Specops study reveals biggest remote working cyber security concerns

Information Age | April 09, 2020

Most employees that have some kind of digital aspect present within their duties are now practicing remote working due to government guidelines amidst the coronavirus pandemic, and fresh cyber security concerns have risen as a result. This apprehension among senior company staff is further evidenced by the finding by Specops that 300,000 Google searches relating to cyber security were activated throughout the previous month. Senior staff from 14 different sectors, 100 from each, were asked to pick one of six security factors that they thought were their biggest concern. The most frequently cited factor among senior staff was reduced password and passcode security. This was predominantly chosen by the computer and IT, travel and hospitality, charity and voluntary work, and media and internet sectors.

Spotlight

Information security plays an important role in protecting the assets of an organisation. As no single formula can guarantee 100% security, there is a need for a set of benchmarks or standards to help ensure an adequate level of security is attained, resources are used efficiently, and the best security practices are adopted. Information security policies and standards can provide an organization with an accurate security baseline and the tools to strengthen its security posture.


Other News
DATA SECURITY

Flow Security Launches Next-Gen Data Security Platform Following $10 Million Seed Round

Flow Security | August 05, 2022

Flow Security today announced $10M in seed funding and launched the first data security platform that discovers and protects both data at rest and in motion. The funding was led by Amiti, with participation from GFC, Amdocs Ventures, and industry leaders such as CyberArk CEO Udi Mokady and Demisto CEO and co-founder Slavik Markovich. Enterprises of all sizes continue to make heavy investments in technology stacks as they transition to modern cloud application architectures. This new era promises many benefits, but has also led to significant data sprawl and major difficulties in securing data. With the widespread adoption of modern architectures, securing sensitive data such as PII, PHI, financial information, and intellectual property has become a near-impossible task. Flow Security helps organizations overcome these challenges by continuously mapping and detecting all data-related risks for an improved data security posture. Flow is the only data security platform that supports use cases including discovering and classifying data flows to external services, policy enforcement, automatic data-related threat modeling, and reducing data access permissions to the minimum. Flow has a growing customer base in highly-regulated markets such as e-commerce, fintech, healthcare, insurtech, and more. "Discovery, mapping and protecting data is usually a manual process, which is not effective in large organizations," says Nir Chervoni, Head of Data Security of Booking.com, "Automatic data mapping should consist of analyzing the actual payload, and not only its metadata. So far, Flow is the only company I've seen that provides that capability for multiple scenarios." "Security and data protection teams are struggling to keep up with the rapid pace of today, and Flow is making their lives exponentially easier," said Ben Rabinowitz, Managing Partner and Founder at Amiti Ventures. "We're thrilled to be a partner on this journey, and eager to help capitalize on this opportunity to give security teams the technology they need to become business enablers." "We've reviewed dozens of different data security tools lately, and we weren't satisfied with any of them. "But Flow's data-in-motion approach is a game changer. It took the platform a few days to map data-related threats that usually take months of manual work to detect." Ralph Pyne, VP of Security at NextRoll "Data security is not a new problem, but the challenges are changing and growing," said Jonathan Roizin, co-founder and CEO of Flow Security. "Organizations are moving at a record pace and quickly transitioning to the cloud and cloud-first applications. These transformations often make life easier, but they also make the jobs of security professionals even more difficult. With Flow, security teams are no longer forced to chase down information. It simplifies security and regulatory processes and bridges the gap between security and development teams." About Flow Security Flow Security revolutionizes data security with the first platform that discovers and protects data not only at rest, but also in motion. Founded in 2021 by Jonathan Roizin and Rom Ashkenazi, the Israel-based company is backed by Amiti, GFC, Amdocs Ventures, and market-leading angel investors.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Upstream Deepens Investment in Michigan, US with a New Vehicle Security Operation Center

Upstream | September 08, 2022

Upstream, the creator of industry-leading cloud-based cybersecurity and data management platform for connected vehicles and smart mobility, is opening its first U.S.-based vehicle security operation center (vSOC) in Ann Arbor, Michigan, to closely surveil and mitigate emerging cyber threats and risks for its U.S.-based automotive clients. Data and connectivity are the foundation of the automotive industry's transformation, unlocking new revenue streams and business opportunities for automotive stakeholders and users. But, connectivity and mobility applications bring a wide range of cyber risks. "Upstream enables OEMs to build trust into the connected vehicles ecosystem. "Our platform monitors over 12 million vehicles worldwide. We see new attack surfaces and threats on a regular basis, fueled by a wide variety of vulnerabilities, including EV charging networks, expanded use of smartphone apps that control basic car functions and infotainment systems. This is the right timing to open our U.S.-based vSOC, and Michigan is a natural choice." Yoav Levy, CEO and co-founder of Upstream "Companies continue to invest in Michigan because of our world-class talent, quality of life, low cost of doing business and culture of innovation," said Trevor Pawl, Michigan's Chief Mobility Officer. "Michigan remains committed to being the global epicenter of the next revolution of the automotive industry and we applaud Upstream's continued success and investment in Michigan's autonomous and electrified future." "Vehicles are benefiting from a wave of technology innovation, producing transportation that is safer and smarter thanks to connectivity," said Faye Francy, executive director of Auto-ISAC, a global information sharing community established by automakers to address cybersecurity risks. "The very technology that provides us with these new efficiencies also introduces potential cyber risk to the vehicle, and vSOC operations is an application for the automotive industry to proactively address the risk." In fact, Upstream found more than 50 percent of all reported automotive-related cybersecurity incidents took place during the past two years alone. "Customer experience applications, by OEMs and smart mobility providers, are one of the fastest growing attack surfaces and account for 6 percent of total attacks in 2022 so far compared to 2 percent in 2021, explains Yaniv Maimon, Upstream's director of vSOC. "Charging stations and infrastructure have also become a significant concern, especially given range anxiety concerns and the constant pressure to accelerate EV adoption." At the Michigan vSOC, Upstream is hiring and training experienced local cyber and automotive experts to operate the vSOC, offer cross-functional response and mitigate attacks in real time. "Southeast Michigan's emergence as a high-tech mobility hub and its proximity to our automotive customers, their Tier-1 suppliers and cybersecurity talent makes it a perfect setting for our new vSOC," Levy said, adding that traditional security operation centers focus on compliance and IT assets and lack the holistic and contextual view required to mitigate cybersecurity threats against vehicles, services and entire fleets. The Michigan-based vSOC is expected to be fully operational by the end of the year. It adds to Upstream's growing network of automotive-specific security centers already active in Israel, and coming soon in Japan. Additional vSOC investments are expected in Europe in the near future. About Upstream: Upstream provides a cloud-based data management platform purpose-built for connected vehicles, delivering unparalleled automotive cybersecurity detection and response (V-XDR) and data-driven applications. The Upstream Platform unlocks the value of vehicle data, empowering customers to build connected vehicle applications by transforming highly distributed vehicle data into centralized, structured, contextualized data lakes. Coupled with AutoThreat® Intelligence, the first automotive cybersecurity threat intelligence solution, Upstream provides industry-leading cyber threat protection and actionable insights, seamlessly integrated into the customer's environment and Vehicle Security Operation Centers (vSOC).

Read More

DATA SECURITY,ENTERPRISE IDENTITY

Keeper Security's Cybersecurity Census Finds U.S. Businesses are Unprepared for Escalation in Cyberattacks

Keeper Security | September 15, 2022

Keeper Security, the leading provider of zero-trust, zero-knowledge and FedRAMP Authorized cybersecurity software, today released findings from its second annual Cybersecurity Census. The report explores insights from IT decision-makers at businesses and organizations across the U.S., revealing that most respondents expect the onslaught of cyberattacks to intensify over the next year, yet 32% lack a management platform for IT secrets–posing a significant risk to organizational security. The 2022 U.S.Cybersecurity Census Report explores the ongoing threats of cyberattacks and the need for cybersecurity investment. The report maps the evolving cybersecurity landscape as hybrid and remote work have transformed businesses over the past two years. According to survey findings, the average U.S. business experiences 42 cyberattacks annually—between three to four each month. Still, fewer than half (44%) of respondents provide their employees with guidance or best practices for governing passwords and access management. IT leaders reveal a lack of preparedness for cyberattacks U.S. businesses face many cyberattacks each year, significantly impacting their organizations. Most respondents agree the total number of attacks will increase over the next year, with 39% predicting the number of successful cyberattacks will also rise. Most organizations in the U.S. believe they're prepared to fend off cyberattacks, with 64% of respondents rating their preparedness at least an eight on a 10-point scale and 28% rating themselves as a 10/10. At the same time, the majority of respondents (57%) say it is taking longer to respond to attacks and only 8% say responses are getting faster. Though most report feeling prepared for attacks, leaders admit their tech stacks lack essential tools. Nearly one-third of respondents (32%) lack a management platform for IT secrets, such as API keys, database passwords and privileged credentials. 84% are concerned about the dangers of hard-coded credentials in source code but 25% don't have software to remove them. More than one-quarter of respondents (26%) said they lack a remote connection management solution to secure remote access to IT infrastructure. With the rise in hybrid work and remote work, this is a significant security gap. This lack of investment in cybersecurity tools is alarming, especially considering the lasting impact of cyberattacks that survey respondents revealed. Nearly one-third (31%) suffered a disruption of partner or customer operations in the wake of a cyberattack and the same percentage experienced theft of financial information. 18% of organizations experienced theft of money, with the average amounting to more than $75,000, while 37% lost $100,000 or more. 23% experienced the inability to carry out business operations. In addition to direct costs, cyberattacks can cause lasting damage to business perception and client trust. More than one-quarter of respondents (28%) suffered reputational damage due to a successful cyberattack and 19% reported losing business or a contract. "The volume and pace at which cyberattacks are hitting businesses is increasing and with that come severe financial, reputational and organizational penalties," said Darren Guccione, CEO and co-founder of Keeper Security. "Leadership must prioritize cybersecurity, enabling their security teams to address rapid shifts in technology and distributed remote work. The impact these shifts have on cybersecurity are both pervasive and extreme. Building a culture of trust, accountability and responsiveness is critical." U.S. businesses must take immediate action against cyber threats Cybersecurity is a pillar of every good business and these findings underscore the need for business leaders to make cybersecurity a part of organizational culture. U.S. business leaders are working to source the necessary talent to stay secure. Nearly three-quarters (71%) of respondents have made new hires in cybersecurity over the past year and 58% say they've increased cybersecurity training. A devastating cyberattack is one stolen password away, but despite this threat, fewer than half (48%) of respondents state they have plans to invest in password management, visibility tools for network-based threats or infrastructure secrets management. Only 44% of respondents provide their employees with guidance and best practices governing passwords and access management. 30% of respondents allow employees to set and manage their passwords and admit that employees often share access to passwords. A mere 26% have a highly sophisticated framework for visibility and control of identity security. Many organizations are considering future investments with 73% of respondents expecting their cybersecurity budgets to increase. However, they face being outmatched by rising external threats and the demands created by existing weaknesses. Cybersecurity in company culture Employees understand the dangers of both external and internal threats. An overwhelming 79% of IT professionals are concerned about a breach from within their organization and 47% have suffered a breach of that nature. As more employees work remotely, businesses must rethink their investments in order to maintain security. In fact, 40% of respondents highlighted remote and hybrid work as a top concern, with rising external threats close behind at 39%. IT leaders themselves admit a lack of transparency in cyber incident reporting within their organizations, with nearly half of respondents (48%) being aware of a cyberattack, but keeping it to themselves. Businesses must foster a sense of trust and transparency in their organizations, creating an open dialogue to recognize the scale of the cybersecurity challenges their organization faces. Only with that recognition can resources be devoted to education and embedding a cybersecurity mindset into the organization's culture. Keeper's 2022 U.S. Cybersecurity Census Report demonstrates that cyberattacks present a profound and ongoing threat. Preventative measures, including investment, education and cultural shifts, are essential for businesses to drive resilience and protect their organizations from cybercriminals. Methodology The report yielded results from 516 IT leaders and decision-makers in businesses across the U.S. About Keeper Security Keeper Security, Inc. ("Keeper") is transforming the way organizations and individuals protect their credentials, secrets, connections and sensitive digital assets to significantly reduce the risks of identity security-related cyberattacks, while gaining visibility and control. Keeper is the leading provider of zero-trust and zero-knowledge security cloud services trusted by millions of people and thousands of organizations for password management, secrets management, privileged access, secure remote infrastructure access and encrypted messaging.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

PlainID, The Authorization Company™, Announces thought leadership collaboration with The Cyber Hut

PlainID | September 05, 2022

PlainID, the Authorization Company™, announces today the release of "Build vs Buy: Guide to Evaluating Authorization" in collaboration with Simon Moffatt, founder and analyst of The Cyber Hut. The increase in remote work and digital commerce has created a proliferation of digital identities which demand secure, frictionless access to applications and the underlying data. The guide is designed to address and inform on key criteria when considering whether to build and maintain authorization policies "inside" an application vs leveraging the benefits of an external authorization engine. The need for functionally rich applications capable of operating in a digitally optimized computing architecture has motivated enterprises to consider migrating their legacy, internally developed policies to an Authorization Platform such as PlainID. "Externalized Authorization is now an essential part of the security arsenal - foundational for agile business operations - allowing the modern enterprise to share data, assets and applications to a range of new stakeholders," said Simon Moffatt. "This guide aims to empower the buyer on a range of topics associated with next generation authorization. It will hopefully be a great asset to the security executive and practitioner alike." Numerous industry analysts are recommending externalizing authorization and authentication as a means to increase an enterprise's security resilience and a prerequisite to creating a Zero Trust architecture. "PlainID is more than delighted to collaborate with Simon and The Cyber Hut. We strongly believe in the virtue of thought leadership and the importance of this subject matter. The power and broad value of authorization are just beginning to be realized, and our hope is that this guide helps firms make informed decisions." Tom Ammirati, PlainID's Chief Revenue Officer PlainID helps businesses advance and modernize by simply and securely connecting identities of all types with the digital assets they need to do their jobs, accomplish tasks at scale, and conduct digital commerce. By making authorization decisions simple, smart, granular, and contextual, PlainID helps enterprises achieve a positive and measurable impact on user experience, enterprise security, and data privacy. Powered by policy-based access control (PBAC), leading-edge features include PlainID's Centralized Management Dashboard, which provides users the ability to create and manage enterprise-wide authorization policies from a central point while maintaining distributed enforcement capabilities. The Platform provides out-of-the-box PlainID Authorizers™ that address common authorization patterns for API gateways, microservices, data, and applications. About PlainID PlainID Inc. The Authorization Company™, is the recognized leader in Authorization as a Service powered by Policy Based Access Control (PBAC). PlainID's simple, straightforward solution to authorization management enables organizations to create, manage and enforce authorization policies across an enterprise. By securely connecting identities to digital assets via PlainID Authorizers, firms can meet the digital demands of user journeys, enable zero trust architectures and provide data security. The PlainID Authorization Platform enables rapid business growth by connecting new and legacy technologies with the latest and most advanced authorization features.

Read More

Spotlight

Information security plays an important role in protecting the assets of an organisation. As no single formula can guarantee 100% security, there is a need for a set of benchmarks or standards to help ensure an adequate level of security is attained, resources are used efficiently, and the best security practices are adopted. Information security policies and standards can provide an organization with an accurate security baseline and the tools to strengthen its security posture.

Resources