Centrify Predicts: Cybersecurity in 2018

As we start 2018, we have continued to see major breaches across industries, only last year we witnessed at least two companies — Uber and Equifax — opt to hold off on alerting the public to their respective cybersecurity breaches and make them public at a later, more convenient date. Whether a coincidence or a trend in the making, time will tell. What we do know is that these were among a handful of security “events” that will help shape the year to come. Here are our predictions for 2018. Organizations will respond to the current threat landscape with a…

What To Consider While Selecting a Single Endpoint Security Vendor?

Whenever I speak about IT security vendor consolidation, I am encountered by confusion-ridden looks from the business fraternity. Businesses are grappling with the challenge of selecting an appropriate security vendor(s) in such an ever-changing IT environment — zero-ing on single vendor’s capabilities does not appear to be the right approach! Information technology has come a long way, and the development has been paralleled with security considerations. For each IT capability there is a security layer to top it up with. Multiple vendors support is like multiple mini IT Security workshops, running 24×7, following their own innovative trouble shooting when a…

What is Adaptive Multi-factor Authentication (MFA)?

In 2016 over $80B have been spent on Security, yet 66% of companies were still breached and 81% of breaches involved compromised credentials in the form of either stolen or weak passwords. I covered in one of my previous blogs the cost of protecting yourself, which according to a study by Ponemon Institute in 2015, the mean annualized cost for 58 benchmarked organizations is $15 million per year. So, now that we understand how expensive it is to get hacked (which many of us probably knew along), I want to state the obvious: In today’s IT world, relying on simple…

Zero-Trust Model: Never Trust, Always Verify

“Never trust, always verify” is the lingo floating around in the security world. It succeeds the traditional belief of “trust, but verify,” which places a fair amount of trust in the people and devices accessing resources within a protected network. Surely, with massive data breaches happening regularly, we know that network perimeters are not as robust as we once thought. Attackers use weak or stolen credentials to gain access a network as a legitimate user. When an attacker has breached the network perimeter, we also know they are able to move laterally to more valuable assets and data that are…

How To Lower Cyber Insurance Premiums

According to Lloyd’s of London, a massive global cyberattack could result in economic losses as high as $53 billion. Given that, it’s no surprise that an increasing number of businesses are adding cybersecurity coverage to their liability insurance. But as businesses rush to insure, what exactly these policies cover, as well as the cost of premiums, is coming under scrutiny. A key question is whether or not non-malicious human activity is covered. On one hand, cybersecurity policies that do not cover human error —  which would include falling victim to sophisticated phishing schemes, visiting Trojan-infected sites, or even deferring patches…

Bad Rabbit Ransomware: Another Wake-Up Call For Organizations

Aside from the cool sounding name, the Bad Rabbit Ransomware has quickly become a problem across Russia and Eastern Europe. While not as many are being affected as with WannaCry or Petya, it is still causing headaches for hundreds of organizations. Ransomware is a particularly nasty type of cyber-attack that costs far more than the relatively minor payouts demanded. For example, as we have seen with WannaCry, certain organizations are particularly vulnerable to ransomware such as healthcare. Disruption of patient care, destruction of data and general disorder caused by a ransomware attack is felt particularly hard by targeted healthcare organizations….

Three Discussions CISOs Should Expect When Attending CyberConnect

I’m really excited to announce that CyberConnect 2017 is nearly sold out! And, I’m even more excited to attend the 30+ keynotes and panels, and collaborate with over 40 thought leader speakers during the event. In fact, collaboration is at the core of CyberConnect. Unlike traditional events, CyberConnect integrates thought leadership, collaborative roundtable sessions and in-depth training designed to arm executives and practitioners alike with the tools and confidence needed to defend their organizations against today’s hyper evolving adversary. So, with collaboration in mind, I’d like to share three topics that CISOs can expect to discuss at the conference. How…

Reevaluate Your Cybersecurity Spend in 2017

Without a doubt, the most frustrating fact I face every day is this: Companies spend a meager 4.7% of their total security budgets on identity and access management (IAM) – while compromised identities are responsible for 80 percent of all data breaches. Eighty percent. This glaring disconnect is almost more than I can wrap my head around. Here’s the math: According to Gartner’s “Forecast: Information Security, Worldwide, 2015-2021, 2Q17 Update,” in 2015, companies spent nearly $84 billion on security. Approximately 4.7 percent of that ($4 billion) went towards identity and access management. This year, the total security spend is projected to…

The Equifax Disaster: Technical Controls — ICIT’s Synopsis of America’s In-Credible Insecurity

The following excerpts are from the Technical Controls section of Part-1 of the ICIT Equifax report entitled “America’s In-Credible Insecurity,” written by James Scott, Sr. Fellow, Institute for Critical Infrastructure (ICIT). Technical Controls Data Encryption Data should be protected according to its value and the potential harm that would result if it were stolen. Encryption does not prevent adversaries or insiders from exfiltrating data; however, it does deter or prevent attackers from exploiting the stolen data unless they spend significant additional resources breaking the encryption or stealing the decryption keys. Data Loss Prevention Data loss prevention is the employment of…