Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
First US Federal CISO Shares Security Lessons Learned
Oldest First  |  Newest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
11/29/2017 | 8:30:55 PM
Basics
Reminds me of that old reality show "To Catch a Thief," which demonstrated to people how easy it was for burglars to break in and steal them blind in a matter of about ten minutes. Almost all the time, there was an unlocked window or unlocked door.

Same thing in cybersecurity. The bad guys don't go right to sophisticated techniques. They go to basic, common passwords and they go to recently announced zero-days to check for a lack of a patch.
SchemaCzar
SchemaCzar,
User Rank: Strategist
11/30/2017 | 9:32:07 AM
Executives wait for "technologists" to lock their own front doors
Reading security news and the general news, I conclude that Touhill needs to talk tougher to executives.  There are too many stories of executives who can't be bothered to follow the same security policies that must be followed by others in the organization.  They are the highest-value person targets in the organization, and they often feel they can dump their own security on an underling, or worse, that security is the organization's problem rather than their personal responsibility.  I recently heard of a high-level VP in a large, regulated business who flat-out refused to follow password change, or even password complexity policy.  This was before password change policies were brought into question, but long after secure password managers were available that make password change and complexity requirements manageable.

Touhill is right that these executives think cybersecurity is a technology problem.  So is the physical security of their own homes: a technology problem.  If they treated home security the way they do organizational security, they wouldn't even lock their own front doors.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
11/30/2017 | 8:32:12 PM
Re: Executives wait for "technologists" to lock their own front doors
@SchemaCzar: Not just executives -- even the very top executives. An MIT professor once told me a story of how a company sent out "fake" phishing emails to its employees as a test, and one of the people who clicked on the link was a C-suite executive. When asked why he clicked on the link, the C-suiter responded, "I wanted to see what would happen."


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-34491
PUBLISHED: 2022-06-25
In the RSS extension for MediaWiki through 1.38.1, when the $wgRSSAllowLinkTag config variable was set to true, and a new RSS feed was created with certain XSS payloads within its description tags and added to the $wgRSSUrlWhitelist config variable, stored XSS could occur via MediaWiki's template sy...
CVE-2022-29931
PUBLISHED: 2022-06-25
Raytion 7.2.0 allows reflected Cross-site Scripting (XSS).
CVE-2022-31017
PUBLISHED: 2022-06-25
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the serve...
CVE-2022-31016
PUBLISHED: 2022-06-25
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated A...
CVE-2022-24893
PUBLISHED: 2022-06-25
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can resul...