Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
What Government Can (And Cant) Do About Cybersecurity
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/22/2015 | 10:58:03 AM
Security Facts Labeling
Great post Jeff. And for anyone wondering what a  "Security Facts" label might look like, here's an example courtesy of the author! 



 
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
1/22/2015 | 12:04:25 PM
Re: Security Facts Labeling
"And CISO's should not report to CIO's.. Information security is a business problem, NOT an IT problem.  IT and security have different goals at the end of the day.  It has to provide a service to the business with no promise of security.  Security is provide a secure means for this IT enablement, which may not be the shortest path between two points."

You won't believe how many times I have said that and how many times people try to convince me otherwise. I have talked to many CIOs and a lot of them believe that Security should fall under their purview. They are convinced that if IT and Security are their responsibility, then they will be able to make wise decisions that fulfill both needs. Apparently, they fail to see a need for a separation of duties to prevent a conflict of interest from making a decision that will be a serious detriment to security. In their minds, they are able to make an impartial judgment that reaches a reasonable compromise that will be good for the organization. As I see it, IT is pressured to deliver technology that enables an organization to fulfill its goals, and security is tasked with the responsibility that the technology delivered is secure. When push comes to shove, which do you think will come out on top if the CIO is pressured to deliver technology? I have seen CIOs divert resources AWAY from security in order to facilitate IT delivery. We all know that security resources are scarce and have to be fought for tooth and nail. When the CIO performs that action, exactly how secure does that leave the organization? In a tie between IT and Security, the tie breaker must be someone that is above both IT and Security, and not someone who IS both IT and Security. It must be someone whose responsibility is the organization itself and not some subset of it.
gmerriman112
50%
50%
gmerriman112,
User Rank: Strategist
1/22/2015 | 1:05:27 PM
The internet needs a security makeover
It seems to me the root problem here is that we have built an intrinsically insecure edifice that needs a serious structural overhaul. Anything short of that is simply fiddling around at the edges. I see nothing in these proposals that address the real problem.
planetlevel
50%
50%
planetlevel,
User Rank: Author
1/22/2015 | 2:51:07 PM
Re: The internet needs a security makeover
I agree, but at least they're talking about cybersecurity now.  Now to help them not make things worse.
planetlevel
50%
50%
planetlevel,
User Rank: Author
1/22/2015 | 2:58:36 PM
Re: Security Facts Labeling
Sure, everyone could get hit by a submarine.  But it's not responsible to take crazy risks, particularly when you are entrusted with other people's data. Trying to figure out the reporting structure that will cure a company's security issues is too simple.  I like your lifestyle analogy here -- security is a culture problem for an organization.

For the nation as a whole, we need to think about how we instill the culture of security into our companies and agencies -- the ones creating the technology without enough security.  I fear that the government approach will be to try to force the issue with super-compliance, liability, and audit.  That won't fix the culture and will probably make things worse, as  people will try to put the responsibility for security on the auditor.

--Jeff
gmerriman112
100%
0%
gmerriman112,
User Rank: Strategist
1/22/2015 | 3:42:36 PM
Re: Security Facts Labeling
 planetlevel says:

"I fear that the government approach will be to try to force the issue with super-compliance, liability, and audit.  That won't fix the culture and will probably make things worse, as  people will try to put the responsibility for security on the auditor."

I used to work in the building trades. While building and fire codes can be a real PITA, I believe that they definitely save lives and prevent injury and property damage.

Professional opinion is that, had the Port Authority been obligated to conform to New York City fire and building codes, the structures would probably not have collapsed completely and a lot more people would have made it out alive. Unfortunately, as a state agency, the Port Authority was exempt from local codes.

It seems to me that any entity holding personal information on the public that could lead to harm if divulged should have a fiduciary obligation to keep that information secure.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
1/22/2015 | 4:16:01 PM
Not about codebase
 

I think security is less about lines of codes but more about what technology we use and what standards we apply for secure application development practices. Sometimes more code may mean more security measures. Some of the old systems listed in infographics do not have any security around themselves.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
1/22/2015 | 4:17:50 PM
Re: Security Facts Labeling
There should always be checks and balances for anything we do, otherwise we are sure it will go out of control.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
1/22/2015 | 4:19:54 PM
Re: The internet needs a security makeover
Not only that but also a new mindset around security. We can not make internet secure, we need to start with that and try to find out a new approaches to address current security needs.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
1/22/2015 | 4:23:50 PM
Re: Security Facts Labeling
It is really impressive that injection is still at the top of the list. That is not really default to solve. I guess old legacy system are not easy to change and becoming the target.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-4020
PUBLISHED: 2021-11-27
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-23654
PUBLISHED: 2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via C...
CVE-2021-43785
PUBLISHED: 2021-11-26
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious...
CVE-2021-43776
PUBLISHED: 2021-11-26
Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other se...
CVE-2021-41243
PUBLISHED: 2021-11-26
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be add...