Home > Resources > Articles > IoT Security Best Practices to Confront Security Challenges

IoT Security Best Practices to Confront Security Challenges

Bineesh Mathew | April 13, 2022 | 256 views

IoT Security
The demand for IoT devices is increasing. According to Statista, the estimated global IoT spending will be $1.1 trillion approximately. So, it is evident that there will be a surge in IoT devices in businesses. However, the fact is that these devices come with a lot of IoT security issues that affect the overall business process.

Some of the security challenges of IoT are:

  • Insecure interfaces
  • IoT malware and ransomware
  • Gap in IoT skills
  • Insufficient testing and updating
  • Brute-forcing and the issue of default passwords
  • Highjacking IoT devices
  • Home Invasions

Indeed, the dangers of IoT security are here to stay. However, you can take steps to protect your users from these threats by using best practices on your IoT device.

  • Compared to 15.8 billion in 2021, the size of the IoT security market is projected to grow to 18.6 billion in 2022.
  • The market is predicted to nearly double in size by 2025, making it a smart bet to invest in IoT security now.


IoT Security Challenges for New Age Businesses

The Internet of Things has introduced new ways to interact with the internet. IoT is no longer restricted to personal use, machines use it too, with the help of human help or by following the directions.

The internet allows devices to communicate with one another. A thermostat, for example, receives information about the room temperature and adjusts it accordingly. Likewise, lights switch on and off automatically, and sensors denote the time of day and the amount of light outside. All of this is accomplished through constant internet communication.

People are excited about IoT, which is why they’re willing to use it even before it is ready and before the devices comply with the safety regulations.

IoT technology is still in its early stages. Therefore, makers and consumers must overcome numerous IoT security obstacles. These obstacles are primarily caused by:

  • Inadequate user knowledge
  • Inconsistent production standards
  • Inadequate upkeep and upgrades

IoT security concerns and vulnerabilities can be presented in broad categories. Some of the most significant IoT security challenges are:

  • Hijacking of IoT devices and ransomware
  • Insufficient testing and lack of updates
  • IoT-driven financial crime
  • Rogue and counterfeit IoT devices
  • Lack of user awareness regarding the Internet of Things security


IoT Security Solutions for New Age Businesses


Update your IoT Devices Regularly

Automatic updates must be in place to check for official updates by the device maker. This installs security patches on your device(s), preventing hackers from infiltrating them in novel ways.

There are two ways to regularly update IoT devices for businesses regularly.

  • Physical Update
This is the traditional way of physically accessing the system or device and updating it. This can be as simple as connecting the IoT device to a computer and updating it.

  • Remote/OTA (Over-The-Air) Update
Numerous devices make it difficult to update every device through a physical update. OTA updates are used to update IoT devices remotely. Again, wireless communication mediums can carry this out with reduced human assistance.

Change your Passwords Regularly and Make them Strong

Changing passwords on various accounts, laptops, and mobile devices frequently has been the norm for a long time now. However, while changing passwords is a standard practice, IoT users often ignore it.

Changing the passwords on a regular basis reduces the likelihood of getting hacked. There is a chance that the manufacturers have the same password for all the IoT devices they produce. So, it is advised to change password as soon as it is installed. Strong passwords improve the security of IoT devices.

Use IoT Data Encryption to Prevent Data Breaches

If you're serious about safeguarding users' privacy and preventing data breaches, you must encrypt data between IoT devices at rest and in transit. This is a critical step in protecting users, whether you use symmetric or asymmetric keys.

There are many essential elements to implementing data encryption, such as:

  • Collaborative strategy
  • Data classification
  • Protect decryption keys
  • Control and limit access
  • Use of SSL decryption technology


Test and Update the IoT Hardware Regularly

To ensure IoT hardware security, set up a robust testing infrastructure. This includes thoroughly testing the IoT device's range, capacity, and latency. In addition, chip manufacturers for IoT devices must strengthen processors for increased IoT security and lower power consumption without making them too expensive for users or too impractical to use in current IoT devices. Many IoT devices available on the market today are indeed cheap and disposable, but they have very little power.

In addition, IoT device manufacturers must make sure that any third-party parts and modules they use in their IoT devices work correctly with their IoT applications.


Avoid Rush Launch of IoT Devices

Manufacturers of IoT devices are frequently rushing to introduce their products to the market at the lowest prices to stay ahead of the competition. Most manufacturers don't pay enough attention to IoT security updates and patches. Unfortunately, in the long run, this poses a severe threat to the security of their IoT devices. So, IoT device manufacturers should not release their products until they have thought about keeping their devices and apps safe in the long run.

The future IoT Security

Industry experts are researching the security problems associated with the Internet of Things. This aproach is expected to bring more possibilities of IoT devices in businesses, solving many security issues.

By 2023, more and more businesses will see the scope of the IoT, with business investment accounting for more than half of all IoT spending. This means that manufacturers will need to double down on their IoT security efforts to meet corporate expectations.

Ordinary users will also have to learn about and stay updated on IoT security changes and their significance.

This, like other advancements, begins with concerted efforts at a higher level. Among other things, the U.S. Congress sponsored a cybersecurity bill in March 2019. This bill would ensure that IoT devices bought by the government have at least basic security features.

Summing Up

On a meticulous evaluation, one can say that the bigger the IoT world gets, the more critical it becomes to prioritize IoT data privacy and security.

Unfortunately, cyber-attacks and rogue devices are here to stay, and with time, they will get smarter. Therefore, you have to keep up-to-date on the latest attacks and ensure that you continue to focus on opting for the most acceptable security and privacy features possible. This protects you from data breaches and increases customer confidence and trust in your product.


Frequently Asked Questions


Why is IoT security a necessity for businesses?

For IoT gadgets to function properly, they require secure hardware, software, and internet connectivity. Unfortunately, any connected equipment can be hacked if IoT security is not in place. Once they gain control, hackers can take control over the object's functioning and steal the user's digital data.

What are some of the security issues in IoT?

A lot of security issues include not having access control, overly large attack surface, outdated software, lack of encryption, application vulnerabilities, lack of trusted execution environment, vendor security posture, and insufficient privacy protection.

Are IoT devices safe?

While most IT systems can patch security problems through frequent updates, most IoT devices cannot. Security flaws remain unnoticed and unattended for an indefinite period. IoT devices that have an exceptionally extended shelf life will stop working if the manufacturer stops supporting them.

Spotlight

DXC Technology

Welcome to the official DXC Technology LinkedIn page. Connect with us to engage and network with industry leaders and get the latest trends in IT innovation and solutions. DXC is the world’s leading independent, end-to-end IT services company, helping clients harness the power of innovation to thrive on change. Created by the merger of CSC and the Enterprise Services business of Hewlett Packard Enterprise, DXC Technology is a $25 billion company with a 60-year legacy of delivering results for thousands of clients in more than 70 countries.

OTHER ARTICLES
ENTERPRISE SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY

The Great CISO Resignation

Article | May 10, 2023

CISOs Are Leaving in Droves The Great Resignation has been front-page news since Covid lockdowns, with many employees looking for the work-life balance they enjoyed at the time. Now, the phenomenon has spread to the role of Chief Information Security Officer (CISO) and shows no signs of letting up. In fact, industry experts predict that it is likely to worsen. A recent study from cybersecurity company BlackFog found that 32% of CISOs in the U.K. and U.S. have considered leaving and many planned to do so in just six months. The majority noted that the top reason for leaving was a lack of work-life balance. The CISO role is demanding, with firefighting and frequent changes in regulations and customer expectations taking up significant time both on and off the job. In another recent study in which 581 CISOs were surveyed, the IANS Research and Artico Search explored CISO compensation and job satisfaction. Three-fourths of CISOs are satisfied with their job, which is 7% higher than in the 2021 sample and more than double that of the 2020 sample. The main drivers of satisfaction are compensation, budget, executive visibility, and organizational support. However, despite high satisfaction numbers, the study found that as many as 44% of respondents are considering a job change. CISO Challenges LIABILITY AND EXPOSURE OF THE CISO There is a perception that CISOs face heightened liability for cyber intrusions and the response to cyber events. One extraordinary example is the recent conviction of Uber’s former security officer, which represents the first time a security executive has faced federal crime prosecution over a data security response. In this case the finding was that he obstructed justice by concealing information about a breach, destroying data, and covering up the incident. CISOs are often in the hot seat when it comes to cyber-intrusions and how they are handled. The Board of Directors (possibly including named corporate officers) in most cases are protected by being diligent about the Business Judgement Rule (BJR). Heavily adopted in Delaware case law and since adopted in various forms in many states, this “rule” stipulates that proper oversight includes demonstrating the duty of loyalty (no conflicting interests) and duty of care (make informed decisions) to be protected from liability. There are few cases (although Enron being one) where liability was found but it was for illegalities and poor business judgment. Since CISOs are not named corporate officers in most cases, BJR does not provide comfort. Similarly, liability insurance which covers legal defense fees and cash judgments often covers only directors and named corporate officers unless the CISO has been specifically included in the policy. DUTY TO REPORT Improving Board-CISO Transparency There is a mechanism found in corporate governance best-practices for ensuring that the most senior people in an organization get direct, unfiltered input from a key executive, regardless of reporting structure. It is called the executive session. This is in common use by Boards of Directors who meet individually with the Chief Financial Officer, Controller, and other key executives, notably without other management in the room. Questions are intended to be penetrating and the respondent is expected to respond openly. Now that cybersecurity has risen to a top risk for the enterprise, the CISO position should be among those who appear individually in an executive session with the highest governing body of an enterprise at least annually. This addition to governance best-practices would give Board members and State governors unfiltered information on cybersecurity matters, thereby helping to fulfil their oversight responsibility. Bob Zukis, founder and CEO of the Digital Directors Network, reports that a survey of its membership of more than 900 IT, cyber, and boardroom leaders shows nearly half of the respondents already have some form of this policy in practice. However, this is still a minority of the overall CISO population, signaling more transparency between the CISO and Board is needed. CISOs in State Governments Government organizations also face many of these issues. Evidence shows that CISOs in state governments are as vulnerable to other job offers as CISOs in the private sector. In the span of eight days in October 2022, there were several reports of state CISOs resigning, including Oklahoma, Georgia, Pennsylvania, and North Dakota. [1] Legal liability is not an issue the government CISO needs to be worried about since governments and their employees are immune from legal suits. However, government CISOs are highly concerned about shouldering blame, especially in the press, for security intrusions or their coverup. As with private industry, state governments should also institute this recommended practice. NCC recommends CISOs be called upon to appear in an executive session with agency heads and even the governor at least once a year. The State of Texas, for example, already has a version of this policy implemented in a statute and in practice. Texas Administrative Code includes provisions for: Reporting, at least annually, directly to the agency head the status and effectiveness of the security program and its controls. Informing any relevant parties in the event of noncompliance with the state agency’s information security policies Resolving the Great CISO Resignation For organizations across the public and private sectors, cybersecurity has risen to one of the top risks and has increased the importance of the role of the CISO. Most are looking to improve their work-life balance and reduce some of the stressors of the job. While many CISOs are also concerned about trends in liability and becoming headline news for decisions made on the job, requiring CISOs to appear in executive sessions with board members or state governors can help to alleviate these concerns and improve CISO job satisfaction while at the same time improving how the most senior levels of organizations fulfil their responsibilities for oversight of top risks.

Read More
PLATFORM SECURITY

Top 5 Application Security Trends Businesses Must Be Aware of in 2023

Article | October 12, 2022

Introduction Top 5 Trends for Businesses to Improve Their Existing Application Security 1.AppSec and Convergence 2.Adoption of Automated AI Security Capabilities 3.Emphasis on Securing the Software Supply Chain 4.Extreme 'Shift Left' 5.Upsurge in Demand for Vulnerability Prioritization Moving Forward with Application Security Introduction The proliferation of applications and their usage across the business landscape has made application security a strategic initiative that spans departments rather than an activity. Several factors are driving the rethinking of application security as a broader strategic program, including the evolving threat landscape, more incremental software development frameworks, and the adoption of nimbler. With the acceleration of software development and the greater-than-ever role of code in current business infrastructure, application security is shifting left in the process and infusing every step to ensure that the applications reaching customers' hands are secure and reliable. Top 5 Trends for Businesses to Improve Their Existing Application Security Applications serve as a doorway to servers and networks, making them an excellent target for malicious actors. Since cyber attackers constantly improve their techniques for breaking into software, it is becoming essential for businesses to gain insights into ever-evolving trends in the AppSec space. Here are some of the prominent trends that businesses should aware of to improve their existing application security. Trend 1: AppSec and CloudSec Convergence To accurately estimate attack surface and overall security posture, both application code vulnerabilities and cloud service hosting misconfigurations must be examined. The convergence of AppSec and CloudSec is becoming a critical component of modern security operations. It allows organizations to gain a comprehensive view of the attack surface and better understand the risks posed by application code and cloud service providers. By looking at these two areas cohesively, organizations can identify business-critical vulnerabilities and prioritize their remediation efforts. Trend 2: Adoption of Automated AI Security Capabilities The increasing volume and complexity of security threats pose significant challenges for organizations, causing strain on their threat detection and response capabilities. This leads to slower response times, higher costs, and a greater impact on security incidents. To address this issue, many companies are turning to security automation as a potential solution. One of such approaches involves the use of artificial intelligence (AI), which can automate data gathering, threat identification, and incident response processes. By adopting security automation, companies can optimize the use of limited security personnel and resources, enabling them to focus on high-value activities that provide maximum benefit to the organization. Trend 3: Emphasis on Securing the Software Supply Chain The software supply chain is emerging as a primary area of focus due to the heightened risks associated with software development. This urgency has been further compounded by the recent attack, such as Solarwind data breach and the Log4j attack on Apache, increasing the significance of software security measures. Companies are taking a more proactive approach for making enhancements in the software supply chain to protect their applications, including conducting Static Application Security Testing (SAST) to identify and address vulnerabilities before malicious actors can exploit them. Trend 4: Extreme 'Shift Left' The ‘shift left’ in software development has gained significant momentum in recent years. The idea behind this approach is to prioritize security and other critical aspects of software development at the earliest possible stage in the development process. By doing so, organizations can make more informed security decisions and identify and address security vulnerabilities before they cause any damage. As the pace of development continues to increase, organizations are increasingly adopting this approach in their software development processes to protect their systems and data from security risks. Trend 5: Upsurge in Demand for Vulnerability Prioritization Managing vulnerabilities in a software system requires analyzing vast amounts of data to determine issues that require immediate attention and prioritization. However, the growing presence of false positives is negatively impacting this process, resulting in decreased efficiency and wasted resources. Organizations are increasingly looking for vendors to provide vulnerability management tools that can reduce false positives, differentiate between low-priority issues and severe security threats, and offer actionable insights to mitigate them. Moving Forward with Application Security Applications security has become more critical than ever before for businesses in the current digital scape. With the attack surface constantly expanding and the frequency of threats on the rise, organizations must remain agile and employ the best effective strategies to protect their applications from potential cyberattacks. The significance of application security has not gone unnoticed. As organizations continue to invest in security measures, they are increasingly upgrading themselves as per emerging security trends to protect themselves against evolving cyber threats. This includes adopting the ‘shift left’ approach, tightening controls, and having a clear definition of remediation processes.

Read More
PLATFORM SECURITY

Security by Sector: Improving Quality of Data and Decision-Making a Priority for Credit Industry

Article | July 29, 2022

The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why?A new study of credit management professionals has revealed that improving the quality of data and decision-making will be a top priority for the credit industry in the next three years. The research, from Equifax Ingnite in collaboration with Coleman Parkes, takes a deep dive into the views of credit management pros across retail, banking, finance and debt management/recovery sectors.

Read More

3 Trends in Data Privacy Breach Laws That Will Carry Over to 2020

Article | February 12, 2020

During 2019, new privacy laws were introduced, and many current laws evolved in the United States and across the global landscape. With the General Data Protection Regulation (GDPR) in full effect, we saw expensive fines levied upon companies that fell victim to data privacy breaches. As we move into a new year, probably the biggest takeaway from 2019 is that being proactive and having a data privacy strategy in place is important to help mitigate the risk of a data privacy breach. The regulatory landscape continues to evolve as states and countries actively pass new expanded requirements for privacy and cybersecurity regulations. While laws in the U.S., like the California Consumer Privacy Act (CCPA), are getting significant attention, many other states and countries are actively amending their breach notification laws to include tighter restrictions.

Read More
ENTERPRISE SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY

The Great CISO Resignation

Article | May 10, 2023

CISOs Are Leaving in Droves The Great Resignation has been front-page news since Covid lockdowns, with many employees looking for the work-life balance they enjoyed at the time. Now, the phenomenon has spread to the role of Chief Information Security Officer (CISO) and shows no signs of letting up. In fact, industry experts predict that it is likely to worsen. A recent study from cybersecurity company BlackFog found that 32% of CISOs in the U.K. and U.S. have considered leaving and many planned to do so in just six months. The majority noted that the top reason for leaving was a lack of work-life balance. The CISO role is demanding, with firefighting and frequent changes in regulations and customer expectations taking up significant time both on and off the job. In another recent study in which 581 CISOs were surveyed, the IANS Research and Artico Search explored CISO compensation and job satisfaction. Three-fourths of CISOs are satisfied with their job, which is 7% higher than in the 2021 sample and more than double that of the 2020 sample. The main drivers of satisfaction are compensation, budget, executive visibility, and organizational support. However, despite high satisfaction numbers, the study found that as many as 44% of respondents are considering a job change. CISO Challenges LIABILITY AND EXPOSURE OF THE CISO There is a perception that CISOs face heightened liability for cyber intrusions and the response to cyber events. One extraordinary example is the recent conviction of Uber’s former security officer, which represents the first time a security executive has faced federal crime prosecution over a data security response. In this case the finding was that he obstructed justice by concealing information about a breach, destroying data, and covering up the incident. CISOs are often in the hot seat when it comes to cyber-intrusions and how they are handled. The Board of Directors (possibly including named corporate officers) in most cases are protected by being diligent about the Business Judgement Rule (BJR). Heavily adopted in Delaware case law and since adopted in various forms in many states, this “rule” stipulates that proper oversight includes demonstrating the duty of loyalty (no conflicting interests) and duty of care (make informed decisions) to be protected from liability. There are few cases (although Enron being one) where liability was found but it was for illegalities and poor business judgment. Since CISOs are not named corporate officers in most cases, BJR does not provide comfort. Similarly, liability insurance which covers legal defense fees and cash judgments often covers only directors and named corporate officers unless the CISO has been specifically included in the policy. DUTY TO REPORT Improving Board-CISO Transparency There is a mechanism found in corporate governance best-practices for ensuring that the most senior people in an organization get direct, unfiltered input from a key executive, regardless of reporting structure. It is called the executive session. This is in common use by Boards of Directors who meet individually with the Chief Financial Officer, Controller, and other key executives, notably without other management in the room. Questions are intended to be penetrating and the respondent is expected to respond openly. Now that cybersecurity has risen to a top risk for the enterprise, the CISO position should be among those who appear individually in an executive session with the highest governing body of an enterprise at least annually. This addition to governance best-practices would give Board members and State governors unfiltered information on cybersecurity matters, thereby helping to fulfil their oversight responsibility. Bob Zukis, founder and CEO of the Digital Directors Network, reports that a survey of its membership of more than 900 IT, cyber, and boardroom leaders shows nearly half of the respondents already have some form of this policy in practice. However, this is still a minority of the overall CISO population, signaling more transparency between the CISO and Board is needed. CISOs in State Governments Government organizations also face many of these issues. Evidence shows that CISOs in state governments are as vulnerable to other job offers as CISOs in the private sector. In the span of eight days in October 2022, there were several reports of state CISOs resigning, including Oklahoma, Georgia, Pennsylvania, and North Dakota. [1] Legal liability is not an issue the government CISO needs to be worried about since governments and their employees are immune from legal suits. However, government CISOs are highly concerned about shouldering blame, especially in the press, for security intrusions or their coverup. As with private industry, state governments should also institute this recommended practice. NCC recommends CISOs be called upon to appear in an executive session with agency heads and even the governor at least once a year. The State of Texas, for example, already has a version of this policy implemented in a statute and in practice. Texas Administrative Code includes provisions for: Reporting, at least annually, directly to the agency head the status and effectiveness of the security program and its controls. Informing any relevant parties in the event of noncompliance with the state agency’s information security policies Resolving the Great CISO Resignation For organizations across the public and private sectors, cybersecurity has risen to one of the top risks and has increased the importance of the role of the CISO. Most are looking to improve their work-life balance and reduce some of the stressors of the job. While many CISOs are also concerned about trends in liability and becoming headline news for decisions made on the job, requiring CISOs to appear in executive sessions with board members or state governors can help to alleviate these concerns and improve CISO job satisfaction while at the same time improving how the most senior levels of organizations fulfil their responsibilities for oversight of top risks.

Read More
PLATFORM SECURITY

A Look at Cryptographic Use Case Trends Around the World

Article | October 12, 2022

Introduction Top 5 Trends for Businesses to Improve Their Existing Application Security 1.AppSec and Convergence 2.Adoption of Automated AI Security Capabilities 3.Emphasis on Securing the Software Supply Chain 4.Extreme 'Shift Left' 5.Upsurge in Demand for Vulnerability Prioritization Moving Forward with Application Security Introduction The proliferation of applications and their usage across the business landscape has made application security a strategic initiative that spans departments rather than an activity. Several factors are driving the rethinking of application security as a broader strategic program, including the evolving threat landscape, more incremental software development frameworks, and the adoption of nimbler. With the acceleration of software development and the greater-than-ever role of code in current business infrastructure, application security is shifting left in the process and infusing every step to ensure that the applications reaching customers' hands are secure and reliable. Top 5 Trends for Businesses to Improve Their Existing Application Security Applications serve as a doorway to servers and networks, making them an excellent target for malicious actors. Since cyber attackers constantly improve their techniques for breaking into software, it is becoming essential for businesses to gain insights into ever-evolving trends in the AppSec space. Here are some of the prominent trends that businesses should aware of to improve their existing application security. Trend 1: AppSec and CloudSec Convergence To accurately estimate attack surface and overall security posture, both application code vulnerabilities and cloud service hosting misconfigurations must be examined. The convergence of AppSec and CloudSec is becoming a critical component of modern security operations. It allows organizations to gain a comprehensive view of the attack surface and better understand the risks posed by application code and cloud service providers. By looking at these two areas cohesively, organizations can identify business-critical vulnerabilities and prioritize their remediation efforts. Trend 2: Adoption of Automated AI Security Capabilities The increasing volume and complexity of security threats pose significant challenges for organizations, causing strain on their threat detection and response capabilities. This leads to slower response times, higher costs, and a greater impact on security incidents. To address this issue, many companies are turning to security automation as a potential solution. One of such approaches involves the use of artificial intelligence (AI), which can automate data gathering, threat identification, and incident response processes. By adopting security automation, companies can optimize the use of limited security personnel and resources, enabling them to focus on high-value activities that provide maximum benefit to the organization. Trend 3: Emphasis on Securing the Software Supply Chain The software supply chain is emerging as a primary area of focus due to the heightened risks associated with software development. This urgency has been further compounded by the recent attack, such as Solarwind data breach and the Log4j attack on Apache, increasing the significance of software security measures. Companies are taking a more proactive approach for making enhancements in the software supply chain to protect their applications, including conducting Static Application Security Testing (SAST) to identify and address vulnerabilities before malicious actors can exploit them. Trend 4: Extreme 'Shift Left' The ‘shift left’ in software development has gained significant momentum in recent years. The idea behind this approach is to prioritize security and other critical aspects of software development at the earliest possible stage in the development process. By doing so, organizations can make more informed security decisions and identify and address security vulnerabilities before they cause any damage. As the pace of development continues to increase, organizations are increasingly adopting this approach in their software development processes to protect their systems and data from security risks. Trend 5: Upsurge in Demand for Vulnerability Prioritization Managing vulnerabilities in a software system requires analyzing vast amounts of data to determine issues that require immediate attention and prioritization. However, the growing presence of false positives is negatively impacting this process, resulting in decreased efficiency and wasted resources. Organizations are increasingly looking for vendors to provide vulnerability management tools that can reduce false positives, differentiate between low-priority issues and severe security threats, and offer actionable insights to mitigate them. Moving Forward with Application Security Applications security has become more critical than ever before for businesses in the current digital scape. With the attack surface constantly expanding and the frequency of threats on the rise, organizations must remain agile and employ the best effective strategies to protect their applications from potential cyberattacks. The significance of application security has not gone unnoticed. As organizations continue to invest in security measures, they are increasingly upgrading themselves as per emerging security trends to protect themselves against evolving cyber threats. This includes adopting the ‘shift left’ approach, tightening controls, and having a clear definition of remediation processes.

Read More
PLATFORM SECURITY

Combating the Risk of SQL Injection Attacks – Part 1

Article | July 29, 2022

The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why?A new study of credit management professionals has revealed that improving the quality of data and decision-making will be a top priority for the credit industry in the next three years. The research, from Equifax Ingnite in collaboration with Coleman Parkes, takes a deep dive into the views of credit management pros across retail, banking, finance and debt management/recovery sectors.

Read More

3 Trends in Data Privacy Breach Laws That Will Carry Over to 2020

Article | February 12, 2020

During 2019, new privacy laws were introduced, and many current laws evolved in the United States and across the global landscape. With the General Data Protection Regulation (GDPR) in full effect, we saw expensive fines levied upon companies that fell victim to data privacy breaches. As we move into a new year, probably the biggest takeaway from 2019 is that being proactive and having a data privacy strategy in place is important to help mitigate the risk of a data privacy breach. The regulatory landscape continues to evolve as states and countries actively pass new expanded requirements for privacy and cybersecurity regulations. While laws in the U.S., like the California Consumer Privacy Act (CCPA), are getting significant attention, many other states and countries are actively amending their breach notification laws to include tighter restrictions.

Read More
MORE ARTICLES

Spotlight

DXC Technology

Welcome to the official DXC Technology LinkedIn page. Connect with us to engage and network with industry leaders and get the latest trends in IT innovation and solutions. DXC is the world’s leading independent, end-to-end IT services company, helping clients harness the power of innovation to thrive on change. Created by the merger of CSC and the Enterprise Services business of Hewlett Packard Enterprise, DXC Technology is a $25 billion company with a 60-year legacy of delivering results for thousands of clients in more than 70 countries.

Related News

ENTERPRISE SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY

Vade Joins the Pax8 Marketplace to Offer MSPs AI Microsoft 365 Email Security Solutions

Globenewswire | June 01, 2023

Pax8, the leading cloud commerce marketplace, announced today it has added Vade, a global cybersecurity company specializing in AI-based cybersecurity, to its cloud marketplace. Vade's Microsoft 365 (M365) security solutions combine AI and human-powered detection and response, designed specifically for Managed Service Providers (MSPs). This collaboration enables MSPs to offer a comprehensive suite of email security services to prevent advanced cyber-attacks and improve email security for their customers. “According to Forbes, during the past 12 months, 34.5% of polled executives report their organizations' accounting and financial data were targeted by cyber adversaries. This is an alarming trend that opens the door for businesses to reprioritize cybersecurity as a business requirement and partner with an MSP to prevent and protect their customers’ email infrastructure,” said Nikki Meyer, CVP of Vendor Global Alliances at Pax8. “The cybersecurity space is growing, and Pax8 is committed to provide our partners with access to best-in-class cloud solutions like Vade, enabling them to proactively protect their customers from threats effectively.” Established in 2009, Vade originated in the town of Hem, near the city of Lille in northern France. From its beginnings as a French startup specializing in email security for internet service providers (ISPs), Vade has evolved into a global cybersecurity company. Their extensive portfolio now includes AI-based cybersecurity solutions tailored for businesses of all sizes and industries. With a presence in seven locations worldwide, including the US, France, Japan, and Canada, Vade has established itself as an international leader in the cybersecurity field. Vade for M365 is an AI-powered, collaborative security solution that is powered by AI, enhanced by people, and made for MSPs. Featuring Vade’s AI detection and response engine that protects 1.4 billion mailboxes worldwide, Vade for M365 blocks and remediates the advanced threats that slip through Microsoft's defenses. Combining powerful protection with integrated features, including automated awareness training, cross-tenant incident response, and auto-remediation, Vade combines powerful, AI-based protection with integrated, no-cost features that help MSPs save time, reduce administrative workload, and generate more ROI from cybersecurity. “As a channel-first company, Vade recognized Pax8’s unique relationship with and commitment to the MSP community,” said Georges Lotigier, CEO of Vade. “Pax8 is not only the premier distributor for MSPs but also a trusted resource with significant cybersecurity expertise, making this partnership a perfect fit. We are thrilled to bring Vade for M365 to Pax8’s MSP community and look forward to the new partnerships the marketplace integration will bring.” The integration of Vade into the Pax8 marketplace provides significant benefits to MSPs and their customers looking to enhance their email security posture. Customers will now have easy access to Vade's state-of-the-art email protection solutions, which can be seamlessly integrated into their existing email infrastructure. Vade M365 offerings include: Phishing, spear phishing, and malware/ransomware protection Auto- and assisted remediation Cross-tenant incident response Automated user awareness training SIEM integration Error-free configuration Deploy in minutes No MX record change Layers with EOP/ATP To learn more about Pax8 and Vade, please visit www.pax8.com. About Pax8 Pax8 is the world’s favorite cloud marketplace for IT professionals to buy, sell, and manage best-in-class technology solutions. Pioneering the future of modern business, Pax8 has cloud-enabled more than 400,000 enterprises through its channel partners and processes one million monthly transactions. Pax8’s award-winning technology enables managed service providers (MSPs) to accelerate growth, increase efficiency, and reduce risk so their businesses can thrive. The innovative company has ranked in the Inc. 5000 for five years in a row. Join the revolution at pax8.com. About Vade Vade is a global cybersecurity company that secures human collaboration with a combination of AI and human-powered detection and response. Vade’s products and solutions protect consumers, businesses, and organizations from email-borne cyberattacks, including malware/ransomware, spear phishing/business email compromise, and phishing. Vade is a fast-growing, channel-first company with a growing network of MSP and MSSP partners, as well as distribution agreements with leading distributors and aggregators in North America, EMEA, and Asia. Founded in 2009, Vade protects more than 1.4 billion corporate and consumer mailboxes and serves the ISP, SMB, and MSP markets with award-winning products and solutions that help increase cybersecurity and maximize IT efficiency. To learn more, please visit www.vadesecure.com.

Read More

ENTERPRISE IDENTITY, SOFTWARE SECURITY, CLOUD SECURITY

Lookout Announces the Successful Divestiture of Its Consumer Mobile Security Business Segment

Businesswire | June 05, 2023

Lookout, Inc., the endpoint-to-cloud security company, today announced it has closed the previously announced sale of its consumer mobile security business to F-Secure, a global provider of consumer security products and services. With this strategic divestiture Lookout will focus on expanding its core enterprise business, built around the Lookout Cloud Security Platform. The sale of Lookout’s consumer mobile security business represents a deliberate and strategic decision to optimize its enterprise product portfolio and concentrate its product innovation and go-to-market on the expansion of these core competencies. The divestiture sets Lookout up for long-term growth and further positions the Company to address the security transformation impacting organizations today, including the increase in remote work, the shift to cloud-based delivery models and the transition to zero trust architectures. “We are pleased to announce the successful divestiture of our mobile consumer security business, which represents a significant milestone in our strategic transformation to become a pure-play enterprise cybersecurity company,” Jim Dolce, CEO at Lookout. “With this refined focus, we will continue to drive innovation, invest in the development of cutting-edge solutions and drive greater value for our customers.” Lookout’s core enterprise business includes Lookout Mobile Endpoint Security and its security services edge (SSE) cloud-native solution, the Lookout Cloud Security Platform. The Company entered the cloud security market through its acquisition of CipherCloud in March 2021. Its Cloud Security Platform was recently scored among the highest three vendors in the 2023 Gartner Critical Capabilities for Security Service Edge (SSE)1 report in each of the four use cases. The Gartner Critical Capabilities for SSE – an essential companion to the Gartner Magic Quadrant™ for SSE2 in which Lookout was named a Visionary for the second year in a row – is a comparative analysis that scores products or services against a set of critical differentiators that every business needs, as identified by Gartner. These four use cases include Secure Web and Cloud Usage, Detect and Mitigate Threats, Connect and Secure Remote Workers and Identify and Protect Sensitive Information. As part of the sale agreement, F-Secure acquires all of the Lookout consumer mobile security products and technology and assumes all responsibility for ongoing operations and customer relationships. Additionally, the Company’s consumer employees will become part of F-Secure. About Lookout Lookout, Inc. is the endpoint-to-cloud cybersecurity company that delivers zero trust security by reducing risk and protecting data wherever it goes, without boundaries or limits. Our unified, cloud-native platform safeguards digital information across devices, apps, networks and clouds and is as fluid and flexible as the modern digital world. Lookout is trusted by enterprises and government agencies of all sizes to protect the sensitive data they care about most, enabling them to work and connect freely and safely. To learn more about the Lookout Cloud Security Platform, visit www.lookout.com and follow Lookout on our blog, LinkedIn and Twitter. © 2023 Lookout, Inc. LOOKOUT®, the Lookout Shield Design®, LOOKOUT with Shield Design®, and SIGNAL FLARE® are registered trademarks of Lookout, Inc. in the United States and other countries. DAY OF SHECURITY®, LOOKOUT MOBILE SECURITY®, and POWERED BY LOOKOUT® are registered trademarks of Lookout, Inc. in the United States. Lookout, Inc. maintains common law trademark rights in EVERYTHING IS OK, PROTECTED BY LOOKOUT, CIPHERCLOUD, SCREAM, the 4 Bar Shield Design, and the Lookout multi-color/multi-shaded Wingspan design.

Read More

ENTERPRISE SECURITY, SOFTWARE SECURITY, CLOUD SECURITY

Safe Security Unveils Industry's First AI-Fueled Cyber Risk Cloud of Clouds Platform with SafeGPT to Answer Cyber Questions a Hundred Times Faster

Prnewswire | June 02, 2023

Safe Security (SAFE), the leader in AI-based cyber risk management SaaS platform, announced today the industry's first Cyber Risk Cloud of Clouds for predicting and preventing cyber breaches. In contrast to the rest of the industry that takes a reactive approach, SAFE's Cyber Risk Cloud of Clouds enables organizations to make informed and predictive dynamic security decisions to reduce risk. Real-Time, Data-Driven, Aggregated Risk in a Single Place SAFE's Cyber Risk Cloud of Clouds provides organizations with a granular and aggregated view of enterprise security risk by bringing together multiple disparate cyber signals, including Crowdstrike, Wiz, AWS, Azure, Google Cloud Provider, Qualys, Tanium, Rapid7, ServiceNow, and more in a single view. This provides organizations with visibility across their entire attack surface ecosystem, including technology, people, and third parties. AI Breach Predictions and Prioritized Actions to Prevent Breaches Using SAFE's predictive AI data models, co-developed with MIT, SAFE generates breach likelihood for different risk scenarios like ransomware. For example, accurately answer questions like: How likely are you to be hit by a ransomware attack in the next 12 months? What is your likelihood of being hit by the latest malware like "Snake" malware? What is your dollar impact for that attack? What prioritized actions can you proactively take to reduce the ransomware breach likelihood and reduce dollar risk? "The CISO is facing an unprecedented level of pressure and the role has evolved into a major business decision maker. With SAFE, CISOs can gain a new level of visibility with higher confidence, through real-time access into their cybersecurity posture, to make the most impactful strategy to decrease cyber risk," said Saket Modi, CEO and Co-Founder of SAFE. "The new release of SafeGPT, a generative AI interface, powered by LLM models is a game-changer. It helps CISOs get the right answers a hundred times faster." SafeGPT Drives Easy Access and Risk Reducing Decisions SAFE's generative AI chat interface powered by LLM models, SafeGPT, offers an intuitive platform for managing cyber risk with ease, providing stakeholders with a clear and comprehensible overview of the organization's cybersecurity posture. With its user-friendly dashboard and natural language processing capabilities, SafeGPT enables users to ask targeted questions of their cyber risk data, determine the most effective strategies for mitigating risk, and respond confidently to inquiries from regulators and other key stakeholders. "The market transitions going on now are going to affect every industry and vertical worldwide," said John Chambers, former Executive Chairman and CEO of Cisco and current founder and CEO of JC2 Ventures." AI is going to have a tremendous impact on cybersecurity, which is why I am excited about the launch of SafeGPT. It simplifies complex problem-solving for board members and C-level executives." About Safe Security Safe Security is the leader in cyber risk management SaaS platforms. It has redefined cyber risk measurement and management with its real time, data driven approach that empowers enterprises, boards, regulators and cyber insurance carriers to understand cyber risk in an aggregated and granular manner. Using SAFE's predictive AI driven data models, co-developed with MIT, customers are now empowered to translate the bits and bytes of cyber risk into dollars and cents so that they can prioritize their cyber investments to most effectively mitigate their risk and understand the return on security investments. Having raised over $100m, SAFE is growing over 200% year-over-year and serves some of the largest global enterprises.

Read More

ENTERPRISE SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY

Vade Joins the Pax8 Marketplace to Offer MSPs AI Microsoft 365 Email Security Solutions

Globenewswire | June 01, 2023

Pax8, the leading cloud commerce marketplace, announced today it has added Vade, a global cybersecurity company specializing in AI-based cybersecurity, to its cloud marketplace. Vade's Microsoft 365 (M365) security solutions combine AI and human-powered detection and response, designed specifically for Managed Service Providers (MSPs). This collaboration enables MSPs to offer a comprehensive suite of email security services to prevent advanced cyber-attacks and improve email security for their customers. “According to Forbes, during the past 12 months, 34.5% of polled executives report their organizations' accounting and financial data were targeted by cyber adversaries. This is an alarming trend that opens the door for businesses to reprioritize cybersecurity as a business requirement and partner with an MSP to prevent and protect their customers’ email infrastructure,” said Nikki Meyer, CVP of Vendor Global Alliances at Pax8. “The cybersecurity space is growing, and Pax8 is committed to provide our partners with access to best-in-class cloud solutions like Vade, enabling them to proactively protect their customers from threats effectively.” Established in 2009, Vade originated in the town of Hem, near the city of Lille in northern France. From its beginnings as a French startup specializing in email security for internet service providers (ISPs), Vade has evolved into a global cybersecurity company. Their extensive portfolio now includes AI-based cybersecurity solutions tailored for businesses of all sizes and industries. With a presence in seven locations worldwide, including the US, France, Japan, and Canada, Vade has established itself as an international leader in the cybersecurity field. Vade for M365 is an AI-powered, collaborative security solution that is powered by AI, enhanced by people, and made for MSPs. Featuring Vade’s AI detection and response engine that protects 1.4 billion mailboxes worldwide, Vade for M365 blocks and remediates the advanced threats that slip through Microsoft's defenses. Combining powerful protection with integrated features, including automated awareness training, cross-tenant incident response, and auto-remediation, Vade combines powerful, AI-based protection with integrated, no-cost features that help MSPs save time, reduce administrative workload, and generate more ROI from cybersecurity. “As a channel-first company, Vade recognized Pax8’s unique relationship with and commitment to the MSP community,” said Georges Lotigier, CEO of Vade. “Pax8 is not only the premier distributor for MSPs but also a trusted resource with significant cybersecurity expertise, making this partnership a perfect fit. We are thrilled to bring Vade for M365 to Pax8’s MSP community and look forward to the new partnerships the marketplace integration will bring.” The integration of Vade into the Pax8 marketplace provides significant benefits to MSPs and their customers looking to enhance their email security posture. Customers will now have easy access to Vade's state-of-the-art email protection solutions, which can be seamlessly integrated into their existing email infrastructure. Vade M365 offerings include: Phishing, spear phishing, and malware/ransomware protection Auto- and assisted remediation Cross-tenant incident response Automated user awareness training SIEM integration Error-free configuration Deploy in minutes No MX record change Layers with EOP/ATP To learn more about Pax8 and Vade, please visit www.pax8.com. About Pax8 Pax8 is the world’s favorite cloud marketplace for IT professionals to buy, sell, and manage best-in-class technology solutions. Pioneering the future of modern business, Pax8 has cloud-enabled more than 400,000 enterprises through its channel partners and processes one million monthly transactions. Pax8’s award-winning technology enables managed service providers (MSPs) to accelerate growth, increase efficiency, and reduce risk so their businesses can thrive. The innovative company has ranked in the Inc. 5000 for five years in a row. Join the revolution at pax8.com. About Vade Vade is a global cybersecurity company that secures human collaboration with a combination of AI and human-powered detection and response. Vade’s products and solutions protect consumers, businesses, and organizations from email-borne cyberattacks, including malware/ransomware, spear phishing/business email compromise, and phishing. Vade is a fast-growing, channel-first company with a growing network of MSP and MSSP partners, as well as distribution agreements with leading distributors and aggregators in North America, EMEA, and Asia. Founded in 2009, Vade protects more than 1.4 billion corporate and consumer mailboxes and serves the ISP, SMB, and MSP markets with award-winning products and solutions that help increase cybersecurity and maximize IT efficiency. To learn more, please visit www.vadesecure.com.

Read More

ENTERPRISE IDENTITY, SOFTWARE SECURITY, CLOUD SECURITY

Lookout Announces the Successful Divestiture of Its Consumer Mobile Security Business Segment

Businesswire | June 05, 2023

Lookout, Inc., the endpoint-to-cloud security company, today announced it has closed the previously announced sale of its consumer mobile security business to F-Secure, a global provider of consumer security products and services. With this strategic divestiture Lookout will focus on expanding its core enterprise business, built around the Lookout Cloud Security Platform. The sale of Lookout’s consumer mobile security business represents a deliberate and strategic decision to optimize its enterprise product portfolio and concentrate its product innovation and go-to-market on the expansion of these core competencies. The divestiture sets Lookout up for long-term growth and further positions the Company to address the security transformation impacting organizations today, including the increase in remote work, the shift to cloud-based delivery models and the transition to zero trust architectures. “We are pleased to announce the successful divestiture of our mobile consumer security business, which represents a significant milestone in our strategic transformation to become a pure-play enterprise cybersecurity company,” Jim Dolce, CEO at Lookout. “With this refined focus, we will continue to drive innovation, invest in the development of cutting-edge solutions and drive greater value for our customers.” Lookout’s core enterprise business includes Lookout Mobile Endpoint Security and its security services edge (SSE) cloud-native solution, the Lookout Cloud Security Platform. The Company entered the cloud security market through its acquisition of CipherCloud in March 2021. Its Cloud Security Platform was recently scored among the highest three vendors in the 2023 Gartner Critical Capabilities for Security Service Edge (SSE)1 report in each of the four use cases. The Gartner Critical Capabilities for SSE – an essential companion to the Gartner Magic Quadrant™ for SSE2 in which Lookout was named a Visionary for the second year in a row – is a comparative analysis that scores products or services against a set of critical differentiators that every business needs, as identified by Gartner. These four use cases include Secure Web and Cloud Usage, Detect and Mitigate Threats, Connect and Secure Remote Workers and Identify and Protect Sensitive Information. As part of the sale agreement, F-Secure acquires all of the Lookout consumer mobile security products and technology and assumes all responsibility for ongoing operations and customer relationships. Additionally, the Company’s consumer employees will become part of F-Secure. About Lookout Lookout, Inc. is the endpoint-to-cloud cybersecurity company that delivers zero trust security by reducing risk and protecting data wherever it goes, without boundaries or limits. Our unified, cloud-native platform safeguards digital information across devices, apps, networks and clouds and is as fluid and flexible as the modern digital world. Lookout is trusted by enterprises and government agencies of all sizes to protect the sensitive data they care about most, enabling them to work and connect freely and safely. To learn more about the Lookout Cloud Security Platform, visit www.lookout.com and follow Lookout on our blog, LinkedIn and Twitter. © 2023 Lookout, Inc. LOOKOUT®, the Lookout Shield Design®, LOOKOUT with Shield Design®, and SIGNAL FLARE® are registered trademarks of Lookout, Inc. in the United States and other countries. DAY OF SHECURITY®, LOOKOUT MOBILE SECURITY®, and POWERED BY LOOKOUT® are registered trademarks of Lookout, Inc. in the United States. Lookout, Inc. maintains common law trademark rights in EVERYTHING IS OK, PROTECTED BY LOOKOUT, CIPHERCLOUD, SCREAM, the 4 Bar Shield Design, and the Lookout multi-color/multi-shaded Wingspan design.

Read More

ENTERPRISE SECURITY, SOFTWARE SECURITY, CLOUD SECURITY

Safe Security Unveils Industry's First AI-Fueled Cyber Risk Cloud of Clouds Platform with SafeGPT to Answer Cyber Questions a Hundred Times Faster

Prnewswire | June 02, 2023

Safe Security (SAFE), the leader in AI-based cyber risk management SaaS platform, announced today the industry's first Cyber Risk Cloud of Clouds for predicting and preventing cyber breaches. In contrast to the rest of the industry that takes a reactive approach, SAFE's Cyber Risk Cloud of Clouds enables organizations to make informed and predictive dynamic security decisions to reduce risk. Real-Time, Data-Driven, Aggregated Risk in a Single Place SAFE's Cyber Risk Cloud of Clouds provides organizations with a granular and aggregated view of enterprise security risk by bringing together multiple disparate cyber signals, including Crowdstrike, Wiz, AWS, Azure, Google Cloud Provider, Qualys, Tanium, Rapid7, ServiceNow, and more in a single view. This provides organizations with visibility across their entire attack surface ecosystem, including technology, people, and third parties. AI Breach Predictions and Prioritized Actions to Prevent Breaches Using SAFE's predictive AI data models, co-developed with MIT, SAFE generates breach likelihood for different risk scenarios like ransomware. For example, accurately answer questions like: How likely are you to be hit by a ransomware attack in the next 12 months? What is your likelihood of being hit by the latest malware like "Snake" malware? What is your dollar impact for that attack? What prioritized actions can you proactively take to reduce the ransomware breach likelihood and reduce dollar risk? "The CISO is facing an unprecedented level of pressure and the role has evolved into a major business decision maker. With SAFE, CISOs can gain a new level of visibility with higher confidence, through real-time access into their cybersecurity posture, to make the most impactful strategy to decrease cyber risk," said Saket Modi, CEO and Co-Founder of SAFE. "The new release of SafeGPT, a generative AI interface, powered by LLM models is a game-changer. It helps CISOs get the right answers a hundred times faster." SafeGPT Drives Easy Access and Risk Reducing Decisions SAFE's generative AI chat interface powered by LLM models, SafeGPT, offers an intuitive platform for managing cyber risk with ease, providing stakeholders with a clear and comprehensible overview of the organization's cybersecurity posture. With its user-friendly dashboard and natural language processing capabilities, SafeGPT enables users to ask targeted questions of their cyber risk data, determine the most effective strategies for mitigating risk, and respond confidently to inquiries from regulators and other key stakeholders. "The market transitions going on now are going to affect every industry and vertical worldwide," said John Chambers, former Executive Chairman and CEO of Cisco and current founder and CEO of JC2 Ventures." AI is going to have a tremendous impact on cybersecurity, which is why I am excited about the launch of SafeGPT. It simplifies complex problem-solving for board members and C-level executives." About Safe Security Safe Security is the leader in cyber risk management SaaS platforms. It has redefined cyber risk measurement and management with its real time, data driven approach that empowers enterprises, boards, regulators and cyber insurance carriers to understand cyber risk in an aggregated and granular manner. Using SAFE's predictive AI driven data models, co-developed with MIT, customers are now empowered to translate the bits and bytes of cyber risk into dollars and cents so that they can prioritize their cyber investments to most effectively mitigate their risk and understand the return on security investments. Having raised over $100m, SAFE is growing over 200% year-over-year and serves some of the largest global enterprises.

Read More

Events