Well, another one: CIO or C-Suite: To Whom Should the CISO Report?
At least the security community seems to agree…
The Role Change of the CSO
I am in this business for almost two decades, which is frightening by itself. On the other hand, it is absolutely fascinating, how the security industry and especially the role of the CSO changed. I do not want to go into long stories of security itself but look at it: Initially it was all about…
Details
Careful what you do with your boarding pass
A lot of people just throw away their boarding pass after a flight. I mean, what information do you find on it? Name, seat, date and flight. So what? You can find this information for a lot of people on social media anyway, right? Well, not really. There is other information on it as well…
Details
Expected Threats in the Next 6 Months
As Threat Intelligence is one of the key assets to be built in companies, the right information sources will be key. The challenge there is not only to get information but to transform it into actionable intelligence. It needs to be targeted to the industry you are working in as well as to the situation…
DetailsHotel Security – The Protocol
Me just a few minutes ago (real life, just the room number is not real): At the reception: Me: Sorry, my key does not seem to work anymore. Reception: What is your room number, sir? Me: 683 Reception: Mr. Halbheer? Me: Yes Reception: Let me give you a new key I understand: A scammer would…
Details
Spread of Eternal Blue – Patching Still a Huge Issue
Back in the early days at Blaster we told the customers that they must do three things: Switch on your firewall Apply security updates Have an anti-virus software installed and keep it updated It seems that even after Wannacry and Petya people have not learned, yet: Look at these statistics with computers still being vulnerable…
Details
Attacks on the Critical Infrastructure happen!
It is not new that in December 2015 and December 2016 Ukraine suffered a power outage due to a cyber-attack. Researchers now figured out that both attacks leveraged the same framework to base their attacks on. It is not as sophisticated as Stuxnet for different reasons (only leverages one vulnerability, the way it communicated, etc.)…
DetailsGDPR – Avoiding False Promises
It is interesting how many companies offer privacy services since the EU announced GDPR and the number is still growing. Almost every company today has a GDPR practice or at least is offering GDPR services. The question shall be asked, whether they are up to the task. I would expect – as companies will get…
Details
Blackmailing happens everywhere today
We have seen ransomware and other vectors for the bad guys to make money. Additionally, the criminals are trying to make money from stolen data, wherever they can. That’s the latest one: Cosmetic surgery hacked. Nude photos and data exposed on the dark web, as hackers blackmail patients Nasty if you are one of them……
Details
Interesting Facts on Data Breaches
The 2017 Data Breach Investigations Report by Verizon was just recently published and it contains a few interesting data points: 75% of the breaches were conducted by outsiders. So, the outsider threat is by far bigger than the insider. However, if you would assume breach, you kind of kill both attacks with one approach 51%…
DetailsDo we tackle the right Threat Intelligence?
As you might know, I am deeply convinced that better threat intelligence allows us to take better security decisions – and I am not the only one making this statement. I am trying to get my head around threat intelligence since a while now and realized that depending on with whom I talk, they have…
Details
Criminals getting closer to State Actors
A few years ago, we saw a clear difference between state actors and criminals looking at the technologies and procedures they applied attacking an environment. Over time we have seen these two groups coming closer together. In the meantime, criminals seem to have caught up. They started to use more sophisticated and targeted malware and…
Details
Security – The CEO’s Responsibility
We always talk about it, right? Security is a top management responsibility but who is really taking this responsibility? Typically the CSO gets under pressure, once incidents happen. Well, Marissa Mayer – the CEO of Yahoo – does, now: Yahoo CEO Loses Bonus Over Security Lapses And with GDPR just around the corner with fines…
Details
Shortage of Cybersecurity Workforce to Increase – An Opportunity for Managed Services
One of the discussions I have with a lot of customers is around managed security services. Especially themes like Security Operation Centers seem to be fairly emotional as quite some customers want to build and run one themselves (and yes, I know the challenges around regulation). One of the points I often make is the…
Details
Threat Intelligence – The Next Big Thing and a Game-Changing Acquisition by Accenture
I made this statement often: To me a good and sound threat intelligence, which is linking to the business will be absolutely key in the future. Therefore we entered into agreement to acquire iDefense – so read on. A study we published last autumn made it clear: We are investing more and more money in…
Details
Accenture Technology Vision 2017
The Accenture Technology Vision is a visionary piece of work showing where we see technology develop over time. It is interesting to see that more and more people are getting back to the center of what we do and where we go. So, the Technology Vision this year carries the title “Technology for People –…
Details
Interview: Me on Cybersecurity
In the context of an event in Berlin, where I had a presentation, I was asked for an interview (in German):
A “thank you” to ISACA German for producing this interview.
Ukraine Power Outage Confirmed as Cyber Attack
Andi t will happen again; I would expect: Ukraine Power Outage Confirmed as Cyber Attack …and not “only” in Ukraine. Swiss TV did a series called Blackout on January, 2nd – three days the power is gone and what happens, what happens afterwards etc. There were seven “fictions documentaries“, which were really interesting. What was…
Details
Facebook and Profiling
Just a quick one. I was aware that a few data points in an anonymized data set can already be enough to identify a single person. However, what you can get out of Facebook is amazing. If you do not know it yet, go to https://applymagicsauce.com/ and apply the magic to your Facebook profile. Just…
Details
Is Cyber Crime worth the effort?
Most of us most probably think that people committing Cyber Crime make a lot of money. The contrary seems to be the case. Looking at Report: Most cybercriminals earn $1,000 to $3,000 a month it seems that the income is fairly minimal. There is one statement in there, which I would challenge: In many ways,…
Details