Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Basic Principles to Help Keep Hackers Out
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/9/2018 | 7:52:42 PM
Re: CIO-CISO conflict
@Christian: Alas, the trend of high-level execs simply outsourcing anything cybersecurity-related wholesale -- strategy and all -- without much forethought -- continues, as I recently observed for a Dark Reading sister site here: securitynow.com/author.asp?section_id=613&doc_id=738870

While I generally agree with you, I will say that one thing that concerns me about stereotypes and stereotypical perceptions is the generalized notion (certainly not all of them) of hackers and IT admins and devs pooh-poohing the lawyers and compliance peeps, which could be problematic for a CISO if that view pervaded to that level.

Of course, technically, security, compliance, and privacy are all three separate circles on the Venn diagram of data stewardship... perhaps we need a Chief Data Steward to oversee -- or, at least, help integrate -- all three.
RetiredUser
100%
0%
RetiredUser,
User Rank: Ninja
7/6/2018 | 3:26:53 PM
Re: CIO-CISO conflict
To Joe's point, as a past code-monkey I definitely was guilty of seeing CISO leaders as just another C-Level lackey.  I've been reading a lot more articles the last couple years that identify the role of CISO of suffering not only in that area, but also from the general perception that the real InfoSec knowledge sits with lower-level managers and hackers.  When I was younger, we saw the C-Levels pimping expensive software packages, trying to fill gaps in process with bloatware and 3rd party vendors.  From my perspective, the real talent reading whitepapers, following cutting edge tech from visionaries and testing out new code ideas in virtual environments were the grunts in the code trenches, not the C-Levels, not the CISOs, but the front-line cyber defenders who never slept, never wore a suit, and so on.  I could point to plenty of CISOs now who came up from those trenches and have earned respect and the right to be heard, but in the overall business model, I'm afraid the CISO is still not seen any differently than the rest of the often disposable and (frankly) figure-head C-Level roles.  I think if that role were carefully trimmed and only truly qualified and knowledgeable hackers were placed there, the idea of the CISO as a "lackey" or "underling" might fade and the industry also start moving away from the C-Level chains that so many Enterprise organizations still suffer from.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
7/5/2018 | 2:28:26 PM
CIO-CISO conflict
Unfixed flaws and unpatched vulnerabilities will remain an issue as long as the CISO is treated as some sort of underling -- whether a direct report or not -- to the CIO. The CIO is judged against business agility objectives, which can run completely counter to the interests of the CISO's office.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-19551
PUBLISHED: 2021-09-21
Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.
CVE-2020-19553
PUBLISHED: 2021-09-21
Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php.
CVE-2021-40847
PUBLISHED: 2021-09-21
The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by ...
CVE-2021-41084
PUBLISHED: 2021-09-21
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`Ã¥), Header values (`Header.value`), Status r...
CVE-2021-23443
PUBLISHED: 2021-09-21
This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.