Introduction to Cyber Security

Managing Cybersecurity Risks in the Airline Industry
by Vance Hilderman We’ve all probably seen enough headlines recently about cybersecurity threats in every industry to become somewhat numb
Three Steps To Make Compliance The Ultimate Security Tool
By Zachary Folk, Camelot Secure Compliance standards such as PCI DSS (Payment Card Industry Data Security Standard) and GDPR (General
From Naoris Protoco: Will companies be forced to play Russian Roulette with insurance premiums?
Will companies be forced to play Russian Roulette with insurance premiums? As cybersecurity insurance premiums soar, companies may be forced
Consolidating the Alphabet Soup of Cyber Protection
By Mishel Mejibovski, Head of Operations and Strategy, SURF Security One of the most significant challenges for CISOs in the
Differences in SAP Security Solutions: What You Need To Know
Guest post by Christoph Nagy, CEO, SecurityBridge The application security market is obscure and holds one or two surprises for those
Guest Post: Data Security in the Cloud: Why It Matters and How to Get It Right
By Eric Sugar, President — ProServeIT   As the cloud continues to grow in popularity, more and more businesses are
The key to data privacy: Giving consumers control
Here is how we can achieve a perfect day in data privacy. By Aubrey Turner, Executive Advisor, Ping Identity Businesses’
How Current Macroeconomic Challenges Will Impact Cybersecurity in 2023
Guest Post by By Leonid Belkind, CTO and Co-Founder of Torq   As we’ve all seen, virtually every economic authority, including
How Can CISOS Solve the Cybersecurity Talent Shortfall?
By Shalom Bublil, Chief Product Officer at Kovrr As cybersecurity threats grow larger, organizations struggle to hire enough staff to
Guest Post: Cyberthreats are closer to the mainframe than they appear
By Ray Overby   There’s a scene in “Jurassic Park” where a Tyrannosaurus rex chases after Jeff Goldblum and Laura

Introduction to Cyber Security

What is cyber security? This introduction to cyber security offers a brief overview of an immense, sprawling subject. Indeed, quite a few books have been written on this subject. It’s impossible to capture it all in a single web page. However, we thought it would be useful to provide a high-level introduction to this topic.

Cyber security is a field of endeavor that spans professions, technologies, processes, laws, law enforcement and national security. At its root, cyber security is about protecting digital assets from harm, theft or malicious, unauthorized use. A digital asset could be a database, a piece of technology like a computer or smartphone, a website, an e-commerce business and so forth.

An introduction to cyber security needs to reference its predecessor. The cyber security field is not new, though it used to be called by (and still is, to some extent) different names. It was known as “information security” (InfoSec). The legal side of it was known as “computer crimes.” The word “cyber” has come into nearly universal use today due to several major shifts that have occurred in the field.

Introduction to Cyber SecurityCyberspace, a concept popularized in science fiction, posits that we (the human users of technology) imagine the invisible, abstract “space” existing between us, our computers, and other computers and their users, as a physical place. It’s fake, but real. Got it? The cyber space has become real enough that it’s a very useful metaphor to describe criminal or malicious acts taking place between people and entities (e.g. governments, corporations) using computers.

We talk about cyber security because life in the modern world has become highly digital. As so many of our interactions and fundamental life processes rely on computers, then crime and malfeasance take place in cyberspace. Hackers are doing much more than affecting InfoSec. They’re affecting people’s lives, in some cases literally, through “cyber physical” acts like hacking connected cars and so forth.

 

Photo by Engin Akyurt from Pexels

Managing Cybersecurity Risks in the Airline Industry

by Vance Hilderman

We’ve all probably seen enough headlines recently about cybersecurity threats in every industry to become somewhat numb to the issue. But cybersecurity in aviation holds a special place in the sense that it can directly impact the safety of passengers and crew. And there’s even more reason to worry since the aviation industry, while far ahead in many areas of technology, seems to have fallen behind with regards to digital security despite the recent mandate to follow the new DO-326A for aviation cyber-security.

 

For example, in 2020, 97 percent of the top 100 airports famously failed a major cybersecurity test. In 2021, EUROCONTROL wrote a paper demonstrating that the aviation industry was experiencing a wave of cybercrime and urged aviation leaders to pay more attention to new attack vectors. And in just the first eight months of 2022, the number of cyber attacks in the aviation industry had already surpassed that of either of the previous two years.

 

The cybercrime increase shows no sign of stopping, and in the meantime, a lot of people are understandably concerned about whether the aviation industry is prepared for the onslaught. Let’s take a look at where aviation is in terms of overcoming cybersecurity risks today and what needs to change.

Risks and motivations

Why have attacks increased so much recently? The number one reason is simple: increased reliance on digital systems, and particularly the Internet of Things (IoT). In other words, more and more of the systems onboard planes and in airlines are interconnected with each other and with the cloud. So there are more vulnerabilities for malicious actors to exploit and more gateways into safety-critical systems than ever before.

 

In addition to the increased attack surface, there’s also a greater reliance today on commercial off-the-shelf (COTS) software, which simply means that the software wasn’t designed specifically for the aviation industry. It’s software that any industry might use, like the Windows operating system or any kind of standard database software. These types of software don’t have the same certification and safety requirements as software developed specifically for avionics, and security in COTS software is primarily the responsibility of the software vendor.

 

But the vendors aren’t always the best at protecting their systems. For example, in 2022, Microsoft detected many different vulnerabilities in the Windows 10 operating system, two of which were zero-day vulnerabilities. That means the company had no idea there were vulnerabilities until malicious actors were already exploiting them. So using COTS that have questionable or insufficient security measures can create serious issues for airlines and aircraft manufacturers alike.

 

The third reason there is increased risk in aviation cybersecurity today is the prevalence of smartphones, tablets, and other internet-connected devices. Most passengers will bring a smartphone on board a plane. Add in in-flight Wi-Fi and you have a potential method for external attacks to access the network through someone’s personal device.

Cybersecurity in the air

All of those factors mean that the aviation industry is less than ideally prepared for the constant onslaught of cyber threats. But I think it’s safe to say you still don’t have to worry about your next flight. Here’s why: on-flight cybersecurity guidelines require stringent testing and oversight far above what most other industries demand.

 

Specifically, the ED-202A standard in Europe and the DO-326A standard in the U.S. stipulate guidelines for software development and security in aviation. Both standards take a risk-based approach, meaning they focus on identifying and mitigating the risks that are most likely to affect the safety and security of aircraft. They also both provide guidance on the processes that avionics developers and manufacturers must follow to develop and certify secure avionic systems. This guidance covers all aspects of the development lifecycle, from defining requirements to testing and certification.

 

While no standard is perfect and there may still be room for improvement with the increase of connected systems onboard planes, the truth is that in-flight systems are well protected. So you can likely go on your next vacation without worrying about cybercriminals taking over your plane.

Cybersecurity on the ground

Personal and financial information are the targets of most cyber attacks in the aviation industry, meaning ground systems in aviation are the target of the majority of attacks. This particularly applies to basic airline software like flight scheduling systems and payment management systems as well as databases. Many of these systems are COTS software, and vulnerabilities and data leaks are not uncommon.

 

Also, it’s hard to properly secure systems that a lot of different people access on a daily basis. The top cybersecurity concern in the aviation industry is phishing threats, which often take the form of scam emails. These emails appear to be from legitimate sources or authorities but ask for personal information or work passwords. Once a password gets leaked, it’s easy for malicious actors to access sensitive data and systems.

 

Airlines have found some creative ways to improve security on the ground. For example, United Airlines has a reward program for people who discover and report vulnerabilities in certain ground systems or scheduling systems. Other airlines are implementing cybersecurity training programs for staff so they can identify phishing attacks and other threats. But there’s no question that there’s still a lot of room to grow in the area of cybersecurity for ground systems.

Room for growth

I’ll finish with this thought: Can the aviation industry improve in terms of cybersecurity? Absolutely. But is it hopelessly behind or in danger of planes falling out of the sky from cyberattacks any time soon? Absolutely not. Cybersecurity continues to be a major priority in aviation, and the industry will continue to grow in terms of protecting sensitive data and systems from outside threats.

About the author:  Vance Hilderman is the principal founder/CTO of three of the world’s most significant aviation development/certification companies including TekSci, HighRely, and AFuzion. Hilderman has trained over 31,000 engineers in over 700 aviation companies and 30+ countries. His intellectual property is in use by 70% of the world’s top 300 aviation and systems developers worldwide, and he has employed and personally presided over 500 of the world’s foremost aviation engineers on 300+ projects the past thirty-five years. AFuzion’s solutions are on 90% of the aircraft developed over the past three decades. His latest book, Aviation Development Ecosystem, debuted at #1 on the Aviation category best-seller list.

Three Steps To Make Compliance The Ultimate Security Tool

By Zachary Folk, Camelot Secure

Compliance standards such as PCI DSS (Payment Card Industry Data Security Standard) and GDPR (General Data Protection Regulation) are frameworks that help organizations streamline their business processes, implement robust security measures, and optimize their cybersecurity posture. By aligning with these standards, businesses can enhance and protect sensitive data, and demonstrate their commitment to data privacy and security to customers and stakeholders.  However, the level of difficulty that companies face in following compliance standards can vary depending on several factors, such as:

  1. Complex and Evolving Regulations: Compliance standards can be complicated, with extensive requirements and technical jargon that may be challenging to interpret and implement correctly.
  2. Resource Constraints: Implementing compliance standards often requires allocating significant resources, including time, budget, and skilled personnel.
  3. Organizational Complexity: Large organizations with multiple departments, business units, or subsidiaries may need help to achieve consistency and alignment across the entire organization.

Ignoring compliance requirements can lead to legal consequences, reputational damage, and increased cybersecurity risks. Although adhering to compliance standards can be challenging, organizations must prioritize and invest in compliance efforts. But before companies can alleviate the pain of compliance adherence and turn the process into a helpful security business tool, there are several steps to follow.

Step 1: Identify All Regulatory and Legislative Requirements: Businesses can find many resources for compliance with regulations like HIPAA, CMMC, FTC, and FFIEC. Identifying and understanding all regulatory requirements to fulfill legal responsibilities and adequately secure intellectual property is crucial.

Once you have identified the applicable regulations, selecting the proper compliance framework, such as NIST CSF, COBIT 5, or HITRUST, is essential. This framework will help align overlapping requirements and establish a standardized approach the company can implement effectively. Remember, compliance is a tool to standardize processes and procedures, ensuring all data protection, including customer data, throughout the entire data lifecycle.

Step 2: Conduct A GAP Analysis and Research Solutions:  After setting up the framework, it is time to identify weaknesses and create a plan to address them. While most companies know their weaknesses, they often overlook crucial areas. To gain a comprehensive understanding of the business’s security posture, it is beneficial for most organizations to engage a qualified third-party cybersecurity firm to conduct a GAP Analysis.

It’s important to note that this third-party assistance does not have to come from a compliance auditor. Instead, it should be an entity that can objectively assess your business from all angles without any institutional bias. These unbiased organizations can review technical and non-technical requirements and help chart a path forward for maximum security.

Once the technical and non-technical requirements have been reviewed and a plan has been established, the identified gaps can be evaluated and prioritized. Then, with an action plan in place to address these gaps, an appropriate compliance solution can be selected. However, any chosen compliance solution must be adaptable, repeatable, and measurable to maximize its benefits.

The ultimate objective of Step 2 is to identify technical and non-technical solutions and present them in a format that enables all stakeholders to make informed decisions. This ensures that the identified solutions are offered in a clear and accessible manner for the involved parties to understand and participate in the decision-making process.

Step 3: Implement and Maintain Selected Solutions: The final stage in transforming the compliance process into a practical tool involves integrating the chosen framework and solutions into the business operations. If Steps 1 and 2 have been executed accurately, Step 3 naturally becomes continuous, efficient, and hassle-free. Moreover, it becomes pain-free because the appropriate framework and solutions have already identified the following key components:

  • Data Owners
  • Stakeholders
  • Change Management Board Members
  • Committees
  • Processes
  • Procedures

With the proper guidance, the compliance process becomes an automated procedure that provides decision-making information to each stakeholder. The ultimate goal of Step 3 is to ensure that the business has the necessary processes and technology to maintain compliance over time.

In conclusion, compliance standards such as PCI DSS, GDPR, and others offer businesses a framework to streamline their processes, procedures, and security functions, optimizing their cybersecurity posture. These standards provide guidelines that enable organizations to enhance their security capabilities, safeguard sensitive data, and demonstrate their commitment to data privacy and security. However, implementing compliance standards can pose challenges due to the complexity of regulations, resource constraints, and organizational complexities. Ignoring compliance requirements can result in severe consequences. Therefore, organizations must prioritize and invest in compliance efforts. By following the necessary steps and integrating compliance into their operations, businesses can alleviate the pain of compliance and transform it into the ultimate security business tool.

Zachary Folk brings over a decade of Cyber/IT Operations and GRC experience to the Camelot Secure team. His roots come from the system and network administration arena. He has taken that knowledge and is now helping companies to integrate technical solutions to streamline and automate compliance standards and enhance their security postures. Zach has successfully prepared for and executed many compliance assessments. He has been retained by various companies as a third-party consultant to help prepare them for compliance assessments and choose the appropriate technology solutions. He holds top-level Cyber Security Certifications such as CISSP with a concentration in ISSEP, CAP/CGRC, C|EH, and Security+. Additionally, he has a BS in Communications from the University of Alabama in Huntsville and is working toward his master’s in cyber security. In addition to cybersecurity and compliance, Zach has served in the Alabama National Guard for 13 years and currently serves as a Support Operations Officer and manages logistics for his battalion.

 

From Naoris Protoco: Will companies be forced to play Russian Roulette with insurance premiums?

Will companies be forced to play Russian Roulette with insurance premiums?

As cybersecurity insurance premiums soar, companies may be forced to play a game of Russian Roulette, taking the chance that they won’t be hit by a cyberattack. The stakes are high, approximately 236.1 million ransomware attacks occurred globally in the first half of 2022 alone, in 2023, it’s predicted that close to 33 billion accounts will be breached costing the global economy $8 trillion.

In light of growing attacks cyber insurance premiums have been increasing exponentially making it difficult for companies to get the coverage they need. Globally, Q1 2022 saw cybersecurity insurance premiums rise by a massive 110% year on year. Q1 2023 saw an additional annual rise of 10%. An annual premium for coverage of $50 million could range anywhere from $100,000 to $500,000. This is a huge chunk of money to come out of operating budgets especially as new regulation is requiring companies to invest more in security systems.

A  slow-down of premium increases at the start of 2023 is good news for companies, but it also has a dark side; there will be more exclusions written into policies as underwriters get to grips with the risks in this fast changing and complex environment. Recently Lloyds of London created a stir when they suggested to 76 of their insurance syndicates to remove “nation-state-backed cyberattacks” from insurance policies by March 2023.

The NotPetya attack in 2017 was a huge driver behind Lloyds decision to implement the exclusionary clauses. The malicious data encryption tool inserted into a legitimate piece of software used by most of Ukraine’s financial and government institutions, spread via trusted networks, rather than widely over the internet. Therefore, it bypassed the processes put in place to prevent ransomware attacks, estimated losses experienced by commercial companies in the Ukraine network exceeded $10 billion.

Prevention has to be the key focus because mitigating the damage of attacks is almost impossible. To put this into perspective, NotPetya destroyed all end-user devices, including 49,000 laptops and the print capability of shipping and logistics giant Maersk. It also destroyed 1,000 of the company’s applications and 3,500 servers. Total cost of losses – $250 million.

In addition to tangible costs of a major data breach or cyber attack, companies now need to consider the cost of regulatory fines, legal settlements, reputational damage, and business interruption costs.

Monica Oravcova, COO and co-founder of Naoris Protocol, a decentralised cybersecurity solution, says “The NotPetya attack really highlighted the NotPetya attack really highlighted the vulnerability of “trusted” networks, where no-one is validating the validators and ensuring the trust level of the network itself. This is a clear case of ‘eyes wide shut’ by some large multinational enterprises who left this attack vector open. New generation technology, such as a decentralised cybersecurity mesh architecture can prevent these kinds of attacks. This technology enforces trust across networks by turning all connected devices into validator nodes that check the security status of every other device in the network. Any detected anomalies or code manipulation will raise an alert within milliseconds potentially preventing the attack”

The average cost of a data breach is $4.2 Million and in the case of regulated industries, costs can be much higher. In finance and banking, the cost is estimated to be  $210 per record with an average breach totaling 25k records, this translates into $10.725 Million.

You cannot talk about insurance premiums without introducing the highest risk factor – people. More than  90% of breaches are facilitated by humans. Experts agree that by addressing the standard of cybersecurity awareness globally, breaches should come down and risk management should be easier to enforce.

Oravcova says “ training must go beyond tick box compliance, motivated by regulatory and liability penalties, every member of staff needs to be able to recognise a malicious email. Many companies focus on technical improvement: ‘How can I make sure I have the best IT and detection systems in place?” but they don’t address the fact that the weakest links are their employees. The pandemic brought this into sharp focus as devices left the security of ring fenced networks. In essence the servers left the building and every device became a single point of failure”

Solutions need to be created in close collaboration between insurance companies, enterprises and cybersecurity firms, to work together in their respective areas to stop cyber attacks. Only then will we see a reduction in insurance premiums and more importantly, a reduction in the frequency of successful attacks.

 

 

 

Consolidating the Alphabet Soup of Cyber Protection

By Mishel Mejibovski, Head of Operations and Strategy, SURF Security

One of the most significant challenges for CISOs in the current climate is the complexity of the cybersecurity landscape. The rapid pace of technological advancement and the growing sophistication of cyber threats make it increasingly difficult for CISOs and IT teams to keep up with the various ways in which their organizations need protection. This complexity is further compounded by the need for a diverse set of tools and software to safeguard against different types of attacks.

As a result, organizations may struggle to maintain agility and efficiency in their operations while also ensuring adequate protection against cyber threats. The shift to remote work brought about by the pandemic has further exacerbated this challenge, making it increasingly difficult to maintain security without disrupting the flow of business.

Employees expect flexibility and the ability to work wherever, and whenever they want. This means having access to company data from private and public networks across a myriad of devices (laptops, desktops, cellphones, tablets, etc.). In the quest to keep threat actors from accessing company data from these unprotected points, the cybersecurity stack continues to expand. Not only does this keep IT teams too busy to focus on other important tasks, but the cost of management and licensing is starting to bust budgets.

Virtual desktop infrastructure (VDI), was once considered a viable solution for corporations looking to provide their teams with the flexibility to work remotely while maintaining central management of data. However, as VDI usage has increased, it has become clear that the technology has limitations that can negatively impact productivity.

A report by Gartner in 2020 found that while VDI is a popular solution, organizations are facing challenges such as network congestion, high costs, and performance issues. Furthermore, VDI’s capabilities can be limited when it comes to accessing cloud and software as a service (SaaS) applications.

A Forrester research report from 2020 also highlights the need for organizations to consider other options such as Remote Desktop Services (RDS) or Windows Virtual Desktop (WVD) depending on their requirements and use cases.

 

Virtual private networks (VPNs) have become a popular solution among consumers looking to protect their online browsing. However, when used in a professional setting, the effectiveness of VPNs can vary.

According to a 2020 report by Cybersecurity Ventures, the use of VPNs increased by 75% during the COVID-19 pandemic as more companies adopted remote work policies. However, the report also found that many VPNs used in the enterprise lack proper security measures and can leave corporate data vulnerable to attacks.

In fact, the Cisco 2020 Annual Cybersecurity Report found that 43% of data breaches involved remote access. This highlights the need for organizations to carefully evaluate and implement VPN solutions to ensure they provide adequate protection and to monitor their performance continuously.

 

Remote browser isolation (RBI) is a cybersecurity solution that aims to protect organizations from web-based threats by isolating web browsing sessions on a remote server. However, despite its potential benefits, there are several downsides to using this technology. One of the major drawbacks is the high cost associated with implementing and maintaining an RBI system.

 

According to a report by MarketsandMarkets, the global Remote Browser Isolation market size was valued at USD 59.7 million in 2019 and is projected to reach USD 164.3 million by 2024, at a CAGR of 22.5% during the forecast period. This can be a significant concern for organizations with limited budgets and may make it difficult for them to justify the investment. Additionally, the complexity of setting up and managing an RBI system can be challenging for some organizations.

 

Centralize the Solution

Managing the complexity of the cybersecurity stack can be a daunting task for CISOs and IT teams.One effective approach to addressing this complexity is to consolidate the various software tools into a single control point. By centralizing the management of security tools and solutions, admins can gain a better overall view of the organization’s security posture, identify potential risks and vulnerabilities more easily, and respond to threats in a more coordinated and efficient way.

The enterprise browser is one way forward because it removes the need for multiple tools by implementing security, data governance, and identity access management directly into the browser. Features such as DLP, web filtering,phishing protection, malware scans, and anti-spam systems are all built into the software directly so that you don’t require multiple solutions. This easy-to-use solution also frees up IT teams. The onboarding process is super simple and takes only 15 minutes. There is no training as the user experience is nearly identical to existing consumer browsers. All users need to do to begin using the enterprise browser is download it to their devices and login using corporate credentials and it will be all set. By making the browser the first line of defense, enterprises have better security, agility, and management.

A secure corporate browser protects company data by authenticating and validating the user and device, every step of the way. Enterprises can filter access based on user and receive alerts when company policy is breached. The browser functions independently from the device it’s on, ensuring increased security from malware, no matter where company data is being accessed. By utilizing a Zero-Trust architecture, the enterprise browser ensures full agility, control, security, and privacy.

Mishel Mejibovski is Head of Operations, SURF Security, which provides a zero-trust secure enterprise browser. www.surf.security

 

Differences in SAP Security Solutions: What You Need To Know

Guest post by Christoph Nagy, CEO, SecurityBridge

The application security market is obscure and holds one or two surprises for those looking for an SAP security solution. Cybersecurity solutions for SAP help customers understand the ever-growing threat landscape and protect themselves effectively. In this article, we would like to discuss some points you should focus on when looking for a security solution for SAP.

As the name suggests, SAP Security or SAP Cyber Security solutions are highly specialized software products that can monitor cyber threats, security-critical activities, application configuration, and more. In the case of SAP’s business-critical applications, other aspects such as security patch management and monitoring of interface traffic also become necessary. The distinction between SAP GRC and SAP Cybersecurity is not clear-cut, and therefore, it is often needed to think of an integrated approach.

SAP Cybersecurity products are divided into solutions and platforms. In contrast to a solution that usually covers a single topic area, an SAP Security Platform takes a holistic approach to protect customer data. Unfortunately, it is not always easy to tell from the glossy brochures of the suppliers whether a platform product is not a single solution.

A real platform characterizes itself when the customers’ maintenance effort (TCO) is reduced thanks to the software architecture. This is the case when a central basic configuration exists on which the security applications are based. Also, the platform should not require you to update each SAP security application individually. The platform gets an upgrade. The special added value of the real platform approach is that the security applications exchange necessary information and expand the user’s view in a systematic form. When properly implemented, the end user can always access all the crucial information needed to evaluate a security incident.

Spot vs. Platform SAP Security

If you look around for SAP security applications, you will quickly realize that there are not only solutions with different functional scope and depth but also different architectural approaches. Which one suits you best depends on the application and purpose.

The integrated approach relies on a software architecture that tries to extend the SAP application’s technology stack with required capabilities to protect the crown jewelry. A particular advantage of this approach is that usually no additional hardware (or virtual appliances) is required. These are often forgotten in the cost analysis and the licensing costs and lead to a nasty surprise in the implementation project.

In contrast, there is also an external solution that accesses the SAP application via an interface and attempts to read out the data necessary for security analyses.

This approach advertises a reduced footprint on the application, which looking closely, is often not so small. External security applications are certainly an excellent choice for closed systems where customers cannot install plugins. However, this does not apply to SAP because, just like with operating systems, you can use additional add-ons. Since this article is about a security solution to protect SAP, it is crucial to note that additional software and appliances often introduce new attack vectors that the customer must analyze. If an attacker can exploit a vulnerability in a security solution, the solution becomes a problem for SAP security. So, check the selected SAP Security Solution for security vulnerabilities and standard security measures brute force protection (2FA), remote access, and update architecture.

External vs. Integrated SAP Security

In this section, we look at the functional scope of an SAP Cybersecurity Solution. A word of caution – No matter what the provider promises you on the website or in glossy brochures, you should form your own opinion in any case. It has already happened that product comparisons were wrong or biased. Be sure to ask for a demonstration of the features you want, and if in doubt, ask for a test installation. Make sure the product you want to buy is used during the test!

Now to the functions you need as an SAP customer. On the one hand, there are four functional vectors that SAP security solutions should cover. Depending on your requirements profile, you may, of course, only be interested in one area. But at the end of the day, to effectively protect SAP against cyberattacks, you must address all of them.

Consider the following functions:

Patch Management

Vulnerability Management

Threat Detection

Code Vulnerability Analysis  

Of course, the functional depth, which details what the selected solution offers you varies among manufacturers. Therefore, we advise you to create a requirements list of the required functions, which will help you with an objective evaluation.  We believe in transparency and openly disclosing what is covered and what features are on the roadmap. Be sure to ask for a product roadmap to learn from the vendor of your choice if there is a solid innovation plan. Especially in cybersecurity, innovation is necessary to prepare for the rapidly changing risk situation.

When should you look for SAP Security solutions?  Fundamentally, it is true – it is never too early, but it could be too late.  According to this principle, you should prefer proactive actions to reactive ones. Especially, when it comes to securing critical enterprise infrastructure and applications such as SAP.  Here are some examples:

If you are a CISO, Chief Information Security Officer, or a CRO, Chief Revenue Office, and you feel that your SAP systems are not patched regularly, and on time, you should look for a solution.

If you are an SAP Basis manager who cannot keep up with monitoring security-related settings, you should look for a solution.

If you manage ABAP developments and notice that the established code quality checks do not sufficiently cover security aspects, you should look for a solution.

If you are responsible for the integration and can no longer say with certainty whether all SAP RFC connections are sufficiently hardened, you should look for a solution.

Christoph Nagy has 20 years of working experience within the SAP industry. He has utilized this knowledge as a founding member and CEO at SecurityBridge–a global SAP security provider, serving many of the world’s leading brands and now operating in the U.S. Through his efforts, the SecurityBridge Platform for SAP has become renowned as a strategic security solution for automated analysis of SAP security settings, and detection of cyber-attacks in real-time. Prior to SecurityBridge, Nagy applied his skills as a SAP technology consultant at Adidas and Audi.

 

Guest Post: Data Security in the Cloud: Why It Matters and How to Get It Right

By Eric Sugar, President — ProServeIT

 

As the cloud continues to grow in popularity, more and more businesses are moving their operations to the cloud. While this can provide many benefits, such as increased flexibility and scalability, it also brings security challenges. With cybercrime on the rise, data security in the cloud has become a critical issue that cannot be ignored.

 

Data is the lifeblood of modern businesses. It is what enables them to make informed decisions, develop new products and services, and stay competitive. When data is lost, stolen, or compromised, the consequences can be severe. Businesses can suffer financial losses, reputational damage, and even legal consequences.

 

With the cloud, data security is particularly important. First, businesses need to make sure to choose a reputable cloud provider such as Microsoft. Second, while these providers offer many security measures, businesses still need to take responsibility for their data.

 

Understanding the shared responsibility model

The shared responsibility model is a critical concept in cloud computing that defines the security responsibilities of both the cloud provider and the customer. This model helps to ensure that both parties understand their respective roles and responsibilities in securing data in the cloud.

 

In the shared responsibility model, the cloud provider is responsible for securing the cloud infrastructure, including the physical security of data centers, network security, and server security. This includes ensuring that their cloud environment is protected against common cyber threats, such as malware, distributed denial-of-service (DDoS) attacks, and unauthorized access.

 

At the same time, the customer is responsible for securing their own data and applications in the cloud. This includes setting up strong access controls, implementing encryption, and ensuring that their data is backed up and recoverable in the event of a disaster.

 

The shared responsibility model is critical for ensuring data security in the cloud because it helps to eliminate confusion about who is accountable for specific responsibilities. It also helps ensure that both the cloud provider and the customer are held accountable for their respective security responsibilities.

 

By understanding the shared responsibility model, businesses can take steps to ensure that their data is secure in the cloud. For example, they can work with their cloud provider to ensure that they have implemented appropriate security measures, such as firewalls, intrusion detection and prevention systems, and data encryption. They can also implement their own security measures to protect their data, such as multi-factor authentication, role-based access controls, and data loss prevention tools.

 

Conducting a risk assessment

Before moving data to the cloud, businesses should conduct a risk assessment to identify potential security risks. This assessment should include a review of the cloud provider’s security measures as well as an analysis of the business’s own security practices. By conducting a risk assessment, businesses can develop a better understanding of the security threats they face and take appropriate measures to mitigate those risks.

 

The first step in conducting a risk assessment is to identify the data that is most valuable and sensitive, such as customer data, financial data, and other critical business information. Once this data has been identified, the next step is to assess the potential risks associated with storing this data in the cloud, including risks such as data breaches, unauthorized access, and data loss.

 

Once the risks have been identified, the next step is to assess the likelihood and potential impact of these risks. This can involve analyzing historical data breaches, assessing the strength of existing security measures, and evaluating the potential impact of a breach on the business.

 

Based on the results of the risk assessment, businesses can develop a comprehensive security plan that addresses the identified risks and vulnerabilities. This plan can include measures such as implementing stronger access controls, increasing the use of encryption, and conducting regular security audits and assessments.

 

Conducting a risk assessment is critical for ensuring data security in the cloud because it helps businesses develop a better understanding of the potential risks they face. By identifying these risks and assessing their potential impact, businesses can take appropriate measures to mitigate those risks and protect their data. This subsequently helps prevent data breaches, unauthorized access, and other security incidents that can have a significant impact on the business.

Implementing strong access controls

Access controls are critical to data security in the cloud. Businesses should implement strong access controls that limit access to sensitive data to only those who need it. Multi-factor authentication, encryption, and role-based access controls are all effective ways to limit access to data.

 

Monitoring and managing cloud environments

Implementing strong access controls is a critical step in ensuring data security in the cloud. Access controls are security measures that are put in place to regulate who has access to data and resources in a cloud environment. By implementing strong access controls, businesses can ensure that only authorized users have access to their data and that the risk of unauthorized access is minimized.

 

There are several ways in which businesses can implement strong access controls in the cloud. One approach is to use multi-factor authentication (MFA) to verify the identity of users. MFA requires users to provide more than one form of identification — such as a password and a biometric scan — to access cloud resources, preventing unauthorized access by requiring an additional layer of verification beyond a simple password.

 

Another approach is to implement role-based access controls (RBAC). RBAC is a method of assigning specific roles and permissions to users based on their job responsibilities. This helps ensure that users only have access to the resources they need to do their jobs and reduces the risk of unauthorized access to sensitive data.

 

Businesses can also implement access controls by using network segmentation to isolate sensitive data from the rest of the cloud environment. Network segmentation involves dividing the cloud environment into smaller, isolated networks that can be accessed only by authorized users.

 

Data security in the cloud is something all businesses should pay attention to. And while these three steps to doing it right are valuable, nothing is as valuable as your team and a security partner that you work with to manage data security. With the right mindset and trusted cloud experts, businesses can take advantage of the many benefits that the cloud offers while minimizing the risks.

 

 

— Eric Sugar is the President of ProServeIT. With over 20 years of experience working in the information technology and services industry, he cares deeply about helping businesses become digital and maintaining digital data security.

The key to data privacy: Giving consumers control

Here is how we can achieve a perfect day in data privacy.

By Aubrey Turner, Executive Advisor, Ping Identity

Businesses’ appetite for gathering (and monetizing) personal data is increasingly at odds with consumers’ growing concerns about how that data is used. More than three-quarters of consumers now feel they will never be fully in control of their personal data online, and still blindly accept the fine print terms and conditions that allow businesses to profit from their data.

Data Privacy Day is an opportune time to renew the debate about reshaping data privacy laws that put consumers’ needs first. Americans would benefit greatly from a national consumer bill of rights of sorts, with protections similar to the European Union’s GDPR privacy laws, rather than the menagerie of state- and sector-specific laws that comprise U.S. data privacy regulations today. Unfortunately, too many U.S. businesses don’t fully reveal how customer data is being used, often exploiting gaps in existing regulations and public awareness.

If businesses want to earn consumer trust long-term, they need to make data privacy a consumer-first matter. With every daily digital interaction, there is a new opportunity to not only keep customers happy, respected and protected but help the business stay ahead of the competition by providing a digital experience that is both seamless and secure.

But what would a consumer data privacy bill of rights look like in the real world? How would their digital life unfold if businesses implemented privacy measures that consumers want?

First, consumers would clearly be able to see when their data is being collected and shared by a business when they interact. They can retrieve their personal data from every business, and easily revoke or set personal preferences for how it is used. No personal data is sold or shared between other entities without notifying consumers and gaining their consent.

On the businesses’ side, they will no longer voraciously collect every piece of personal data from a user, only to figure out how to monetize it later. Instead, they collect the bare minimum, provide consent and data management controls on the fly, and dispose of any collected data that is not used within a limited time period.

Adopting progressive profiling is one-way businesses can make this transition. Progressive profiling is a consumer-friendly, privacy-compliant way to collect personal day. It limits what data is collected about the consumer by gathering smaller amounts of information incrementally instead of all at once. Rather than inundate new users with questions and sign-up forms, businesses that adopt progressive profiling collect personal data gradually over time as a customer uses their product or service. It minimizes friction while delivering a happier customer experience. Businesses can also incentivize consumers to share more information as the relationship, and trust, between customer and brand grows.

Next, consumers will no longer feel like their smart speakers, smart TV, wearables and other digital devices with listening and monitoring capabilities are spying on them. Consumers will no longer experience the intrusive pop-up ads and emails for products or services that they just casually mentioned in conversation.

Consumers won’t receive any unsolicited emails and texts either. When making a one-time purchase from a business that they may never engage with again, they won’t receive any emails or texts from the business attempting to lure them back by offering deals and discounts.

On social media, consumers will now know what information about them is shared to tailor targeted ads and provide easy ways for them to update that information whenever they want. And when visiting websites for the first time, consumers aren’t forced to respond to any website requests for cookies. At the very least, when presented with a cookie banner, consumers can simply click a “reject all” button rather than having to check/uncheck a long list of preferences.

Data privacy policies will also be easy to understand. When businesses disclose their policies on the website, consumers no longer have to deal with terms of service agreements that are so complex that individuals simply give up and “accept all” without truly understanding the agreement.

Consumers can also do a quick review at any time via a credentialed, digital wallet to see which businesses have access to their data. The digital wallet can identify which businesses no longer serve the consumer and easily revoke access.

While the GDPR model may not fit perfectly within the U.S. system, we need some kind of comprehensive federal privacy law. A consumer data privacy bill of rights can free consumers from that helplessness they feel each time they are required to provide information to businesses, or when data is passively collected without transparency, fearful of how that data may be exploited.

Aubrey Turner

Instead, businesses should realize that, as consumers become more aware of their data autonomy, enhanced data privacy can create a business advantage. If businesses want to earn consumer trust long-term, they need to make data privacy a matter of trust and choice. With every digital interaction, they gain a new opportunity not only to keep customers informed, empowered, and protected but also to help the business stay ahead of the competition.

 

How Current Macroeconomic Challenges Will Impact Cybersecurity in 2023

Guest Post by By Leonid Belkind, CTO and Co-Founder of Torq

 

As we’ve all seen, virtually every economic authority, including the US Federal Reserve, European Central Bank, The Swiss Government, and Morgan Stanley, is predicting a macroeconomic slowdown across 2023. While there is debate about whether it will be a bump in the road or a recession, everyone agrees that in general, spending will be curbed, and that organizations will, at minimum, be looking to do more with their existing resources.

 

So, what does this mean for the cybersecurity industry? It will have to acknowledge what its customers and prospects are dealing with and be sympathetic to their situations. However, it is also not without its opportunities. The fact is, IT and security professionals will be looking for ways to drive more value from their existing security stack, rather than adding more point solutions to it.

 

Cyberthreats Don’t Pause During a Downturn

Another critical point is that there is uniform agreement that evolving cyberattacks will continue relentlessly. Threat actors will evolve to become more cunning, with novel new approaches for deploying threats, and manipulating users. Therefore, the cybersecurity attack surface is certain to expand, not contract. No-one in the cybersecurity ecosystem can stand on their laurels during an economic downturn. Cyberattacks have the potential to create monumental, well-documented economic damage that can exacerbate economic challenges in an already difficult financial environment.

 

Cybersecurity companies need to emphasize their proactive capabilities over the historic reactive element in these economic circumstances. If they position themselves as a critical, protective layer, it will go a long way to cementing the essential nature of their offerings. Simply talking about how they handle crises once they’ve begun is no longer good enough. Optimally, cybersecurity firms should emphasize how their offerings harness early threat intelligence signals and build defenses against them into their workflows and processes.

 

Democratizing Security Contributes to Cost Efficiencies

Another consideration for cybersecurity companies is the potential to increase democratization of security responsibility across customer and prospect organizations. Part of maximizing value involves security processes that focus on shared responsibilities, in which employees, R&D, DevOps, and IT are true partners and collaborators in protecting their organizations. An example of this is how security automation is now moving towards validating end users’ identities, and enabling them to have temporary security clearances to engage in system updates, credential retrieval, and remote access with dramatically minimized risk. This is enabled through integration across communications and project management tools, anchored by workflows that ensure accurate verification and access controls.

 

Cybersecurity companies also need to look at the security ecosystem as one that is interconnected, instead of being a siloed collection of point tools. Organizations are now demanding that previously-disparate security systems talk to each other. Platforms, applications, and tools must become interoperable and interconnected, for comprehensive management, monitoring, and measurement.

 

Vendors that listen to what organizations are looking for and calibrate their offerings to map to a holistic ecosystem view are the ones that are likely to have the most success in 2023 and beyond.

 

Geopolitical Strife is Another Key Factor

Another important contextual element that pairs with the macroeconomic situation is the geopolitical climate. The two are connected across multiple junctions. Cybersecurity companies must continue to push the envelope of their offerings to address the needs of organizations that exist within geopolitical difficulties. They need to make their offerings essential even during times of deep uncertainty and instability.

 

Without engaging in any vulture-like tactics, vendors must consider how customer priorities intersect at the nation-state level with companies operating in conflict zones. There are business opportunities available–ones that fundamentally positively contribute to resilience of both business and country. However, vendors need to carefully navigate through complexity and ensure their offerings and messages are accurately in tune with the difficulties the organizations are facing.

 

Taking a broader portfolio view focused on addressing critical customer challenges is key. Instead of looking inwards, cybersecurity companies must look outward and approach their markets with a view that’s sympathetic to what organizations are experiencing and adjust their strategies accordingly. So, indeed, while the macroeconomic climate is stormy, it is possible to chart a clear path forward beneficial to vendors and customers alike.

 

About the Author

Leonid Belkind is a co-founder and Chief Technology Officer at Torq, a no-code security automation platform. Prior to Torq, Leonid co-founded, and was CTO of Luminate Security, a pioneer in Zero Trust Network Access and Secure Access Services Edge, where he guided this enterprise-grade service from inception, to Fortune 500 adoption, to acquisition by Symantec. Before Luminate, Leonid managed engineering organizations at Check Point Software Technologies that delivered network, endpoint and data security products to the world’s largest organizations.

 

How Can CISOS Solve the Cybersecurity Talent Shortfall?

By Shalom Bublil, Chief Product Officer at Kovrr

As cybersecurity threats grow larger, organizations struggle to hire enough staff to stay secure. Not only do companies often lack talent with the skills to meet existing risks, but they also need to add and train staff with the ability to handle new threats in areas like cloud security.

“Because there are so many specialty areas in cybersecurity, and because the field is evolving so quickly, basic cybersecurity know-how no longer cuts it,” notes The University of Tulsa.

Yet finding this talent is easier said than done, leaving many organizations short-staffed. A survey by Cobalt finds that 94% of security teams face talent shortages. Plus, existing talent are often unsatisfied, with 54% in the Cobalt survey saying that challenges like it being “harder to monitor for vulnerabilities” make them want to leave their jobs. That could lead to more turnover and exacerbate the shortage.

But all hope is not lost. In this series on “what keeps a CISO up at night,” we’re examining some of the top issues that CISOs and other IT leaders face. Here, we’ll take a closer look at how to solve the cybersecurity talent shortfall.

Reframe Cybersecurity

To start closing the cybersecurity talent gap, CISOs can push to reframe how cybersecurity is viewed within their organizations.

Rather than making cybersecurity seem overly technical and operational, CISOs can reposition cybersecurity as being more strategic, creative and business-oriented. That can help attract employees. It can also get other leaders on board so you have the budget and overall organizational support to ramp up hiring.

“In today’s environment, cyber is not a cost center, it is a strategic component of enterprise risk management and a business enabler. When it is positioned as such to employees, they will understand that the company values cyber and see a career ladder to scale,” says Deloitte.

Similarly, CISOs can work with HR teams to reframe job descriptions and search for soft skills too, rather than strictly looking for IT skills.

“These characteristics might include curiosity, commitment for problem-solving, and strong work ethic — all of which can help shape future professionals with the right corporate guidance and training,” notes the Computing Technology Industry Association (CompTIA).

Broaden Talent Pools

Another important aspect of closing the cybersecurity talent gap is broadening the talent pools you search in. If your existing searches aren’t yielding enough candidates — such as if you’re mainly sourcing talent from the alma maters of current employees — perhaps you’re not reaching a diverse enough audience.

Recruiting more women, BIPOC individuals, neurodivergent candidates and others who might be underrepresented in your organization can be a great way to add cybersecurity talent while tapping into the power of diversity.

“A growing body of research shows organizations that embrace diversity and establish an inclusive industry and workplace culture perform at higher levels, which means a safer and more secure cyber world.,” says (ISC)², a nonprofit association for information security leaders.

To find more diverse candidates, CISOs can take steps like working with HR teams to find partners like educational institutions and nonprofits that get you outside of your existing talent pools.

You also might find that you’re overlooking your internal talent pool. Upskilling and reskilling existing employees to move into cyber roles, especially when staff come from other positions that might typically be easier to fill, can help you reduce cybersecurity staff shortages.

Leverage Technology Where Possible

As important as it is to change how organizations position cybersecurity and how they source employees, that doesn’t mean that the cybersecurity talent shortfall can immediately be solved. Organizations will likely have to deal with some gaps in the near term, but they can turn to technology to ease shortages.

For example, technology that automates areas like threat detection might help short-staffed cybersecurity teams stay ahead of attacks. Other types of cybersecurity technology like Kovrr’s Quantum cyber risk quantification platform can help CISOs get the most out of existing cybersecurity resources.

By modeling the financial impact of potential cyber events, you can understand where the largest risks exist and direct employees to focus on those areas.

Suppose you want to roll out a company-wide cyber awareness program, as well as improve data recovery capabilities. If you’re short-staffed, you might not have the bandwidth to do both at the same time. But by leveraging Kovrr’s financial quantification capabilities, you can determine the financial impact that these two activities would have on your business. From there, you can prioritize the one that would provide the most financial risk reduction.

Overall, the cybersecurity talent shortfall isn’t necessarily a quick or easy fix, but CISOs can rest easier at night by following these steps. Repositioning how your organization and candidates think about cybersecurity, expanding your talent pools, and maximizing your existing staff by leveraging technology can go a long way toward building a more secure organization.

About the Author: Shalom is chief product officer at Kovrr and a cyber data science expert. Throughout his career, Shalom has acquired unique expertise in cyber intelligence, threat modeling, risk modeling, machine learning and artificial intelligence. Shalom joined an elite Israeli intelligence unit and served for four years specializing in cyber. Following his military service, he joined Lacoon Mobile Security where he led the threat intelligence and threat modeling initiatives. In his last position before founding Kovrr, he led cyber threat intelligence and modeling efforts at Deep Instinct, developing a commercial detection engine product from scratch based on advanced artificial intelligence technology. Shalom holds a B.A. from the Open University of Israel.

 

Guest Post: Cyberthreats are closer to the mainframe than they appear

By Ray Overby

 

There’s a scene in “Jurassic Park” where a Tyrannosaurus rex chases after Jeff Goldblum and Laura Dern’s characters as they speed through the wildlife park in a Jeep. The camera pans to the car’s side mirror, which reads, “Objects in mirror are closer than they appear” — a minute yet clever detail that shows the audience just how close the creature is to ravaging the vehicle.

 

While a cyberthreat does not incite the same type of fear as a T. rex, IT teams should be worried because cyberthreats are now at the doorstep of the mainframe.

 

Organizations today have supplier ecosystems with hundreds of vendors and third-party solutions to meet growing business needs. But the rise in IT connectedness also presents plenty of opportunities for bad actors to infiltrate networks due to vulnerabilities in the software supply chain. In 2021, 61% of security breaches occurred at weak points in the supply chain — up from 44% the previous year.

 

Although the mainframe remains central to nearly three-quarters of all business strategies, we seldom hear about the mainframe infrastructure’s involvement in cyberattacks. This is a significant oversight considering the vast amount of data stored and processed on the mainframe. It’s time to stop ignoring the risks posed to this vital infrastructure and implement a proactive approach to cybersecurity with vetted vendors by your side.

 

The biggest cyberthreat: Overlooking mainframe security

The global IT outsourcing market is expected to grow by $98 billion from 2020 to 2024 as organizations increasingly rely on third-party software and cloud services. Threats hidden in third-party software can reach even the most seemingly secure components of an organization’s IT framework — like the mainframe.

 

Access to the mainframe is a goldmine for bad actors who can take advantage of vulnerabilities to gain control of security, encrypt data and demand a ransom. Despite the rise in attacks, we don’t often hear about their impact on mainframe security. Most organizations uphold the “conspiracy of silence,” which deters them from reporting mainframe attacks. And since there are fewer reports of mainframe attacks, many security teams assume their mainframes are inherently guarded — a false sense of security that hackers continuously exploit.

 

For the many organizations that store sensitive data on the mainframe — and routinely use third-party software — bolstering cybersecurity at each point along the software supply chain should be a top priority.

 

3 actions to shield the mainframe from supply chain attacks

Organizations of all sizes rely on the mainframe for transaction processing, client data storage and inventory management. Infrastructure as critical as the mainframe should be protected accordingly. With a proactive approach to cybersecurity and methodical partnerships with vendors, you can protect your entire IT infrastructure, the mainframe included.

 

  1. Proactively hunt for vulnerabilities. No matter how strong an organization’s cyberdefenses are, proactively scanning for vulnerabilities in operating system software and application programs is the most effective way to stop a bad actor in their tracks. This approach enables you to detect zero-day vulnerabilities as well as network and system gaps. You should also develop a cybersecurity strategy that includes both defense mechanisms to prevent attacks and an incident response plan for when you are faced with a threat.

 

  1. Prioritize patches. Many organizations lack adequate resources and bandwidth to dedicate to patch management. But considering 60% of data breaches stem from known but unpatched software vulnerabilities, fixing vulnerabilities in your system is a surefire way to prevent harmful cyberattacks. Whether you outsource patch management to a managed service provider or reallocate internal resources, establish a playbook for continuous patch management to avoid the 3 to 18 months of downtime it takes to patch the entire system. Most importantly, don’t punish IT teams for downtime due to continual mainframe patching — instead, encourage the initiative.

 

  1. Assess your vendors. It’s imperative to conduct third-party risk assessments before teaming with a vendor. While it may seem like a daunting task considering the number of vendors an organization can partner with, it will save you time and resources down the line. For full visibility into a vendor’s supply chain standards, ask about their security policies and procedures and how their software is developed and tested. You can also evaluate third-party reviews if they are available to gain unbiased insights about the company. Finally, determine whether the organization performs its own risk assessments on the third parties it engages with.

 

Ransomware and other types of cyberattacks are on the rise, and the mainframe is a prime target for the bad actors who execute these attacks. But by carefully selecting the right vendors and implementing security checks, you can keep your data and IT infrastructure safe from even the most sophisticated cybercriminals.

 

It’s time to leave the false sense of security surrounding the mainframe in the rearview — because today, cyberthreats are much closer to the mainframe than they appear.

 

Ray Overby is CTO and co-founder, KRI

 

 

 

 

 

Photo by Mike B: https://www.pexels.com/photo/brown-t-rex-statue-410856/ 

Privacy Policy