Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Cyberrisk Through A Business Lens
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
JulietteRizkallah,
User Rank: Ninja
1/16/2017 | 9:26:21 AM
Visibility is key
Developing the ability to see what is going on is critical for the IT and executive staff to change the behaviors you have just described.  IT security solutions need to provide behavioral analysis that helps recognize what is out of norm and a potential threat.  The big data analysis offered today deals with millions of security logs and results in escalation of many false-positives and therefore an overrated risk profile on everything -as you mentioned-.
enhayden
enhayden,
User Rank: Strategist
1/9/2017 | 1:34:23 PM
Excellent Post!
This is a terrific article analyzing cyberrisk for the enterprise at a business perspective vs. technical perspective.  

As a former CISO -- and someone who struggled to get the "management on board" with cyber risk -- your one comment "...personnel routinely choose not to comply with cyberrisk policies because management places greater emphasis on revenue, budgets, and/or deadlines...." really hit home.

To minimize this response by the employees/contractors/vendors the CEO and Board Chair need to be the key messengers broadcasting the message that cyber and physical risk is EVERYONE's concern and that revenue will be negatively impacted by poor security and risk practices/analysis.

Again, well done!  

Ernie Hayden CISSP CEH GICSP PSP
jonesj26
jonesj26,
User Rank: Author
1/4/2017 | 5:26:51 PM
Re: Spot On
Thanks, RickL273!
jonesj26
jonesj26,
User Rank: Author
1/4/2017 | 5:25:39 PM
Re: Thank you
Thanks, Michael!  Very gratifying to hear that you find my stuff to be useful!
michaelfillin
michaelfillin,
User Rank: Apprentice
1/3/2017 | 2:34:44 PM
Thank you
Always great to read your articles Mr Jones. Thanks
RickL273
RickL273,
User Rank: Apprentice
1/3/2017 | 1:52:51 PM
Spot On
Jack,

Nice job!

Executives need the right Lens to look through so they can understand the problem and the investment. Cyber Risk management and security is another investment area and if they can see the return in terms of revenue (or lost revenue) they will invest which will benefit all.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-20099
PUBLISHED: 2022-06-27
A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
CVE-2022-2221
PUBLISHED: 2022-06-27
Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credentials of other users. This issue affects: Devolutions Remote Desktop Manager versions prior to 2022.1.8.
CVE-2022-28622
PUBLISHED: 2022-06-27
A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remote unauthorized access. HPE has made the following software update to resolve the vulnerability in HPE StoreOnce Software 4.3.2.
CVE-2022-31034
PUBLISHED: 2022-06-27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in paramete...
CVE-2022-31035
PUBLISHED: 2022-06-27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with th...