Gmail Phishing Attack Reinforces that 2FA is the Cyber-Safety Belt We All Need

It is time to shift from a single password to multi-factor authentication A new phishing scam designed to steal login credentials from Gmail customers is making headlines this week. And once again, we are reminded of the danger of relying on passwords as the only means of securing access to systems, apps or data. The Gmail phishing attack has four key components: An email comes from someone you know who has already been victimized by this attack The subject is an actual one that the sender has previously used, along with an actual attachment that may have a familiar title…

Time to Take Cybersecurity Seriously

The recent Institute for Critical Infrastructure Technology (ICIT) White Paper titled “Cybersecurity Show Must Go On: Surpassing Security Theatre and Compliance and Minimal Compliance Regulations,” authored by James Scott, Sr. Fellow, ICIT, and Drew Spaniel, Researcher, ICIT, highlights organizations’ lack of commitment to invest in strong security tools that have real impact to their organization’s security position. Despite the cyber breaches over the last several years that confirm that identities are the root of most breaches, organizations fail to deal with the real problem head on. Organizations leverage technology to increase the productivity of associates that expand the perimeter to…

Will “Security Fatigue” Inevitably Overwhelm Your Organization?

“Security fatigue” is a growing concept within cybersecurity circles: experts report that the sustained threat of malicious attacks is causing end users to feel defenseless and hopeless. There’s a growing frustration about online account security, as the mounting frequency and severity of attacks is creating a bunker mentality that is difficult to escape. In many cases, organizations and employees are taking the fatalistic attitude of hoping they’re not a high enough value target to attack, rather than acting definitively to bolster their defenses. What can you do to keep security fatigue from stunting your security posture? Here are three key…

Solving DHS Continuous Diagnostics and Mitigation (CDM) Phase 2

The Department of Homeland Security (DHS) established a $6B blanket purchase agreement (BPA) to improve the cyber defenses for federal, state, local, tribal and territorial governments. The DHS Continuous Diagnostics and Mitigation (CDM) program helps protect government IT networks from cyberthreats and enhances risk-based decision making by providing a consistent and proven set of solutions. Centrify is the selected solution for CDM Phase 2 CRED that ensures all federal agency associates only have access to servers, applications or network resources based on their unique identity, role and responsibility within their organization. Centrify Server Suite offers a robust Active Directory bridge…

The Great Gig in the Sky: Secure Hybrid Cloud

Every day I hear from companies concerned and frustrated over a specific challenge — how to stand up workloads in the cloud while maintaining privileged access security (PAS). Infrastructure-as-a-Service (IaaS) has become the great equalizer. It doesn’t matter whether you’re large or small, in finance, healthcare or government — we all share the same worries when it comes to securing access to, and in, the cloud. I was pondering this the other day while sipping a short, dry cappuccino and listening to Pink Floyd’s Dark Side of the Moon. I had an epiphany. Thanks to Roger Waters & Co, I walked away with…

Top Three New Year’s Security Resolutions

When it comes to setting New Year’s resolutions, most people shoot for the moon. We tell ourselves we will give up carbs, go running every morning, become a vegan or even give up drinking alcohol. Inevitability, three weeks later, we find ourselves right back where we started. As security professionals, responsible for keeping the bad guys out and reducing the risk of data breaches, we find ourselves right back where we started too — we fundamentally do not really improve our security posture, and then wonder why not. We are very similar to our consumer counterparts, because we set lofty…

Single-factor Authentication (SFA) vs. Multi-factor Authentication (MFA)

This blog will discuss the what single-factor authentication (SFA), two-factor authentication (2FA) and multi-factor authentication (MFA) are, and why more than one factor of authentication is vital to security. What is Single-factor Authentication (SFA)? Single-factor authentication is the simplest form of authentication methods. With SFA, a person matches one credential to verify himself or herself online. The most popular example of this would be a password (credential) to a username. Most verification today uses this type of authentication method. What is Two-factor Authentication (2FA)? Two-factor authentication uses the same password/username combination, but with the addition of being asked to verify who a person is by using…

Why Organizations Need Adaptive Multi-factor Authentication (MFA)

We hear about high profile security breaches frequently. Most of these breaches exploit the system login credentials of end users to get into the company’s network. Leading organizations are recognizing this and are beginning to focus on better securing end user identities. Multi-factor authentication (MFA) is becoming a very popular method for doing this as MFA requires a user to provide more than just a password to access the network. These additional factors of authentication require the user to provide something that only the user knows, has and is. As a best practice, when implementing MFA, it should be setup across…

3 Ways to Ensure You Are Not the Next Company Breached

There is a superstition that bad things happen in “threes.” This month, we mourned the loss of three national icons — Astronaut, John Glenn, Actor, Alan Thicke and TNT Sideline Reporter, Craig Sager. Similarly, this week, I received an email from Yahoo! announcing they had been breached again — affecting over 1B users — including me. On Friday, I received another notification from Bleacher Report, informing me that their users had been compromised. Do you see where this is going?… STOP! Is this Superstition True? The short answer is No. Are superstitions true? Most rational people would agree that they…

How Much Does It Cost to Protect an Organization from Cybercrime?

$15 million per year is the mean annualized cost if you don’t protect yourself, based on 58 benchmarked organizations according to a study by Ponemon Institute in 2015. 2014’s mean cost per benchmarked organization was $12.7 million. Thus, we observe a $2.7 million (19 percent) increase in mean value. The net increase over six years in the cost of cyber crime is 82 percent. Figure one shows an average annualized cost per sector (1 Million omitted) The same study concluded that the cost breakdown for: Internal activities is 31% for detection, 24% for recovery, 15% for investigation, 13% for containment, 9%…