Commentary
News
News
Commentary
CommentaryNewsCommentary
Commentary
NewsNews
News
CommentaryNewsCommentaryNews
CommentaryQuick HitsNewsNews
Gartner's estimate of # of endpoints with EDR (250k) is at least 1 order of magnitude low.
In reply to: EDR Market Sizing
If I was a malicious intender, I would take the approach of siphoning in small increments as well. I know many people that rarely check their financial accounts online and a small transaction would slip through possibly...
In reply to: Vigilance is key
Even with RBAC you run the risk of things being lost in transition unless you have a CMDB. When someone transitions, especially in larger companies there transition may not be well represented at the account level if their...
In reply to: 3. Elevated Account Permissions
According to BSIMM6 data, that is not the case. Only 3 of 78 firms had a bug bounty system going when we measured them.
Download the data for yourself.
In reply to: Re: Bug bounties and healthcare
Thanks for highlighting this, Ryan. Apple fanbois and fangrrls often insist that Apple is more secure, but largely that is due to market share (at least, in the desktop/laptop world) -- and that gap is not as wide...
In reply to: Re: Good Analogy
The problem with shared responsibility is that when it's everyone's repsonsibility, it's no one's responsibility.There needs to clearly be a party with clear responsibility; otherwise, everyone will shrug things off to each...
In reply to: Too much is too little
This is such an important topic these days. With the rise in data breaches, it's critical to ensure that employees are trained on any and all technology to prevent accidental breaches. The fact that 45% of employees are...
In reply to: Data Breaches - The Importance of Training
Of course the dark market attracts more and more IT specialist, but you need to remember the story about Max Butler. He've got 13 years of jail sentence for hacking and selling credit cards.
In reply to: Sentence
Another important consideration is to ensure that the security team is actively involved with the recruiting/hiring process (and, by extension, the HR department less so), because the former will have a better idea of what...
In reply to: Involvement
It's worth pointing out that iOS and Mac were found, collectively, to have by far the most discovered vulnerabilities for the year before.Strangely enough, however, even though Android technically has far fewer vulnerabilites...
In reply to: iOS/Mac
Jim Routh's comments are interesting given the Zephyr Health run a bug bounty program: https://www.youtube.com/watch?v=GbW777t1tTA
In reply to: Bug bounties and healthcare
I wanted to add that most of the attacks I see, because we're focused on detecting threats outside the firewall, are exploitations of the very technology used to collect user information. All of us are surrounded by this...
In reply to: Technology Used for Collecting Information
Dark Reading Tech Digest September 7, 2015Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Tweet This
