Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
First US Federal CISO Shares Security Lessons Learned
Oldest First  |  Newest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/29/2017 | 8:30:55 PM
Basics
Reminds me of that old reality show "To Catch a Thief," which demonstrated to people how easy it was for burglars to break in and steal them blind in a matter of about ten minutes. Almost all the time, there was an unlocked window or unlocked door.

Same thing in cybersecurity. The bad guys don't go right to sophisticated techniques. They go to basic, common passwords and they go to recently announced zero-days to check for a lack of a patch.
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
11/30/2017 | 9:32:07 AM
Executives wait for "technologists" to lock their own front doors
Reading security news and the general news, I conclude that Touhill needs to talk tougher to executives.  There are too many stories of executives who can't be bothered to follow the same security policies that must be followed by others in the organization.  They are the highest-value person targets in the organization, and they often feel they can dump their own security on an underling, or worse, that security is the organization's problem rather than their personal responsibility.  I recently heard of a high-level VP in a large, regulated business who flat-out refused to follow password change, or even password complexity policy.  This was before password change policies were brought into question, but long after secure password managers were available that make password change and complexity requirements manageable.

Touhill is right that these executives think cybersecurity is a technology problem.  So is the physical security of their own homes: a technology problem.  If they treated home security the way they do organizational security, they wouldn't even lock their own front doors.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/30/2017 | 8:32:12 PM
Re: Executives wait for "technologists" to lock their own front doors
@SchemaCzar: Not just executives -- even the very top executives. An MIT professor once told me a story of how a company sent out "fake" phishing emails to its employees as a test, and one of the people who clicked on the link was a C-suite executive. When asked why he clicked on the link, the C-suiter responded, "I wanted to see what would happen."


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25789
PUBLISHED: 2020-09-19
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.
CVE-2020-25790
PUBLISHED: 2020-09-19
** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our secu...
CVE-2020-25791
PUBLISHED: 2020-09-19
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
CVE-2020-25792
PUBLISHED: 2020-09-19
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().
CVE-2020-25793
PUBLISHED: 2020-09-19
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From<InlineArray<A, T>>.