What is data governance? A best practices framework for managing data assets
Data governance is just one part of the overall discipline of data management, though an important one. Whereas data governance is about the roles, responsibilities, and processes for ensuring accountability for and ownership of data assets, DAMA defines data management as "an overarching term that describes the processes used to plan, specify, enable, create, acquire, maintain, use, archive, retrieve, control, and purge data. While data management has become a common term for the discipline, it is sometimes referred to as data resource management or enterprise information management. Gartner describes EIM as "an integrative discipline for structuring, describing, and governing information assets across organizational and technical boundaries to improve efficiency, promote transparency, and enable business insight." Data governance may best be thought of as a function that supports an organization’s overarching data management strategy. A data governance framework provides your organization with a holistic approach to collecting, managing, securing, and storing data.
Average tenure of a CISO is just 26 months due to high stress and burnout
Today, CISO jobs come with low budgets, long working hours, a lack of power on executive boards, a diminishing pool of trained professionals they can hire, but also a constant stress of not having done enough to secure the company's infrastructure against cyber-attacks, continuous pressure due to newly arising threats, and little thanks for the good work done, but all the blame if everything goes wrong. Across the years, many CISOs have often pointed out the problems with their jobs and the stress and damage they inflict. However, there has been no conclusive study to support broad assertations. ... The Nominet study only surveyed high-ranking CISO executive jobs, but the problem is widespread across the industry. Infosec -- or cyber-security -- has a habit of grinding through employees due to the rigors of the job. Low-level infosec positions, like threat analyst or penetration tester, are just as bad in terms of stress level, if not worse, primarily for the same reasons -- constant fear of new incoming attacks, long-working hours, low pay, almost no job satisfaction.
How do I build a cloud-ready network?
Enterprises that decide to move processing to a cloud provider must prepare their networks for the migration. That will almost certainly mean upgrading WAN links, but enterprises shouldn't start talking to internet service providers until they've performed a careful analysis of the applications they plan to move. Here are some considerations enterprises should evaluate when preparing a cloud-ready network: Are you planning to move an interactive application to the cloud or begin using a SaaS platform? Are you simply eliminating the need to maintain the resources for end-of-month processing or application testing? Are you currently operating an in-house private cloud but plan to move some of the processing to a public cloud to create a hybrid cloud? Look carefully at what network resources each type of application requires. Interactive applications typically don't move a great deal of data across the network.
Half of cybercrime losses in 2019 were the result of BEC scams
For comparison, BEC/EAC-associated losses were $1.3 billion in 2018, $676 million in 2017 and $360 million in 2016 (with a $30,000 average monetary loss per complaint). The IC3 also observed an increase in the number of BEC/EAC complaints related to the diversion of payroll funds. Some victims can get their money back, though: IC3’s Recovery Asset Team (RAT), which was established to streamline communication with financial institutions and assist FBI field offices, gets involved if the victims made transfers to domestic accounts under fraudulent pretenses. In 2019, they recovered $305 million of the $384 million lost in 1,307 such incidents, by reacting quickly and requesting banks to freeze the accounts involved. In some cases, they even managed to identify the scammer. “In February 2019, the IC3 RAT received a complaint involving a BEC incident for $138,000, where the victim received a spoofed email and wired funds to a fraudulent bank account in Florida. The RAT took quick action and worked with key financial partners to freeze the funds,” the IC3 shared.
Presidential campaigns taking email security more seriously--not so much at the local level
While the picture for email security at the presidential campaign level appears to be improving, at the local level, email security seems to be overlooked: 142 of 187 domains used by election officials in the three largest counties (or parishes) in every state don't use DMARC at all. Of the remaining jurisdictions, 42 use monitor-mode only, and 11 use invalid DMARC, leaving only 5.3% of those local domains protected by DMARC, Valimail's research shows. At the local level, "it appears to be awareness more than anything else," that is a problem with adopting DMARC and other secure email technologies, Blank says. "There is an enormous amount of technology that exists [but local officials] don't even know where to start and that there are tools that can help." Organizations such as the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) stand ready to help campaign officials learn what the best technologies are and how to deploy them. Last week the group issued summary guidance for what it calls "essential cybersecurity" for election officials. The three key technologies the M3AAWG advises campaigns to use are multi-factor authentication (MFA), email authentication and encryption.
Cybersecurity Jobs Going Begging As College Computer Science Grads Lack Skills
Many of the half-million cybersecurity job openings are going begging because college computer science graduates often lack the needed skills and hands-on experience, House Research and Technology Chair Haley Stevens (D-MI) asserted today. She added the nation’s education system is further exacerbating the problem because few high school students have any exposure to computer science in the classroom, let alone cybersecurity. Another reason for the cybersecurity workforce abyss Stevens pointed to is a lack of women in the profession. “The cybersecurity field as a whole lacks diversity, even more so than many other STEM fields. The math is simple: Last year, women accounted for only 20 percent of the global cybersecurity workforce,” she noted. Aggrieved women of color in cybersecurity jobs make on average $10,000 less than their male counterparts, Congressman Stevens contended: “We cannot address our current and future cybersecurity workforce needs without recruiting and retaining more women and minorities into the field.”
The tech IT professionals love: 5G, cloud management, Graph API
The biggest appeal? Increased speed. 5G networks have potential download speeds of 20Gbps, which is not only faster than 4G but faster than cable internet connections, according to Josh Fruhlinger in What is 5G? How is it better than 4G? Plus, 5G significantly reduces network latency, which is critical for Internet of Things uses such as telemedicine and autonomous vehicles that require fast transmissions. “5G is looking extremely promising: better coverage, less energy consumption, low latency, high data rates. This is a game-changer that will take us to new levels,” said Scott Schober, CEO of Berkeley Varitronics Systems, during the Twitter chat. “We are working with a lot of the carriers and teams actively testing, and they are making some great progress. There is enough money and marketing behind this, so they have to make it happen sooner than later.” 5G installations are starting to appear, such as Whirlpool’s private 5G network, provided by AT&T for its fleet of driverless vehicles. The company is in the process of rolling out the 5G network across the plant, and hopes to make 80% of its 100 vehicles driverless.
Cloud computing security: These two Microsoft tools can help you battle shadow IT
You get more control by analysing and controlling cloud app usage on the device directly. Microsoft Cloud App Security (MCAS, a Cloud Application Service Broker, which is itself a cloud service) now includes a shadow IT discovery tool that integrates with Defender ATP to discover cloud app and service usage on any managed device. Defender already monitors what processes are running and what files are being opened as it checks for malware, and that same information lets it report back on what cloud services are being used. It's an automated process that creates a catalog of cloud apps that are in use, by which users and on which devices, with security and compliance risk scores for each app. But because MCAS is integrated with Defender, you get the option to block and whitelist apps directly on the device. That works for all devices, not just the ones on the corporate network -- and it even lets you enforce read-only access to your corporate resources for external users like suppliers and partners. Defender ATP can look at the labels you apply with Azure Information Protection, so you can tell when data tagged as sensitive or confidential is being sent to a cloud service -- in real time, or later on, even if that device is no longer connected for you to scan or available for you to look at physically.
What are the newest cyber attacks to look out for?
Swarm technology refers to decentralised systems that use automation such as AI to operate without the need for human intervention. Named after the term that defines a group of insects and acting in a similar manner, although swarm tech has been known to have the potential to benefit society, some experts are wary of its possible cyber attacking capabilities as well. Derek Manky, chief of security insights & global threat alliances at Fortinet, explained: “Over the past few years, the rise of swarm technology, which can leverage things like machine learning and AI to attack networks and devices has shown new potential. “Advances in swarm technology have powerful implications in the fields of medicine, transportation, engineering, and automated problem solving. However, if used maliciously, it may also be a game changer for adversaries if organisations do not update their security strategies. “When used by cyber criminals, bot swarms could be used to infiltrate a network, overwhelm internal defences, and efficiently find and extract data.
Police use of facial recognition ‘unjustifiable’, says Scottish Justice Committee
“The sub-committee believes that there would be no justifiable basis for Police Scotland to invest in technology which is known to have in-built racial and gender bias, and unacceptably high levels of inaccuracy,” said the report. It said the committee had not received sufficient evidence to justify the introduction of LFR technology, or that it is even possible to use the technology in a “proportionate” way. “Its use on people who attend legitimate and legal pursuits, such as peaceful protests, concerts or sporting events, is not necessary or proportionate,” the report said. Although Police Scotland does not currently use LFR, plans to introduce it were included in its 10-year Policing 2026 strategy, which the committee said must be reviewed and updated if the police still plan to deploy the technology. “The Scottish Police Authority must ensure that comprehensive human rights, equalities, community impact, data protection and security assessments are carried out,” it said, adding these must all be made publicly available.
Quote for the day:
"Leadership is a matter of having people look at you and gain confidence, seeing how you react. If you're in control, they're in control." -- Tom Laundry
No comments:
Post a Comment