An insider threat is defined as a security risk that derives from within an organisation; and with the global cost averaging $11.45 million, it is critical that organisations address this issue. Frequently, the risk is attributed to malicious or negligent employees, as well as others close to the organisation, such as contractors and business associates, and think that employee monitoring software will prevent threats. Yet, this understanding of insider threats misleadingly unloads the blame on people; in other words, exposing them as the scapegoat.

Javvad Malik is a Security Awareness Advocate at KnowBe4.

While there are people who do actively seek to harm an organisation, according to the Ponemon Institutes 2020 Cost of Insider Threats Report, they only account for 23% of insider threats. The majority of people can be easily trained to become an asset rather than a liability for the organisation.

Rather than blaming people then, why are we not shifting our attention to the root of the problem? That is to say, security software.

Whether embedded with vulnerabilities, corrupted by governments, or used as a channel to harvest data for a profit, the use of security software at present is riddled with problems.

One of the largest and most commonly used security software providers, is the Czech-based company, Avast antivirus, with more than 435 million active users across 59 countries employing their antivirus protection. However, until the end of January 2020, Avast was also furtively gathering data from their users and selling that data on to third-party customers through their subsidiary, Jumpstart. In that sense, they have been working as a double agent against the very people who had entrusted them with their internet security and, specifically, their privacy.

In many cases, the software itself is faulty. According to the Veracode SOSS Report Vol. 10 published last year, around 10 million flaws were found across 85,000 applications and 83% of those applications had at least one flaw in the initial scan. Out of those flaws, 20% were marked high or very high severity. It is precisely through exploiting such vulnerabilities that bad actors are able to infiltrate an organisation and access its data.

Complicating things further, the sheer scale and complexity of vulnerabilities makes it that much harder to verify if a system has or has not been patched. Indeed, the majority of data breaches (60%) occur because software vulnerabilities were left unpatched. The Equifax data breach of 2017 and the Marriott breach in 2018 are two exemplars of this occurring, collectively exposing over 640 million records.

In certain instances, the government gets involved, and not in a way that resolves infringements on privacy rights or apprehends the criminals behind attacks. Rather, they themselves are the offender. The attacks carried out by APT5, otherwise known as Manganese, on high-end enterprise VPN servers are a clear example of this.

Since August 2019, it was revealed that Chinese state-sponsored hackers performed internet scans in search of Fortinet and Pulse Secure VPN servers. They then attempted to exploit two vulnerabilities within these VPN servers to gain access to files without the need for authentication. In this way, allowing the hackers to acquire access to passwords and VPN session data from vulnerable devices. The Iranians are not too far behind either. A report by cybersecurity firm ClearSky revealed that Irans government-backed hacking units have made it a priority to exploit VPN bugs as soon as they become public.

Fortinet and Pulse Secure VPN servers are both widely used, with hundreds of thousands of customers. More specifically, Pulse Secure is popular amongst numerous Fortune 500 companies, including some of the largest technology firms and government agencies. Their use of a VPN server is, primarily, to protect their internal servers from unauthorized access. Yet, if they fail to do so, how can we then turn around and blame the employees when a breach occurs?

Finally, there is scareware. As is implied by the name, scareware is a form of phishing that gambles on your fear and perception of an impending threat. Through a pop-up ad, cybercriminals send warnings suggesting that your computer is infected with malware or that it is running slow. They then capitalize on your concern and panicked reaction to provide a solution.

However, the solution, a fake or a bogus update, enables the bad actor to access your data and install malware on your computer, perhaps even ransomware. In this type of scenario, it is easy to point the finger at the individual who clicks on the ad, but what about the security software providers who let it happen? Is it not the responsibility of security software programs to identify malicious ads and block them from popping up on the screen?

In the end, we are left to wonder what the real insider threat is. All this time, people have been described as the weakest link and held responsible for exposing organisations to insecurity. Yet, looking at the evidence, the problems seem to stem from security software and their providers. Considering that they are the ones who are supposed to protect us, both individuals and organisations, from a cyberattack, it is rather ironic that they are, in reality, the problem.

Read the original post:
The real insider threat is the use of security software - TechRadar

EFF and its members work to ensure that technology supports freedom, justice, and innovation for all the people of the world. The COVID-19 pandemic has made obvious how important the Internet and digital tools are to our lives and how vital it is that we maintain an open and secure approach to them.

For those of us living under quarantine, shelter in place orders, or just staying home to voluntarily help protect our communities, we now rely on the Internet and digital tools more than ever to share information and advice, create art and memes, listen to our favorite musicians perform live, or just to feel less alone. We see how technology is helping us cope, hopefully temporarily, with the loss of in-person contact. Many others are using digital tools and services to organize mutual aid for their neighborhoods and communities in this time of crisis.

When fear threatens to undermine our rights and pervert justice, thats where EFFand youcome in.

Thanks to open access science, scientific and medical teams are able to instantly share their work and build on efforts to track the virus, study its effect on people, and develop vaccines. Others are developing ways to create and repair vital medical equipment using open tools, including reportedly 3D printing. We are coming together online and offline in new and creative ways, and ensuring that security, privacy, and openness are baked into the tools and services we use will only support our efforts.

In some ways, the explosion of open creativity online to keep us connected and sane during these scary times is one of the bright spots in the darkness. But in the United States, it also shows how this crisis disproportionately impacts those of us who are marginalized in society alreadythe unsheltered, those who cannot afford or access reliable broadband service to continue school or work, the consultants and retail workers who have little reserves, and all of those falling through our frayed social safety net. Innovation is needed here toolike ensuring that robust broadband access works for everyone, not just the wealthy, and is not dependent on temporary largess of some giant providers.

We also know that times of great public fear come with great risk. Public fear has driven some of the worst human rights atrocities, and given opportunities for those who would seize power from us and reduce or even erase our hard-won human rights and civil liberties. Already we see efforts to use this public health crisis as an excuse to place irrational blame on our Asian communities and direct even more pressure and discrimination against refugees and immigrants. We already see calls from companies seeking to cash in on this crisis for unchecked face surveillance, social media monitoring, and other efforts far beyond what medicine or epidemiology require.

When fear threatens to undermine our rights and pervert justice, thats where EFFand youcome in.

We know that this virus requires us to take steps that would be unthinkable in normal times. Staying inside, limiting public gatherings, and cooperating with medically needed attempts to track the virus are, when approached properly, reasonable and responsible things to do. But we must be as vigilant as we are thoughtful. We must be sure that measures taken in the name of responding to COVID-19 are, in the language of international human rights law, necessary and proportionate to the needs of society in fighting the virus. Above all, we must make sure that these measures end and that the data collected for these purposes is not re-purposed for either governmental or commercial ends.

As we head further into these difficult times, EFF is standing strong to make sure that we both take advantage of how technology can help us now and, equally importantly, that we emerge from this time with our freedom and democracy as strong, if not stronger, than when we went in. Because we at EFF have a committed membership as our primary support over half of our annual budget comes from individuals we are able to pivot our attention to these issues even as we continue our ongoing fights. Our lawyers are scrutinizing the proposed laws and regulations and corporate privacy moves, especially the growing and concerning raft of corporate/government surveillance efforts. Our technologists are digging into the digital tools we all rely on during this crisis to make sure that your privacy is protected. Were pushing to lower artificial barriers to information sharing, and working to make sure that access to knowledge is one of the things we keep as we emerge from these times. And more.

We have created an issue page dedicated to our COVID-19 focused work and will continue to highlight our efforts there, as well as publish needed practical information about how to fight COVID-19 phishing attempts and how to show your EFF support as we head into our 30th year of standing strong for your rights.

Right now, when real science is so often under attack, those of us who care about truth, health, and each other need to take seriously the things that science and medicine are telling us about how to keep this virus from spreading. And we also need to be vigilant so that we come out the other side of this crisis with a society we want to live in and hand down to our kids. We canand mustdo both.

EFF is proven, ready, and strong. With the support of our members, new and old, well be there with you every step of the way.

Visit link:
EFF and COVID-19: Protecting Openness, Security, and Civil Liberties - EFF

By PAULINE KAIRUMore by this Author

The Covid-19 coronavirus pandemic has drastically changed life as we know it.

In Kenya, where the number of confirmed cases had reached 15 by the time of going to press, the government asked employers to allow staff to work from home.

In addition, all learning institutions have been shut down as students go online and to the radio for lessons and homework.

Remote interactions and e-commerce have emerged as valuable contingent options amid the pandemic, which is projected to cause one of the biggest economic recessions in recent times.

Microsoft announced that it is offering its Microsoft Teams collaboration platform, for free, to companies to make remote working possible.

Corporate vice president for Microsoft 365 Jared Spataro said, At Microsoft, our top concern is the well-being of our employees and supporting our customers in dealing with business impact during these challenging times. By making Teams available, we hope that we can support public health and safety by making remote work even easier.

In Kenya, Safaricom and Nation Media Group said they had acquired and were providing laptops, dongles and tech tools to their employees.

Safaricom said over 95 per cent of its workforce has been asked to work from home.

We will be engaging collaboration tech tools such as Microsoft Teams, WebEx, Yammer & Cisco Jabber to enable teams that would ordinarily be required to work from a certain location to work remotely, the companys chief human resources officer, Paul Kasimu, said.

Safaricom also announced on Tuesday that it was doubling its internet speeds for home fibre packages at no extra cost.

Nation Media Group under the Safe Nation mantra, last week rolled out the business continuity plan for remote working protocols.

NMG systems administrator Sicily Rugendo, said, We are connecting our teams to VPN, a vital tool for internet security, especially when you are working from home, which will allow secure remote access to corporate resources.

We are enabling e-mail connectivity to different software systems, and giving them interactive tools like Skype-for-business, to enable people hold meetings remotely, Ms Rugendo added.

The Kenya Association of Manufacturers has launched an online directory for locally manufactured goods to help Kenyans shop online and have products delivered to their homes or shops.

We are doing this to forestall disruptions in the market, said the associations chief executive Phyllis Wakiaga.

The Ministry of Education assured parents and pupils of continuation of learning following the closure of schools.

The Kenya Institute of Curriculum Development said it would deliver the curriculum through YouTube, the Kenya Education Cloud, radio and television starting Monday.

The ministry will broadcast programmes daily, from Monday to Friday, through Radio Taifa and English Service.

Originally posted here:
Technology saves the day as Kenyan firms send staff to work from home - The East African

"Security Software in Telecom Market"

Global Security Software in Telecom Market Research Report: Information by Component [Solution (Identity and Access Management (IAM), Risk and Compliance Management, Encryption, Data Loss Prevention (DLP), Unified Threat Management, Security Information and Event Management (SIEM), Distributed Denial of Service Mitigation (DDoS) and Firewall)

Security Software in Telecom Market Research Report- Forecast till 2025

Market Highlights

Due to the massive expansion of LTE networks, the customers have been experiencing seamless connectivity across the globe. It has given a significant opportunity to the telecom industries to expand their networks and penetrate in urban, rural, and remote areas. Furthermore, a perpetual increase in the usage of internet, increasing need demand for data services, and rising adoption broadband adoption are some of the critical drivers for the telecom industry. The development of networks has also resulted in a higher number of cyber-attacks in the telecom industry. The Global Security Software in Telecom Market 2020 was valued at USD 3,599.4 million in 2018 and estimated to expand at a CAGR of 11.9% with a value of USD 8,923.5 million by 2025.

Telecom operators have often experienced attacks while signaling, metering, switching, and configuring the network. The increasing number of cyberattacks has motivated the security providers to develop a sustainable solution for the enterprises. Hence, the increase in data breach incidents has led to the demand for establishing secure networks.Inadequate infrastructure and inexpensive security solutions to implement IPV6 technology, which is the most recent version of internet protocol, are some of the factors that are hindering the expansion of security software in the telecom market.

Get a Free Sample @ https://www.marketresearchfuture.com/sample_request/6961

Segmentation:

By component, the security software in the telecom market is classified into solutions and services.

By solution, the security software in the telecom market is segmented into identity and access management (IAM), risk and compliance management, encryption, data loss prevention (DLP), unified threat management, security information and event management (SIEM), distributed denial of service mitigation, firewall, and others.

By services, the market is categorized into professional services (risk assessment, design and implementation, support and maintenance, and others) and managed services.

By security, the market is segmented into network security, endpoint security, application security, cloud security, and others.

By deployment, the market is segmented into the cloud and on-premise.

By end-user, the market is segmented into large enterprises, small and medium enterprises (SMEs), and government.

Regional Analysis

The global security software in the telecom market has segmented into Asia-Pacific, North America, Europe, the Middle East & Africa, and South America.

North America is estimated to dominate the security software in the telecom market. It has also been anticipated that it will retain the market during the forecast period. The advent of new technology and adaptation to it has led to considerable growth in the market. The rise in the deployment of IoT and the existence of internet-enabled solutions and cloud services have led to significant exposure to global security software in the telecom market. Canada and the US are facing a higher number of cyberattacks in the telecom sectors, which is one of the most significant reasons which increases the demand for security software.

Asia-Pacific is estimated to be the fastest-growing telecom market during the forecast period. With fast digitization, along with the developments in IoT and cloud computing has created a higher risk of cyber-attacks and security breaches. It resulted in a higher demand for global security software in the telecom market. It has encouraged the service providers to develop security solutions efficiently for the telecom operators. Countries like India, Japan, and China are growing at a faster pace, and hence, they contribute to the expansion of the market in the APAC region. Moreover, the increasing cyber-crime and strict government rules and regulations are speculated to increase the demand, thereby growing the market in the APAC region.

Key Players

The prominent players of the global security software in telecom market are Symantec Corporation (US), IBM Corporation (US), Palo Alto Networks (US), Dell Inc (US), McAfee (US), and Trend Micro (Japan) Inc. are few of the most eminent players who contributed about 40% of the market share in 2018.

Other players like Check Point (US), Splunk (US), Amazon Web Services (US), Imperva (US), Qualys (US), F-Secure (Finland), HP Enterprise Development LP (US), FireEye (US), Oracle Corporation (US), Forcepoint (US), Fortinet (US), Microsoft Corporation (US), Proofpoint (US), F5 Networks (US), CyberArk (Israel), Sophos (UK), Juniper Networks (US), and, FireEye (US) have also played a key role and have secured position on the global security software in telecom market.

Browse Complete Report @ https://www.marketresearchfuture.com/reports/security-software-telecom-market-6961

Global Security Software in Telecom Market Research Report: Information by Component [Solution (Identity and Access Management (IAM), Risk and Compliance Management, Encryption, Data Loss Prevention (DLP), Unified Threat Management, Security Information and Event Management (SIEM), Distributed Denial of Service Mitigation (DDoS) and Firewall) and Services (Managed Services and Professional Services)], Deployment Mode (Cloud and On-Premise), Security Type (Network Security, Endpoint Security, Application Security and Cloud Security) and Region [North America (the US, Canada, Mexico), Europe (Germany, the UK, France, Italy, Spain and Rest of Europe), Asia-Pacific (China, Japan, India and the Rest of Asia-Pacific), the Middle East & Africa and South America] - Forecast till 2025

Media ContactCompany Name: Market Research FutureContact Person: Abhishek SawantEmail: Send EmailPhone: +1 646 845 9312Address:Market Research Future Office No. 528, Amanora Chambers Magarpatta Road, Hadapsar City: PuneState: MaharashtraCountry: IndiaWebsite: https://www.marketresearchfuture.com/reports/security-software-telecom-market-6961#summary

See original here:
Security Software in Telecom Market is Growing Rapidly Due to Increasing Internet Penetration - Press Release - Digital Journal

In a previous post, I shared some expert insight into how organizations can address the challenges of hiring skilled talent despite the ongoing infosec skills gap. Organizations cant rest easy once theyve brought on new talent, however. They need to make sure they hold onto their existing workforce.

Thats easier said than done. Cybersecurity Ventures forecasted that a total of 3.5 million infosec-positions will be unfilled in 2021. Clearly, skilled infosec professionals have plenty of other places to go should they be unhappy with their current employer.

Acknowledging that reality, we at the State of Security asked security experts to weigh in on the impact of the infosec skills gap on existing security teams. We then asked them to share their thoughts on how organizations can keep their current teams intact. Heres what they had to say.

Its challenging. I accept that there will always be four times more work than I have resources. My mantra is to prioritize. Make sure we are working on the highest risk, the most likely security issues, and communicate the residual risk.

The other solutions are extending the responsibility for protecting the business into all parts of the business. I deputize people onto the cybersecurity team, and I recognize that people bring cybersecurity issues and solutions. I even have silver deputy badges that I found on Amazon for .50 each that I hand out with a certificate of recognition. I love walking by peoples cubes and seeing them pinned on the wall!

There is also an opportunity to leverage low tech solutions like easy-to-find and easy-to-follow security cheat sheets, so people whose core competency is customer service, legal, or administration can know how to do things securely without being frustrated or inadvertently causing a security incident.

The infosec skills gap impacts security teams today by putting additional stress and reliance on specific personnel who have attained the necessary skillsets to perform at peak. In many cases, thats only one or two individuals. This can create a potential single point of failure, putting stress on hiring managers to fill that gap.

One solution to the infosec skills gap problem is to reach out to Market Vendors for readily available SAAS solutions. Other options include onsite or remote contract staff as well as customized support options with SLAs that can assist with daily cybersecurity support operations and maintenance. After all, sleeping peacefully at night leads to less stress and better health.

Despite constantly fighting for bandwidth, the really successful small security teams Ive seen have mastered processes and constant improvement to win out more often than not.

How that works in reality varies from business to business, but it can generally be summarized by having a program of small improvements that can be constantly assessed and scored, thus providing evidence to the rest of the business that the team is busy but successful. For example, having the team focus on a single area of improvement (implementing improved password policies, hardening software firewalls, etc) and making sure they can measure the number of devices touched and the number of configuration changes made helps justify new team hires as well as keeping forward momentum. (Hopefully, these different effects are tracked already by your compliance tools, so measuring your success shouldnt take any extra human bandwidth.)

In terms of processes, making sure that your response is consistent, well-documented and easy to do (preferably by multiple team members so processes dont break down simply due to short term staff absences, etc) can be the difference between beating the influx of new risks and challenges and collapsing under a deluge of repetitive and inefficient workflows. The people closest to the problem should also be closely involved in developing those processes to make sure they really can be achieved, too!

Discussions about the infosec skills gap often focuses on hiring, training, or outsourcing. Those are a few ways to fill the gap, but how do you stop the gap from widening at your organization? Keeping talent is just as important as bringing it in, and when demand is high and supply is short, keeping talent isnt easy. It isnt just about money, either. There will always be another company who can pay more, which is why culture, personal development, and a reasonable workload are just as important. Remember Daniel Pinks keys to motivation in his book Drive. Everyone seeks mastery of their domain, autonomy in their work, and purpose for what they are doing. Its less costly to keep a person than to hire one.

Of course, you could always outsource, a decision which comes with its own sets of pros and cons.

My thoughts are akin to Schrdingers cat. There is both a skills gap and not a skills gap. By that I mean that there is potentially an infosec skills gap and that hiring practices are not helping. These two factors culminate in a situation where jobs are not being filled.

Nothing I am saying is new.

Barriers to entry and hiring are multifaceted issues. Lets consider the following:

Job postings appear to request skills that are both beyond what is needed for the role and that require a high amount of years of experience. This potentially screens candidates from being reviewed and prevents others from applying.

Infosec is a large space, as demonstrated by the number of certifications in our industry. As a result, newcomers to our field might not know which skills are foundational to having a career in information security, while HR might not have an accurate understanding of what skills are needed for which roles.

Many companies exhibit a lack of communication on the status of an application after someone has applied.

Diversity (or lack thereof) also plays a role here

This infosec skills gap or ineffective hiring process is also creating multiple issues downstream:

Companies are becoming increasingly tool heavy due to an effort to counteract the lack of human analysts on the ground. However, good intentions dont mean that tools are deployed effectively and or that alerts are reviewed as often as they need to be.

The current talent begin to lose their skills as they become dashboard warriors instead of spending their time tuning and managing tools.

Companies are becoming more vulnerable to digital threats as it becomes harder for them to fill security positions.

For the short term, security teams can attempt to manage these issues by focusing on defense in depth and foundational controls, as found in most frameworks:

Asset management Hardware & Software

Multiple Factor Authentication (MFA)

Secure configurations and baseline images

+ many others from your framework of choice

Make sure youve got the basics nailed down. You can get to the fancy stuff later. Also, there are lots of free resources available. Seek those out. One of my faves is https://www.globalcyberalliance.org/.

Another very important skill is communication. Many technical folks do not necessarily understand the impact that security can have to the operation of their organization. An organization is never going to be 100% secure, so it is very important to understand the tradeoffs in minimizing risk while maintaining optimal business efficiency. This is another area that organizations should spend time training their teams on. Part of the onboarding process should include some training on what it is that the business does as well as ongoing training of the organizational goals and progress towards those goals.

Small teams typically outsource many of their security functions to managed service providers or managed security service providers. When selecting these providers, it is also key to select providers that can integrate the business goals of the organization to the management of their security tools. Focus on implementing security tools with metrics that can clearly help to identify the risk to the business and activities that mitigate that risk. For example, reporting on the number of missing patches means nothing to the business, but reporting on the risk vulnerabilities and insecure configurations present to the organization can show both the current risk posture and the impact a patching program has on mitigating the risk to the business.

Only when maintaining an open dialog of communication can these goals be achieved together.

Small, stretched in-house teams should look to the use of smart technology and automation where they can. Whilst there are a lot of unknowns and variables with cyber detection and defence that will always require a degree of professional judgment, there are also plenty of known knowns which can be automatically defended against. In-house teams should also look to establish arrangements with trusted external partners upon whom they can offload specialist activities and whose skills they can use as required rather than trying to retain them in-house.

Its really important to show that you care about your employees. One of the ways you can do that is by providing training for them, having one-on-ones with them, finding out what their goals are, and creating a roadmap together. Of course, you want to see them go and hit that goal. With that said, the best thing you can do to make that happen is to be that manager who wants to see their employees succeed and who cheers them on the entire way.

Now its also important to have a conversation with your team about work and life balance because burnout is prevalent in InfoSec. Burnout is a mental health issue. When someone on the security team feels burnt out, it puts the security posture of the company at risk. With that said, please take care of your employees and show them that you care.

Many companies are looking for qualified staff due to the security and compliance concerns mandating that job roles be filled. This has increased the pressure on cybersecurity teams to wear multiple hats within an organization. This skill gap also creates particular roles that can become very focused, the exact opposite of the first issue, and can silo roles into doing one area of security. This creates an ebb and flow when looking for people. The culture of career development will look different in each scenario.

The infosec skills gap will continue to widen as security becomes everyones concern. Many times, we see teams with a small security team thats focused full-time on security but that also has a culture of security spread throughout various groups. This allows for a team to have a smaller full-time security team with the greatest reduction in risk.

Create diverse and inclusive teams that approach security in a holistic and proportionate way. This teams should do the following:

Include all departments,

Effectively train consumers on their roles and responsibilities in the cyber defence team,

Embed intrinsic motivators,

Enhance existing team members skills,

Build a culture of trust and understanding where questions are welcomed, and

Hold formal learning sessions where its safe to speak up for the purpose of creating a continuous improvement programme.

One of the major barriers on the infosec skills gap is simply knowing where to start. There are many avenues of information security, each with their own complexities that need to be understood. IT departments are tasked with defending endpoints, network devices, applications, the cloud, and more. Gartners Adaptive Security Architecture makes a great visualization on how complex protecting each one of these avenues can be. From a high level, it outlines that first, you need to create a baseline of what you have in your environment, harden what you know about, detect what you cannot harden, and respond to anything that is detected.

Information security teams that are feeling outstretched need to simply get back to the basics. The Pareto Principle fits into the value of defensive architecture. The rule states that 80% of the effects come from 20% of the causes. Relating that to information security, we can state that 80% of cybercrime type attacks can be mitigated by 20% of the defensive techniques we can take. The Center for Internet Security (CIS) did a study and found that one could stop up to 85% of attacks by simply implementing the first five of their Critical Security Controls. These five controls are basic and foundational measures such as simply having a baseline of your system and applying hardening benchmarks to your machines.

Read the original:
How Organizations Can Retain Talent Amidst the Infosec Skills Gap - tripwire.com