Cyber Policy in the News
Don’t use Huawei phones, say heads of FBI, CIA, and NSA
Don’t use Huawei phones, say heads of FBI, CIA, and NSA
Huawei? No way, say US spy chiefs.
US intelligence chief worries more about cybersecurity than terrorism
US intelligence chief worries more about cybersecurity than terrorism
At Senate committee’s “Worldwide Threats” hearing, the top US intelligence agencies put tech front and center.
US intelligence chief worries more about cybersecurity than terrorism
Russian hackers hunt hi-tech secrets, exploiting US weakness
Russian hackers hunt hi-tech secrets, exploiting US weakness
WASHINGTON (AP) â Russian cyberspies pursuing the secrets of military drones and other sensitive U.S. defense technology tricked key contract workers into exposing their email to theft, an Associated Press investigation has found.
Russian hackers hunt hi-tech secrets, exploiting US weakness
Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It
Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It
When Kaspersky Lab revealed last week that it had uncovered a sophisticated piece of malware designed to plant malicious code inside the firmware of computers, it should have surprised no one. And that’s not just because documents leaked by Edward Snowden have shown that spy agencies like the NSA have an intense interest in hacking \[…\]
Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It
British 15-year-old gained access to intelligence operations in Afghanistan and Iran by pretending to be head of CIA, court hears
A 15-year-old gained access to plans for intelligence operations in Afghanistan and Iran by pretending to be the head of the CIA to gain access to his computers, a court has heard.
Maybe Russia is Hacking the FBI and Stealing Our Biometric Data, Exhaustive Report Says
Maybe Russia is Hacking the FBI and Stealing Our Biometric Data, Exhaustive Report Says
Biometric data belonging to millions of Americans may or may not be at risk and it is frankly unclear based on a BuzzFeed report published Tuesday. At least two experts are concerned anyway, according to the site.
Maybe Russia is Hacking the FBI and Stealing Our Biometric Data, Exhaustive Report Says
Hackers exploit casino’s smart thermometer to steal database info
Hackers exploit casino’s smart thermometer to steal database info
Hackers exploit casino’s smart thermometer to steal database info
Mashable.com – 4/15/18 Nothing is safe.
Hackers exploit casino’s smart thermometer to steal database info
Netsparker GDPR Survey: 10 Percent of C-Level Security Execs Say GDPR Will Cost Them $1M+
Data also reveals healthcare and finance industries most resistant to GDPR
London—April 12, 2018—Netsparker Ltd., a leading player in the web applications security industry, has today released the results of its GDPR Survey. The survey of more than 300 C-level security executives, conducted online by Propeller Insights on behalf of Netsparker in March 2018, found that companies are taking the new General Data Protection Regulation (GDPR) much more seriously than HIPAA and PCI: 99 percent are actively involved in the process to become GDPR-compliant, despite the cost and internal reorganization involved.
GDPR is a new set of regulations the European Union (EU) has put in place to protect their citizens’ sensitive data from cybersecurity breaches. Under the terms of GDPR, strict conditions govern how organizations gather data and how it is managed. Organizations that fail to comply will face penalties. GDPR will go into effect May 25, 2018.
Companies Are Serious About GDPR Compliance
Companies seem to be taking GDPR very seriously. While many still aren’t PCI and HIPAA compliant, almost all (99 percent) of the security executives surveyed said their organizations are actively involved in the process to become GDPR-compliant.
- About half (49 percent) are 75 percent of the way through the process
- Another 37 percent are halfway there
- More than two-thirds (71 percent) are confident that they’ll be fully compliant by the May 25 deadline
- Only 2 percent say it’s unlikely that they’ll be ready
In preparation for GDPR, 57 percent of companies are re-engineering internal systems and procedures, 55 percent are recruiting new people specifically to tackle GDPR compliance, and 48 percent are re-engineering internal security teams.
“People are taking GDPR seriously because of how many high-profile data breaches we have all witnessed in the last few years,” said Ferruh Mavituna, CEO of Netsparker. “In the past, blame for data breaches was shifted around from party to party. Was it the business? The individual? The government? GDPR removes the ambiguity. As of May 25, businesses are responsible for data breaches. As a result, companies will have to restructure how they handle data, and, if they don’t have a sound IT infrastructure, they will have to rebuild from the ground up. It’s heartening to see that so many companies are taking themselves to task.”
GDPR Costs
The cost of GDPR is steep: while 80 percent of those in a micro company (1-9 employees) expect GDPR compliance to cost their business under $50,000, most (92 percent) of those working at an enterprise (more than 1,000 employees) expect GDPR compliance to cost their business over $50,000. Additionally:
- 1 in 10 say GDPR compliance will cost their business less than $10,000
- About two-thirds (36 percent) will spend $50-100,000
- About a quarter (24 percent) will spend between $100,000 and $1 million
- 1 in 10 say GDPR compliance will cost their business more than $1 million
Although 82 percent of companies currently have a data privacy officer (DPO) on staff, 77 percent plan to hire a new, replacement DPO prior to GDPR going into effect. More than two-thirds (37 percent) of businesses have had to hire at least six new employees to achieve GDPR compliance, and almost 1 in 5 (19 percent) have had to hire at least 10.
Healthcare and Finance Industries Slowest to Change
Meanwhile, security executives working in healthcare and finance report the most resistance to GDPR:
- 14 percent of healthcare companies have only completed 25 percent of the GDPR compliance process, and 7 percent are unlikely to be GDPR-compliant by May 25
- 21 percent of finance companies have only completed 25 percent of the GDPR compliance process, and 3 percent haven’t even begun the process
Security executives expect the technology industry will be most affected by GDPR (53 percent), followed by:
- Online retailers — 45 percent
- Software companies — 44 percent
- Financial services — 37 percent
- Online services/SaaS — 34 percent
- Retail/CPG — 33 percent
The vast majority (82 percent) say GDPR will be a positive thing for third-party companies in e-commerce, because it will cause them to take security and privacy more seriously, including: better evaluating third-party contractors (36 percent), making sure business partners are GDPR- compliant (28 percent), and checking the location of all business partners with whom data is shared (22 percent).
For more information, see the survey results here.
About Netsparker Ltd.
Netsparker was founded in 2009 and develops a web application security scanner. The scanner’s accurate scanning technology led to early success, and Netsparker is now a recognized leader in the web application security industry.
Netsparker can identify vulnerabilities in any type of modern and custom web applications, regardless of the architecture or platform they are built with. Upon identifying a vulnerability, the Netsparker scanner uniquely generates a proof of exploit to identify a false positive.
Netsparker is available as desktop software and as a cloud service. It is trusted and used by world-renowned organizations from all industry verticals, including Samsung, NASA, Microsoft, ING Bank, and Ernst & Young.
New Survey from Protiviti and ISACA Reveals Cybersecurity, IT Governance and Emerging Technology are Shaping IT Audit Plans in 2018
According to a newly-released benchmarking study from global consulting firm Protiviti and ISACA, IT audit plans in 2018 are being directly affected by the challenge of cybersecurity. The 7th annual survey found that one in five organizations, on average, is not including cybersecurity in its audit plans due to lack of qualified resources, specifically people, skills and/or auditing tools. Given the increased focus on digital transformation within organizations, IT auditors are playing an increasingly important role and need to be involved throughout an entire technology project lifecycle.
In the study, IT audit leaders and professionals defined their top five technology challenges:
- IT security and privacy/cybersecurity
- Infrastructure management
- Emerging technology and infrastructure changes – transformation, innovation, disruption
- Resource/staffing/skills challenges
- Regulatory compliance
There is an interrelated dynamic present in these findings. Emerging technologies and digital transformation place greater pressure on existing IT infrastructure and cause companies to explore alternative delivery models (e.g. through third-party arrangements), while giving rise to new cybersecurity and privacy risks – all of which require an evolution in the skillset of IT auditors. The survey reached offers findings from more than 1,300 chief audit executives (CAE), internal audit professionals and IT audit vice presidents and directors worldwide.
“Organizations are putting themselves at risk by not planning for and addressing existing and evolving cybersecurity threats within their audit plans,” said Andrew Struthers-Kennedy, a Protiviti managing director and global leader of the firm’s IT Audit practice. “Planning for cybersecurity not only helps with risk management, but also helps address gaps that can come from digitalization. As more businesses accelerate the pace of technology transformation and increase their reliance on third-party vendors as part of their digital transformation efforts, the number and severity of cybersecurity risks is increasing.”
“Given the increased focus on digital transformation within organizations, it’s important for IT auditors to be involved throughout the entire technology project lifecycle to ensure policies and processes are put in place to mitigate risk,” said Theresa Grafenstine, chair of ISACA’s board of directors. “IT audit leaders looking to become more engaged within their organization’s major technology projects have to build credibility with executive management teams by demonstrating the value that the IT audit function provides.”
The upcoming enactment of the EU’s General Data Protection Regulation (GDPR), which establishes new compliance requirements for information security and data privacy, further highlights the importance of effective data management and protection of organizational data.
“With regulators beginning to look more closely at the security and management of organizational data, we encourage IT audit teams to be aware of all data that an organization processes, where it resides and how it’s being protected,” added Struthers-Kennedy. “While the increase in data capture and processing activities offers opportunities for enhanced business insight and competitive advantage, it also adds significant risk and therefore data protection needs to be prioritized.”
IT Audit’s Growing Importance
It’s clear that IT audit teams are of growing importance in organizations. This survey is the first one since the survey began that finds at least half of all organizations polled have a dedicated IT audit director (or equivalent position). This is a significant increase from just five years ago when only one in three organizations had a dedicated IT audit director.
Still, there is room to grow in how the IT audit function is viewed by business partners and board members within an organization. Overall, less than half of respondents indicate that their CAE or IT audit director meets regularly with their company’s CIO to help develop the IT audit plan. Regular meetings with business leaders can help not only with timely risk identification but also to convey the value audit teams deliver.
About the Survey Report and Resources Available
The 2018 IT Audit Benchmarking Survey consisted of a series of questions in six categories: Emerging Technology and Business Challenges; IT Implementation/Project Involvement; IT Audit in Relation to the Overall Audit Department; Risk Assessment; Audit Plan; Cybersecurity and Skills, Capabilities and Hiring. The full survey report, along with an infographic and a short video, is available for complimentary download from ISACA here and from Protiviti here.
About Protiviti
Protiviti (www.protiviti.com) is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to help leaders confidently face the future. Through its network of more than 70 offices in over 20 countries, Protiviti and its independently owned Member Firms provide clients with consulting solutions in finance, technology, operations, data, analytics, governance, risk and internal audit.
Named to the 2018 Fortune 100 Best Companies to Work For® list, Protiviti has served more than 60 percent of Fortune 1000® and 35 percent of Fortune Global 500® companies. The firm also works with smaller, growing companies, including those looking to go public, as well as with government agencies. Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.
About ISACA
Nearing its 50th year, ISACA® (isaca.org) is a global association helping individuals and enterprises achieve the positive potential of technology. Today’s world is powered by technology, and ISACA equips professionals with the knowledge, credentials, education and community to advance their careers and transform their organizations. ISACA leverages the expertise of its 450,000 engaged professionals in information and cybersecurity, governance, assurance, risk and innovation, as well as its enterprise performance subsidiary, CMMI® Institute, to help advance innovation through technology. ISACA has a presence in more than 188 countries, including 217 chapters worldwide and offices in both the United States and China.
Twitter: www.twitter.com/ISACANews
LinkedIn: www.linkedin.com/company/isaca
Facebook: www.facebook.com/ISACAHQ
Instagram: www.instagram.com/isacanews/
The City of Atlanta Is Still Locked Out of Files Over a Week After SamSam Ransomware Attack
The City of Atlanta Is Still Locked Out of Files Over a Week After SamSam Ransomware Attack
The City of Atlanta Is Still Locked Out of Files Over a Week After SamSam Ransomware Attack
Gizmodo – 4/2/18 – City officials in Atlanta, Georgia are still trying to recover 10 days after a ransomware attack on municipal computer systems hit at least five out of 13 departments, knocking out some city services and forcing others to revert to paper records.