Keep Up on Security News

It is good to keep up on the latest security news so that you can review what vulnerabilities are being created with new bugs.

Keeping up on the latest vulnerabilities allows you to keep the Risk analysis up to date (Risk = likelihood * impact). Because as new events happen, your risk profile changes.

We created Security News Analyzed page for this reason:

http://oversitesentry.com/security-news-reviewed/

 

We are looking for ways to make this methodology better and more efficient. So that one spends the least amount of time on reviewing the latest news as possible.

On the Security News Analyzed page we have collected 30 top security news websites which allow you to keep up on your technology in your company and homes.

 

We have redone this site many times, and are in the midst of redoing it again (keep an eye on it in the next couple of months:

Here are some older looks:

7/8/2016 discusses the vulnerability

 

At this point I was still reviewing many websites for inclusion  (06/2015)

Cybersecurity!! Or Else!

Mr. Business owner/manager if you do not take Cybersecurity seriously then it will bite you but how exactly?

 

Spend money on cybersecurity or you will eventually get attacked… I know that is hard to understand fully

As discussed before The Psychology of Security (Oversitesentry post from 8/22/14)

Believe it or not on a regular basis we tend to seek risks when there could be losses .  So what does that mean with regards to Cybersecurity?  Well, if you do nothing with Cybersecurity efforts on your computers and network devices then you are risking ransomware taking all of your data and thus testing your IT backup processes.   But knowing or not knowing  (maybe subconscious) we do not accept that we have to address a risk  such as ransomware. Even if ransomware could destroy our data. Part of the problem is that we are running our business and home life with certain levels of computing and every day things are working as we expect. So why should we spend more time with Cybersecurity concerns?

  1. the right thing to do – create a proper cybersecurity
  2. The more we disregard the threat and the potential impact could be higher

So this phenomenon becomes a vortex of

NOTHING to see here – keep moving

to

When attackers find weaknesses then the attack could put your small business out-of-business (if no backup tests were done and the right circumstances create the perfect storm).

Eventually this weird sense of not wanting to deal with cybersecurity because it increases risk will be your undoing.

So what does it really mean??   Cybersecurity or Else?

It means you can go out of business if you lose all your data and cannot recreate them in a reasonable amount of time or at all.

This has happened before:

The above is an old picture, but likely has not changed much if at all. We are unfortunately creatures of habit.

 

So these are your choices

Everyone makes an unconscious decision to spend some, more or no time on Cybersecurity for a variety of reasons.

What has to be done is to check your systems with testing and auditing process, such as with a CISA certified person. Like Us – Contact Us

 

So what is really happening is the CISA audit is a type of catastrophic insurance. If audits are done on a regular basis then the computer systems will not get to the point of catastrophe (losing all data with no recovery).

Maybe what is needed is to frame the debate of cybersecurity is to focus on the business aspects.

No cybersecurity attention? then $100k in costs or loss of business outright.

How to fix this? Management must be more cybersecurity savvy, and ask the right questions to the cybersecurity professionals.

 

More Security or More Business? is it Us vs Them?

When we say We need to be more secure in cyberland, does that mean small business needs to change what they do to be more secure?

ISACA says we need governance:

Governance and management for Enterprise business should use the COBIT 5 principles

  1. Principle 1: Meet stakeholder needs
  2. Principle 2: Covering the enterprise from end-to-end
  3. Principle 3: Applying  single integrated framework
  4. Principle 4: Enabling a holistic approach
  5. Principle 5: Separating governance from management

The COBIT framework ‘simplified’ means for the business to drive “cybersecurity”. I.e. if you need to sell widgets on the Internet you have to have cybersecurity on the Internet with credit card processing then that is what you have to say: ” We have to protect our systems to sell our products and stay in business”.

The conversation cannot start with ” I need security more than sales” because we know how that conversation ends. In fact the Cybersecurity person needs to say we facilitate sales, and make sure they are done safely. We take care of government compliance.

Besides  some good sound bites, the hard work of creating a truly secure organization is to set up a framework of weighing risks versus threats and impact.

A methodology must be used instead of just telling your IT department “keep us as secure as possible” ok?

What consistent methods do we need to operate to make Cybersecurity for companies work effectively for the stakeholder?

I listed the 5 principles of COBIT, and one of the most important piece of one of the principles is to assess risk (likelihood * impact) for each computer and IT device in your company.

An Audit has to be performed where all the pieces of the network and computer systems for the business needs are cataloged and rated for importance and weaknesses.

Once this inventory has been created a Risk analysis with expenditure of money has to be accumulated and reviewed with the stakeholders.

The process of reporting is also important, how to report and whom to report to.

Principle 5: separating governance from management has it’s reasons. The IT department must be overseen and directed by a governing body. If you want to discover these details get an audit from an ISACA Auditor and get on the path to become more secure within your business needs and requirements.

Contact us to audit your business

 

Who is Responsible For Cybersecurity?

I am talking about the reality that someone must be responsible so we can hold their feet to the fire. We don’t want to get to the point of too many directions of responsibility, as then when a breach does happen it is dangerous to see what will happen from there? So the CISA (Certified Information Systems Auditor) exam prep says that the Board of the company is responsible as they are the stakeholders. The board ultimately controls the purse strings, and hiring/firing of the CEO. But the problem with Cybersecurity is the changing nature of threats with increasing use of technology. Thus if the CEO changed some parameters unknown to the board, or if the board has not had time to digest then the CEO should be part responsible as well.

So if the CEO is part responsible because of changes that are occurring without the board’s knowledge…  or is it that the board should have contingency plans for unknown changes?

Let’s review what responsibility means?

Definition from Google:

The state or fact of having a duty to deal with something or of having control over someone.

The state of fact of being accountable for something

The opportunity or ability to act independently and make decisions without authorization

I want to restate this dictionary definition for cybersecurity specifically:

The ISACA Auditing standard will stay as the “Financially” responsible entity will stay in the board.

But I want to pick into who is responsible for Cybersecurity? Is it the person who misuses one of the definitions:

“The opportunity or ability to act independently and make decisions without authorization”

We all use computers (and mobile devices) independently, and in fact more devices are coming into our lives that will  create problems if we do not use them properly.

So even though the board is financially responsible, we are all responsible for using our devices with a certain amount of Cybersecurity intelligence.

The board has to set the stage with enough funding for firewalls, and audits and the like, but the users are responsible for using the devices without clicking on phishing emails or going to questionable websites that will cause problems even in the most secure environments.

Contact Us to create a security policy for the future.

Cyberjoke Friday Summer Edition v1.991

Library jokes in the summer:

What do you get when you cross an elephant with a computer?

A lot of memory.

Why did the computer sneeze?

It had a virus

What did the spider do inside the library computer?

It made a web page.

Or we have the ultimate ring fight:

Hmm always there isn’t it? Human error versus our best devices and efforts.

Pinterest has some good jokes sometimes…

Cybergeeks say that the weakest link is the human.

How about xkcd?  In the computing world, xdck is classic and great.

 

Be careful what you ask for. The Darknet is one such place

Guns available on the Darknet in the past

And don’t believe that anything on the Internet or Darknet is actually ‘anonymous’. If it sounds too good to be true, then it is.

 

And finally

It is always amazing to me that how little people update their computers and other devices – no matter the ultimate fix.

Contact me to discuss IT security…