Articles

 

  • Crowdsourced Security Testing

    Identifying exploitable vulnerabilities in enterprise environments is a difficult pursuit – one that CISOs and their security teams spend considerable time and effort trying to accomplish. An important resource that can be unleashed to drive progress in this area is the collective power of vetted and skilled security experts – sometimes referred to as ethical hackers or white hats – to identify problems before a malicious adversary can do so.

  • Roadmap to Zero Trust

    The first portable traffic monitors were introduced in 1936. Referred to as electronic eyes, these weatherproof road strips were laid across the pavement and connected to a battery-operated recorder. When your Hudson or Packard passed over the strip, the recorder would increment the car count by one. It also printed the results, along with the time, onto a roll of paper that lasted for about 24 days. The clock required winding every eight days. So cool.

  • CorpSec, Meet InfoSec. (And Vice Versa)

    I once had a neighbor whose dank little basement was finished entirely in particle board. I remember him bragging during a party that the low-density sheets of sawmill shavings were lifted from some poorly monitored warehouse at work. “No one ever goes in there,” he joked, “and these boards would have just been thrown out. So, I figured I’d put ‘em to good use.” Welcome to theft rationalization, New Jersey-style.

  • AI-Based Identity Analytics

    In the late 1970’s, there was no better computing lab than at Xerox. Yes, dear Millennials, I do mean that Xerox. Sadly, despite a great flagship product, a company name that became a verb, and stupendous research (they invented the mouse), Xerox gradually slid from #39 to #291 on the Fortune 500 list between 1978 and 2018. (By the way, it’s interesting that Google is also a single-product company with great research and a verbed name).

  • Embedded IoT Cyber Solutions: An Interview with Bill Diotte of Mocana

    Internet of Things. One can’t help but imagine the discussion where such an awkward moniker emerged as the winning entry: Internet of Devices? (Too specific). Internet of Systems? (Too general). Internet of Embedded Components? (No way). The logic of this progression led to the wildcard compromise: Things. And such a naming challenge is a useful hint that identifying security solutions for IoT is similarly difficult.

  • UK Flunks Huawei

    Regarding Chinese tech companies like Huawei, Americans are told the following: Trojans that have been expertly dissolved into the product code allow for remote control of networks by the Chinese Government. From our boardrooms in Midtown, to member offices on Capitol Hill, this narrative is rarely questioned. Even our diplomats repeat the warning: Ambassador Grenell recently told Berlin to steer clear of Huawei for 5G – or else.

  • Network Security as a Service

    Many TAG Cyber customers are wasting their money. And yes, I hear you laughing—but no, they are not wasting money on our services. Instead, they are wasting money doing technology tasks others could do better. Sometimes this involves running servers. Other times it involves coding apps. But it almost always involves trying to manage – and secure – data networks with insufficient staff, budget, and resources. We see this every day.

  • Active and Integrated Email Defense

    I just received a purchase order from Midwest Library Service for a textbook I wrote on intrusion detection many years ago. That old book focused on passive intrusion detection as a prompt for subsequent management action in a SOC. I’d hoped that detection of indicators would result in alarms that could then initiate rapid mitigation. Subsequent evolution of IDS included some things that I expected, but also many that I didn't. (Don’t tell Midwest).

  • Gary Hayslip Weighs in on the CISO’s Role in Helping the Enterprise Reach its Future-State Goals

    In recent years, as enterprise security has captured the interest and attention of the CEO and the Board of Directors, the role of the CISO has continued to evolve and become ever-more strategic. Case in point: More than 9 out of 10 (91%) of enterprise-wide digital transformation initiatives include security and/or privacy personnel as stakeholders, according to PwC’s 2018 Digital Trust Insights Report.

  • Seeing a Phish

    Let’s start with CNN – and no, not that CNN, but rather convolutional neural networks. This class of deep neural networks is the workhorse for computer vision, and is one of the underlying forces behind recent advances in artificial intelligence. Their design is inspired by the image processing done in the visual cortex of the animal brain. When you see one of those cat recognition demos by an AI system, a CNN is likely doing most of the work.

  • Why Cyber Teams Must Focus on Cybersecurity Basics

    Cyber threats are becoming more widespread and nefarious. 6.4 billion fake emails are being sent each day, according to EY. Meanwhile, 1.9 billion personal and sensitive data records have been compromised between January 2017 and March 2018 at an average cost of $3.62 million per organization.

  • Securing Your Workload Mesh

    Andrew Carnegie once said this: 'The way to become rich is to put all your eggs in one basket and then watch that basket.' While this quip from the industrialist might have been useful folksy advice for Grandma and Grandpa, it is terrible guidance for the modern computing and application system designer. A much better mental image in computer science today involves distribution – and the correct unit for scattered computation is the workload.

  • Security Conference Boothonomics

    With the RSA Conference at T-minus two weeks, I wanted to share some heartfelt advice with those of you now doing vendor booth planning. My advice comes from many years of standing on either side (seller and buyer) of that little porto-table with its stacks of data sheets and bowls of Hershey kisses. My hope is that this advice will help you to maximize the ROI for your little slice of exhibitor heaven in Booth 7002 of the South Expo.

  • Man, these passwords. We need AI.

    While waiting to go on-camera last week at Yahoo Finance, I was mulling about, chatting up the other guests outside the studio. A woman was seated nearby with her laptop, and when I introduced myself as a cyber security professional, she summarized her view of my life’s work in three words: Man, these passwords. And then, she offered a concise and entirely correct solution to the problem – also in just three words: We need AI.

  • VM Security from an Unexpected Source

    Much of what you learned in Operating Systems 101 is no longer applicable to modern computing – and virtualization lies at the root (ahem) of this change. The core principle is that physical host machines are now used to run multiple guest virtual machines (VMs) to optimize the use of memory, bandwidth, and CPU.