Articles

 

  • HMG Tech News Digest June 21

    Trending News on Zoom's CIO Focusing on the Cyber Threat Challenge, Facebook's New Cryptocurrency, 5G Smart Phones Posing Potential Health Hazard, and Saving the World Through AI

  • A Process for Testing Email Security

    Mimecast’s recent Email Security Risk Assessment (ESRA) is a great read on the topic of threats to email (not to mention including a nice infographic suitable for printing and framing). Let me provide here a brief summary of how the Mimecast team executes ESRA tests, which it has been doing for the past couple of years. Their fine process illustrates how source selection or review might be performed for any number of email security offers.

  • Book Review: Malware Data Science by Joshua Saxe with Hillary Sanders

    One perk of teaching is the free books. Lots of them. They usually come with a lovely letter suggesting that the new edition of The Grand Handbook of Cyber Security – and they all sound like that – would be just perfect for your graduate or undergraduate students. I usually hand these freebies, unopened, to the nearest student I can find. I’m not saying the books are always terrible, but I prefer to select books on my own, thank you.

  • Risk-Based Vulnerability Lifecycle - Prediction and Validation

    When an enterprise examines its cyber risk, an attack surface emerges. This is the set of entry points where vulnerabilities can be exploited by malicious actors. Viewing cyber risk in this way results in the strategic objective to reduce that attack surface, generally through discovery of vulnerabilities, combined with purposeful action designed to reduce the risk of exploits to such weak points. Prediction and validation are key activities in this regard.

  • Cyber Purple Teaming

    As someone whose eyes cannot distinguish properly between colors, I always shudder at the thought of mixing up red and blue teams during a cyber exercise. And now, with the advent of purple teaming in the enterprise, I surrender all hope that my cones can keep up. That said, I heartily endorse this new purple strategy of evaluating cyber control effectiveness to detect intrusions, bot activity, malware actions, lateral movement, and data exfiltration.

  • Crowdsourced Security Testing

    Identifying exploitable vulnerabilities in enterprise environments is a difficult pursuit – one that CISOs and their security teams spend considerable time and effort trying to accomplish. An important resource that can be unleashed to drive progress in this area is the collective power of vetted and skilled security experts – sometimes referred to as ethical hackers or white hats – to identify problems before a malicious adversary can do so.

  • Roadmap to Zero Trust

    The first portable traffic monitors were introduced in 1936. Referred to as electronic eyes, these weatherproof road strips were laid across the pavement and connected to a battery-operated recorder. When your Hudson or Packard passed over the strip, the recorder would increment the car count by one. It also printed the results, along with the time, onto a roll of paper that lasted for about 24 days. The clock required winding every eight days. So cool.

  • CorpSec, Meet InfoSec. (And Vice Versa)

    I once had a neighbor whose dank little basement was finished entirely in particle board. I remember him bragging during a party that the low-density sheets of sawmill shavings were lifted from some poorly monitored warehouse at work. “No one ever goes in there,” he joked, “and these boards would have just been thrown out. So, I figured I’d put ‘em to good use.” Welcome to theft rationalization, New Jersey-style.

  • AI-Based Identity Analytics

    In the late 1970’s, there was no better computing lab than at Xerox. Yes, dear Millennials, I do mean that Xerox. Sadly, despite a great flagship product, a company name that became a verb, and stupendous research (they invented the mouse), Xerox gradually slid from #39 to #291 on the Fortune 500 list between 1978 and 2018. (By the way, it’s interesting that Google is also a single-product company with great research and a verbed name).

  • Embedded IoT Cyber Solutions: An Interview with Bill Diotte of Mocana

    Internet of Things. One can’t help but imagine the discussion where such an awkward moniker emerged as the winning entry: Internet of Devices? (Too specific). Internet of Systems? (Too general). Internet of Embedded Components? (No way). The logic of this progression led to the wildcard compromise: Things. And such a naming challenge is a useful hint that identifying security solutions for IoT is similarly difficult.

  • UK Flunks Huawei

    Regarding Chinese tech companies like Huawei, Americans are told the following: Trojans that have been expertly dissolved into the product code allow for remote control of networks by the Chinese Government. From our boardrooms in Midtown, to member offices on Capitol Hill, this narrative is rarely questioned. Even our diplomats repeat the warning: Ambassador Grenell recently told Berlin to steer clear of Huawei for 5G – or else.

  • Network Security as a Service

    Many TAG Cyber customers are wasting their money. And yes, I hear you laughing—but no, they are not wasting money on our services. Instead, they are wasting money doing technology tasks others could do better. Sometimes this involves running servers. Other times it involves coding apps. But it almost always involves trying to manage – and secure – data networks with insufficient staff, budget, and resources. We see this every day.

  • Active and Integrated Email Defense

    I just received a purchase order from Midwest Library Service for a textbook I wrote on intrusion detection many years ago. That old book focused on passive intrusion detection as a prompt for subsequent management action in a SOC. I’d hoped that detection of indicators would result in alarms that could then initiate rapid mitigation. Subsequent evolution of IDS included some things that I expected, but also many that I didn't. (Don’t tell Midwest).

  • Gary Hayslip Weighs in on the CISO’s Role in Helping the Enterprise Reach its Future-State Goals

    In recent years, as enterprise security has captured the interest and attention of the CEO and the Board of Directors, the role of the CISO has continued to evolve and become ever-more strategic. Case in point: More than 9 out of 10 (91%) of enterprise-wide digital transformation initiatives include security and/or privacy personnel as stakeholders, according to PwC’s 2018 Digital Trust Insights Report.