axio - kn

Sodium hydroxide, NaOH, is a commonly used water treatment deployed in safe amounts by water treatment plants across the US. In large concentrations, however, it can be dangerous and even deadly to humans. Now, imagine a hacker from a country of national security concern finding a vulnerability in the remote access software that controls the levels of NaOH, or lye, in the water system. With just a few lines of code, the hacker can increase the NaOH to 100 times the normal level, sufficient to poison every member of the town.  

SolarWinds Lawsuit:  Only the Beginning 

Microsoft, Cisco, Deloitte, and even the Cybersecurity and Infrastructure Security Agency (CISA). These are just a handful of the 18,000 or so customers affected by the SolarWinds Orion data breach of 2020, and, nearly two years later, the company continues to handle the fallout from this event. “We expect to incur significant legal and other professional services expenses associated with the Cyber Incident in future periods,” it said in a Q2 2021 Preliminary Financial Results statement. 

We recently had the rare opportunity to sit down with three cyber-experienced executives offering their views on cybersecurity and how to communicate cyber risk with the C-Suite and Board. Each of our panelists brings a unique perspective to the table, discussing how cyber security programs can be managed and what information actually helps them make successful decisions.  

Are your cybersecurity conversations with your board and executive leadership lost in translation? Effective communication is foundational to building, maintaining, and optimizing a cybersecurity program, regardless of company size or sector. As a security leader, if your Board or CEO struggle to understand the state of your organization’s cyber risk posture, you will effectively be fighting an uphill battle for resources, budget, and stakeholder buy-in.

Does your cybersecurity leader have a cat twin? Is your cyber leader stubborn? Or is your cyber leader flexible and able to adapt to a changing environment? In celebration of National Cat Day on October 29th, we are proud to present the top 5 cats* who may most resemble your cybersecurity leader and program.

 

In 2021, you wouldn’t expect a modern hospital in the US to be running on pen and paper, but that is exactly what happened when an Alabama hospital was attacked by ransomware, resulting in the first alleged death by cyber attack in the country. The healthcare sector has always been a top target for cybercriminals, even more so within the last year and a half; ransomware attacks against hospitals carry high stakes, making them easy targets because they are more likely to pay the ransom with lives on the line. With hospitals and healthcare entities under immense and unprecedented stress due to the COVID-19 pandemic, hackers have capitalized on new or amplified cyber vulnerabilities stemming from continued digital transformation and a global shift to remote work. 

Whether in the private sector, state government, or federal, cybersecurity compliance is an omnipresent influence on organizational decision-making. Compliance requirements are designed to oblige companies and organizations to follow specific regulations to discourage and prevent cyber-attacks. It has long been a part of a traditional risk assessment approach for many companies but, by itself, does not fulfill the needs of a holistic cybersecurity and risk strategy. Those who oppose compliance argue that it restricts a company’s ability to improve cybersecurity. Compliance mandates are a necessary but not sufficient part of your organization’s security strategy. Here we will scrutinize the merits of traditional cybersecurity compliance and examine why compliance alone is not sufficient to protect your organization from data breaches.  

Cyberattacks and data breaches continue to drive the headlines in 2021 – and there are few signs that cyber adversaries are retrenching. The looming threat of ransomware has forced organizations to not only evaluate their entire cybersecurity programs, budget, and roadmap, but also critically evaluate their Identity and Access and Privileged Access Management (PAM) solutions. PAM controls are a fundamental part of active cyber defense, as solutions ensure continuous visibility and management to highly privileged, administrator accounts that constitute an organization’s “keys to the kingdom.” The recently disclosed cyber attack at the Port of Houston is a refreshing success story that underscores how PAM controls can help prevent and mitigate a business-crippling data breach.

If you’re a cybersecurity professional, chances are that you are familiar with the National Institute for Standards and Technology Cybersecurity Framework (NIST CSF). An understanding of the NIST Cybersecurity Framework (CSF) standard is critical for any company seeking to conduct business with a US Government agency, and increasingly more private-sector entities – and organizations abroad – are leveraging the NIST CSF to build their cybersecurity programs.