Cyber News Roundup: The security world according to Black Hat
Editor’s Note: This is your cyber news roundup with the latest cybersecurity news and tips from the Cyber Oregon team to help you and your organization stay safe online and protect your digital assets. We examine cybersecurity news and developments from across the Northwest and the Nation that are important to all Oregonians including individuals, businesses, non-profit organizations, government entities, and educational institutions. Sign up to receive ongoing updates here.
Since 2015, Black Hat has conducted an annual survey on the current state of cybersecurity. To no one’s surprise, security professionals are concerned, as in very concerned. They are not just concerned about data breaches like Experian, Target or Russians meddling in U.S. elections, but also a myriad of other cybersecurity issues. More than 315 security professionals expressed distress over security issues related to personal privacy, politics, cryptocurrency, ethics and compliance.
As discussed in PYMNTS.com’s article Black Hat: Cybersecurity Is More Than A Tech Problem, “In terms of data misuse, a scant 26 percent of respondents felt that it would be possible for individuals to protect their online identity and privacy going forward. Coming from cybersecurity experts, many of whom are responsible for protecting the data at issue here, that’s a pretty depressing statistic. Consumers may not be great at protecting their own data, but if the professionals responsible for doing so on their behalf feel this way, it paints a rather hopeless outlook.”
Here are some sobering statistics from the report.
- Thirteen percent believe that the U.S. government was prepared to respond effectively to a significant cyber threat. Interestingly, though, more experts were concerned about a financially motivated cyberattack than a politically motivated one.
- Fifteen percent of respondents said they participate in cryptocurrency buying and selling, and even fewer — 12 percent — said they participate in cryptocurrency mining.
- When discussing political cyberwarfare, more than half of respondents believed that Russian cyber initiatives heavily impacted the outcome of the 2016 U.S. presidential election, and nearly three-quarters felt that recent activity from Russia, China and North Korea was making U.S. enterprise data less secure.
Boy Scouts don’t grow up to be incident response planners
Does your company have an incident response (IR) plan? It’s doubtful considering that one in three companies don’t have an IR plan in place, according to CSO online. In 10 steps for a successful incident response plan, author Doug Drinkwater discusses the sad state of IR planning for most companies. Worse, many plans are never even tested.
Here is a 10-point process to ensure that your company has an IR plan that will help in a time of crisis.
- Address business issues and assign roles
- Identity relevant business departments and get them involved
- Identify KPIs to measure the event
- Test, test and test again
- Review the plan constantly
- Determine what an incident is
- Form your team, led by a seasoned IR analyst
- Implement the right tools
- Establish a communications strategy
And no, there is no #10 in the article which is somewhat ironic when you consider how important the topic is.
Physician, heal thyself
Like most security IT professionals, healthcare chief information security officers (CISOs) face a wide variety of challenges including dealing with malware, ransomware and cryptocurrency mining. For Sentara Healthcare CISO Dan Bowden, there are many lessons he’s learned over the years that can help other IT leaders address cybersecurity issues. In an interview with HealthITSecurity, Sentara Healthcare CISO Dan Bowden offers 10 lessons he’s learned that can help other IT leaders
- Seek first to understand, and then to be understood
- Lead by building trust and influence, not by pointing at the org chart
- Telegraph your plans, allow others buy-in, create joint ownership
- Act and speak like the C-suite and board are included
- Make your boss and their boss look good
- Create pre-determined outcomes
- People first, then process, then technology
- Recruit and re-recruit your people, from dedication to commitment
- Look for “net adds”— there is always a small win available, they add up
- Capitalize on crisis
Cyber Oregon partner blog posts of interest
- Sword & Shield: How to Spot a Social Engineer
- Fortinet: Resolving the Challenges of IT-OT Convergence