Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Basic Principles to Help Keep Hackers Out
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/9/2018 | 7:52:42 PM
Re: CIO-CISO conflict
@Christian: Alas, the trend of high-level execs simply outsourcing anything cybersecurity-related wholesale -- strategy and all -- without much forethought -- continues, as I recently observed for a Dark Reading sister site here: securitynow.com/author.asp?section_id=613&doc_id=738870

While I generally agree with you, I will say that one thing that concerns me about stereotypes and stereotypical perceptions is the generalized notion (certainly not all of them) of hackers and IT admins and devs pooh-poohing the lawyers and compliance peeps, which could be problematic for a CISO if that view pervaded to that level.

Of course, technically, security, compliance, and privacy are all three separate circles on the Venn diagram of data stewardship... perhaps we need a Chief Data Steward to oversee -- or, at least, help integrate -- all three.
RetiredUser
100%
0%
RetiredUser,
User Rank: Ninja
7/6/2018 | 3:26:53 PM
Re: CIO-CISO conflict
To Joe's point, as a past code-monkey I definitely was guilty of seeing CISO leaders as just another C-Level lackey.  I've been reading a lot more articles the last couple years that identify the role of CISO of suffering not only in that area, but also from the general perception that the real InfoSec knowledge sits with lower-level managers and hackers.  When I was younger, we saw the C-Levels pimping expensive software packages, trying to fill gaps in process with bloatware and 3rd party vendors.  From my perspective, the real talent reading whitepapers, following cutting edge tech from visionaries and testing out new code ideas in virtual environments were the grunts in the code trenches, not the C-Levels, not the CISOs, but the front-line cyber defenders who never slept, never wore a suit, and so on.  I could point to plenty of CISOs now who came up from those trenches and have earned respect and the right to be heard, but in the overall business model, I'm afraid the CISO is still not seen any differently than the rest of the often disposable and (frankly) figure-head C-Level roles.  I think if that role were carefully trimmed and only truly qualified and knowledgeable hackers were placed there, the idea of the CISO as a "lackey" or "underling" might fade and the industry also start moving away from the C-Level chains that so many Enterprise organizations still suffer from.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
7/5/2018 | 2:28:26 PM
CIO-CISO conflict
Unfixed flaws and unpatched vulnerabilities will remain an issue as long as the CISO is treated as some sort of underling -- whether a direct report or not -- to the CIO. The CIO is judged against business agility objectives, which can run completely counter to the interests of the CISO's office.


Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14869
PUBLISHED: 2019-11-15
A flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could esc...
CVE-2019-18987
PUBLISHED: 2019-11-15
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public, its previous versions can be exposed, thus potentially disclosing private or sensitive information within the filter's definition.
CVE-2019-18986
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVE-2019-18981
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVE-2019-18982
PUBLISHED: 2019-11-15
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.