A CISO's Guide to Phishing and Malware

|

article image
Chief information security officers (CISOs) face a gauntlet of evolving challenges to secure their enterprises. From complex infrastructure with legacy hardware and software to a lack of resources and a changing threat environment, a CISO’s challenges are constant and ever present. Hackers need to find only one vulnerability to exploit; the defender must defend against all possible threats. Regulations and litigation are increasing the stakes for companies and their CISOs, with data breaches becoming costly and fireable offenses.

Spotlight

EUROPEAN DYNAMICS

EUROPEAN DYNAMICS is a leading Information Technologies service provider and software developer in the field of e-government, operating internationally as a group of companies, with offices and antennas in Athens, Berlin, Basel, Brussels, Copenhagen, London, Luxembourg, Nicosia, Stockholm, etc. The group designs, develops, supports and operates complex IT systems and commercialises a wide

OTHER ARTICLES

What Does It Take to Be a Cybersecurity Professional?

Article | August 30, 2021

While eating dinner at a Fourth of July cookout last weekend, my nephew described why he had so many career options as a pilot: There’s a shortage of pilots, and many existing pilots will be retiring soon. Other current pilots need to be retrained, because they fell behind in various ways during the pandemic. New people want to get into the field, but there are many hard requirements that can’t be faked, like flying hours, or unique experience on specific aircraft. There are many job openings and everyone is hiring. My response? Sounds a lot like our current cybersecurity career field. Professionals in cyber are seeing almost the exact same things. And yes, there are many, perhaps thousands, of articles on this topic saying different things. Everyone is focused on the shortages of cyber pros and the talent issues we currently face. But how hard is it to get into a cyber career for the long term? How can someone move into a fulfilling career that will last well beyond their current role? One reason I like the pilot training comparison is that becoming an excellent cyber pro takes time and commitment. If there are any “quick wins” (with minimal preparation or training) in cybersecurity careers, they probably won’t last very long — in the same way that flying large airplanes takes years of experience. After I got home that night, I saw this article from TechRepublic proclaiming “you don’t have to be a tech expert to become a cybersecurity pro.” Here’s an excerpt: “Ning Wang: I think that we’re in a pretty bad state. No matter which source you look at, there are a lot more job openings for cybersecurity than there are qualified people to fill it. And I have worked at other security companies before Offensive Security, and I know firsthand, it is really hard to hire those people. … “You may think that you have to have so much technology background to go into security. And again, I know firsthand that is not the case. What does it take to be a great cybersecurity professional? And I think from my observation and working with people and interacting with people, they need a creative mind, a curious mind, you have to be curious about things. … “And then even if you have all of that, there’s no shortcuts. If you look at all the great people in cybersecurity, just like all the other fields, that 10,000-hour rule applies here as well.” My response? I certainly agree that advanced degrees and formal certifications are not required (although they help). Still, the 10,000-hour rule and determination are must-haves to last in the long term. Here’s what I wrote for CSO Magazine a decade ago on the topic of “Are you a security professional?”: “Many experts and organizations define a security professional based upon whether or not they have a CISSP, CISM, Master’s Degree in Information Assurance or other credentials. Or, are you in an organization or business unit with 'security' in the title? While these characteristics certainly help, my definition is much broader than that. "Why? I have seen people come and go in the security area. For example: Adam Shostack started his career as a UNIX sysadmin. Likewise, you probably know people who started in security and left, or who still have a different job title but read blogs like this one because their job includes something less than 50% information security. (That is, they wear multiple hats). Others are assigned to a security function against their will or leave a security office despite their love for the field (when a too-tempting opportunity arises). Some come back, others never will.” WHY BECOME A CYBER PRO? This CompTIA article outlines some of the top jobs in cybersecurity, with average salaries: 1. Cybersecurity Analyst $95,000 2. Cybersecurity Consultant $91,000 3. Cyber Security Manager/Administrator $105,000 4. Software Developer/Engineer $110,140* 5. Systems Engineer $90,920 6. Network Engineer/Architect $83,510* 7. Vulnerability Analyst/Penetration Tester $103,000 8. Cyber Security Specialist/Technician $92,000 9. Incident Analyst/Responder $89,000 * Salaries marked with an asterisk (*) came from the U.S. Bureau of Labor Statistics. The article also walks through many of the steps regarding education, certifications and skills. Of course, there are many other great reasons to get into a cyber career beyond pay and benefits, including helping society, the fascinating changes that grow with new technology deployment, a huge need, the ability to work remotely (often), and the potential for a wide variety of relationships and global travel if desired. Becoming a CISO (or CSO) is another important role, with CISO salaries all over the map but averaging $173,740 according to Glassdoor. OTHER HELPFUL ARTICLES ON BECOMING A CYBER PRO Yes, I have written on this topic of cybersecurity careers many times over the past decade-plus. Here are a few of those articles: • “The case for taking a government cyber job: 7 recommendations to consider” • “Why Are Some Cybersecurity Professionals Not Finding Jobs?” • “Why You Should Consider a Career in Government Cyber Security” • “Play a Game - Get a Job: GCHQ’s New Tool to Recruit Cyber Talent” FINAL THOUGHTS Many people are now considering career changes as we come out of the COVID-19 pandemic. Cybersecurity is one of the hottest fields that has staying power for decades. At the same time, Bloomberg is reporting that U.S. job openings are at record levels. Also, Business Insider is offering a template to revamp your resume and get a remote job anywhere in the world. So even if the obstacles look daunting, a career in cybersecurity may be just the long-term change you are looking for. Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/what-does-it-take-to-be-a-cybersecurity-professional

Read More

The Coronavirus is Already Taking Effect on Cyber Security– This is How CISOs Should Prepare

Article | August 30, 2021

Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. The Coronavirus is hitting hard on the world’s economy, creating a high volume of uncertainty within organizations. Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. In light of these insights, Cynet has shared a few ways to best prepare for the Coronavirus derived threat landscape and provides a solution (learn more here) to protect employees that are working from home with their personal computers, because of the coronavirus. Cynet identifies two main trends – attacks that aim to steal remote user credentials, and weaponized email attacks:

Read More

Data Privacy Problem: Are Home Genealogy Kits a Security Threat?

Article | August 30, 2021

Surprising news recently emerged from the personal genetics business. The two leading direct-to-consumer companies in North America, 23andMe and Ancestry.com, announced within a week of each other that they were laying off a significant proportion of their workforce as a result of a steep drop in sales. This past Christmas, the sales of testing kits were expected to take a sharp hike — nothing says family like a gift that says prove it. But sales plummeted instead. According to Second Measure, a company that analyzes website sales, 23andMe’s business plummeted 54 per cent and Ancestry kits sales declined 38 per cent. Industry executives, market watchers and genealogists have all speculated about the causes of the drop in consumer interest. Market saturation? Early adopters tapped out? Limited usefulness? Recession fears? Whatever the theory, everyone seems to agree on one factor: privacy concerns.

Read More

How Is Covid-19 Creating Data Breaches?

Article | August 30, 2021

Trevor is working from home for the first time. He loves the freedom and flexibility, but doesn’t read his company’s new BYOD policy. Sadly, he misses the fact that his home PC is not protected with updated security software nor the latest operating system patches. Kelcie’s home PC is faster than the old work laptop that she’s been issued to use during the pandemic. She decides to use a USB stick to transfer large files back and forth between her PCs to speed things up. After a few days, she does all her work on her home PC, using a “safe” virtual desktop app. But unbeknownst to her, there is a keylogger on her home PC.

Read More

Spotlight

EUROPEAN DYNAMICS

EUROPEAN DYNAMICS is a leading Information Technologies service provider and software developer in the field of e-government, operating internationally as a group of companies, with offices and antennas in Athens, Berlin, Basel, Brussels, Copenhagen, London, Luxembourg, Nicosia, Stockholm, etc. The group designs, develops, supports and operates complex IT systems and commercialises a wide

Events