bsw226

Business Security Weekly Episode #226 – August 02, 2021

Subscribe to all of our shows and mailing list by visiting: https://securityweekly.com/subscribe

1. OT Security for Critical Infrastructure and Why It Is Not “Intuitive” – 03:00 PM-03:30 PM

Announcements

  • SC Media debuts its all-new SC digital experience, fully integrated with Security Weekly podcast content and more. The new site increases the scope and scale of original content resources from editorial staff, contributors, and the far-reaching CyberRisk Alliance network. Visit www.scmagazine.com to check out the new look!

  • If you missed any of our previously recorded webcasts or technical trainings, they are available for your viewing pleasure at https://securityweekly.com/ondemand

Description

The IT and operational technologies of critical infrastructure are under attack. The “general expectation” from the public and lawmakers is “fix it already” but we will discuss why this expectation is yet to be fully met.

Guest(s)

Edward Liebig

Edward Liebig – CISO at Delviom LLC

With more than four decades in IT and over three of those decades spent in Security, Mr. Liebig is highly experienced executive leader well trained at establishing threat metrics/risk profiles and strategizing their IT and cybersecurity solutions from idea through implementation. Skillful negotiator of multi-million-dollar contracts boosting infrastructure, organizational efficiency, and eliminating down time. Metrics driven, with a pinpoint in problem solving acumen.

Hosts

AdrianSanabria

Adrian Sanabria

@sawaba

Senior Research Engineer at CyberRisk Alliance

JasonAlbuquerque

Jason Albuquerque

@Jay_Albuquerque

Chief Operating Officer at Envision Technologies

JoshMarpet

Josh Marpet

@quadling

Executive Director at RM-ISAO

2. The State of Cybersecurity & Destigmatizing Reporting Security Vulnerabilities – 03:30 PM-04:00 PM

Announcements

  • CyberRisk Alliance, in partnership with InfraGard, has launched the Critical Infrastructure Resilience Benchmark study. Measure your readiness for ransomware by completing the survey and getting your score. Visit https://securityweekly.com/CIRB to take the survey

  • Security Weekly Unlocked will be held IN PERSON this December 5-8 at the Hilton Lake Buena Vista!

    We are excited to announce our first round of speakers: David Kennedy, Alyssa Miller, O’Shea Bowens, Marina Ciavatta, Patrick Coble, Chris Eng, Eric Escobar, Kevin Johnson, and Justin Kohler!

    Visit https://securityweekly.com/unlocked to register and check out our rockstar lineup!

Description

In the Leadership and Communications section for this week: 10 security tools all remote employees should have, 1 in 4 security teams report to CIOs, but would benefit from CISO leadership, state of cybersecurity survey results, destigmatizing reporting security vulnerabilities and more!

Hosts

AdrianSanabria

Adrian Sanabria

@sawaba

Senior Research Engineer at CyberRisk Alliance

  1. 10 security tools all remote employees should have – This article has an interesting mix of both personal and enterprise recommendations, which seems appropriate, given that the lines have blurred for remote and hybrid employees.
    1. Cybersecurity training
    2. Digital wallets
    3. Credit/digital identity monitoring
    4. Password managers
    5. Two-factor tokens
    6. Antimalware software
    7. VPN services
    8. Backup solutions
    9. Privacy screens
    10. Laptops, phones, network hardware
  2. 1 in 4 security teams report to CIOs, but would benefit from CISO leadership: survey – There appears to be a bit of a disconnect between how CIOs and CISOs perceive security prioritization, according to this survey of 3000+ security professionals. The clearest insight coming out of this article is that nothing is clear when it comes to the ideal placement of the CISO within an org structure, because business needs can vary so wildly.

    “Sixty-one percent of the CIOs surveyed believe their board of directors prioritizes cybersecurity, whereas only 47% of CISOs say the same.”

    “When the CISO is at the top of the security reporting structure, companies likely have greater executive buy-in for risk assessments and cybersecurity-business goals alignment.”

  3. Preparedness, checklists, leadership buy-in: How to build a rapid IT response – The article fails to achieve what it suggests in the title, but rightly puts a lot of emphasis on preparedness and practice. Instead, I want to share some interesting insights from a recent post on LinkedIn from Ian Amit. He observed a cyber crisis simulation that was part of Israel’s annual CyberWeek events. His observations:
    1. “Processes are completely lacking… Experts were sidelined by more vocal people”
    2. “Business interests… sidelined the discussion… causing delays in decision making”
    3. “3 key individuals were professional and backed by a methodical process… were overrun by others… 2 of which were women… men were cutting them off and offering an explanation to what they were saying”

    The original post is here: https://www.linkedin.com/posts/iamit_observing-a-cyber-crisis-simulation-as-part-activity-6822882236627464192-0QYL

  4. CSO Global Intelligence Report: The State of Cybersecurity in 2021 – “Any lingering indifference to cybersecurity risk has evaporated in the face of spiking ransomware attacks, software supply chain threats, and the challenges of securing remote workers.”

    So… what do we do next? According to the results of a wide-ranging survey (2741 respondents):
    1. spend more, particularly in “attack prevention”!
    2. half of respondents are either just getting started with security awareness programs, or haven’t started yet
    3. double down on what they’ve been doing already

  5. See something, say something: How to destigmatize reporting security vulnerabilities – Kaseya employees tried to blow the whistle on internal security risks but were ignored and mistreated. Many quit or were fired as a result. How can organizations usher in a culture that can accept criticism without angrily lashing out? How should employees deal with this: is it worth getting fired over? Should they risk going outside the company to report serious issues?
JasonAlbuquerque

Jason Albuquerque

@Jay_Albuquerque

Chief Operating Officer at Envision Technologies

JoshMarpet

Josh Marpet

@quadling

Executive Director at RM-ISAO