Application Security Verification Standard

| April 26, 2016

article image
The primary aim of the OWASP Application Security Verification Standard (ASVS) is to normalize the range in the coverage and level of rigor available in the market when it comes to performing web application security verification

Spotlight

Genesys

Genesys is the market leader in omnichannel customer experience (CX) and contact center solutions in the cloud and on-premises. We help brands of all sizes make great CX great business. The Genesys Customer Experience Platform powers optimal customer journeys consistently across all touchpoints, channels and interactions to turn customers into brand advocates. Genesys is trusted by over 4,500 customers in 80 countries to orchestrate more than 100 million digital and voice interactions each day.

OTHER ARTICLES

Information Security Management System to Protect Information Confidentiality, Integrity, and Availability

Article | June 18, 2021

In this modern world of technology, ensuring information security is very important for the smooth running of any organization. Unfortunately, there are many information/cyber security threats, including malware, ransom ware, emotet, denial of service, man in the middle, phishing, SQL injection, and password attacks. Whatever your business is, no doubt, it can collapse your business and your dreams. However, the severity of its after-effects depends upon the type of business you do. As information security threat has become a hurdle for all organizations, companies must implement an effective information security management system. In 2019 alone, the total number of breaches was 1473. It is increasing every year as businesses are doing digital transformation widely. Phishing is the most damaging and widespread threat to businesses, accounting for 90% of organizations' breaches. This article lets you understand what ISMS is and how it can be effectively implemented in your organization. Information Security Management System (ISMS) According to ISO/IEC 27001, Information Security Management System (ISMS) refers to various procedures, policies, and guidelines to manage and protect organizations' information assets. In addition, the system also comprises various other associated resources and activities frameworks for information security management. Organizations are jointly responsible for maintaining information security. People responsible for security in an organization ensure that all employees diligently meet all policies, guidelines, and other objectives regarding protecting information. Also, they safeguard all assets of the organization from external cyber threats and attacks. The goal and objective of the system are to protect the confidentiality, integrity, and availability of assets from all threats and vulnerabilities. Effectively implementing an information security management system in your organization avoids the possibility of leaking personal, sensitive, and confidential data and getting exposed to harmful hands. The step-by-step implementation of ISMS includes the process of designing, implementing, managing, and maintaining it. Implementing ISMS in Organizations The standard for establishing and maintaining an information security management system in any organization is ISO 27001. However, as the standard has broad building blocks in designing and implementing ISMS, organizations can shape it according to their requirements. Effectively implementing ISMS in organizations in compliance with ISO 27001 lets you enjoy significant benefits. However, an in-depth implementation and training process has to be ensured to realize these benefits comprehensively. Therefore, let us look into how an information security management system can be successfully implemented in your organization. Identification The first step in implementing ISMS is identifying the assets vulnerable to security threats and determining their value to your organization. In this process, devices and various types of data are listed according to their relative importance. Assets can be divided across three dimensions: confidentiality, integrity, and availability. It will allow you to give a rating to your assets according to their sensitivity and importance to the company. Confidentiality is ensuring that the assets are accessed by authorized persons only. Integrity means ensuring that the data and information to be secured are complete, correct, and safeguarded thoroughly. Availability is ensuring that the protected information is available to the authorized persons when they require it. Policies and Procedures and Approval from the Management In this step, you will have to create policies and procedures based on the insights you got from the first step. It is said to be the riskiest step as it will enforce new behaviors in your organization. Rules and regulations will be set for all the employees in this step. Therefore, it becomes the riskiest step as people always resist accepting and following the changes. You also should get the management approval once the policies are written. Risk Assessment Risk assessment is an integral part of implementing an Information Security Management System. Risk assessment allows you to provide values to your assets and realize which asset needs utmost care. For example, a competitor, an insider, or a cybercriminal group may want to compromise your information and steal your information. With a simple brainstorming session, you can realize and identify various potential sources of risk and potential damage. A well-documented risk assessment plan and methodology will make the process error-free. Risk Treatment In this step, you will have to implement the risk assessment plan you defined in the previous step. It is a time-consuming process, especially for larger organizations. This process is to get a clear picture of both internal and external dangers that can happen to the information in your organization. The process of risk treatment also will help you to reduce the risks, which are not acceptable. Additionally, you may have to create a detailed report comprising all the steps you took during the risk assessment and treatment phase in this step. Training If you want effectively implement all the policies and procedures, providing training to employees is necessary. To make people perform as expected, educating your personnel about the necessity of implementing an information security management system is crucial. The most common reason for the failure of security management failure is the absence of this program. Implementing ISMS Once policies and procedures are written, and necessary training is provided to all employees, you can get into the actual process of implementing it in your organization. Then, as all the employees follow the new set of rules and regulations, you can start evaluating the system's effectiveness. Monitoring and Auditing Here you check whether the objectives set were being met or not. If not, you may take corrective and preventive actions. In addition, as part of auditing, you also ensure all employees are following what was being implemented in the information security management system. This is because people may likely follow wrong things without the awareness that they are doing something wrong. In that case, disciplinary actions have to be taken to prevent and correct it. Here you make sure and ensure all the controls are working as you expected. Management Review The final step in the process of implementing an information security management system is management review. In this step, you work with the senior management to understand your ISMS is achieving the goals. You also utilize this step to set future goals in terms of your security strategy. Once the implementation and review are completed successfully, the organization can apply for certification to ensure the best information security management practices. Summing UP Organizations benefit from implementing and certifying their information security management system. The organization has defined and implemented a management system by building awareness, training employees, applying the proper security measures, and executing a systematic approach to information security management. Thus implementation has the following benefits: Minimized risk of information loss. The increased trust of customers in the company as the company is ISO/IEC 27001 certified. Developed competencies and awareness about information security among all employees The organization meets various regulatory requirements. Frequently Asked questions What are the three principles of information security? Confidentiality, integrity, and availability (CIA) are the three main principles and objectives of information security. These are the fundamental principles and the heart of information security. How does information security management work? Information security management works on five pillars. The five pillars are assessment, detection, reaction, documentation, and prevention. Effective implementation of these pillars determines the success of the information security management in your company. What are the challenges in information security management? Challenges in information security management in your company can be the following: You can’t identify your most critical data Policies aren’t in place for protecting sensitive information. Employees aren’t trained in company policies. Technology isn’t implemented for your policies. You can’t limit vendor access to sensitive information.

Read More

As Ransomware Surge Continues, Where Next for Government?

Article | August 30, 2021

Global leaders want to carve out specific areas of critical infrastructure to be protected under international agreements from cyber-attacks. But where does that leave others? There are ‘four or five steps you could take that could significantly mitigate this risk,’ Falk said. These are patching, multifactor authentication and all the stuff in the Australian Signals Directorate's Essential Eight baseline mitigation strategies. …” Back in April of this year, a BBC News headline read, "The ransomware surge ruining lives." And that was before the cyber-attacks on critical infrastructure sectors like Colonial Pipeline, meat-processing giant JBS, the Irish Health Service and so many others. And when President Biden met with Russian President Putin last month in Geneva, he declared that certain critical infrastructure should be “off-limits” to cyber-attacks. “We agreed to task experts in both our countries to work on specific understandings about what is off-limits,” Biden said. “We’ll find out whether we have a cybersecurity arrangement that begins to bring some order.” As an initial positive step forward, this cyber defense policy makes sense. In fact, most global experts applaud these moves and efforts to better protect and clarify international crimes in cyberspace. Previous administrations going back to George W. Bush have taken aggressive steps to ensure critical infrastructure is protected in the U.S. and around the world through actions involving people, process and technology, both offline and online. The 16 critical infrastructure sectors identified by DHS/CISA can be found here. Still, many questions remain regarding this new policy: Will all global governments actually agree on the wording? More importantly, even if they do agree, how will the agreements be enforced? Also, what happens if some countries continue to allow criminals to attack these critical infrastructure sectors from their soil? And my main question goes further: Even if all of these agreements and actions are 100 percent agreed upon and enforced, which most people don’t believe will happen, does this imply that every organization not covered under these 16 critical infrastructure sectors can be openly attacked without a response? Is this giving into cyber criminals for everyone else? For example, would K-12 schools or small businesses be “fair game” and not off limits? Could this actually increase attacks for any organization not considered on the CISA list? No doubt, some will say that schools are a part of government, and yet there are private schools. In addition, if we do cover all others somehow, perhaps as a supplier of these 16 sectors, doesn’t that make the “off-limits” list essentially meaningless? Essentially, where is the line? Who is included, and what happens when some nation or criminal group crosses the line? These questions became more than an intellectual thought exercise recently when the Kaseya ransomware attack impacted more than 1,500 businesses, without, in their words, impacting critical infrastructure. CBS News reports, “Still, Kaseya says the cyber-attack it experienced over the July 4th weekend was never a threat and had no impact on critical infrastructure. The Russian-linked gang behind the ransomware had demanded $70 million to end the attack, but CNBC reported that the hackers reduced their demands to $50 million in private conversations. "The Miami-based company said Tuesday that it was alerted on July 2 to a potential attack by internal and external sources. It immediately shut down access to the software in question. The incident impacted about 50 Kaseya customers.” OTHER RECENT RANSOMWARE NEWS Meanwhile, in a bit of a surprise, ransomware group REvil disappeared from the Internet this past week, when its website became inaccessible. As Engadget reported, “According to CNBC, Reuters and The Washington Post, the websites operated by the group REvil went down in the early hours of Tuesday. Dmitri Alperovitch, former chief technology officer of the cyber firm CrowdStrike, told The Post that the group's blog in the dark web is still reachable. However, its critical sites victims use to negotiate with the group and to receive decryption tools if they pay up are no longer available. Visitors to those websites now see a message that says ‘A server with the specified host name could not be found.’" CNBC reported: “There are 3 main possibilities for the criminal gang’s disappearance — each of which carries good and bad news for U.S. efforts to combat the ransomware scourge emanating from Russia. The Kremlin bent under U.S. pressure and forced REvil to close up shop. U.S. officials tired of waiting for Kremlin cooperation and launched a cyber operation that took REvil offline. REvil’s operators were feeling the heat and decided to lay low for a while. "This situation may send a message to some of the players that they need to find a less-aggressive business model, which could mean avoiding critical infrastructure, or it could mean avoiding U.S. targets.” Also, the Biden administration announced several other measures to combat ransomware: “The Biden administration will offer rewards up to $10 million for information leading to the identification of foreign state-sanctioned malicious cyber activity against critical U.S. infrastructure — including ransomware attacks — and the White House has launched a task force to coordinate efforts to stem the ransomware scourge. "It is also launching the website stopransomware.gov to offer the public resources for countering the threat and building more resilience into networks, a senior administration official told reporters.” And yet, many experts are still predicting that ransomware will continue to grow in the near future. For example, TechHQ wrote that “identifying the culprits often isn't as big an obstacle as apprehending them.” To show recent growth of ransomware attacks, Fox Business offered details on a Check Point report this past week that “ransomware attacks surge, growing 93 percent each week.” Also: “'The ransomware business is booming. We’re seeing global surges in ransomware across every major geography, especially in the last two months,' said Lotem Finkelstein, head of threat intelligence at Check Point Software. 'We believe the trend is driven by scores of new entrants into the ransomware business.'" For more background on this hot topic, a few weeks back I appeared on MiTech News to discuss the ransomware crisis. FINAL THOUGHTS I’d like to close with this article which offers a slightly different perspective on ransomware from ZDNet Australia: “The threat of ransomware dominates the cyber news right now, and rightly so. But this week Rachael Falk, chief executive officer of Australia's Cyber Security Cooperative Research Centre, made a very good point. Ransomware is ‘Totally foreseeable and preventable because it's a known problem," Falk told a panel discussion at the Australian Strategy Policy Institute (ASPI) on Tuesday. ‘"It's known that ransomware is out there. And it's known that, invariably, the cyber criminals get into organisations through stealing credentials that they get on the dark web [or a user] clicking on a link and a vulnerability," she said. ‘We're not talking about some sort of nation-state really funky sort of zero day that's happening. This is going on the world over, so it's entirely foreseeable.’" Article Orginal Source: https://www.govtech.com/blogs/lohrmann-on-cybersecurity/as-ransomware-surge-continues-where-next-for-government

Read More

A COVID-19 Cybersecurity Poll: Securing a Remote Workforce

Article | March 17, 2020

As the coronavirus pandemic continues to sweep the globe, and cities and states impose social-distancing measures, businesses are sending their users home to work. And this massive, unprecedented shift to distance working brings with it a whole new set of cybersecurity challenges. For instance, a lack of IT resources can bite many organizations as they move to enable remote strategies. And when workers and students are sent outside the normal perimeter, managing device sprawl, and patching and securing hundreds of thousands of endpoints, becomes a much a bigger challenge. Threatpost editors wanted to learn more about challenges and best practices from the IT and security professionals on the front lines of this. Please take a few minutes to take the Threatpost poll. The answers will be collected the results will be published in an article later this week.

Read More

How the IIoT can subdue cyber security challenges met by software adoption

Article | February 25, 2020

Matt Newton, senior portfolio marketing manager at AVEVA, discusses how IIoT can best cyber security challenges met through software adoption. According to Gartner’s 2019 Industrial IoT Platforms Magic Quadrant report, by 2023 30% of industrial enterprises will have full, on-premises deployments of IIoT platforms. IIoT platforms and software adoption is rapidly increasing – up 15% in 2019 – and this will undoubtedly continue to grow as we progress through the new decade. From enhancing operational performance to improved business processes, adopting new technology and software capabilities is vital for business success in today’s industrial sector. However, when it comes to adopting software and technology, integrating new systems with existing legacy systems in the industry can be a challenge.

Read More

Spotlight

Genesys

Genesys is the market leader in omnichannel customer experience (CX) and contact center solutions in the cloud and on-premises. We help brands of all sizes make great CX great business. The Genesys Customer Experience Platform powers optimal customer journeys consistently across all touchpoints, channels and interactions to turn customers into brand advocates. Genesys is trusted by over 4,500 customers in 80 countries to orchestrate more than 100 million digital and voice interactions each day.

Events