Building a Cyber Security Team from Within

f3b2fc701727fc40be4730a2194bf138.jpg

While building an in-house cyber security operations center can be resource-intensive, it can safeguard your data.
Hijacking technology used to be the favorite hobby of benign oddballs. The Max Headroom incident was inexplicable, but harmless. Gary McKinnon may have hacked the Pentagon, but he was hunting for evidence of UFOs. That’s sadly not the case anymore: cyberattacks can and do inflict real damage.

Sony Corporation has become a famous example. In the last few years, it’s suffered no fewer than three high-profile security breaches. The latest, a DDoS attack around Christmas, was an inconvenience, the fallout being five days of network outage and a few irate gamers. The 2011 PlayStation Network hack, however, resulted in a mass data harvest and a $15 million settlement for those affected. 

Hacking is an attack weapon, which has become a business-critical issue costing companies millions, which very much puts it in the domain of the CFO.

The argument from some quarters is that outsourcing your protection is the way forward. For CFOs, it’s easy to see the appeal of making the process of protecting your infrastructure another number on a balance sheet. Unfortunately, while it’s simpler in the short-term, it’s hard to know in advance that your managed service provider (MSP) will get cybersecurity right. With many data breaches occurring as a result of poor outsourcing decisions, it’s a risk that many boards aren’t prepared to take. We have also seen some situations in which a company has had to buy back its own data from a legacy MSP.
Building an in-house security operations center, or SOC as it’s more commonly known, can be a resource-intensive process. But managed correctly, it can safeguard your business-critical data and your bottom line.
The first decision a CFO should make is whether or not in-house security should be integrated with the rest of the IT department. For smaller businesses, this might be unavoidable: for medium-to-large enterprises, however, it’s worth thinking about.

A dedicated SOC has many benefits, chief among them that your business owns its data and knows what’s happening with it. It gives you in-depth control over your IT security and enables your company to make the best use of its application performance. 

The big challenge for CFOs is that security can be expensive. It’s possible to spend a lot of money, and there’s no guarantee you won’t be breached. The most important thing is that CFOs realize the role of the CISO is now a strategic one. IT security should be a business enabler, and the role of the CISO should be less focused on the technical and more on strategy and stakeholder management. Understanding how security can help a business achieve its objectives and overcome organizational challenges is key to the CISO role. 
CFO.com  http://bit.ly/1GLk9Qn
5 Ways to Use Virtual Reality in the Enterprise

 With the Microsoft's HoloLens headset, users can view virtual 3D images within the everyday real world. 

For enterprises trying to differentiate themselves from their competitors, trying to connect with customers, trying to better show off their products and even make potential customers feel like they're trying out everything from a new car to a new iPhone before they buy it, virtual reality is likely to be a game changer for the enterprise.
Virtual reality is getting a lot of attention this week because the keynote during the second day of Facebook's annual F8 developer conference was largely focused on Oculus, a company that has built a virtual reality headset. Facebook bought Oculus in March 2014, and now the social network has big plans on developing not only virtual reality games, but ways for Facebook users to communicate and share experiences using virtual reality.
Facebook executives want users to even create virtual reality experiences for their online friends. Google is also known to be developing virtual reality products, though it hasn't specified exactly what it's doing.
If Facebook's vision becomes a reality, that will mean big things for gamers flying virtual fighter jets or fighting in medieval times.
What might it mean for the enterprise, though? Well, it should mean better communications with customers, a better way to show off new products and even a better way to work with employees.
Here are a few examples of how the enterprise could use virtual reality in another five or 10 years.
1. Training
Trainers will use virtual reality extensively. Soldiers, for instance, would be able to train in a virtual middle-eastern village or in a snowy, remote environment without leaving their American base.
Financial managers would be able to train using a virtual office environment, so they could practice good communication and leadership skills.
2. Pulling in remote workers
Virtual reality also should make for better relationships between employees working remotely and their managers or working groups. Think about employees being able to work from home but at the same time, working from virtual offices, surrounded by their virtual peers. This could make the worker feel more like a part of the meeting or a part of the team, leading to possible productivity boosts.
Another plus if you are more tightly coupled, it can be instrumental to make your boss more confident that you actually are working and not just goofing off at home.
3. Less business travel
Today, when most workers need to attend an important meeting -- whether it's in another corporate location or at a client's office -- they head to the airport, work their way through security and endure a plain ride, sometimes squeezed in that dreaded middle seat.
Of course, some people use videoconferencing, but it's not widespread. And that experience still isn't quite like being in the same room and sitting down face-to-face with colleagues or clients.
A virtual reality meeting could make it seem like a manager is in an actual face-to-face meeting when he or she is actually alone in the office.
What companies will notice is a reduction in travel costs and in the administrative work it takes to make the travel arrangements and deal with the expenses. It also will reduce the amount of time workers are outside the office and unavailable. 
4. Sales
If someone is interested in comparing two different types of smartphones before buying one, testing them both out via virtual reality would be the perfect solution.
Salespeople could help their potential customers to virtually try before they buy. Customers could feel like they're sitting in a car. They'd see how it would steer and feel on the road and how the interior looks up close. They could see how roomy it is -- all before taking the time to drive to a dealer to see it in person.
5. Order up!
Kagan said one of the first uses of virtual reality may be at restaurants to allow customers to make their to-go food orders instead of calling in or using the Web.
Computerworld  http://bit.ly/1F2thLJ
Cyber Insurance: Well Worth it but Beware of Exclusions

It’s what all sensible people do to mitigate the risk of catastrophic financial damage: Buy insurance. There’s not even a choice when it comes to auto and health risks – insurance is a legal mandate. And most people would agree that anyone with a house who does not carry homeowner’s insurance is a fool or fabulously wealthy.

So, why not use cyber insurance? Indeed, the case for it is compelling. The costs of data breaches are in the millions and rising fast. As the Ponemon Institute put it in a synopsis of one of its recent reports on the issue, “data breaches have become as common as a cold, but far more expensive to treat.”

In another report sponsored by HP Enterprise Security, Ponemon found that, “the average annualized cost of cyber crime incurred by a benchmark sample of U.S. organizations was $12.7 million,” up 96% since five years ago. The average cost to resolve a single breach was $1.6 million. Most policies are nowhere near inclusive of all cost associated with breaches. So, as Wendi Rafferty, vice president of services at CrowdStrike, put it to CSO in an earlier interview, part of any prudent organization’s advance plan to respond to a data breach should include data breach insurance.

The biggest reason is that a general liability policy is no longer enough. It covers, “third-party claims of bodily injury or property damage, but the trend among insurance providers is to exclude electronic records and data,” said Jared Kaplan, executive vice president and CFO of Insureon.
Getting effective cyber insurance is not simple, however. Data breaches, in addition to being expensive, are notoriously complicated. They require a host of costly responses, including forensic investigation, notification of first and third parties, fulfillment of legal and compliance obligations, possible litigation, working with law enforcement, public relations, credit monitoring fees, crisis management – the list goes on.
As technology risks continue to evolve, many carriers are starting to pull back on the types of industries and risks they will cover.

Also different industries have different kinds of risks, health care is not the same as retail, which is not the same as buying for Education.
That means simply buying a “cookie-cutter, off-the-shelf” policy is asking for trouble since it will likely have exclusions for significant expenses.
According to a recent post in Dark Reading, many such policies exclude coverage for:
    - Breaches of protected information in paper files.
    - Claims brought by the government or regulators, including the Office of Civil Rights, the Department of Health and Human Services, and the Office of the Attorney General.
    
    -Vicarious liability, for data entrusted to a third-party vendor, when the breach occurs on the vendor’s system.

    -Unencrypted data.

Some damages, of course, cannot be measured exactly. But there are ways to close coverage gaps. One of the most obvious is to practice good security “hygiene,” including end-to-end encryption of data and keeping software up to date with all recent patches.
Common exclusions in “off-the-shelf” cyber insurance policies:
    - Breaches of protected information in paper files
    - Claims brought by the government or regulators
    - Vicarious liability, for data entrusted to a third-party vendor that is     breached
    - Unencrypted data
    - Negligence: Failure to install software updates or security patches
    - First-party notification expenses for disclosure of PII or PHI
- Many of the policies, with premiums ranging from $6,000 to $37,000, limit coverage to just $1 million, which in today’s world rarely comes close to covering the total expenses.
In short, cyber insurance can ease the pain, but it won’t eliminate it.  
Techpageone http://bit.ly/1F2utyL

« China Admits to Having Cyber Warfare Units
Battle for African Internet Users Stirs Fears »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ClearedJobs.Net

ClearedJobs.Net

ClearedJobs.Net is a career site and job fair company for professionals seeking careers in the defense, intelligence and cyber security communities.

Bundesdruckerei

Bundesdruckerei

Bundesdruckerei specializes in secure identity technologies and services for protecting sensitive data, communications and infrastructures.

Idemia

Idemia

Idemia is a global leader in security and identity solutions.

IDnext

IDnext

IDnext is the open and independent platform to support innovative approaches in the world of the Digital identity.

Tempered Networks

Tempered Networks

Tempered Networks delivers the first purpose-built platform for IIoT cybersecurity that allows customers to connect and secure devices in minutes without the need for specialized skills.

WetStone Technologies

WetStone Technologies

WetStone develops software solutions that support investigators and analysts engaged in eCrime Investigation, eForensics and incident response activities.

Garrison

Garrison

Garrison SAVI® is a unique technology for secure remote browsing that can dramatically change the risk profile for enterprise cyber security.

Sandia National Laboratories

Sandia National Laboratories

Sandia National Laboratories is a premier science and engineering lab for national security and technology innovation. Activity areas include Cyber and Infrastructure Security.

Rostelecom

Rostelecom

Rostelecom is Russia’s largest integrated provider of digital services and solutions, covering all market segments including consumer, governmental and private organizations.

AlJammaz Technologies

AlJammaz Technologies

AlJammaz Technologies is the leading Technology Value-Added Distributor, which distributes advanced technology products, solutions and services in area including networking and cybersecurity.

Wavex Technology

Wavex Technology

Wavex Technology is an award winning IT Services firm offering clients a secure and fully managed IT service.

BOXX Insurance

BOXX Insurance

BOXX Insurance Inc. is a new type of insurance company for a new type of risk. Cyberboxx is the first fully-integrated cybersecurity and insurance solution for small-to-medium-sized businesses.

Dataships

Dataships

We help companies automate their privacy compliance while building healthy, transparent data relationships with their customers.

Harbottle & Lewis

Harbottle & Lewis

Harbottle & Lewis is a leading UK-based law firm focused on the Private Client and Technology, Media and Entertainment sectors.

BitLyft

BitLyft

BitLyft is a managed detection and response provider that is dedicated to delivering unparalleled protection from cyber attacks for organizations of all sizes.

Aspire Technology Solutions

Aspire Technology Solutions

Aspire is an award-winning IT Managed Service and Cyber Security Provider. We specialise in cyber security, cloud, connectivity, managed services, unified communications and IT support.