Knowledge Shared By FireSale HackBoy...
The Art Of Exploitation...
Security Experts...Same Techniques To Make Hacker's Stuff Useless.
Dark Side Of Hacking... In Short Destruction Of Cyber Stuff.
All The Digital Stuff Is Under The Influence Of Cyber Attacks... Be Safe
By Waqas
A group of hackers going by the handle of "Chuckle Squad" hacked the official Twitter account of Twitter CEO Jack Dorsey on Friday afternoon.
This is a post from HackRead.com Read the original post: Twitter CEO Jack Dorsey’s account hacked with racial slurs
Whether you work for an established security industry player like Symantec or a smaller company trying to build brand awareness, providing your solution to a media outlet for an in-depth review is both an exciting and nerve-wracking experience. A positive review will put your product in front of an enormous audience of potential customers. Of course, so will a negative review…
So, when we handed our PARANOID solution over to veteran reviewer John Breeden II for a review in CSO.com, I’ll admit a hint of anxiety tinged our confident anticipation for the outcome.
Fortunately, Breeden reports PARANOID performed very well under his rigorous testing: “(PARANOID) acts as a last line of defense and was very effective in that role during our testing.”
You can read his full review here: “Review: How Nyotron Paranoid puts endpoint security worries to rest.”
Breeden introduces his article by pointing out that PARANOID is a complement to an organization’s traditional endpoint security solutions, not a replacement. He explains how PARANOID uses Nyotron’s unique Behavior Pattern Mapping (BPM) language to map the entire legitimate behavior of the operating system related to file system, registry, IPC and networking.
“The philosophy behind PARANOID is that there is an infinite number of ways that hackers can attack a computer and a network, with new techniques popping up all the time,” writes Breeden. “But if an attacker gains access to a system, there are a limited number of things they can actually do based on what is allowed by the operating system.”
He began his testing with a softball pitch right over the plate: deleting a file from the test system’s desktop. It’s a simple process for the end-user that requires only a few mouse clicks. But Breeden explains what the user doesn’t see: thousands of system calls happening in the background in a very specific sequence at the kernel level of the OS. PARANOID maps all legitimate actions for every possible event on a Windows desktop or server, and automatically blocks any processes that fall outside of those legitimate sequences from executing and issues an alert.
“PARANOID… is ready to pull the rug out from (attackers) at the last second, because there is not a lot an attacker can do that would be identical to the same thing being conducted by a legitimate user or program on that system,” adds Breeden.
Then the real testing began. Breeden launched an attack that has proven able to slip past a commercial antivirus (AV) program that was loaded and fully up-to-date on the test system (he does not provide the product name or vendor).
According to Breeden, “Paranoid saw the attack and even mapped out the illegal processes used to encrypt files and demand a ransom. It was neat to see the attack mapped out, especially when the antivirus program didn’t know anything was wrong, even after the files were encrypted.”
He launched a second attack, and while it too avoided the traditional endpoint security solutions, PARANOID caught it and prevented it from damaging or stealing any files.
Breeden’s final analysis: “The truth is that in today’s world, you really need to be highly concerned, or even paranoid, all the time about cybersecurity. The PARANOID platform can provide a solid last line of defense, and let network admins sleep a little bit easier.”
You can read the full review here.
To schedule a demonstration of how PARANOID can serve as the last line of defense in your organization’s security stack, fill out our short online demo request form, and we’ll get right back to you.
The post CSO.com Reviews Nyotron PARANOID appeared first on Cybersecurity Insiders.
In cybersecurity, we tend to focus on things that appear wrong, and act accordingly. For instance, if we detect someone inside our network who doesn’t belong there, we take steps to remove them, then determine and mitigate any damage they caused (or try to). We look for a specific action or event that is “wrong” and that dictates how we try to correct it.
However – and stay with me here – if you only look for things that are not right, you only find things that are incorrect.
I realize this seems like a very small distinction to make. But understanding this distinction is critical to your ability to implementing a wider and more effective range of detection and protection mechanisms.
When you search for things that are wrong, you have to know what to look for. That leaves the figurative door open for new threats you may not be aware of yet to slip past you.
This is one reason why signature based anti-malware programs fail to detect new malware and require regular updates. They monitor for what they “know” is wrong, and that does not include new malware variants that are created every day.
Consider your organization’s accounting department and its focus on the proper categorization of monetary assets to ensure the books are balanced. If there are any discrepancies, they are quickly identified. They do not have to know the source of the discrepancy, just that there is a discrepancy. Then they can investigate and figure out the root cause, and that should not be too difficult.
In the cybersecurity field, we typically don’t approach a problem in the same way because it’s usually too complicated to figure out the “Right Way” for things to happen. For example, when a user deletes a file from his PC’s desktop, he moves the mouse cursor over the file, selects it and sends it to the Recycle Bin. He doesn’t see how that procedure results in thousands of system calls happening in a specific sequence.
If you can map how an operating system is designed to function, it becomes possible to detect whenever there is a deviation, and stop it from occurring. It doesn’t matter what the wrong system calls might be; just that those system calls are not what occur during normal operations.
This is how Nyotron works. We have solved the issue of figuring out how an operating system functions. From there, it was just a matter of applying that knowledge to cybersecurity. Even when a new or unknown attack hits, it must touch specific areas of the OS and it will never be able to do so in a way that follows all the legitimate path(s). As soon as it deviates from the path, Nyotron detects and stops it. Additionally, Nyotron doesn’t interrupt the end user with notifications or alerts, and never requires regular updates against the enormous and ever-evolving cyber threat landscape.
Again, this is a finite problem and the demonstration of a very complex and invaluable investment by Nyotron.
The post Look for “What’s Not Right” Instead of “What’s Wrong” appeared first on Cybersecurity Insiders.
By Sudais
According to Google hackers, the hacking spree against iPhones has been going for years.
This is a post from HackRead.com Read the original post: Google hackers found malicious websites hacking iPhones
If you have spent any amount of time online recently, then it is extremely likely that you have already heard about the General Data Protection Regulation (the “GDPR“), the European regulation which came into effect on May 25, 2018 and which governs data protection or individuals which have their personal data processed or stored by an organization within the European Economic Area (EEA). Meanwhile, information management professionals are likely to remain very busy in the coming months with the upcoming California Consumer Privacy Act of 2018 (the “CCPA“) which can be considered as the most far-reaching data privacy law in the United States so far.
The CCPA is California’s new privacy legislation that gives greater privacy rights to Californian residents and creates new obligations on relevant businesses. It shares a number of similarities with GDPR, while maintaining a number of differences with GDPR. There are some overlaps between the two laws and, indeed, the GDPR appears to have been the inspiration behind the CCPA. A large amount of work performed in connection with GDPR preparation provides effective foundations for CCPA compliance, although organizations should also bear in mind the distinctions between both legislations.
The CCPA was passed by the California State Legislature and signed into law by Governor Jerry Brown on June 28, 2018. It enters into effect on January 1, 2020, with enforcement to begin six months after the adoption of the California’s Attorney General’s regulations, or July 1, 2020, whichever is sooner.
Who does the CCPA apply to?
The CCPA applies to a consumer which can be broadly interpreted to mean any Californian resident. A resident includes any individual who is in the state of California for other than a temporary or transitory purpose, and every individual who is domiciled in the state of California who is outside the state for a temporary or transitory purpose. Given this broad definition, it would seem that a consumer could also potentially include employees, students and other individuals who would be classified as California “residents”.
The CCPA applies to any “business” that collects personal information about consumers and does business in the State of California and either:
Nonprofit businesses, as well as companies that do not meet any of the three above thresholds, are not required to comply with the CCPA.
In practical terms, this means that any company that does business with Californian residents will have to consider the CCPA (or at least determine if they meet one of the above thresholds), even if they operate outside of California and do not have any premises or equipment in California.
What information is covered under the CCPA?
The CCPA applies to personal information which is defined widely as any information that relates to a particular consumer or household. This definition means data which relates to a household such as energy or water consumption could be considered personal information for the purposes of the law. For organizations who have already worked on GDPR compliance, there is no significant difference with the EU’s concept of “personal data” under the GDPR since data that can be linked to a household is also likely to be indirectly linked to a natural person and therefore constitute “personal data” under the GDPR.
The CCPA provides a comprehensive list of examples of what constitutes personal information, which is helpful for organizations. Examples expressly cited include:
Certain data is however excluded from the CCPA, such as personal information made available in federal, state or local government records (which are called “publicly available data“), de-identified or aggregated data as well as information covered by other applicable laws and regulations, such as HIPAA (covering medical and patient health information), the Gramm-Leach-Bliley Act (covering information maintained by financial institutions), the Driver’s Privacy Protection Act (covering motor vehicle and driver’s license information), and the California Financial Information Privacy Act, just to name a few.
What are the potential penalties under the CCPA?
The CCPA allows for fines up to $2,500 per violation (or $7,500 if the violation is deemed intentional, but violations lacking ‘intent’ will remain subject to the $2,500 maximum fine) but does not place a limit on the total amount of the fine which may be imposed (contrary to GDPR). There is therefore the potential for extremely high penalties, with fines being able to be multiplied by the number of impacted individuals. The current version of the law also provides businesses with a 30-day period to cure their alleged violations after being notified of such violation.
However, in the event of a data breach, the CCPA provides that a consumer may, in such case, bring a civil action to recover damages. The amount of damages which may be imposed is between $100 to $750 per consumer and per incident, or the actual damages suffered by the consumer, whichever is greater. In addition to such financial penalties, the consumer may request an injunctive or declaratory relief.
How granular should my organization’s data management be?
CCPA places great emphasis on the documentation that businesses must keep to demonstrate their accountability. In other words, compliance will require organisations to review their current approach to governance and analyse how they actually manage data protection as a corporate issue. In particular, the CCPA requires covered organisations to ensure that effective systems and processes are in place to give effect to the following rights:
Organizations will need, for example, to have a policy in place to determine when certain data is no longer necessary to retain; for how individuals will be able to withdraw their consent; and to deal with user requests when they object to the processing of their data. The good news is that businesses will be able to leverage the privacy notices they have already put in place for GDPR, however they will also have to consider certain CCPA specificities.
For example, both legislations include a right of access giving individuals the possibility to obtain similar information that the organization has on them, however the time frame is not exactly the same (within a month under the GDPR and within 45 days under the CCPA) and the GDPR allows the individual to access more information (e.g. in relation to automated decision-making). In addition, the CCPA only requires disclosure regarding personal information covering the 12 month period from the date of receipt of the request, whereas the GDPR does not have any time limitation (the information to be provided to the consumer under the GDPR could therefore span a period of multiple years, e.g. from the date the consumer started the relationship with the business). Like the GDPR, the right to deletion under the CCPA is not unlimited and the organization may refuse a deletion request on certain grounds, for example if the information is needed to complete the transaction for which it was collected or is needed to provide goods or services requested by the consumer; or if the information is used to detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity; or is required to comply with a legal obligation or applicable laws.
In addition, both the GDPR and the CCPA require organizations to disclose if personal data would be sold, however the CCPA goes one step further by requiring businesses to provide a clear and conspicuous link on the business’s Internet homepage titled “Do Not Sell My Personal Information” to facilitate the opt-out by consumers of the sale of personal information. In addition, the CCPA requires the creation of three different lists of categories of personal information that the business has over the preceding 12 months, a) collected, b) sold, or c) disclosed for business purposes (or the fact that it has not done so). The level of detail expected for such lists is still unclear at this stage.
In addition, minors under the age 16 have an opt-in right: a business may not sell the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age (or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age), has opted in to authorize the sale of personal information.
Last but not least, the data portability right under both the GDPR and the CCPA allows consumers to request a copy of their personal information “in a readily useable format that allows the consumer to transmit this information from one entity to another”, however the CCPA does not go as far as the GDPR which allows consumers to request the organization to directly send the personal information to another organization.
The above are only some of the differences between GDPR and the CCPA, and have been listed to illustrate how important it is for organizations to carefully consider the different requirements under both GDPR and CCPA.
Can organizations charge fees?
A business cannot discriminate against a consumer who exercises his or her rights under the CCPA. In other words, the CCPA prevents a business from charging a consumer a fee because he or she exercised a right under the CCPA (such as requesting their information to be deleted or opting out from the sale of personal information).
The CCPA contains a non-exhaustive list of discriminatory practices, which includes:
However, the CCPA does allow a business to charge a different price or provide a different level of service to customers if “that difference is reasonably related to the value provided to the consumer by the consumer’s data.” Accordingly, a business may offer financial incentives, such as the payment of a compensation for the collection of personal information, or offer a different price, rate, level, or quality of goods or services if that price or difference is directly related to the value provided to the consumer by the consumer’s data.
What security measures are required under the CCPA?
The CCPA provides that any consumer whose non-encrypted or non-redacted personal information is “subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures” may file a civil action and recover between $100 to $750 in statutory damages per incident, or actual damages. At this stage, a consumers’ right to litigate only applies to data breaches, not to violations under any other section.
What lies ahead?
Even though the CCPA was signed into law on June 28, 2018 and is set to enter into effect on January 1, 2020, amendment bills are still continuing to make their way through the California Legislature. In addition, California’s’ Attorney General is also expected to issue regulations over the coming months. As a result, it is possible that some of the information described above may change before the law enters into effect or is enforced.
Summary
While the CCPA is not yet applicable, its enforcement date is rapidly approaching and it is necessary to use the remaining time left to prepare for the new requirements. The scope of the requirements is broad: the CCPA forces a company-wide strategy and review of processes for managing personal data on every level, and it includes various types of online data in its definition of personal. New rights and obligations must be accounted for and every organization will have to work out its own approach to reflect the context and practices of the business. At the very least, a business should be mapping the personal information that it collects and locations where personal information is stored. In this regard, the CCPA is not the only new or updated privacy law to be enacted in the United States: other states, such as Nevada and Utah, have recently updated their privacy laws, and it is expected that more states will follow.
The post Getting Started on the California Consumer Privacy Act appeared first on Cybersecurity Insiders.
As businesses are going mobile, data security seems to be a top precedence for most enterprise leaders in 2019. And that’s because securing information at every level has become a priority than just a necessity.
So, Cybersecurity Insiders has outlined a list of major Mobile Security Threats of 2019 which might hinder the growth of firms in their respective industry in the current year.
Data Leakage- As per research conducted by Ponemon, organizations operating around the world are at a 28% risk of suffering a breach within the next 2 years. The research further says that simple education and implementation of best work practices can help guard against cyberattacks of any range.
Phishing- Phishing is a Social Engineering attack where a fraudulent email is sent to company employees and is laced with malicious malware links. And the year 2019 is said to witness a lot of victims affected by this cyber threat. Simply remaining vigilant against such scams by using threat monitoring solutions happens to be the best way to manage against such types of attacks.
Network Security- It’s obvious that a mobile device stays secure only if the network it connects to is guarded against the cyber attacks. Hence, connecting mobile devices like Smartphones and laptops to open networks is a strict ‘no’ these days as it can make hackers snoop into device anytime.
Obsolete software- Any mobile device functioning on an obsolete operating system is prone to hackers. So, CTOs and CIOs should ensure that all their mobile devices are operating with the latest software and are receiving regular security updates.
Cryptojacking- When a malware is fraudulently injected into a computing device, it happens to use the processing power of the device to mine cryptocurrency. And this is what leads to Cryptojacking. So, corporate companies should keep a watch on their employee devices on what is being downloaded in the name of apps.
Spyware- In general, foreign nation governments are on a prowl to snoop into the critical networks of their adversary nations. In most cases, they also take chances to infiltrate corporate networks as data related to R&D, merger and acquisitions and finance might strike gold to them in the dark world. Thus, spyware installed on a company network can prove as the biggest cyber threat to companies in 2019.
The post Major Mobile Security Threats of 2019 appeared first on Cybersecurity Insiders.
Finland government has joined forces with UK’s National Cyber Security Center (NCSC) to investigate the recent cyber-attacks which took place on state-run public service websites in the country this August.
Among the attacks, the most serious were those which targeted National Police Service and other public websites.
Thus, the National Bureau of Investigations (NBI) of Finland will now on work closely with public and private entities to help them mitigate cyberattacks on any range launched by Europe’s subsidiaries.
On August 21st this year, unknown hackers launched distributed denial of service attacks (DDoS) which resulting in server functionalities failure.
Remember, on a previous note the City of Lahti Municipal Computer System and the IT system managing the official online poll results of Finland Elections was also targeted in the attack.
Some of the affected websites include VERO- the central tax administration center run by the Finnish government, the Finnish Population registration center, the online info center of the government named Suomi.fi, Poliisi- the police organization of Finland, Kela- the social insurance institute, and the website of Finnish Border Guard.
Cybersecurity Insiders has learned that the Finland government is suspecting the hand of Russian President Vladimir Putin in this entire cyber-attack saga as the incident took place on the same day when Putin met Finland’s Sauli Niinisto for bilateral talks.
Note- China and Russia are known to spy on the IT networks of the Ministry for Foreign Affairs since many years as they are mainly interested in the data going to& fro between Finland and the European Union. Finnish Security Intelligence Service (SUPO) has uncovered this espionage in 2013 and since then has taken all necessary precautions to block the espionage.
The post Finland starts probing cyber attacks launched on its government websites appeared first on Cybersecurity Insiders.
A Ransomware Attack which took place on the Digital Dental Record and PerCSoft software operating in the dental offices across the United States is said to have crippled the entire digital systems making the retained medical and backup records inaccessible to doctors since early this week.
Highly placed sources suggest that the malware attack took place on the software providers based in Wisconsin who collaborated on the cloud backup services provider DDS Safe.
DDS Safe is a HIPAA compliant 3 layered dental backup solution which helps dental offices recover data at the time of disaster.
Sources reporting to Cybersecurity Insiders say that a well known hacking group somehow managed to intercept the database of Digital Dental Record and PerCSoft in the last weekend and uploaded REvil (Sodinokibi) Ransomware on the computers at 100s of dental offices located across the United States.
IT staff discovered the data breach on Monday when few of the medical practitioners from different locations reported that they could not access their patient information due to a server error. When a probe was launched it was revealed that the ransomware locked up the entire database.
From Wednesday this week, the admin staff of the two software companies was reportedly sharing the decryption key with the doctors to free up the database from file-encrypting malware. Data from over 100 offices among 400 were reportedly restored by Thursday this week.
However, the data recovery process is reportedly going slow as some of the doctors & staff vented out their anger on the software provider via Facebook that the file decryption tools were of no use to them.
More details are awaited!
The post Ransomware attack on Dental Offices across US United States appeared first on Cybersecurity Insiders.
Virtualization giant VMware recognizes this new reality, which explains why it has decided to acquire two companies that give the company a stronger foothold in digital transformation and cybersecurity.
One of the companies, Pivotal Software, brings to VMware a platform for developing applications in the cloud. The other, Carbon Black, has a cloud-native endpoint protection platform that ensures this is done securely. Together, the acquisitions send a strong signal by VMware and its parent company, Dell EMC, that it is serious about the role DevSecOps plays in developing modern, cloud-based workloads.
VMware CEO Pat Gelsinger said the acquisitions address two critical priorities for VMware – “building modern, enterprise-grade applications and protecting enterprise workloads and clients. With these actions we meaningfully accelerate our subscription and SaaS offerings and expand our ability to enable our customers’ digital transformation.”
From a security perspective, the move is especially significant. While in the past, security often took a backseat in development, it has become a priority. As organizations build workloads in the cloud and integrate them into hybrid environments, they are thinking about security from day one.
“We now have the opportunity to seamlessly integrate Carbon Black’s cloud-native endpoint protection platform into all of VMware’s control points. This type of bold move is exactly what the IT and security industries have been looking to see for a very long time,” said Patrick Morley, CEO, Carbon Black.
Addressing the Skills Gap
In highlighting the importance of DevSecOps, the VMware acquisition of Carbon Black also helps call attention to the need for advanced cybersecurity and cloud security skills. Currently, there is a shortage of nearly 3 million cybersecurity workers worldwide, something (ISC)² is helping to address with its cybersecurity education curriculum.
Part of (ISC)²’s Professional Development Institute (PDI), DevSecOps: Integrating Security into DevOps is a self-paced online course that delivers in-depth instruction on making security an integral part of the development cycle to achieve DevSecOps. The course is targeted at experienced cyber, information, software and infrastructure security professionals looking to launch or strengthen a DevSecOps program in their organizations – or make security an integral component in their digital transformation strategies.
(ISC)² also recently launched a course on Cloud Basics as part of PDI, which is the first in a series of courses on the cloud, designed to provide a solid understanding of cloud computing including key drivers and rationale for moving to the cloud, cloud architecture and computing concepts and characteristics, cloud service and deployment models, and cloud brokers.
The growing popularity of (ISC)²’s Certified Cloud Security Professional (CCSP) certification has been well-documented. In January 2019, Certification Magazine recognized it, for the fourth year in a row, as the “Next Big Thing” in its annual salary survey. The magazine’s survey respondents reported that the CCSP would be the most-pursued certification by security professionals in 2019, just ahead of the CISSP certification. (ISC)² research in 2018 showed a similar trend, with the CCSP and CISSP cited as the most sought-after security industry certifications globally last year.
As the VMware acquisitions demonstrate, as cloud computing applications and security continue to intersect, it will drive a greater need for more education among cybersecurity professionals to ensure that DevSecOps is a foundational aspect of the cloud migration process.
The post VMware Acquisitions Highlight the Importance of DevSecOps appeared first on Cybersecurity Insiders.
Ransomware attacks are super- threatening to businesses these days as they can make or break a business with ease. And security researchers suggest that the only way to mitigate such cyber risks is to use backup files for disaster recovery and maintain a healthy Cybersecurity posture by using threat monitoring solutions.
But nowadays, Insurance companies which are offering a cyber insurance cover are offering a new deal with the fallout in the event of such crimes. And that is to pay the demanded ransom in Cryptocurrencies such as Bitcoins or Monero to get back the files.
According to a report published by ProPublica early this week insurance companies are now preferring to fork tens and thousands of dollars in ransom to minimize the detriment to the affected parties.
ProPublica report says that paying a ransom to hackers makes complete sense as it cuts down the need to pay overtime to employees engaged to recover data and also helps the need to pay heavy for public relation efforts to deal with the aftermath of an attack.
But Cybersecurity experts working for governments and corporates suggest the other way round while dealing with the cyber attacks. Payment of ransoms in malware attacks doesn’t guaranty free-up of data and in-fact encourages crime to a large extent.
William Haul, the President of a Financial firm operating in the UK suggests the same advice given by the Insurance company. His firm which became a victim of a WannaCry Ransomware attack in 2017 spent thousands of pounds to rebuild the lost data and in the purchase of new hardware and software. He who likes to keep his firm’s name anonymous has come to a conclusion that paying a ransom of $300 as Ransomware made a lot of sense than spending millions of dollars to rebuilt the database.
So, what’s your say on the advice given by the Insurance Companies?
Feel free to share your views through preferred social media platforms seen below.
The post Insurance companies are insisting to pay ransom for ransomware attacks appeared first on Cybersecurity Insiders.
UK’s Department of Transport is planning to use the technology of Artificial Intelligence to prevent traffic jams months in advance. It is being done by allowing the technology firms like Google Maps an access to traffic data and roadblocks and repairs in advance to prevent future congestion.
As per the new Traffic Regulation orders issued by the Department of Transport(DfT), authorities will be allowed to share data related to roadway changes, temporary shutdowns, and others such works with technology firms. And this is where companies will gain access to such data to make their navigational tools backed up by AI assist daily road commuters.
The idea is to allow the drivers to choose the best possible route to their destinations which prevents traffic jams to take place on inner roads and highways.
Note- On average, the UK witnesses over 50,000 road closures every year for up-gradation or improvement purposes.
To encourage companies in developing more navigational technologies, the DfT is offering a Future of Mobility Grand Challenge where businesses can apply for funding to develop innovations for UK’s Future Transport Infrastructure.
For every road user, there is nothing much frustrating than experiencing a road jam due to road works or other reasons. And this is where the government of the UK is opening up data to technology firms to reduce congestion, pollution, and hard work for road users.
The post UK Transport department to use AI to avoid traffic jams appeared first on Cybersecurity Insiders.
A Cyber Attack launched on Iran’s Islamic Revolutionary Guards Corps (IRGC) by US Intelligence in June this year is reported to have foiled the ability of Iran’s military to future attack Oil Tankers in the sea.
Highly placed sources report that the cyber attack was launched on the same day when US President Donald Trump called off military strikes against Iran’s military at the last minute after Iran downed a US Drone at the Strait of Hormuz.
“It was a well-planned attack on the digital assets of IRGC which wiped out the entire control systems of the paramilitary force- a separate unit aside maintained alongside Iran’s conventional military”, say experts from the New York Times.
Although the white house did not react to the news, a spokesperson from the Trump Administration says that their leader is not going to spare such outside-the-war related cultures anymore.
The official added that all such activities are designed to help Iran change its behavior without initiating a physical military war which could do a lot of damage to human lives than expected.
“It is a direct message to adversaries that the United States has a lot of capabilities to retaliate to such attacks of any genre,” says Norman Roule, a former intelligence official.
Army Gen Paul M, who happens to be the head of Cyber Command for the United States said that the American operations are calibrated to stay well below the threshold of war. However, when provoked, the consequences could become serious.
The post US Cyber Attack foils Iran’s ability to attack Oil Tankers appeared first on Cybersecurity Insiders.
Following a six-day Vegas experience, I thought it would be interesting to reflect on all the insight and knowledge gained from almost a week of eating, sleeping, and breathing cloud security. As one of the youngest Black Hat 2019 attendees, my point of view was quite unbiased and unsuspecting as I had never attended a security event before – let alone one of the biggest events in the country.
The post The Bitglass Blog appeared first on Cybersecurity Insiders.
By Owais Sultan
Keeping data and information secure is one of the biggest problems businesses face. Cybercrime is a big issue for many because of the amount of personal data they hold regarding their customers.
This is a post from HackRead.com Read the original post: Ways to Help Keep Your Business Systems Secure
By Waqas
The IT security researchers at Kaspersky have discovered a dangerous malware in CamScanner, a tremendously popular app for Android devices used by more than 100 million users around the world.
This is a post from HackRead.com Read the original post: Popular CamScanner app for Android infected with nasty malware
Last week marked the return of Amazon Prime Day – Amazon’s seasonal retail event which has fast become a masterclass in driving demand and growth through great customer experience. In fact, last year’s event was touted as ‘the biggest shopping event in history’, with over 100 million products sold.
In a savvy move to drive up premium subscriptions, Prime Day sees subscribed members of the Amazon Prime service access exclusive discounts on an array of products for a limited amount of time – 48 hours, this year. Many manufacturers and third-party merchants now actually save their best deals for Prime Day knowing millions of extra shoppers will be buying goods via the online store.
Checkout challenges in e-commerce
The campaign, in numbers, appears to have been a runaway success for the business. For the brand, however, not all has gone seamlessly – with major glitches during last year’s event potentially harming customers’ perception of the platform’s reliability. In many markets, this comes in the wider context that e-commerce – and mobile commerce in particular – are seeing rapid growth, but putting long-term aspirations at risk by continually disappointing customers with unstable on-boarding and checkout processes, or failing to assure customers they are processing their data securely.
This is particularly significant, given the ‘frictionless’ expectations consumers now have; failing at this first hurdle will have serious commercial consequences, for any business online. Yet, businesses must keep up with these demands without losing sight of security and stability. As I wrote about earlier this year, almost all enterprises are now storing sensitive data in digitally transformative environments, but only 30% are encrypting it. For Amazon Prime Day and every other day, you need to ask yourself: are all our checkout and payment processes, many of which are likely cloud-based, encrypted and secure?
Payments that protect companies and customers alike
For the wheels of commerce to turn efficiently, making payments for a product or service with a credit or debit card must remain easy and secure for consumers. The payment ecosystem is highly regulated and constantly changing, therefore it is essential for any business selling online to have the right technology in place. Each purchase launches a complex, automated and highly-integrated process involving not just merchants but also banks, acquirers, payment processors and potentially a host of other players. And of course, as expectations and e-commerce volumes rise, businesses must process higher volumes of payments, at higher speed, with lower power consumption and greater security and tamper-protection.
Powering around 80% of the world’s point-of-sale transactions, these are some of the mission-critical challenges we help our clients tackle every day – and were top of mind as we developed and released payShield 10K – the cutting-edge Hardware Security Module (HSM) which plays a fundamental role in securing the payment credential issuing, user authentication, card authentication and sensitive data protection processes for both face-to-face and digital remote payments.
So, if you’re making any online purchase in the near future – think about the huge set of technologies keeping that purchasing process stable and secure. It might feel fast and frictionless to you, but there’s a whole lot going on under the hood.
To learn more about payShield 10K, please read our Transaction Processing Using payShield HSMs solution brochure.
The post Priming the Payments Ecosystem for Explosive Growth appeared first on Cybersecurity Insiders.
The gaming industry has exploded in recent years with breakout hits like Fortnite creating hundreds of millions of fans across the globe. At the same time, evergreen classics like Call of Duty and Bethesda’s role-playing pantheon – featuring Skyrim and Fallout – continue to act as a lure to newcomers and diehard gamers alike.
The increasing popularity of gaming has been driven by a ‘democratisation’ of the sector. Whereas the ability to play games used to be contingent on having the latest console, the most up-to-date operating system and the ability to buy the newest games, these cost and technological barriers have started to decrease. Fortnite’s addictiveness is in part down to good game design, but its hyper-popularity was undoubtedly driven by low spec requirements and not needing to spend anything on the game upfront.
5G has the ability to take ‘click-and-go’ gaming to the next level. We look at a few ways that the latest wave of connective technology will impact the gaming industry.
The ‘Netflix of gaming’
Earlier this year, Google lifted the lid on an on-demand streaming service called Google Stadia. Hailed as the ‘Netflix of gaming’, Stadia was designed to meet the needs of a population that is increasingly used to consuming media on tap. While reception to its announcement has been mostly positive, even the platform’s biggest detractors couldn’t deny that the concept of the Stadia denoted an equalizing moment for the industry.
5G, and its potential to offer speeds of up to an astonishing 50 Gbps, would form part of the engine-room helping to power platforms like Stadia. As any online gamer knows, lag – or the delay between pressing a button and that action playing out on screen – can be the difference between an enjoyable evening playing a Battle Royale shooter with your mates online and a controller-smashing strop.
5G and the latest generation of ultrafast broadband services can reduce the likelihood of gamers encountering breaks that completely destroy their sense of immersion, making the Stadia a feasible concept for gamers whether they are playing on the go or sat at home.
End of lag?
Lag is among a number of issues that gamers on sketchy internet connections run into on a day to day basis – and it’s not just relevant to streaming services like Stadia. Online gamers will probably be well-acquainted with the ideas of high latency, ‘pings’ and jitter, all of which can conspire to wreck your gaming session.
So much of the coverage around 5G has focused on achieving next level speeds, when in fact, the conversation should be about more reliable connections that could help to eradicate high latency.
An additional advantage of low latency is the fact that developers can start to offload some of the computational workload from a device and instead allow remote sources to shoulder some of the processing. This means that devices with smaller batteries and limited thermal capacity, such as smartphones, can take on beefier games without collapsing under the strain.
Enabling virtual reality
Reducing latency is also vital in enabling Virtual Reality (VR) and Augmented Reality (AR) applications. The rise of affordable standalone headsets, coupled with mobile networks that can connect users without devastating lag, is increasingly improving the viability of this area of gaming. Considering the importance of player immersion involved with VR and AR, the need to kill off game-killing disruptions is of the utmost importance. 5G has the ability to do this.
Are you looking forward to the era of 5G enabled gaming? Which gaming innovations are you hoping to come out of this next generation of connectivity? Let us know in the comments below or by tweeting us @Gemalto.
The post What does the arrival of 5G technology mean for the world of gaming? appeared first on Cybersecurity Insiders.
CCSP (Certified Cloud Security Professional). The CCSP is for IT and information security leaders seeking to prove their understanding of cybersecurity and securing critical assets in the cloud. It shows you have the advanced technical skills and knowledge to design, manage and secure data, applications and infrastructure in the cloud.
Roles that typically require a CCSP include Cloud Computing Analyst, Cloud Administrator, Cloud Architect, Cloud Engineer, Enterprise Architect, Security Administrator, Security Architect and Systems Engineer.
To qualify for the CCSP, you must have a minimum of 5 years cumulative paid work experience in information technology, of which 3 years must be in information security and 1 year in 1 or more of the 6 domains of the CCSP CBK.
CCSK (Certificate of Cloud Security Knowledge). The CCSK is administered by CSA and certifies competency in key cloud security areas.
Roles that typically use the knowledge gained through the CCSK include Cloud Computing Analyst, Cloud Administrator, Cloud Architect, Cloud Engineer, Enterprise Architect, Security Administrator, Security Architect and Systems Engineer.
In contrast to the CCSP, the CCSK has no experience requirements. You earn the certificate by passing the test. The CCSK test asks participants to demonstrate knowledge of three key documents: the CSA Guidance, the CSA Cloud Control Matrix and the ENISA report.
Other Differences
An important distinction is that the CCSP is a certification and the CCSK is a certificate. A certification recognizes a candidate’s knowledge, skills and abilities typically as framed by a job role. A certificate scope is narrower, and only provides proof of a training course completion.
A certification grants a candidate access to a membership organization, and almost always requires an annual continuing professional education (CPE) commitment to maintain the certification. But a certificate does not often associate one with any membership organization, and the body of knowledge gained does not evolve over time or require CPE.
Takeaway
In many ways, the CCSP and CCSK credentials complement each other. Because the CCSP recognizes the value of CCSK and has a provision that CCSK can be substituted for 1 year of required experience, the CCSK is often viewed as a good start along the path to earning a CCSP later.
Achieving CCSP certification provides the added benefit of membership in (ISC)², the world’s largest nonprofit association of cybersecurity professionals. More than 140,000 members strong and growing, (ISC)² offers its members professional development courses through the Professional Development Institute (PDI); continuing professional education through industry events such as the global Security Congress; technical webinars discussing areas of developing cybersecurity trends; and benefits such as Member Perks, the (ISC)² Community and the bimonthly InfoSecurity Professional magazine.
For a deeper dive into these two credentials, read the article, Comparing the CCSP and CCSK.
The post CCSP and CCSK: Which Cloud Security Credential Is Right For You? appeared first on Cybersecurity Insiders.
Canon Solutions, a business unit of Canon America held a special event on Information Security at Metlife stadium in New York on Aug 22nd this year. The event’s objective was to help business leaders with security specialists who then provide strategies and technologies to help mitigate the growing number of cyber threats.
Canon’s motive was to take the attendees to a new world and help connect them with Five Pillars of Security- Information Security, Cybersecurity, document security, print security, and device security.
Canon solutions in partnership with its partners Barracuda, Vera and Agile Cybersecurity Solutions showcased different live situations and presentations where speakers can take deep dive into the topics to understand them better and to the core.
“As data security has become a prime concern for all business leaders across the globe Canon Solutions America is committed to providing solutions to protect intellectual properties of businesses, data of employees & customers with the help of best in class technology and sophistication”, says Peter Kowalczuk, President, Canon Solutions.
Technically, Canon Solutions America offers a variety of options to protect digital assets from data breaches. Solutions about File Encryption, Access Control, Centralized Management, Archival storage, and Enterprise Digital Rights Management are available in the company’s catalog.
When it comes to Cybersecurity, Canon Solutions offers services such as Vulnerability Assessment, Consulting Services, Virtual CISO, Incident Response, Penetration Testing, Digital Forensics and Virtual Chief Information Security Officer( V-CISO).
The post Canon Solutions and Information Security appeared first on Cybersecurity Insiders.
This post was originally published by siri oaklander.
In the wake of the recent Capital One security breach in their cloud environment on AWS, the security community is taking another look at how we approach cloud security. CloudPassage recently shared guidance in our blog, “Capital One Data Breach: Non-Technical Tips To Not Be A Headline”. Here we take a look at how your industry peers are thinking about focusing on what matters by taking a look at the 2019 AWS Security Report.
Read more here: https://blog.cloudpassage.com/2019/08/14/2019-aws-security-report/
Photo:www.channelfutures.com
The post What the 2019 AWS Security Report Tells Us About Preventing a Cloud Data Breach appeared first on Cybersecurity Insiders.
This post was originally published by amol sarwate.
On July 29, it was announced that there was a Capital One cloud data breach. A hacker had accessed about 100 million credit card applications, and investigators say thousands of Social Security and bank account numbers were also taken. This comes on the eve of the news that Equifax has reached a $700 million settlement with U.S. regulators over stolen personal information for 147 million records in 2017.
Read more here: https://blog.cloudpassage.com/2019/08/21/preventing-a-capital-one-cloud-data-breach/
Photo:www.gadgetguy.com.au
The post Preventing a Capital One Cloud Data Breach appeared first on Cybersecurity Insiders.
This post was originally published by amol sarwate.
Here at CloudPassage, we’ve been researching how public data can be used for real-time vulnerability alerting using principles from the United States Tsunami Warning Center. I am excited to announce that we will be presenting and demonstrating initial results from this research at the OWASP Global AppSec 2019 conference in Washington DC. Please join our session on vulnerability alerting and threat intelligence on September 13 at 4:30 pm.
Read more here: https://blog.cloudpassage.com/2019/08/27/real-time-vulnerability-alerting/
The post Real-time Vulnerability Alerting appeared first on Cybersecurity Insiders.
Imperva which offers Enterprise data and application software has made it official on its website that its data related to its Cloud Web Application Firewall (WAF) dubbed as Incapsula was exposed to hackers for some time.
The Redwood City-based company says that the incident came into the light to its authorities on Aug 20th, 2019 where data related to the Cloud WAF accounts dated through Sept 15th, 2017 were exposed/access by/to hackers. It includes data related to email addresses and hashed/salted passwords.
Furthermore, for a small portion of Incapsula customers data related to API Keys and Customers related SSL Certificates was also leaked during the incident.
Currently, the Cyber Incident is being thoroughly investigated by Imperva, and impacted customers are reportedly being informed through proper channel.
Readers of Cybersecurity Insiders should notify a fact that the California based company was acquired by Thoma Bravo in 2019.
So, was the data breach discovered before or after the acquisition is yet to be known. However, industry analysts say that the breach could cause Thoma Bravo to go slow on the purchase as it has to first find out the data breach repercussions and then demand a discount for the purchase.
Similar to the purchase of Yahoo by Verizon where the latter got a discount of $350 million after it discovered that then Marissa Mayer led company showed laxity in following Cybersecurity norms leading to the leak of more than a billion email IDs and passwords related to Yahoo! users in Aug’13.
The post Imperva announces that data of its Cloud firewall was exposed to hackers appeared first on Cybersecurity Insiders.
American Global Cybersecurity Software McAfee says that every minute over 504 new cyber threats was being populated on the internet in the 1Q of 2019. Security experts from the Santa Clara based firm also suggest that there has been an increase in ransomware attacks in the 1Q of 2019 as cyber crooks were coming out with innovations and sophistication.
Furthermore, over 220 Billion credentials were stolen in cyberattacks in this year across the world by cyber crooks and this includes a 29% rise in coin mining malware and a 118% rise in ransomware samples.
As every infection leads to business disruption, a threat to consumers, and financial loss, McAfee says that such threats might prove disastrous to startups and SMBs if they fail to take precautionary measures well in advance from the beginning of their business.
While spear phishing tops as a major cyber threat in McAfee report, Remote Desktop Protocol (RDP) vulnerabilities are reported to be exposing data to ransomware attacks via brute force logins.
Among them, Dharma Ransomware happens to be the most active malware families of this quarter along with GandCrab, Ryuk, and Anatova.
Going with the Coin mining malware, McAfee report says that CookieMiner malware was discovered to be targeting Apple iOS users to steal bitcoins from e-wallets.
Note 1- A ransomware is a kind of malware variant which locks down files from access until a ransom is paid to users.
Note 2- With coin mining malware, computing resources are used by a fraudulently downloaded app to mine cryptocurrency- all without the knowledge of the hacker.
The post Every minute over 504 new Cyber Threats are being populated on the internet appeared first on Cybersecurity Insiders.
By Waqas
The US space agency NASA (National Aeronautics and Space Administration) has confirmed that it is currently investigating an incident involving one of its astronauts who might have committed the first-ever cyber crime in outer space.
This is a post from HackRead.com Read the original post: NASA astronaut accused of accessing ex-wife’s bank account from space
Here at CloudPassage, we’ve been researching how public data can be used for real-time vulnerability alerting using principles from the United States Tsunami Warning Center. I am excited to announce that we will be presenting and demonstrating initial results from this research at the OWASP Global AppSec 2019 conference in Washington DC. Please join our session on vulnerability alerting and threat intelligence on September 13 at 4:30 pm.
In this session, I will demonstrate how a real-time vulnerability alerting system can be built in the AWS cloud using public data. With more than 2000 unique vulnerabilities disclosed every month, CSOs and security practitioners have an impossible task of cutting through the noise and prioritizing the most critical issues for remediation. Doing this daily is excruciating and doing it only weekly is too slow. So wouldn’t it be nice if there was an automated system that alerted you about the most gruesome, high-profile vulnerabilities in real time and produced insights you can take action on immediately?
Vulnerabilities and security attacks are like tsunamis caused by earthquakes that hit without warning, causing significant damage and leaving us scrambling. Although one cannot predict earthquakes, there are two tsunami warning systems operated by NOAA in the United States that produce reliable results in the nick of time. Based on the same core concepts and principles, we have built an open-source Vulnerability Warning Center proof of concept with real-time vulnerability alerting about highly-seismic vulnerabilities before they hit your organization’s shore.
Unlike getting data from honeypots and sensors, I decided to take a different approach and harness public data about attacks, exploits, data leaks, and vulnerabilities from blogs, Twitter, and numerous other data points to create simple alerts and graphs that warn with actionable insights in real time. In this initial phase the system has shown remarkable results which I will demonstrate in our session. In the live demo, I will ask the audience to pick a day, or week, or month, and I will then demonstrate the system’s capability to identify the most pressing security vulnerabilities during that time frame.
In the XY scatter graph below, from July 15 to August 15 the system generated about 40,000 data points on more than 4000 unique vulnerabilities and generated intelligence quotient scores for each. The X-axis represents the day of the month on which the data was collected and the Y-axis represents the vulnerability intelligence quotient score. The data gets generated every few hours to refresh the graph and accurately identifies in real time the nastiest threats and vulnerabilities.
In the session, I will also examine the design and implementation details of our real-time vulnerability alerting to show how the system can cut through the noise and rank the most relevant real-time vulnerability information. I believe that we have just scratched the surface. In the future, I plan to leverage machine learning and data analytics to process data from different regions, languages, and sources that will increase coverage, accuracy, and even highlight the industries that are being targeted by the threat.
We hope to see you at OWASP Global AppSec 2019 in Washington DC so we can share with you a system based on public data that can accurately—and in real time—curate, identify, and prioritize high-priority vulnerabilities and provide you actionable insights to protect your organization’s assets.
Meanwhile, check out CloudPassage Halo that provides comprehensive security visibility and compliance for your public cloud infrastructure.
The post Real-time Vulnerability Alerting appeared first on Cybersecurity Insiders.
The digital age that we live in today offers a lot of comforts as well as dangers. We generate an enormous amount of data every day and gathering that information doesn’t require much effort. You must have already come across links which redirects you to an unsecured website asking you to fill in sensitive information. You can fall prey to cyber attack by clicking on such links. Knowledge of cyber security can help prevent these attacks.
Cybersecurity, a part of information security, refers to the processes and activities performed to secure computer systems and networks from unauthorized access or cyber attacks. Robust cyber security has become a necessity for every organization since there have been numerous cases of data breaches all across the world. According to a news report, a total of 12449 data breaches were confirmed during the year 2018, which was a 424% increase in comparison with 2017. Renowned names like Facebook, Google, and Marriott too appeared on the list of companies facing cyber attacks. This explains why the need for cyber security is at an all-time high.
The National Association of Software and Services Companies (NASSCOM) has predicted that there will be a demand of 1 million cyber security professionals by 2020 in India alone. With the widening skills gap, time is ripe for professionals to gain expertise in cyber security concepts and contribute their efforts in mitigating any data breach that occurs in an organization.
There are many cyber security jobs available for individuals who are starting their career in IT security. Some of the job roles included in this field are:
While the responsibilities for each role may vary depending on the organization you work for, some of the common tasks handled by a cyber security professional include:
As the techniques used by hackers continue to become advanced, cyber security professionals need to upgrade their skills to remain relevant in the job market. The growing adoption of digitalization has led to newer ways of penetrating computer systems and compromising sensitive information. Dealing with such a vulnerable environment requires a candidate to have exceptional skills in securing networks. Some of those skills include:
Individuals willing to enter the cyber security domain generally have a bachelor’s degree in computer science or any related field. Certain organizations prefer candidates with an advanced degree like Master of Business Administration in Information Systems for a cyber security job. There are many recognized certifications too in cyber security which can help you validate your knowledge and skills.
CEH (Certified Ethical Hacker)
Offered by the International Council of E-Commerce Consultants (EC-Council), the Certified Ethical Hacker certification is ideal for entry-level professionals looking out for their first cyber security job. Ethical hackers look into the vulnerabilities of the computer systems and networks and protect them from any possible threats. Aspirants should pass the 312-50 ECC Exam to obtain the CEH designation.
CISM (Certified Information Security Manager)
This credential is offered by the Information Systems Audit and Control Association (ISACA). Aspirants need to be well versed in topics like information security management, information security incident management, information risk management, and more. Professionals who wish to achieve this certification should have at least five years of experience in the security domain. They should then pass the CISM exam which consists of 200 multiple choice questions.
CompTIA Security+
It is also an entry-level certification for which aspirants need to learn about the network security concepts, access controls, threat management, and more. To achieve this certification, candidates need to pass the SY0-501 exam. It is preferred to have work experience of at least 2 years in network security domain before preparing for this certification.
CISSP (Certified Information Systems Security Professional)
The International Information Systems Security Certification Consortium or (ISC)2 provides the CISSP certification. It is a highly regarded certification for cyber security practitioners. This certification validates your knowledge in building, guiding, and handling security standards and policies of an enterprise. Appearing for the CISSP exam requires the candidate to meet a certain experience level in information security.
Regardless of the certification you pursue, you are paving a way to a high paying career by exploring the world of cyber security. As per Glassdoor, the average salary earned by a Cyber Security Engineer is $1,29,847 in the United States. For other related roles, the salaries are:
By looking at the above figures, you can do a huge favor to your career by becoming a cyber security professional.
Companies have now understood the importance of hiring cyber security talent looking at the current scenario of IT security. As new variants of malware are being developed every year, you can start thinking like a hacker and protect your organization’s systems against any such threats. Wait no more! Take up a cyber security course and plunge into this promising career.
The post Demand and Salary Prospects for Cyber Security Jobs appeared first on Cybersecurity Insiders.
Thinking about attending the upcoming Gartner Security & Risk Management Summit, 19 – 20 August 2019, in Sydney, Australia?
As a Summit sponsor, we’d like to offer you a special discount code (SECSUMMIT3) that will help save you $450 off the standard conference fee.
If you do plan to attend, please drop by the Thales Booth S38 and meet the Thales team.
Since Australia’s Notifiable Data Breaches (NDB) started on 22 Feb 2018, there have been 964 data breaches declared (from 1st April 2018 to 31st March 2019), with compromised credentials being the majority of malicious breaches. Come meet our cyber security experts and discuss how to develop an access management strategy that includes multi-factor authentication to protect your organisation from identity theft.
We would also be happy to discuss how data encryption and encryption key management can help you to transform your cybersecurity, risk management and compliance strategies to meet the pace and scale of today’s digital business whether on-premise or in the Cloud.
We hope to see you at the Gartner Summit.
The post Gartner Security & Risk Management Summit: August 19-20 appeared first on Cybersecurity Insiders.
Thales’ Managed Services program was recognized at the MSP Innovation Awards, powered by Channel Partner Insight (CPI), earlier this summer in New York City. The MSP Innovation Awards are designed to honor the vendors, distributors and MSPs across North America who are leading the way in managed services at a time of unprecedented disruption and change in the channel.
With 20 categories recognizing the achievements of MSPs, MSSPs, distributors and vendors, Channel Partner Insights was looking for businesses that stand out from the crowd in the managed services market. The awards are completely independent and based solely on innovation and achievement in the North American channel over the past year.
We are excited to announce that Thales was recognized in two categories: Best Project and Highly Commended for Best Security Offering. The full list of awards can be found here.
Thales’ Best Project submission was centered on a use case with a Fortune 500 biotech company that was looking for a security provider for installed pacemakers on a global scale. CPI saw the project as a truly ambitious and innovative example of leveraging the power of IoT. Discover how the solution allowed the customer to create a process that maintained data safety throughout every communication using our SafeNet Keyfactor Control and Luna HSMs, and why it came out on top to win the Best Project Award.
The SafeNet Data Protection On Demand (DPOD) product provides MSPs or MSSPs managed security services that can be immediately be deployed for their customers, under their own branding, bundled with their cloud or security services. DPOD made a strong case about how Thales is transforming traditional, on-premises providers into relevant cloud service providers through this as-a-service security product. Learn how DPOD helps MSPs provide data protection as-a-service offering to their customers and develop their revenue streams, and why DPOD was Highly Commended in the Best Security Offering category.
Chen Arbel, VP, Business Development, Cloud Protection & Licensing, represented Thales at the award ceremony. When asked how important security is to an MSP’s business today, Chen stated, “We believe, because we’ve seen many times, that the number one reason MSPs lose business is related to the fact that they do not cover cybersecurity or they have failed to provide expertise in this field. Cybersecurity – or data encryption – is a critical part of each and every organization today.” Watch Chen’s interview on how the MSP space is evolving, where MSPs should be investing, and the top security threats out there today.
Thales also answered CPI’s five crucial questions for MSPs in the market today, read about what is and will be most important for MSPs to grow their businesses.
Hundreds of MSPs anonymously shared their opinions of what they love and loathe about their vendor partners in CPI’s exclusive State of the Market report. The report covers five technology areas: security, RMM, PSA, backup and business continuity, and software. MSPs told CPI what they really look for in their vendor partners from each category, giving frank feedback on what keeps them loyal and invested, as well as what could make them switch to a new vendor partner.
The post Thales’ Managed Services Program Honored at MSP Innovation Awards appeared first on Cybersecurity Insiders.
Clearly, the skills gap is a serious problem, impacting an organization’s ability to keep up with software vulnerabilities, harden devices, respond to security issues quickly and strategically manage security in an ever-evolving threat landscape. With the odds stacked against them, businesses must find new ways to recruit and retain skilled security employees and proactively address the lack of talent to fill critical roles.
Here’s what IT and potential security professionals should know about tackling this major skills shortage – and strengthening career prospects.
Organizations must get creative with hiring
A shortfall of talent with traditional experience and education in security is only expected to intensify, so employers must consider hiring talent with less typical work histories to take on security roles.
Still, many hiring managers think it is necessary to look for candidates with traditional technology credentials — college degrees in tech fields, for example. But this is a mistake when it comes to hiring during a talent crunch. Businesses today should open themselves up to applicants whose nontraditional backgrounds bring value to the table. When positioning yourself for a security role, make it known how your previous experience, education and soft skills equip you with new ideas to meet the challenges of improving cybersecurity.
Security leaders and hiring managers will need convincing to recast their expectations and look to candidates with a wide range of competencies. But employees who see these jobs as an opportunity to use existing skills, develop new skills and shift gears in their career are viable candidates more likely to commit to a company for the long term.
Developing employees internally
An existing internal talent pool is an excellent resource for cybersecurity roles. If you’re coming from general IT, engineering, compliance, networking and other disciplines with technical knowledge and a natural curiosity, you could very well be the right candidate for taking on a new career challenge.
Security is increasingly a shared responsibility across all lines of business, and a solid, in-house training program helps identify employees with the aptitude for security. As an existing employee seeking a new security-focused role, consider job rotation programs and job shadowing across departments as a viable first step.
Businesses also look for training and certification programs to help transitioning internal candidates gain valuable security education to enhance the skills they bring to the job. But there’s no reason to wait. It will be highly advantageous for you to get a step ahead and move forward with professional development and certification on your own.
Tapping outside resources
Forward-thinking employers are also tapping local technical, community and traditional colleges to find students who have cybersecurity skills or are looking for a career in cybersecurity. Be sure to leverage resources available in your community.
Another smart move is developing relationships with associations that offer membership and certification for security professionals. As organizations actively seek out a pipeline to security talent, you have much to gain through these avenues.
Waiting for qualified candidates to come to them is not an option for employers in this job market. A proactive and collaborative approach between employee and employer is essential for fostering talent in the industry and successfully addressing the cybersecurity talent gap. With the right strategy, you have the power to help fill the gap and achieve more in your career.
Want to take advantage of the security skill shortage? Learn how in the Add Security to Your Skill Set (and How to Do It) eBook.
The post IT Professionals: Use the Security Skills Shortage to Your Advantage appeared first on Cybersecurity Insiders.
