Stop Measuring Your Cybersecurity in Terms of Budget

DCMS | May 11, 2020

  • Almost every month there is a new report detailing how firms are increasing their cybersecurity budgets, or buying the latest tech to help defeat hackers.

  • The typical way that companies have looked to improve their cyber capabilities is by investing in the latest tech to help protect their networks.

  • Clearly measuring how strong your cybersecurity is can no longer be done by how much money is spent on it each year.


The last decade has seen an explosion in cybersecurity spending, with the global market now valued at $112bn in 2019. Almost every month there is a new report detailing how firms are increasing their cybersecurity budgets, or buying the latest tech to help defeat hackers, but is this correlating with a reduction in cybercrime? A recent report found that while 85 percent of companies rated their security stack incredibly highly, 86 percent of them had still suffered a data breach in the last 12 months. Clearly there is a disconnect between how companies are measuring their cybersecurity readiness and achieving effective security in reality.


The typical way that companies have looked to improve their cyber capabilities is by investing in the latest tech to help protect their networks. While these systems are effective, they still require employees with the sufficient skills to work them properly. Given that the DCMS recently found that 48 percent of UK businesses struggled to find employees with basic cyber skills, for example being able to configure a firewall correctly, it seems unlikely that the majority of companies are getting the most out of these tools.



Learn more: THE TIME HAS COME TO BRING IN AI, MACHINE LEARNING AND AUTOMATION IN CYBERSECURITY .
 

“Measuring human cybersecurity readiness is difficult to do. Currently, companies have had to rely on certifications for measuring ability, which quickly become outdated as hackers develop new techniques almost daily”.


Experts often say that one of the best ways of defending your network is educating employees to be on the lookout for risks. However, often many businesses are not taking their human cyber readiness into account. This is because they are unable to effectively measure the skills of their cyber team. Measuring human cybersecurity readiness is difficult to do. Currently, companies have had to rely on certifications for measuring ability, which quickly become outdated as hackers develop new techniques almost daily.

“ If an organization is unable to tell how strong its team is at cybersecurity, it will always be behind the hackers who are looking to steal its information”.


However, failing to measure your human readiness companies can open themselves up to increased risk. For example, many organizations carry out breach simulations to provide crucial experience for the day when there is a real attack. However, businesses rarely measure how well their teams coped with each scenario and what training and actions should come from it. If an organization is unable to tell how strong its team is at cybersecurity, it will always be behind the hackers who are looking to steal its information. In the past, the only measure companies had to judge their employees was through what certificates they held. This led to hiring professionals on huge salaries who have been working in the industry for many years and have secured the correct qualifications.


Just because they have a certificate does not mean they are necessarily better at handling a threat as the most junior person on the team. This is because it is impossible to know who is best to handle a response simply by looking at certificates. The junior member could have had more recent experience in handling that type of threat, or recently read about the latest techniques. By being able to continually measure who in the team is stronger at certain tasks can go a long way in improving efficiency in defending against attacks. Often, rather than hiring in the talent from outside their teams, organizations could spend a fraction of the budget and focus on upskilling their own existing staff. Of course, to do this you first need to know what skills your team already has, and where there are gaps that need to be filled.


Learn more: CYBER SECURITY GUIDANCE FOR REMOTE WORKING .
 

Spotlight

The Higher Education Information Security Council (HEISC), along with EDUCAUSE and Internet2, held its annual Information Security Awareness Video & Poster Contest, an event that allows college students to win prizes, gain experience, and earn recognition by creating a PSA about information security.
HEISC works to improve information security & privacy programs across the higher education sector


Other News
SOFTWARE SECURITY

Contrast Security Introduces Cloud-Native Automation

Contrast Security | April 23, 2022

Contrast Security , the leader in code security that empowers developers to secure-as-they code, today announced the introduction of cloud-native automation for users leveraging Red Hat OpenShift, the industry's leading enterprise Kubernetes platform. Red Hat OpenShift users can now deploy containerized applications with embedded security features within a native continuous integration and continuous delivery (CI/CD) pipelines. This enables Red Hat OpenShift users to retain scalability, while adding automated security testing and protection as a routine part of the software delivery process. These added capabilities result in minimized manual configuration, reduction in additional overhead costs, and overall security efficiencies. Contrast enables customers to continuously monitor OpenShift applications at runtime to deliver the most actionable results without requiring AppSec teams to waste hundreds of hours validating results and causing delays for developers. "Unfortunately many organizations lack the means to implement scalable security gates within their CI/CD pipelines, which translates to insecure code being shipped across distributed cloud environments. Contrast helps these teams drive their DevSecOps transformation with automation at scale. These new capabilities are another component to Contrast's overall mission of ensuring developers are empowered to embed security capabilities within their environments without imposing additional work on them. We want to make security a value-add for everyone." Sanjay Ramnath, Vice President of Product Management at Contrast Security Contrast enables Red Hat OpenShift users to benefit from the following capabilities: Source-to-Image Deployment: Cloud developers can embed Contrast's Assess and Protect agents into their source code image to implement continuous vulnerability detection with runtime context and help protect their apps from targeted attacks in production. CI/CD Jenkins Pipelines: AppSec teams can trigger automated security tests within native Jenkins pipelines and establish security policy gates to mitigate potential vulnerabilities. Alternatively, users can also automate in their Jenkins CI/CD pipelines by pulling the agent from Contrast. OpenShift Pipelines via Tekton: Contrast provides OpenShift users with automated tasks that can be used to create repeatable pipeline templates within OpenShift Pipelines environments. APIs provided by the Contrast Secure Code Platform help initiate automated vulnerability static scanning at build time and instrument applications for security telemetry from within prior to deployment. The Contrast Secure Code Platform is available today with support for Java, .NET, and Node.js applications. About Contrast Security Contrast Security secures the code that global business relies on. It is the industry's most modern and comprehensive Code Security Platform, removing security roadblock inefficiencies and empowering enterprise developers to write and release secure application code faster. Embedding code analysis and attack prevention directly into software with instrumentation, the Contrast platform automatically detects vulnerabilities while developers write code, eliminates false positives, and provides context-specific how-to-fix guidance for easy and fast vulnerability remediation. Doing so enables application and development teams to collaborate more effectively and to innovate faster while accelerating digital transformation initiatives. This is why a growing number of the world's largest private and public sector organizations rely on Contrast to secure their applications in development and extend protection to cloud and on-premise applications in production.

Read More

DATA SECURITY

Futurex Named a Leader in Hardware Security Modules by ABI Research

Futurex | February 25, 2022

Futurex receives top scores for cloud HSM service and strong cloud integration, extensive payment HSM platform, richest features, customer flexibility BULVERDE, Texas, February 24, 2022 — ABI Research, global technology intelligence firm, today named Futurex a leader in hardware security modules (HSMs). In its latest Hardware Security Module: OEM competitive assessment report, ABI Research gave Futurex, a leader in enterprise-class data security solutions, high scores for its cryptography-as-a-service options, extensive payment HSM offerings, rich features, hybrid deployment options, and customer flexibility. “The HSM market is changing rapidly. This is propelling highly flexible HSM offerings that can scale easily and adapt quickly to emerging demands,” the report by ABI Research reads. “Futurex showcases an extensive payment HSM platform with strong cloud integration and service availability, enabling it to carve itself a particularly successful niche in the HSM market which it is actively expanding.” “We are honored to be recognized by ABI Research as a leader in the HSM space,” said Ryan Smith, vice president, global business development, at Futurex. “Our four decades of HSM R&D, in-depth knowledge of enterprise security needs, and being the first in industry to offer cryptography-as-a-service, have made us the trusted HSM partner for the world’s largest enterprises.” Putting Innovation and Customers First ABI Research’s report highlights Futurex’s commitment to innovation by recognizing the operational flexibility and application versatility its HSMs have to offer. The report also noted that Futurex is the only company offering the same suite of features with its cloud HSM as with its on-premises hardware. With multiple payment HSM vendors currently going through end-of-life processes with their HSMs, organizations are looking for options including migrating their infrastructures to the cloud without changing any application code. As organizations look for robust security while optimizing costs with OPEX models, many turn to Futurex’s VirtuCrypt Cloud Payment HSM for their cryptographic needs. About Futurex For more than 40 years, Futurex has been a trusted provider of hardened, enterprise-class data security solutions. More than 15,000 organizations worldwide, including financial services providers and corporate enterprises, have used Futurex’s innovative hardware security modules, key management servers, and enterprise-class cloud solutions to address their mission-critical systems, data security, and cryptographic needs. This includes the secure encryption, storage, transmission, and certification of sensitive data. For more information, please visit futurex.com.

Read More

PLATFORM SECURITY

Cloudflare Completes Acquisition of Area 1 Security

Cloudflare | April 04, 2022

Cloudflare, Inc. , the security, performance, and reliability company helping to build a better Internet, today announced it has completed its acquisition of Area 1 Security. Email is both one of the largest cloud applications for any business, and the biggest security threats that organizations of all sizes face. Yet legacy email security solutions are often expensive, overly complex, and disjointed from an organization’s holistic security strategy. Further, malicious phishing and business email compromise campaigns are incredibly costly—with U.S. businesses losing more than $2.4 billion a year according to data from the FBI’s Internet Crime Complaint Center 2021 Internet Crime Report. With the acquisition of Area 1 Security, Cloudflare will provide organizations an easy way to block phishing, malware, business email compromise and other advanced threats as part of an integrated, Zero Trust approach to securing all of their organizations’ applications. “Cloudflare's mission is to help build a better Internet, and we've invested heavily in building the world's most powerful cloud network to deliver a faster, safer, and more reliable Internet for our users. Now we're officially able to welcome the Area 1 team to Cloudflare and enhance our ability to secure the number one place where security threats come from, email. To us, Zero Trust security without email built in is worth nearly zero. By bringing email security and Zero Trust together with Area 1 Security, we believe that we will give customers the most complete Zero Trust security platform available." Matthew Prince, co-founder & CEO of Cloudflare Area 1 Security’s cloud native platform, which works seamlessly with any email offering, stops phishing and other advanced email attacks by preemptively discovering and eliminating them before they can inflict damage in a corporate environment. By combining Area 1 Security’s highly scalable technology and years of experience in email protection with Cloudflare’s global network, the two companies will provide a holistic Zero Trust solution that customers can enable through Cloudflare’s global network. Area 1 Security’s email security capabilities will be available for purchase for all enterprise plan customers today, and will be available to customers on all other paid plans in the months to come. "Cloudflare delivers one of the world’s leading Zero Trust networks, and we're excited about what we'll be able to build together for our customers and channel partners," said Patrick Sweeney, CEO and President of Area 1 Security. "By joining forces, Area 1’s technology and Cloudflare's global network will give customers the most complete Zero Trust security platform available, inclusive of securing the most critical of today’s business applications – your email." About Cloudflare Cloudflare, Inc. is on a mission to help build a better Internet. Cloudflare’s suite of products protect and accelerate any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare have all web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures 2018 list and ranked among the World’s Most Innovative Companies by Fast Company in 2019. Headquartered in San Francisco, CA, Cloudflare has offices in Austin, TX, Champaign, IL, New York, NY, San Jose, CA, Seattle, WA, Washington, D.C., Toronto, Lisbon, London, Munich, Paris, Beijing, Singapore, Sydney, and Tokyo.

Read More

DATA SECURITY

Symphony Technology Group Announces the Launch of Skyhigh Security

Skyhigh Security | March 22, 2022

Symphony Technology Group (“STG”), a leading Menlo Park-based private equity firm focused on the software, data, and analytics sectors, today announced the launch of Skyhigh Security. The new portfolio company was created to satisfy the growing cloud security requirements for large and small organizations. Skyhigh Security’s unique approach extends security beyond data access to securing how the data is used. Its data-aware Security Service Edge (SSE) is built to meet the needs of the modern workforce with security that follows the data and users wherever they are. Earlier this year, STG announced it would be splitting McAfee Enterprise into two organizations—Trellix and Skyhigh Security—to better focus on the very distinct markets of Extended Detection and Response (XDR) and the SSE. At that time STG also announced that Gee Rittenhouse, who previously led Cisco’s cyber security business, would serve as CEO of the SSE business, bringing deep cloud security expertise. “Skyhigh Security has emerged as a dedicated cloud security company that is laser-focused on propelling businesses forward with a comprehensive and converged approach to data security. We’re committed to investing in this business, which is in one of the most important markets in security, SSE.” William Chisholm, managing partner, STG “With the majority of data in the cloud and users accessing it from everywhere, a new approach to security is needed,” said Rittenhouse. “Skyhigh Security has created a comprehensive security platform to secure both data access and data use via unified policies and data awareness. Organizations can now have complete visibility and control and seamlessly monitor and mitigate security risks—achieving lower associated costs, driving greater efficiencies and keeping pace with the speed of innovation.” “Organizations are at a crossroads navigating the hybrid workforce,” said Frank Dickson, vice president, IDC. “While the ‘work from anywhere’ model creates flexibility and agility, it can also be a point of security vulnerability, challenging perimeters and endpoints and opening new attack surfaces in the cloud. These organizations need a best-in-class cloud-native solution that simplifies the implementation of cloud security to protect data regardless of where it lies.” “Protecting the way data is used is as important as the way data is accessed—we must implement a powerful data-centric defense to meet the demands of how work is conducted today,” said Dan Meacham, chief information security officer, Legendary Entertainment. “Skyhigh Security’s platform approach is completely integrated and simple to use. With over 10 years focus on cloud security, they are a pioneer in the SSE space. Skyhigh Security’s innovations have been validated both by analysts and customers alike. It is truly one of the most solid and unique SSE solutions in the market today.” The Skyhigh Security SSE Portfolio includes Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), Cloud Data Loss Prevention (DLP), Remote Browser Isolation technology, Cloud Firewall and Cloud Native Application Protection Platform (CNAPP). The company was most recently named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge and recognized in the 2022 Critical Capabilities for SSE for its MVISION Unified Cloud Edge (UCE) solution. About Skyhigh Security: Skyhigh Security protects organizations with cloud-native security solutions that are both data-aware and simple to use. Its market-leading Security Service Edge (SSE) Portfolio goes beyond data access and focuses on data use, allowing organizations to collaborate from any device and from anywhere without sacrificing security.

Read More

Spotlight

The Higher Education Information Security Council (HEISC), along with EDUCAUSE and Internet2, held its annual Information Security Awareness Video & Poster Contest, an event that allows college students to win prizes, gain experience, and earn recognition by creating a PSA about information security.
HEISC works to improve information security & privacy programs across the higher education sector

Resources