On 29 July 2019, Capital One disclosed a digital security incident in which an outside individual gained unauthorized access to its systems. That party then leveraged their access to obtain the personal and financial information of Capital One cardholders as well as of individuals who at one point applied for a credit card. Overall, the bank holding company estimated that the breach affected 100 million Americans as well as six million Canadians.
For the 14th consecutive year, IBM Security released its annual Data Breach Report that examines the financial impact of data breaches on organizations. According to the report, the cost of a data breach has risen 12% over the past 5 years to $3.92 million per incident on average. These rising expenses are representative of the multi-year financial impact of breaches, increased regulation and the complex process of resolving criminal attacks.
Companies of all sizes are learning that when it comes to keeping their digital assets safe; being able to monitor what’s going on within their environments makes all the difference. Unfortunately, those same companies have struggled with basic fundamentals such as maintaining accurate asset inventories and deploying the right technology on those assets to gain visibility into their security posture – two components critical to the effectiveness of traditional visibility programs.
The recent Tripwire blog ‘7 Habits of highly effective Vulnerability Management’ by Tim Erlin was a great read with some sage advice on the always relevant security topic of VM. I noticed, however, that although the seven points themselves were all Tim’s own, the title snappily paraphrased Steven Covey’s classic management book. This made me think.
Are you going to Black Hat USA 2019? If you are, you’re no doubt counting down the days until 3-8 August when you can join the thousands upon thousands of security professionals at the Mandalay Bay Resort and Casino in Las Vegas, Nevada. But if you’ve been to any of its other 21 iterations, you probably know that this conference can be a bit overwhelming if you don’t know what you’re doing. That’s why it’s good to go in knowing all that you can do as an attendee.
With access to more resources than ever before, cybercriminals are rapidly scaling their operations, making every organization a potential target for a cyberattack. And, they are constantly shifting their tactics to exploit new vulnerabilities and slip past perimeter-based controls undetected. Meanwhile, the longer a threat goes undetected in a network environment, the greater the potential for damage through a security breach, data loss, or business downtime and disruption.
The recently discovered BlueKeep RDP vulnerability reminds us yet again (as if needed to be reminded) that monitoring RDP is not a luxury but an absolute necessity. Many organizations still expose RDP ports to the Internet, making it a prime target for attacks. But even when RDP is only available internally it can still pose a threat – especially for large networks.
Cybersecurity is finally reaching the shop floor in earnest thanks to new technology that works with—not against—the legacy equipment that runs most industrial control systems (ICS). That being said, industrial companies and organizations in sectors like manufacturing, energy, utilities, transportation and water treatment can be slow to adapt to the new cybersecurity tools at their disposal because they present a new way of operating in an industry that’s set in its ways.
