SAVANTURE releases its 3Q SECURITY SAVANT NEWSLETTER offering great summary data for CISOs, CPOs, and Security Experts that can be leveraged as a tool with staff
PRLog - Nov. 3, 2013 - RESTON, Va. -- SAVANTURE, an industry leading information security and privacy services provider, announced that it has published its third quarter Security SAVANT NEWSLETTER which can be accessed at http://www.savanture.com/ and selecting “Newsletter.” The newsletter is intended to be a tool for security executives to keep up to date on trends, regulator and law changes, and best practices and a tool to educate peers, employees, and executives within their own organization.
SAVANTURE continues to work to improve its integrated, comprehensive level of information assurance and protection, fulfill most IT security oriented compliance requirements, and significantly reduce enterprise wide risk through its information sharing, industry participation and service offerings.
A high-level summary of the information in this issue of SAVANTURE's SECURITY SAVANT includes:
Exploring High Risk IT Security Threats, Top 5 threats we are tracking:
1. The Futility of Passwords
2. Advanced Persistent Threats
3. Ignorance of Privacy
4. Lack of Information Management
5. Inadequate Identity and Access Management
Advanced Persistent Threat (APT). A Primer. A Refresher.
Advanced Persistent Threat (APT) refers to a group, such as a government or an organization, with both the capability and the intent to persistently and effectively target a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information but applies equally to other threats such as that of traditional espionage or attack. APTs typically are achieved over a long period of time where patience leads to obfuscation of low impact activities.
There are several ways APT may penetrate a customer’s network to deploy an automated propagating malware through a wide variety of vectors, even in the presence of properly designed and maintained defense-in-depth strategies:
§ Internet-based malware infections such as drive-by download, phishing, and file sharing.
§ Physical malware infection through external device connections such as a USB
§ External exploitation such as vishing, rogue access points, or remote access through a trusted third-party
War of the World-Wide Internet (aka Worldwide Web War, World Wide Internet War, World Wide Cyber [World Wide C], Cyber War, Cyberwar)
Every conflict tagged as a “war” historically has been of the physical world. So why is the conflict over the Internet with nation-states attacking each other electronically not a war?
Many arguments can be made that few lives have been lost, no mass destruction has resulted, and so forth. Yet, we believe these catastrophic events are coming. Call it World War C (Cyber), World War I (Internet) or any other creation … the cyberwar is coming. Planes, trains, and ever increasingly automobiles, utilities, financial systems, and even our homes are all connected and subject to external influences via the Internet. Few in the industry would argue that within 2 years, life loss and physical damage will be caused due to a cyber-attack.
The Domain Name Service Achilles Heel Contributing Industry Expert and Strategy Consultant to SAVANTURE, Rick Rumbarger
Most people, even seasoned IT professionals, don’t give the Domain Name System (DNS) the attention it deserves. As TCP/IP has become the dominant networking protocols, so has the use of DNS. Most organizations use DNS to not only direct customers to their website, but to conduct almost every aspect of their day-to-day business operations. DNS is the hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network that converts complicated IPv4 & IPv6 device addresses into easy to understand names (e.g. mail.domain.com) that humans can use and understand. On private networks it is used to address even the most mundane things like printers and servers. To understand the risk to which your business is exposed, you must understand the security threats that exist. The most common security issues for DNS are:
Unauthorized Authoritative DNS Record Changes
Denial of Service Attacks
Recursive DNS Spoofing/Cache Poisoning
Security best practices for DNS:
Registrar Lock Your Domain Names
Outsource Your DNS Services
Utilize Strong Access Controls
Activate DNSSEC On Your Domain Names
Continuously Monitor Your Critical Services & DNS Records
Promote The Use of Protected Recursive DNS Servers
Protect Your DNS Service Against DDoS Attacks
The Role of Chief Information Security Officer
A generally accepted definition for the role of Chief Information Security Officer (CISO) is a senior level executive within a business or organization who is responsible for managing the risks and business impacts of IT security. The CISO is responsible for establishing and maintaining the enterprise vision, strategy and program to ensure information assets and technologies are adequately protected. The CISO directs staff in identifying, developing, implementing and maintaining security across the organization including people, processes and technology to reduce information and information technology (IT) risks. They respond to incidents, establish appropriate standards and controls, manage security technologies, and direct the establishment and implementation of policies and procedures. The CISO is also usually responsible for information technology security related regulatory compliance.
Significant Regulatory Changes, Americas
2013 HIPAA regulator changes due to willful neglect, instead of first attempting to resolve the matter through informal means. Penalties for HIPAA violations are significant. Penalties for violations caused by willful neglect, which are corrected, range from $10,000 to $50,000 per violation. The minimum penalty for an uncorrected HIPAA violation caused by willful neglect is $50,000 per violation. The penalties are capped at $1.5 million for all violations of an identical requirement in a calendar year.
Changes to Children’s Online Privacy Protection Act (COPPA)
Updates are to continue to strengthen the laws to protect children that go in effect in July 1, 2013.
GLOBALLY, 99 Countries with Privacy Laws. Read more.
Q&A
What security standard is the best to use as the foundation for my Security Plan?
You can access and download the full newsletter at http://www.savanture.com/landing-page/.
About SAVANTURE
SAVANTURE is an industry leading information security and privacy services provider with integrated, comprehensive solutions that provide customers with efficient, effective, and low cost information assurance and risk management. The company offers its premiere solution, Genesis5, which combines technology, processes, global intelligence and people to create an unsurpassed solution to organizations across multiple industries including small and medium sized business, enterprise, public sector, healthcare, financial services, retail, power and utilities, as well as private labeled offerings through service providers. SAVANTURE also offers its cloud and premise based platform services as stand-alone offerings, including Security Information and Event Management (SIEM), Log Management Service (LMS), Vulnerability Management Service (VMS), and Authentication Services.
For more information, please visit http://www.savanture.com/.
Read Full Story - Free Security Trends Report And Newsletter | More news from this source
Press release distribution by PRLog
Free Security Trends Report And Newsletter
November 03, 2013 at 20:10 PM EST
