Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
4 Basic Principles to Help Keep Hackers Out
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
7/9/2018 | 7:52:42 PM
Re: CIO-CISO conflict
@Christian: Alas, the trend of high-level execs simply outsourcing anything cybersecurity-related wholesale -- strategy and all -- without much forethought -- continues, as I recently observed for a Dark Reading sister site here: securitynow.com/author.asp?section_id=613&doc_id=738870

While I generally agree with you, I will say that one thing that concerns me about stereotypes and stereotypical perceptions is the generalized notion (certainly not all of them) of hackers and IT admins and devs pooh-poohing the lawyers and compliance peeps, which could be problematic for a CISO if that view pervaded to that level.

Of course, technically, security, compliance, and privacy are all three separate circles on the Venn diagram of data stewardship... perhaps we need a Chief Data Steward to oversee -- or, at least, help integrate -- all three.
RetiredUser
100%
0%
RetiredUser,
User Rank: Ninja
7/6/2018 | 3:26:53 PM
Re: CIO-CISO conflict
To Joe's point, as a past code-monkey I definitely was guilty of seeing CISO leaders as just another C-Level lackey.  I've been reading a lot more articles the last couple years that identify the role of CISO of suffering not only in that area, but also from the general perception that the real InfoSec knowledge sits with lower-level managers and hackers.  When I was younger, we saw the C-Levels pimping expensive software packages, trying to fill gaps in process with bloatware and 3rd party vendors.  From my perspective, the real talent reading whitepapers, following cutting edge tech from visionaries and testing out new code ideas in virtual environments were the grunts in the code trenches, not the C-Levels, not the CISOs, but the front-line cyber defenders who never slept, never wore a suit, and so on.  I could point to plenty of CISOs now who came up from those trenches and have earned respect and the right to be heard, but in the overall business model, I'm afraid the CISO is still not seen any differently than the rest of the often disposable and (frankly) figure-head C-Level roles.  I think if that role were carefully trimmed and only truly qualified and knowledgeable hackers were placed there, the idea of the CISO as a "lackey" or "underling" might fade and the industry also start moving away from the C-Level chains that so many Enterprise organizations still suffer from.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
7/5/2018 | 2:28:26 PM
CIO-CISO conflict
Unfixed flaws and unpatched vulnerabilities will remain an issue as long as the CISO is treated as some sort of underling -- whether a direct report or not -- to the CIO. The CIO is judged against business agility objectives, which can run completely counter to the interests of the CISO's office.


Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16531
PUBLISHED: 2019-09-20
LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVE-2019-9717
PUBLISHED: 2019-09-19
In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c has a complex format argument to sscanf.
CVE-2019-9719
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-9720
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-16525
PUBLISHED: 2019-09-19
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.