Cloud-enabled threats are on the rise, sensitive data is moving between cloud apps
“We are seeing increasingly complex threat techniques being used across cloud applications, spanning from cloud phishing and malware delivery, to cloud command and control and ultimately cloud data exfiltration,” said Ray Canzanese, Threat Research Director at Netskope. “Our research shows the sophistication and scale of the cloud enabled kill chain increasing, requiring security defenses that understand thousands of cloud apps to keep pace with attackers and block cloud threats. For these reasons, any enterprise using the cloud needs to modernize and extend their security architectures.” 89% of enterprise users are in the cloud, actively using at least one cloud app every day. Cloud storage, collaboration, and webmail apps are among the most popular in use. Enterprises also use a variety of apps in those categories – 142 on average – indicating that while enterprises may officially sanction a handful of apps, users tend to gravitate toward a much wider set in their day-to-day activities. Overall, the average enterprise uses over 2,400 distinct cloud services and apps.
Move beyond digital transformation — and improve your ROI
How do you achieve value across an entire digital enterprise and make sure all investments give you that coveted, but sometimes elusive, ROI? You need to do more than transform. You need to transcend traditional approaches to growth and change. As part of PwC’s 2020 Global Digital IQ research, we studied thousands of companies and their digital behaviors. We found that just 5 percent are getting moderate or significant payback from their digital efforts in all areas measured: growth, profits, innovation, customer experience, brand lift, attracting and retaining talent, disrupting their own industry, using data to improve decisions, cutting costs, and combating new industry entrants. This elite group of companies — what we call Transcenders —achieve real payback across their enterprises. They embrace innovation, and they don’t fear change. If this were high school, they’d reign as prom queen, star quarterback, and valedictorian all rolled into one. What does it take to transcend? Four core differentiators deliver consistent, standout performance. And they’re elements many leaders talk about but don’t always act on or get full value from.
It's easy to see a digital transformation business strategy as a fun-filled ride into the future and envision the onslaught of high-fives when new technology (and the associated technology leader) have repositioned the company for change, growth and becoming a digital business. Reading the marketing pitch on digital transformation, it's easy to assume that you buy the right technology and perhaps some services, and after a few months, you arrive in the land of rainbows and unicorns. What's often left out of these stories are two salient facts. First, technology by itself has rarely transformed a business. Kodak invented many of the core technologies for digital photography, but chose to shelve them for a variety of reasons, not the least of which was a concern about cannibalizing its core business. The DVD was a widely available technology, but using it to create a novel business model of sending movies by mail helped Netflix-- with its super-easy customer experience--overtake video giant Blockbuster, who clung to its store-based ways.
Home Affairs pushes back against encryption law proposals
The Independent National Security Legislation Monitor (INSLM), Dr James Renwick, went further during public hearings in Canberra this week. Not only did he propose tougher independent oversight of TOLA actions, he repeatedly expressed his concern that the Attorney and the Minister didn't constitute an independent "double lock" for authorising TCNs. Such a double lock is required in the UK, where the equivalent to a TCN must be approved by both the Secretary of State for Home Affairs and the independent Investigatory Powers Commissioner's Office (IPCO). "Leaving aside the personalities and the people who might fill those offices from time to time, nevertheless the Attorney and the Minister for Communications are both members of the same government and the same cabinet," Renwick said on Friday. "There's at least some administrative law which suggests that in those circumstances, they might both be bound by a cabinet decision." Hamish Hansford, DHA's Acting Deputy Secretary for Policy, rejected that view. "Notwithstanding both an Attorney and Minister for Communications are members of a cabinet, they are also independent decision-makers under statute, and they need to exercise those responsibilities independently, if you like," he said.
Looking at the future of identity access management (IAM)
MFA is already popular among some enterprise technologies and consumer applications handling sensitive, personal data (e.g., financial, healthcare), and will continue to transform authentication attempts. A lot has been said about increased password complexities, but human error is still persistent. The addition of MFA immediately adds further security to authentication attempts by having the user enter a temporarily valid pin code or verify their identity by other methods. An area to watch within MFA is the delivery method. For example, SMS notifications were the first stand-out but forced some organizations to weigh added costs that messaging might bring on their mobile phone plans. SMS remains prevalent, but all things adapt, and hackers’ increased ability to hijack these messages have made their delivery less secure. Universal one-time password (OTP) clients, such as Google Authenticator, have both increased security and made the adoption of MFA policies much easier through time-sensitive pin codes. Universal OTPs also do away with the requirement for every unique resource to support its own MFA method.
Forget the Internet of Things. Here’s what IoT really stands for
Intelligence of things looks less like the restroom in Ethiopia, and more like Hartsfield-Jackson Atlanta International Airport, where the world’s largest toilet maker, Toto, has taken things a step further. There, too, the bathrooms are studded with sensors, from the urinals to the faucets. But they don’t just flush automatically, they all report back to central cloud database. The volume of data is astounding – a single toilet may flush 5,000 times per day. In aggregate, the airport can use this data to predict “rush hour” for the airport bathrooms, and deploy custodians before and after to make sure the toilets are clean, the paper towels are stocked, and everything’s running smoothly. “The last decade was about connectivity, and we describe that dynamic with the Internet of Things,” Steve Koenig, vice president of research at the Consumer Technology Association, told Digital Trends. “This decade is really about adding intelligence to different devices, services, etc. We’re confronted with a new IoT: The intelligence of things.” ... “Without intelligence, there is no value,” Kiva Allgood, head of IoT and automotive at Ericsson, told Digital Trends.
How healthcare CIOs can keep their organisations secure
For healthcare environments, ransomware poses one of the scariest types of threats in the entire cyber security arena. Physicians-in-training get a taste of the potential reality during routine training exercises at Maricopa Medical Center. As trainees attempt to use diagnostic equipment, like CT scanners, in resuscitating “patient” dummies, they’re greeted with ransomware lockout messages onscreen demanding Bitcoin payments before the equipment can be used again. They must use their intuition to treat the patient instead of the correct equipment. The price for this can be (again, this is a dummy patient) serious brain damage. The Internet of Things (IoT) unlocks huge potential for organisations, including healthcare entities. But this dependence on internet-connected infrastructure also poses a risk. Avoiding ransomware attacks in healthcare requires a multifaceted approach ... The Health Insurance Portability and Accountability Act (HIPAA) was an important step forward for healthcare security and organisations as well as patients.
Cybersecurity: Hacking victims are uncovering cyberattacks faster
"The buzz around the topic leading up to the GDPR deadline helped to get it in front of senior execs outside of the IT team. Many of them saw the importance of GDPR compliance and they supported measures to improve defences and breach identification," Grout said. While the legislation only applies to the European Union, the impact is also felt by global organisations that do business or transfer data in Europe. That appears to have had an impact on the median dwell time across the globe, which is down from 78 days to 56 days. However, one in ten FireEye investigations still involve organisations that had cyber attackers intruding on the network for over two years, indicating that cyber criminals -- and in some cases, nation-state backed hacking operations -- can still remain very stealthy when compromising networks. "Some of them are being targeted by highly skilled APT [Advanced Persistent Threat] groups that are able to hide themselves for a long time after the initial breach," said Grout. One of the most common weaknesses exploited by attackers -- as identified in the report -- is the failure to enforce multi-factor authentication (MFA) on the enterprise network. A lack of MFA means that cyber criminals who successfully breach or steal passwords can easily gain access to networks.
AI’s bias problem: Why Humanity Must be Returned to AI
If an AI system is built in a contrived laboratory environment with data that isn’t representative of the target audience, or worse, patterns in the data reflect prejudice, the AI’s decisions will also be prejudiced. It is incredibly difficult for algorithms to ‘unlearn’ these patterns, so it is important that biases are not built into the algorithm from the first phases of implementation. Origins of bias can be nuanced and hard to spot, ranging from historic impartialities based on race and gender, to a lack of diversity within training sets. As a consequence, certain groups are disproportionately represented. A study by the National Institute of Standards and Technology (NIST) found that facial recognition misidentified African-American and Asian faces ten to 100 times more than Caucasians, while Native Americans were misidentified more than any other group. The study also revealed that women were falsely identified over men, and senior citizens had more than 10 times the issues faced by middle-aged adults. According to a report by AI Now Institute at New York University, the lack of diverse training data also threatens to worsen the historic underemployment of disabled people.
Achieving SOC 2 Compliance in DevOps
If you are wondering whether AWS complies with SOC 2 at this point, you are not alone. AWS as a cloud environment is designed to comply with SOC 2 requirements; at the very least, the ecosystem offers tools that make compliance easy. SOC 2 compliance is something that AWS takes seriously. In fact, AWS keeps the location of data centers confidential to ensure maximum security. It also offers high resilience with multiple redundancies and automated disaster recovery measures. Through AWS Artifact, you can gain access to all SOC reports, including SOC 2 Security, Availability, and Confidentiality Reports generated by AWS. All controls are provided and you have the complete services in scope list for maximum compliance. AWS has an extensive set of tools for maintaining controls and ensuring compliance. Amazon CloudWatch is a good example of a comprehensive monitoring tool that you can use across the AWS ecosystem. The same is true for AWS CloudTrail and Amazon GuardDuty. You also have AWS Shield offering security measures that are ready to deploy.
Quote for the day:
"The problem with being a leader is that you're never sure if you're being followed or chased." -- Claire A. Murray
No comments:
Post a Comment