Infosec Update

There is a threat difficult to quantify or even detect, one that has not yet grabbed the headlines or captured the imagination, and yet is relentlessly and efficiently looting, pillaging and plundering the U.S. and global economies of their magic ingredient — trade secrets.

Oh boy....

Listen to the podcast as Steven asks me about “Knowing thy enemy”, “lessons learned”, “crowd sourcing attacks”, “understanding environmental and cultural context”, “Iranian cyber war”, and “political goals”.

There are products out there claiming to be “Enterprise Solutions” that only support a single mobile operating system, or, worse yet, a single version of a single operating system. While these products may do an admirable job managing the subset of devices that run that OS, what about the rest?

If the auditor observers that no one is showing up to the change management meetings, authorizations are rubber stamped without any real evaluation, unauthorized changes and unplanned outages are occurring regularly, then she will likely flag this as a potential high risk area.

The CIO is a “General”. Generals are not concerned with how the weapons function or how the rank-and-file are performing. This is the job of the lieutenants. The General focuses on the strategic application of resources on the battlefield.

Due Diligence can be categorized as a fraud management tool, an information gathering exercise or just a shield that will provide some value in case something goes wrong. It is important to undertake a DD for all transaction irrespective of the value. You cannot evaluate it in terms of ROI. Consider it as a cost just like a premium paid for insurance.

Exploits of unpatched Windows bug will jump, says Symantec; Mozilla tackles XSS vulnerabilities with new technology; New Facebook blog: We can hack into your profile; Red Condor’s Spam Trip Wire detects new virus; Adobe Releases Update for Shockwave Player; Gates Creates Cyber-Defense Command; Google clamps down on ‘malvertising’; Hacked high-profile Twitter accounts still spreading malicious links; Spam, Phishing, and Malicious Code Related to Recent Celebrity Deaths.

'Undocumented' admin accounts in two types of router used by telecoms companies. Doh!

It's funny because it's true.

There is a surfeit of Information today, and although we have come up with ways and means to store them for eternity, we are still not able to ensure their security. Information is valuable only as long as it remains protected, and once in the hands of people who are likely to misuse it, it turns into a recipe for disaster.