Cloud Hosting

Now is a great time to review your security posture, as you havea new tool to help you. On May 18, 2021, the Center for InternetSecurity (CIS) released Version 8 of its CIS Controls, formerly knownas the CIS Critical Security Controls (and often called the"CIS Top 20").

CIS intends the new version to better address some of the majordevelopments in IT and cybersecurity over the past several years,including the movement to cloud solutions, increased mobility, andnormalization of remote work. CIS is also updating the ecosystem oftools that support the Controls, including self-assessment toolsand a method for risk assessments that helps to justify securityinvestments.

The Version 8 update is likely to garner a lot of attention fromcompanies looking to address the "reasonable security"requirements referenced in California law (see Cal. Civ. Code1798.81.5(b), 1798.150(a)(1)), including in the forthcomingCalifornia Privacy Rights Act (CPRA), as well as numerous otherstate laws.

Then-California Attorney General (now Vice President) KamalaHarris concluded in her 2016 data breach report that anorganization's failure to implement all applicable CIS Controls"constitutes a lack of reasonable security." Since thatreport, many companies have used the CIS Controls as a primary wayfor evaluating their compliance with reasonable securityprovisions.

At their core, the CIS Controls are a list of security bestpractices similar to security frameworks such as NIST 800-53 andthe ISO 27000-series. Prior to Version 8, the CIS Controls wereorganized into 20 top-level controls that addressed, for example,access control, vulnerability assessment, audit log maintenance,and other foundational controls that mitigate security risk. Eachtop-level control includes specific "safeguards"(previously called "sub-controls"), which are actions,tools, or other resources that support the top-level control.

The key difference between the CIS Controls and other frameworksis their organization of the controls into "ImplementationGroups" (IGs), which define a set of recommended securitycontrols based on risk. Organizations may choose the IG appropriateto their risk and budget, then implement the controls listed forthat IG.

This grouping makes the CIS Controls an attractive option forbusinesses of varying sizes and risk profiles, including small- andmedium-sized businesses focused on basic cyber hygiene anddefense.

In addition to creating IGs, Version 8 consolidates severaltop-level controls, thereby reducing the total number from 20 to18, renames many of the controls, and reorganizes the relationshipbetween the controls and many of their underlying safeguards. TheVersion 8 safeguards place much more emphasis on mobile and cloudsecurity than prior versions' sub-controls.

In large part, these changes reflect CIS's goal of focusingmore holistically on system and asset security-regardless of wherethose systems or assets reside (within the corporate network, inthe cloud, at an employee's home, etc.) and which IT teamsmight be responsible for them. For example, Version 7.1 has acontrol specifically for "Wireless Access Control," whichincludes a sub-control to "Leverage the Advanced EncryptionStandard (AES) to Encrypt Wireless Data" (among others).

In Version 8, there is no control singularly focused on wirelesssecurity. Instead, wireless safeguards are dispersed throughout,and encryption of wireless traffic is rolled into a more generalsafeguard to "Encrypt Sensitive Data in Transit" underthe "Data Protocol" control. Version 8 notes that"[p]hysical devices, fixed boundaries, and discrete islands ofsecurity implementation are less important" in computing nowthan they were when prior versions were adopted.

New data privacy and security laws are increasing pressure onorganizations to adopt "reasonable" security controls forpersonal data. For instance, the New York Stop Hacks and Improve Electronic DataSecurity (SHIELD) Act, which went into effect in March 2020,requires businesses to "implement and maintain reasonablesafeguards to protect the security, confidentiality and integrityof the private information."

On the other side of the country, the CPRA will updateCalifornia law as of January 1, 2023, to require "[a] businessthat collects a consumer's personal information [to] implementreasonable security procedures and practices appropriate to thenature of the personal information to protect the personalinformation from unauthorized or illegal access, destruction, use,modification, or disclosure in accordance with Section1798.81.5."

Likewise, the Virginia Consumer Data Protection Act, which alsobecomes operative on January 1, 2023, requires businesses to"[e]stablish, implement, and maintain reasonableadministrative, technical, and physical data security practices toprotect the confidentiality, integrity, and accessibility ofpersonal data."

The White House, too, has joined the fray with its recent Executive Order on Improving the Nation'sCybersecurity (which we previously covered here). Intentionally or not, Version 8'smore holistic approach to security and increased emphasis on cloudand mobile technologies echoes many provisions of the ExecutiveOrder.

Among other things, the Executive Order directs the governmentto accelerate its movement to cloud systems and to adopt"zero-trust architecture" (ZTA), a security model thatchallenges the traditional notion of a security"perimeter" and focuses on the defense of computingassets wherever they reside.1Government contractors and suppliers who may need to shift towardscloud-based systems and ZTA-based security might consult the newCIS Controls to evaluate and develop their security programs.

Organizations of all sizes face some degree of informationsecurity risk to confidential or personal data. CIS ControlsVersion 8 makes mitigating those risks even more accessible andprovides a great excuse to take account of your securityposture.

Footnote

The National Institute of Standards and Technology (NIST) statesthat ZTA's "focus on protecting resources rather thannetwork segments is a response to enterprise trends that includeremote users and cloud-based assets that are not located within anenterprise-owned network boundary."

Originally published 05.24.21

The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances.

Read the rest here:
Center For Internet Security Updates CIS Controls With Focus On Cloud, Mobile, And Remote Work - Technology - United States - Mondaq News Alerts

Read More..

If someone broke into your home, and held all of your possessions to ransom, you would call the police.Right?

Or would you quietly pay whatever sum the thieves were demanding, and get your life back as quickly and easily as possible?

It might be a simple enough decision in a real-world scenario, but when it comes to cyber crime and ransomware, it seems to be much more complex.

Big companies can make good targets for cyber criminals who, in some cases, can extort millions of dollars with a pretty simple operation.

Ransomware attacks often see cyber criminals steal and encrypt data, or damage internal networks, and demand money to undo it.

More Australians are alert to the threat of cyber attacks but are we doing enough to prepare against the threat?

They might even threaten to publish sensitivestolen information, or offer it to competitors.

Sometimes paying the ransom can be easier than asking for help and fighting back.

Policy experts from the Cyber Security Cooperative Research Centre want to make it mandatory for Australian companies to tell authorities when they are being targeted.

And they want more clarity on whether paying ransoms is legal at all.

They warn a "tsunami of cyber crime" has cost the global economy about $1 trillion, and say Australia is a soft target.

In late March staff at Nine arrived at work on a Sunday morning, ready to put the Today show to air only to find they had been the victim of a near-crippling cyber attack.

It rocked the company's operations, with many Sydney-based staff forced to work from home or temporarily move to Melbourne, and it took weeks for workflows to be back to normal.

Nine was very upfront about the attack, and sought the help of authorities like the Australian Signals Directorate in managing it.

Knocking out the news is one thing, but only a few months ago a huge slice of the US was left scrambling for petrol after a ransomware attack knocked out Colonial Pipeline's networks.

Leanne Sherriff

The company was forced to completely shut down its pipelines, responsible for about half of the US East Coast's fuel supplies, for days.

Colonial later confirmed it paid a $US4.4m ($5.6m) ransom.

Australian logistics giant Toll Holdings was hit in two separate attacks last year.

It too worked with experts from the Australian Signals Directorate, and said at the time it had "no intention of engaging with any ransom demands."

And steaks were on the line when global meat processing company JBS Foods paid a $US11 million ($14.2 million) ransom in bitcoin about a month ago.

Its global operations, including in Australia, were all but brought to a standstill by the attack, and the company said it paid the money to avoid data being stolen.

Some experts warn many Australian companies do not fully appreciate the scale of the threats their companies face.

They compare the amount of money paid for security guards, alarms and sensors to protect a company's physical assets, compared to the relatively little money paid for cyber security.

ABC News

Rachael Falk from the Cyber Security Cooperative Research Centre said it is more common, and more serious, than many businesses appreciate.

"I think businesses are still woefully under prepared," she said.

"There are examples happening all around the world, and in Australia, almost on a weekly basis."

There are two things Ms Falk is suggesting the federal government could do to help companies better defend themselves.

The first is to use tax incentives to encourage businesses to invest in their cyber security.

The second is force them to speak up when they suffer an attack, and let authorities and security agencies know,to help protect others in future.

"We're saying be more transparent, because once it's out in the open, it helps everyone," she said.

"I can understand the need to want to protect the company, protect customers, and also the deep need to want to just get on with remediating what's going on, and not have to shout from the rooftops.

"I entirely understand that, but I think being transparent about it is helpful."

Those ideas are being pitched separately to legislation the government is already considering, imposing greater cyber security obligations on operators ofcritical assets like water, health energy and transport.

In a new policy paper, Ms Falk also argues the federal government has to clarify the legalities of paying ransoms.

While the official advice is always against paying ransoms, and instead working with authorities to combat ransomware attacks, some companies do take up the option.

It gets complex, because it is against the law to "deal with"money that could finish up involved in crime.

It is also illegal to provide funds to terrorist organisations which is another risk, in such a circumstance.

It used to be a business needed a lock on its door and a CCTV camera to protect against criminals, now experts say they need to invest in security they cannot see.

But duress is a defence, given the companies can reasonably believe a threat will be carried out if they do not pay.

Ms Falk does not suggest explicitly criminalising the payment of ransoms, arguing doing so would only further add to the burden of ransomware victims.

But she said those facing that difficult prospect should know legally where they stand.

"It will provide the victims with at least some certainty," she said.

"If we pay this, because we have to, we at least won't be facing some sort of action down the track from the Commonwealth that accuses our board of paying a ransom when we shouldn't have."

But she said better defences, and preventing an attack in the first place, were much simpler solutions.

"Ransomware is entirely foreseeable, and every business is at risk," she said.

"It's not just big organisations and household names, it's small companies.

"If they run a computer connected to the internet, they're at risk."

Continued here:
If your company is held hostage, should you pay the ransom? Or should you be forced to tell the authorities? - ABC News

Read More..

HARTFORD, Conn., July 12, 2021 /PRNewswire/ -- Connecticut Governor, Ned Lamont signed HB 6607, "An Act Incentivizing the Adoption of Cybersecurity Standards for Businesses" into law last week. The bill, introduced by Representative Caroline Simmons, prohibits the Superior Court from assessing punitive damages against an organization that implements reasonable cybersecurity controls, including industry recognized cybersecurity frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internet Security (CIS) Critical Security Controls (CIS Controls).

The Connecticut bill states that in the result of a data breach of personal and restricted information, the court may not assess punitive damages if the organization created, maintained, and complied with a written cybersecurity program containing administrative, technical, and physical safeguards for protecting PII and restricted information.

"It is critically important to do a better job of protecting businesses and consumers against cyber-attacks," said Representative Simmons. "In Connecticut, we took a step to accomplish this voluntarily without regulation by incentivizing organizations to adopt cyber best practices, like the NIST framework and the CIS Critical Security Controls."

Connecticut joins Ohio and Utah in legislative efforts to adopt an incentive-based approach for businesses to implement cybersecurity best practices.

"Cybersecurity is largely unregulated today; there is no national statutory minimum standard of information security, making it difficult to improve cybersecurity on a wholesale basis," said CIS Executive Vice President & General Manager, Security Best Practices, Curtis Dukes. "Connecticut's cybersecurity bill introduces a critical interim step: incentivizing the adoption of cyber best practices like the CIS Controls, to improve cybersecurity and protect citizen data."

The CIS Controls are a set of internationally-recognized, prioritized actions that form the foundation of basic cyber hygiene and essential cyber defense. Applying the CIS Controls provides a critical, measurable security value against a wide range of potential attacks. Analysis shows that implementing the CIS Controls mitigates the majority of cyber-attacks when evaluated against attack patterns in the widely referenced ATT&CK framework published by the MITRE Corporation. Specifically, the CIS Controls mitigate:

Further, Implementation Group 1 (IG1), a subset of the Controls that is considered basic cyber hygiene, is effective in mitigating:

Under the bill, organizations have to conform with revisions and amendments to identified industry-recognized cybersecurity frameworks (like the CIS Controls), laws, and regulations within six months after the revised document is published.

The bill becomes law on October 1, 2021.

About CIS:The Center for Internet Security, Inc. (CIS) makes the connected world a safer place for people, businesses, and governments through our core competencies of collaboration and innovation. We are a community-driven nonprofit, responsible for the CIS Controls and CIS Benchmarks, globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously refine these standards to proactively safeguard against emerging threats. Our CIS Hardened Images provide secure, on-demand, scalable computing environments in the cloud. CIS is home to the Multi-State Information Sharing and Analysis Center (MS-ISAC), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial (SLTT) government entities, and the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), which supports the cybersecurity needs of U.S. elections offices. To learn more, visit CISecurity.org or follow us on Twitter: @CISecurity.

Media Contact: Autum Pylant [emailprotected]518-266-3495

SOURCE Center for Internet Security

Here is the original post:
Connecticut Becomes Third State to Incentivize Cybersecurity Best Practices for Businesses - PRNewswire

Read More..