2017: The year of cybersecurity scale
Forget about centralizing all cybersecurity data because it is no longer feasible to do so. Enterprise cybersecurity professionals must learn all they can about distributed data management architecture and include cloud-based elements to all their planning. Enterprise customers have already placed SIEM vendors such as AlienVault, IBM, LogRhythm and Splunk on a data management treadmill to keep up with scale, but these vendors will be forced to innovate rapidly, tier their storage backends and provide cloud-based services for non-critical and archival data. Cybersecurity professionals will need to understand an array of data management technologies – relational databases, NoSQL, Hadoop/HDFS, etc. – and figure out what goes where and how to keep track of it all. Finally, companies like Amazon, Facebook, Google and Microsoft familiar with cloud-scale data challenges may play a role in new types of cybersecurity data management architectures.
Seven bold predictions about Android for 2017
The first reason is Google (more on that in a bit). Another reason for this landmark will be a lack of innovation from Apple; the big "A" will continue to play it safe (as they did in 2016), and more users will migrate to Android because of this. Couple this with the increased performance and battery life found in Android 7, and the Linux-driven mobile platform will easily climb the next rung in the global dominance market's ladder. ... Another reason Android will dominate 2017 is the device designed by Google: the Pixel. Not only is this device the most powerful smartphone on the market, it also brings to light features that people will want. One feature in particular is Assistant. Google is the first company to bring an AI-centric digital assistant to life and do it right. With the power of the Pixel driving that feature, this device will continue to be one of the hottest on the market.
Why People and Processes Are Critical to Cybersecurity
“There is so much to consider in cybersecurity, and traditionally, IT in higher education is understaffed,” says Jill Albin-Hill, vice president for information technology and CIO at Dominican University. “It’s tough to find the time and to get the right resources on campus to be able to address it all.” To address that gap, Dominican teamed up with four other small institutions in the western Chicago suburbs — Elmhurst College, North Central College, Wheaton College and Judson University — to create a cybersecurity consortium. The group banded together to contract with an external IT service firm that helps all of the institutions manage cyber risks. ... “Already, it’s helped me gain some visibility across the institution about how this is an important university consideration, and not just an IT issue,” Albin-Hill says.
Top Cybersecurity Lesson from 2016: Unchecked Insiders
It might surprise you, but most organizations struggle to implement and maintain access controls—a basic security building block for file and e-mail systems. Employees and contractors typically have access to far more sensitive data than they need to do their jobs. This makes it much easier for intruders and insiders to do a lot of damage. In the study, 88 percent of end users said their jobs require them to access and use proprietary information such as customer data, contact lists, employee records, financial reports, confidential business documents, or other private or confidential information assets. Sixty-two percent believe they have access to company data they probably shouldn’t see. This, combined with a lack of monitoring and auditing for the files and documents employees do access, sets organizations up for disaster.
Will the cloud be a safe haven for data in 2017?
Delivering enterprise security via the cloud will ultimately start to lower the cost and complexity of the security infrastructure, as those legacy appliance systems are replaced in favor of agile, distributed models, he said. “There’s a growing call for security to be treated as a fundamentally basic utility where safety can be assumed. The cloud is the key to enabling this, with benefits like storage options, scalability and ease of deployment,” Chasin said. Bluelock CTO Pat O'Day predicts that when faced with a hardware refresh, more companies will turn to the cloud than to new hardware. “There’s a lot of churn in the hardware space because of virtualization. Companies are growing tired of having to refresh their IT systems with new hardware every five years. People want to be more mobile, and the cloud is a way to get there.
Intel's Compute Card mini-computer is so small that you may lose it
At first glance, it's easy to mistake the modular computer for a credit card or smart card. It's so thin, it could be easy to lose. But it's a full blown computer, crammed with a 7th Generation Intel Kaby Lake processor, memory, storage and wireless connectivity. It's so small, it can't accommodate USB-C or other ports to power up or connect to displays. The Compute Card will work only after being plugged into a slot of a larger device, much like smart cards. Here's the bad news: It's not targeted toward PCs. However, we hope Intel will eventually make them for PCs, and there are hints the chipmaker could. The idea of a super-small computer is exciting, and it could solve some problems. For example, computer upgrades could become easier.
The future for APIs - how management and security will have to come of age
The gaps that exist between internal IT teams can lead to issues not being fixed. Research by Ovum pointed to problems here, with 53 percent of respondents stating that the security team should lead on this topic while 47 percent believing that the software development team handling APIs would be responsible. Alongside nailing down the responsibility for these potential problems, this includes managing the response that IT teams should take when there are attacks on their APIs. For internal APIs, the response includes looking at what the attacks are targeting and how to stop the problem. Simply turning an API “off” is one approach; the issue with this is that it stops legitimate traffic from accessing the API as well. Categorising attacker traffic and blocking this from interacting with the API is a more fine-grained approach, but relies on a more intelligent approach to rating requests.
Are we all at risk? Implications of the Oracle-Dyn Merger News
We no longer live in an age when we can outsource our issues, especially when it comes to security. Inspect what you expect. Think about all the moving parts of your ecosystems and inspect those parts. Build layers of redundancy, consider and think about front layers. Do not narrow your thinking to just DDoS attacks, but also DDoS mitigation. Reddit had a good strategy in place when it partnered with Dyn. Without Dyn, it may have been down for days, but Dyn was able to get them back up within hours. Ten years ago, as the CTO of a cloud service provider, prospects used to run us through the security gambit to ensure we had the proper security measures in place to protect their infrastructure they put in our cloud… at the same time AWS, MS and Google were being hit by security incidents and downtime one after the other.
Yahoo breach: a breakdown of the biggest data breach ever
Amichai Shulman, CTO Imperva, explained that, “This Yahoo breach and others before it teach us a couple of things: Attackers are still ahead of enterprises, even the larger companies when it comes to covering their tracks. The alleged breaches were only detected once the leaked information surfaced on the web; and time is still a factor. While the passwords were not leaked in clear text, the time between leakage and detection allowed the attackers, using modern computing power, to crack most of the passwords. If the enterprises had promptly detected the breaches a lot of the potential damage could have been avoided.” “We all can learn from Yahoo!’s misfortune, teaching us how to pre-empt and react to [potential] breaches, because the tools are out there on the market to help. With Yahoo being such a behemoth organisation, the question here is – did they invest in security and, if so, how did it go so wrong?” questioned Alez Cruz-Farmer, VP at NSFOCUS.
Interview with Wesley Coelho on Challenges in DevOps
Once you get there, or not necessarily in sequence, the other interesting thing that people are doing with Agile is you don’t want it just within your organization. You want it across organizations. So if you’re implementing Agile but you are outsourcing a component of your software, for example, to a different organization, you want to eliminate the waterfall communication that’s happening across those organizations. Example of what we’re seeing is a luxury auto manufacturer, who’s developing cars that they sell that run 100 million lines of code. They don’t write any of that code internally. It’s all outsourced to dozens of suppliers. So when they take that car out on the track and they find a defect in the car, they file that defect in their own central repository and they take a technology, an automation technology such as Tasktop, and that gets transformed and automatically transmitted to the right supplier who produced the component where the defect was.
Quote for the day:
"The cure for boredom is curiosity. There is no cure for curiosity." -- Dorothy Parker
No comments:
Post a Comment