Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
How NOT To Be The Next Sony: Defending Against Destructive Attacks
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
McDaveX
100%
0%
McDaveX,
User Rank: Strategist
1/9/2015 | 5:32:24 AM
because...
Every attack was "unprecidented". Even if its the third time you were compromised by the same unpatched bug. :)
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/9/2015 | 9:11:26 AM
Re: because...
Super analysis, Sara. Your analogy about aproaching destructive attacks more like a physical disaster (flood, explosion, etc.) than a digital one is really apt. And what happened to Sony presents an object lesson in what needs to be in place to support essential services while the damage is being contained. 
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2015 | 9:40:58 AM
Re: because...
The Sony breach was a painful example of how crucial it is for an incident response plan to be part and parcel of a security strategy. Sony's Lynton reportedly (according to the NYT) told his staff in the aftermath: "There is no playbook for us to turn to." But that's only because they didn't have a full-blown IR plan in place. If so, Sony might have had a better and quicker response, with less carnage.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/9/2015 | 9:57:31 AM
Re: because...
Speaking about Incident Response plans, look no further than our latest flash poll (click or mosey over the right side, column and scroll down) to see that IR is not exactly a pressing priority within the Dark Reading community. 40 percent of respondents say they don't even have a plan!
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
1/9/2015 | 10:03:46 AM
Single Point of Failure
I am a strong advocate for not allowing a single point of failure. Some corporations may find an excessive overlapping of responsibilities redundant. The contrary not only represents a security hole but also a valid business risk as your employees do have the right to take off, leave the corporation, etc. There are many issues involved with a single point of failure. Enterprise needs to realize people are not as predicatable as computation. For that reason and a few others such as a knowledge challenge there needs to be responsibilities that overlap.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 10:40:43 AM
Re: because...
@McDaveX  :)  Yeah, I think that organizations would rather focus on the "unprecedented" damage than admit to the fact that they got compromised by the same, old ordinary methods.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 10:47:52 AM
Re: Single Point of Failure
@RyanSepe  I think that a lot of security pros out there need to take your comments to their CEO/CFO to help them get approval for a bigger IT security staff.  :)
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
1/9/2015 | 11:04:36 AM
Re: because...
@Kelly  Yeah, I mean I'm sympathetic to Sony's disaster recovery plight, because I'm sure they didn't think that an information security breach could cause that much damage. It definitely makes the point that the same people who build DR plans for natural disasters need to be working on DR plans for digital disasters.
ArthurTisi
50%
50%
ArthurTisi,
User Rank: Apprentice
1/10/2015 | 3:40:06 PM
We need to expand awareness to home users more
Recent pieces written by Brian Krebs reinforces how opportunitstic groups like LizardSquad are using botnets to infultrate not only corporate network devices but home devices as well.  Homeusers need to practice a little more discipline with passwords and the like, using the default is not a viable option.

Arthur Tisi

 
aaaaaaaadfzdfazef
50%
50%
aaaaaaaadfzdfazef,
User Rank: Apprentice
1/12/2015 | 9:52:15 AM
Helping avoid being the next Insider Threat story
Your right. The Insider Threat is not just about corporate data or financial reward. Today's world offers many different opportunties for the insider threat. Critical services that society relies on are dependent on computers and seen as potentially vulnerable to security attacks. To avoid being the 'next' Sony Insider Threat story, insider threats need to continue to move in priority and become an executive and board-level concern. 

The good news is that there is a lot that organizations can do now. Building an Insider Threat Program helps move an organization from paranoia to protection. This means involving a sophisticated tool set, staff and manager's awareness and an efficient process. 
Page 1 / 2   >   >>


HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.