Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
KPMG Study: Breaches Up, Security Spending Down
Threaded  |  Newest First  |  Oldest First
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/28/2016 | 10:45:19 AM
Proactivity vs Reactivity
I suppose the bright side here is that the trend seems to be moving away from reactive security...if one wants to be an optimist about it.

But there still ought to be proactive security measures happening, regardless of breaches.
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
7/28/2016 | 10:55:37 AM
Re: Proactivity vs Reactivity
It's true, Joe... infosec professionals are done bouncing around like squirrels in a cage (most of them, anyway). There's simply too much coming at them every single minute. I think this is at least part of what Greg Bell was talking about with his phrase "cyber fatigue."
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/28/2016 | 11:03:38 AM
Re: Proactivity vs Reactivity
Precisely.  Which goes to a related point: The best defense is a good offense.

(Which isn't an endorsement of per se offensive security measures.  Just noting the need for proactivity rather than reactivity.)
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/28/2016 | 4:02:23 PM
Re: Proactivity vs Reactivity
"The best defense is a good offense"

Exactly. I agree. The only problem is that there is no budget for offense in most cases. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/29/2016 | 1:29:13 PM
Re: Proactivity vs Reactivity
@Dr.T: Yet another (of many) reasons the CISO should report directly to the CFO.  If security comes more directly under the CFO's purview, the fallout of a breach or data loss/compromise will hit the CFO more directly.  Then they'll start budgeting better.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2016 | 1:54:47 PM
Re: Proactivity vs Reactivity
That's an interesting point of view that I have yet to hear having the CISO under the CFO. Definitely seems plausible. Typically what I have seen is the CISO under the CIO. Do you think it would be more beneficial to have the CISO under the CFO, like you stated, or on the same level as the CFO all under the CEO?
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
7/29/2016 | 3:47:59 PM
Re: Proactivity vs Reactivity
Personally, I think that cybersecurity has come to the point where it really is its own discipline. When it comes to protecting an organization, cybersecurity has to have an equal voice at the table, and any tiebreaker should come from the one who is responsible for the organization as a whole. That usually falls on the shoulders of the CEO. Anytime you place security under another line, it takes a back seat and no longer has a fair voice at the table. For instance, if the CISO falls under the CIO, there is an inherent conflict of interest. IT is tasked with delivering technology to enable the business, whereas security needs to ensure that the technology is safely delivered (an oversimplification, I know, but it illustrates the point). If a situation arises where those come into conflict, IT generally overrules security. I have seen this happen. I have seen a CIO reclassify a security position because IT needed another FTE and did not have an open req. How does that help security? In that particular case, the security position that was reclassified was never reinstated or replaced. It was a permanent loss for security.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/30/2016 | 7:26:56 AM
Re: Proactivity vs Reactivity
Indeed, even the federal government has taken note of the CIO-CISO conflict of interest.  Capitol Hill Republicans have proposed having the CISO of the Department of Health and Human Services answer to the General Counsel, as can be seen in this report from last year: energycommerce.house.gov/sites/republicans.energycommerce.house.gov/files/114/Analysis/20150806HHSinformationsecurityreport.pdf

Now, a bipartisan bill before Congress proposes separating the office of the DHHS CISO entirely -- completely divorcing the role of the CIO.  See, e.g., fcw.com/articles/2016/05/27/hhs-ciso-hearing.aspx
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/31/2016 | 10:15:55 PM
Re: Proactivity vs Reactivity
Also a divorce of the roles is probably for the best.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
8/1/2016 | 7:30:37 AM
Re: Proactivity vs Reactivity
@Ryan: For that matter, how do you feel about the relationship between the CISO, the CCO, and the CPO?  In many organizations, one of these does the job of another -- if not all three.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/30/2016 | 7:23:30 AM
Re: Proactivity vs Reactivity
@RyanSepe: The notion isn't novel -- and one of the primary justifications for it is that the CISO and the CIO have an inherent conflict of interest.

I wrote about it for InformationWeek last year, in fact: informationweek.com/strategic-cio/cyber-security-and-the-cio-changing-the-conversation/a/d-id/1320660
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/31/2016 | 10:08:15 PM
Re: Proactivity vs Reactivity
I've put a lot of thought into this conflict of interest in the past between the CIO's goals and the CISO's. As you stated in your article, the success metrics for each is different. Cyber Security is more of a cost saving mechanism than a revenue earning mechanism, and unfortunately for InfoSec professionals the latter is held in higher regard.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/28/2016 | 4:00:56 PM
Re: Proactivity vs Reactivity
"cyber fatigue."

I hear you. This is nothing that will be going away anytime soon. Unless we figure out a way to deal with security in more manageable and proactive way such as designing the systems and applications secure in the first place, not leaving security to later stages.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/28/2016 | 3:58:01 PM
Re: Proactivity vs Reactivity
"moving away from reactive security "

That would be great, I would think it would take more time, most SMEs do not know all these things are all about until they get hit.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/28/2016 | 3:56:10 PM
20% ?
Does this mean that 20% do not know that they are breached? Most companies have been breached one way of other, it does not have to be via a professional hacker, an employee forwarding an email to their Gmail is a breach.
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
7/28/2016 | 4:04:02 PM
Re: 20% ?
Commenter Dr.T asked: "Does this mean that 20% do not know that they are breached?"

No. It means 80 percent of respondents were honest enough to admit they had been breached. The remainder either weren't being completely forthright or feared some sort of blowback.

I don't know any infosec professionals who think their networks are invuinerable. You?
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/29/2016 | 1:27:23 PM
Re: 20% ?
An MIT Professor and cybersecurity expert I know, Stuart Madnick, always has this quip to share at every presentation he gives: "There are two types of organizations: Those that know they've been hacked, and those that don't know they've been hacked."
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2016 | 1:52:20 PM
Re: 20% ?
Yes, I have heard variations of this same premise elsewhere. I do agree with this to a certain extent. I think what it comes down to was how severe was the hack.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/28/2016 | 4:02:42 PM
IoT at the workplace
 

Can not wait to see when IoT devices come to workplaces, what an exciting days it would be for security experts :--))).
T Sweeney
50%
50%
T Sweeney,
User Rank: Moderator
7/28/2016 | 4:08:31 PM
Re: IoT at the workplace
Yes, the Internet of Things promises to keep things very exciting from a security perspective.

Or as a pen-tester friend of mine likes to describe it, "job security."
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/28/2016 | 5:40:50 PM
Re: IoT at the workplace
Yes agreed. From your perspective what typcially non-work related IoT devices do you think will have the greatest impact in the work environment as they become more integrated? Or do you think it consistent across device platforms?


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.