-6823
PUBLISHED: 2019-07-15
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.