Tag: cyber security

Cyber Security Legislation Will Change the Face of BusinessAs 2017 gets underway, cyber security legislation will strengthen and force businesses to change the way they approach information security.  At the federal level in the United States, the US Congress and President have proposed numerous updates to existing regulations and new regulations to cover all facets of cybersecurity.  These include the Cyber Preparedness Act of 2016, Cybersecurity Systems and Risk Reporting Act and others.

At the state level, legislation was introduced or considered in at least 28 states in 2016. Fifteen of those states enacted legislation, many addressing issues related to security practices and protection of information, and cyber crimes in general, including dealing with rasomware.

One example is the new regulation by the New York State Division of Financial Services (NYS-DFS) that goes into effect on March 1, 2017 (changed from January 1) that requires organizations registered as banks, insurers, and other financial institutions in the state to implement comprehensive cyber security programs and policies.  The first bar is to encrypt nonpublic information at-rest and in-transit.  This includes confirming a third party service provider’s adherence to these enhanced data security requirements.  Covered entities have to certify they meet the first set of requirements by February 15, 2018 and annually after that.

Other key requirements of the NYS-DFS cybersecurity regulation and others is to maintain audit trails of sensitive data, including logs of access to critical systems.  While it is important to understand who can and has accessed an information system, it is more important to control and audit the access to the sensitive data inside.  Encrypting documents and controlling who can access them regardless of the user’s or file’s location is key to protecting sensitive data and meeting these regulations.  This ensures that only authorized people inside and outside of the organization can access the information.

One thing to remember is that most regulations prescribe the minimum an organization must do to comply.  As we have seen in recent years, complying with a regulation does not mean you are safe and your data is secure.  You need to think about protecting, controlling and monitoring all sensitive data inside your organization to ensure you meet regulations but also that you maintain your business.

It is clear that regulators and legislators are focused on raising the bar for cybersecurity programs and to ensure the public that nonpublic information remains private.  Organizations need to focus on developing a robust risk-based cybersecurity program rather than reactively responding to regulatory guidance.

The time is now to enhance your data security to meet new regulations and protect your business.

Top Four Cyber Security Predictions For 20172016 has been an epic year for cyber security and data breaches.  From recent hacks at Yahoo and LinkedIn to problems at the FDIC and stolen intellectual property from Glaxo-Smith Kline, this year has been a boon for data breaches large and small.

The past year has shown us that malicious attacks and inadvertent mistakes continue at an alarming rate and the consequences are legal, financial and brand reputation woes.

So how will 2017 fare?  Will we see more of the same or a change in the cyber security landscape?

Here are four security predictions for 2017.

1. Cyber Security Legislation will Change the Face of Business

In the US, cyber security legislation is already strengthening as states and the federal government are trying to force businesses to improve their security posture to prevent the next data breach.  One example is the new regulation by the New York State Division of Financial Services (NYS-DFS) that goes into effect on January 1, 2017 that requires organizations registered as banks, insurers, and other financial institutions in the state to implement comprehensive cyber security programs and policies.  The first bar is to encrypt non-public information.  Executives will be held personally responsible for failure to meet these requirements, so this will definitely cause some changes.

Europe is implementing the General Data Protection Regulation (GDPR) act and I can see other countries, including the US federal government, move toward more serious legislation.  As more governments realize there is a national security risk from these cyber attacks, they will implement tougher rules to help prevent the leaking of sensitive data.


2. Hackers Will Attack the Supply Chain

If a hacker wants to get access to sensitive information from a large company, the easiest approach is to go after a weak link in the supply chain.  This may be a service provider, an attorney or a small business partner.  The large company may have adequate security controls for data that is inside the company, but what about when it leaves the company?  Does the business partner have adequate security controls?

Unless organizations are protecting the data itself, there is no guarantee that it will remain secure and only accessible by an authorized user.  Until organizations persistently protect information at the data level, we will continue to see hacks on the supply chain, including more ransomware attacks, since hackers will exploit the weakest link in the chain.  That weak link may be a trusted insider who inadvertently clicks on a phishing email or accidentally sends sensitive information to the wrong email.


3. Organizations Will Impose Stricter Data Security on Contractors and Advisors

To meet stricter regulations and comply with data governance initiatives, organizations in 2017 will place stricter controls on how internal and outside partners access data and collaborate.  Internal contractors and other advisors are typically treated as insiders who have access to sensitive data.  These trusted insiders can pose serious security threats, since they do not work for the company and may not be subject to the same security standards as an employee.  Based on the recent Ponemon Institute survey Risky Business: How Company Insiders Put High Value Information at Risk, 70% of organizations do not know the location of confidential information and 73% believe they lost confidential information in the past 12 months.  There is a major risk that a contractor or advisor could steal intellectual property or other high value data and take it with them to their next client.


4. Enterprises Will Adopt a Data-Centric Security Approach Over Perimeter Security

Sensitive data moves in and out of organizations everyday and the volumes will only increase in 2017.  Globalization and an increasingly mobile workforce increase the risk of this data getting into the wrong hands.  While many organizations focus on securing the network, servers and endpoint devices, the data itself is what matters most.  This is especially true as more employees use a combination of work and personal devices and consumer versions of Enterprise File Synch and Share (EFSS) systems.

Organizations will shift their focus from protecting the perimeter to protecting the data itself by encrypting it and applying dynamic security policies that impose granular user access controls so that only authorized users can access it.  These security policies will travel with the data regardless of location or device and ensure that the enterprise is always in control of it, including having a comprehensive audit trail of all access.  These measures will allow executives, shareholders and other stakeholders to feel confident that business can continue without interruption and meet the governance needs of its constituents.

Cyber Security Takes Center Stage at Stevens Institute Of TechnologyFasoo and the New Jersey Technology Council sponsored “Closing the Threat Gap: Executive Perspectives on the Cybersecurity Landscape” at the Stevens Institute Of Technology in Hoboken, New Jersey on October 26, 2016.  The event featured cyber security leaders discussing the effects of internal and external threats to businesses.  There was a great turnout with some existing Fasoo customers, executives, attorneys, risk officers, CISOs, IT and security professionals from numerous organizations in the greater NY area.  Common feedback from the event was an appreciation for understanding the larger cyber security landscape and how everything from drones to DDOS attacks can affect their companies and personal lives.

Dr. Larry Ponemon, Chairman of the Ponemon Institute, was the first keynote speaker. He talked about the increased threat landscape and how trusted insiders are fast becoming one of the main threats to organizations.  Citing from the recent study “Risky Business: How Company Insiders Put High Value Information at Risk“, he emphasized how ill prepared many companies are to detect and prevent data breaches from trusted insiders with over 70 percent of companies not confident they can manage and control employee access to confidential files.  Dr. Ponemon also talked about results from “The Rise of Nation State Attacks” citing organizations’ lack of readiness to respond to nation state attacks due to an uncertainty as to what a nation state attack is and how to identify the key characteristics, methods and motives of these attacks.

Mark Lobel, US and Global TICE Cybersecurity Leader at PwC focused his keynote on results of the recent PwC “Global State of Information Security Survey 2017”.  Mark mentioned that spending on security is increasing in most organizations and many are realizing that they have to concede the perimeter.  With increasing threats and the landscape constantly shifting to include IoT devices and greater mobility of the workforce, the need for better threat intelligence, monitoring and protection of high value assets is greater than ever.  We still need perimeter security, but companies need to focus on preventing the exfiltration of sensitive information from either hackers or insiders through sophisticated means.  Mark used the analogy of cyber security being like a game of chess with the kings removed. You can never win and it’s a constant battle to keep ahead of the exploits and vulnerabilities.

A panel discussion moderated by Dr. Paul Rohmeyer, Associate PFasoo dinner with Dr. Larry Ponemon and Dr. Paul Rohmeyerrofessor Information Security Management, and Risk Assessment at Stevens, discussed recent cyber security events and some major trends going forward.  The panel consisted of Mark Lobel, Dr. Larry Ponemon, Michael Frank, President at Secure Business Strategies, and Mike Miracle, an executive at BlackRidge Technology. There was a lively discussion of the recent DDOS attack that crippled major websites, like Netflix and Twitter.  This lead to audience interaction as the panel and audience members discussed who is responsible for security related to a product. Should the manufacturer build security into the product or is it the responsibility of the organization implementing the product to ensure the network and access to the product and it’s data is secure?  Or in the case of DDOS is it up to the telecoms to block that traffic?

In the case of IoT devices, like those used for the DDOS attack, the consensus was the manufacturer needs to build security in, but in many cases there are no standards or certifications available to ensure security.  One panelist mentioned wanting something similar to the Underwriters Labs (UL) mark to ensure safety and security.  There were discussions about the increasing sophistication of attacks from hackers and how best to prevent taking down your systems or more commonly stop someone from stealing your most sensitive information.  It is most important to secure the data so that if it gets into the wrong hands, it is protected.

There was one question from the audience about legal responsibility when organizations share information on attacks with the goal of improving their security. The guidelines of what to share and how are still being developed and debated.  Numerous Information Sharing and Analysis Organizations (ISAO) do exist, but the sharing of attack and vulnerability information is still a work in progress. It may make sense technically to share, but if you are sharing sensitive data with a competitor that might potentially use it against you, you are less likely to share it.

There was also a lot of discussion on how process and policy needs to go hand in hand with technology. While the goal is to simplify security so that the user is unaware of it, the reality is that policy and process are needed to guide technology. I can have the best technology, but if it’s not used properly and people ignore security basics, they will ultimately get in trouble.  Organizations need a combination of good policy, process and technology.  While the goal is to improve our machine learning capabilities to take the human out of the cyber security decision tree, people are still at the heart of the problem and solution.

Book a meeting