Kremlin coercion and sanctions could impact Western customers

Read More

Every day, I see the failure in our technology. I’m sure you see it as well. Since the day we started receiving email, we have failed at protecting recipients from scams, phishes and other email messages that they don’t want. I remember the infamous email-based computer worm, the “ILOVEYOU virus,” that infected fellow IT friends back in 2000.

Those victims should have known better than to click on an email that said ILOVEYOU, but they did and had to clean up afterwards. We hope that our antivirus or endpoint protection software alerts us to problems. In reality, it often does not. When technology fails, it’s likely because the attacker made an end run around it by targeting humans. Here are four ways they do it.

To read this article in full, please click here

Read More

Authentication remains one of the most painstaking challenges faced by CISOs in organizations large and small. This longstanding, fundamental element of security continues to cause headaches for security leaders seeking to identify and authorize users and devices often spread across different states, borders, and time zones. Meanwhile, persistent risks associated with ineffective authentication strategies and processes threaten businesses as they become more agile and remote, requiring security teams to rethink approaches to authentication in the modern landscape.

Authentication a significant obstacle for modern CISOs

Authentication continues to test CISOs for several reasons, with its modern definition being the first to address, Netskope CISO Lamont Orange tells CSO. “We use lots of terminology to describe what is meant to address the authentication and authorization methods required for devices, applications and systems, in addition to supporting security policies that govern this interaction. In the past, we have implemented authentication in very basic construct: If I need access, I must pass credential tests (login/password) for each user/service request without the use of MFA in most cases,” he says.

To read this article in full, please click here

Read More

As solutions to managing cybersecurity threats increase, surprisingly few metrics are available on how well these methods work to secure organizational assets. The National Institute of Standards and Technology (NIST) has pioneered information security performance measurement models that can produce metrics. (Note: NIST’s work in this area is now being updated.)

Aside from government agencies’ requirements to produce information security performance measures, the measurement models NIST recommends can also be used for internal overall IT improvement efforts. Either way, NIST recommends considering four factors while developing and implementing an information security measurement program:

To read this article in full, please click here

Read More

Software supply chain attacks realize researchers’ worst fears

Read More

Cyber-heist could be biggest ever recorded

Read More