Category: The State of Security

PCI DSS 4.0 and ISO 27001 – the dynamic duo

This article has been indexed from The State of Security It’s not often we can say this, but 2022 is shaping up to be an exciting time in information governance, especially for those interested in compliance and compliance frameworks. We…

CIS Control 17: Incident Response Management

This article has been indexed from The State of Security We all know that it is a question of when you will be compromised and not if you will be compromised. It is unavoidable. The goal of CIS Control 17…

PCI DSS 4.0 is Here: What you Need to Consider

This article has been indexed from The State of Security The Payment Card Industry Data Security Standard (PCI DSS) is a benchmark with tenure in the industry, with the first version being introduced in 2004. The PCI DSS was unique…

Improve your patching efficiency with Tripwire State Analyzer

This article has been indexed from The State of Security Organizations are always concerned with improving efficiencies to make business flow smoother. Some of the biggest inefficiencies in any business revolve around time wasted on operational tasks. Whether it is a stale…

CIS Control 16 Application Software Security

This article has been indexed from The State of Security The way in which we interact with applications has changed dramatically over years. Enterprises use applications in day-to-day operations to manage their most sensitive data and control access to system…

What Is the Role of Incident Response in ICS Security?

This article has been indexed from The State of Security In recent years, cyber espionage has been growing in magnitude and complexity. One of the most common targets is Industrial Control Systems (ICS) within critical infrastructure sectors. With many organizations…

Your Guide to the NIST Cybersecurity Framework

This article has been indexed from The State of Security To put the impact of cybercrime into perspective, let’s examine some important, and startling, numbers: Data breach costs increased from $3.86 million to $4.24 million in 2021. Every 39 seconds,…

Out of Band (OOB) Data Exfiltration via DNS

This article has been indexed from The State of Security Last week, I attended the NotSoSecure Advanced Web Hacking training. While there were plenty of interesting topics taught, one that caught my attention was Out-of-Band (OOB) Data Exfiltration using DNS.…

World Backup Day: Simplicity and Patience is Key

This article has been indexed from The State of Security A few months ago, a news popular cybersecurity news organization posted an urgent notice on social media seeking help to recover their data after their blog was deleted.  They announced…

¿QUÉ ES FIM (FILE INTEGRITY MONITORING)?

This article has been indexed from The State of Security El cambio es prolífico en los entornos de TI de las organizaciones. Los activos de hardware cambian. Los programas de software cambian. Los estados de configuración cambian. Algunas de estas…

AvosLocker ransomware – what you need to know

This article has been indexed from The State of Security What is this AvosLocker thing I’ve heard about? AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure…

EDoS: The Next Big Threat to Your Cloud

This article has been indexed from The State of Security What is EDoS? Economic Denial of Sustainability (EDoS) is a cybersecurity threat targeting cloud environments. EDoS attacks exploit the elasticity of clouds, particularly auto-scaling capabilities, to inflate the billing of…

EDoS: The Next Big Threat to Your Cloud

This article has been indexed from The State of Security What is EDoS? Economic Denial of Sustainability (EDoS) is a cybersecurity threat targeting cloud environments. EDoS attacks exploit the elasticity of clouds, particularly auto-scaling capabilities, to inflate the billing of…

5 Social Engineering Attacks to Watch Out For

This article has been indexed from The State of Security We all know about the attacker who leverages their technical expertise to infiltrate protected computer systems and compromise sensitive data. This type of malicious actor ends up in the news…

The Obsession with Faster Cybersecurity Incident Reporting

This article has been indexed from The State of Security Requirements for reporting cybersecurity incidents to some regulatory or government authority are not new, but there has always been a large amount of inconsistency, globally, in exactly what the requirements…

How to Combat Asset Blindness in OT Security

This article has been indexed from The State of Security One of the main challenges of OT security is the problem of compatibility. OT components often differ significantly from each other in terms of age and sophistication as well as…

To Governance and Beyond: Cybersecurity as a Journey

This article has been indexed from The State of Security How often have you heard someone say “Cybersecurity is complicated!”? If you’re a practitioner in the cybersecurity industry you’ll have heard these words often, probably along with “…and it’s really…

Human Factors: Why Technology Alone Will Never Equal Cyber Secure

This article has been indexed from The State of Security In this episode, Kai Roer, Chief Research Officer at KnowBe4, explains how human factors will always play a role in how secure our technology is. Spotify: https://open.spotify.com/show/5UDKiGLlzxhiGnd6FtvEnmStitcher: https://www.stitcher.com/podcast/the-tripwire-cybersecurity-podcastRSS: https://tripwire.libsyn.com/rssYouTube: https://www.youtube.com/playlist?list=PLgTfY3TXF9YKE9pUKp57pGSTaapTLpvC3…

Texas SB 820 Advances K-12 Cybersecurity Despite Limitations

This article has been indexed from The State of Security Like many organizations, K-12 schools adapted to COVID-19 by accelerating their digital transformation journeys. And like everyone else who followed this path, they invited unwanted attention from digital criminals in…

Ragnar Locker ransomware – what you need to know

This article has been indexed from The State of Security What is this Ragnar Locker thing I’ve heard about? Ragnar Locker is a family of ransomware, which first came to prominence in early 2020 when it became notorious for hitting…

VERT Threat Alert: March 2022 Patch Tuesday Analysis

This article has been indexed from The State of Security Today’s VERT Alert addresses Microsoft’s March 2022 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-989 on Wednesday, March 9th. In-The-Wild & Disclosed…

The Five Stages of File Integrity Monitoring (FIM)

This article has been indexed from The State of Security The benefits of a capable and properly deployed File Integrity Monitoring (FIM) solution are plentiful: If you see unexpected or unexplained file changes, you can investigate immediately and resolve the issue quickly…

What Is CPS 234 and Who Needs to Comply with It?

This article has been indexed from The State of Security In November 2018, the Australian Prudential Regulation Authority (APRA) released the Prudential Standard CPS 234 in direct response to the escalating attack landscape in the financial sector. APRA has understood…

Regulating a Nation’s Information Security Workforce

This article has been indexed from The State of Security In a previous article, I examined Australia’s proposed Security Legislation Amendment (Critical Infrastructure) Bill 2020. This information security overhaul imposes strict reporting requirements for enterprises as well as affords the…

Creating Your Disaster Recovery Action Plan

This article has been indexed from The State of Security Perhaps Disaster Recovery (DR) isn’t one of the hot terms like the Internet of Things (IoT) or Hybrid Cloud, but I would argue that re-examining your DR plan now might…

CIS Control 15: Service Provider Management

This article has been indexed from The State of Security Enterprises today rely on partners and vendors to help manage their data. Some companies depend on third-party infrastructure for day-to-day operations, so understanding the regulations and protection standards that a…

Tripwire Patch Priority Index for February 2022

This article has been indexed from The State of Security Tripwire’s February 2022 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. First on the patch priority list this month is a vulnerability for Microsoft Windows LSA (CVE-2021-36942). This…

Email Security Trends Coming in 2022

This article has been indexed from The State of Security Organizations are under constant threat of cybercrime. While there are many available attack vectors, email is the most obvious path towards a full network compromise. The notion that email security should be…

The Crossroads of Disinformation and Nation State Attackers

This article has been indexed from The State of Security In this episode, Ian Thornton-Trump, CISO at Cyjax, digests nation state’s disinformation campaigns and the cybersecurity landscape. He also discusses the role disinformation on social media plays in cybersecurity. Spotify:…

OT Vulnerability Management: A Risk-Based Approach

This article has been indexed from The State of Security The number of missing security patches in an OT system is typically very large—measured in the thousands, at least. It would be difficult and expensive for an asset owner to…

VERT Threat Alert: February 2022 Patch Tuesday Analysis

This article has been indexed from The State of Security Today’s VERT Alert addresses Microsoft’s February 2022 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-985 on Wednesday, February 9th. In-The-Wild & Disclosed…

User Created Content with Tripwire Configuration Manager

This article has been indexed from The State of Security Tripwire Configuration Manager allows for user created configuration and compliance management content via a new Policy Management capability. Custom user content can be used alongside existing cloud service provider and…

Privacy in 2021: A Year Worth Reviewing

This article has been indexed from The State of Security With two new U.S. State privacy laws, new Standard Contractual Clauses out of the EU, more GDPR-style laws passed around the globe, and record data protection fines, 2021 provided plenty…

BlackCat ransomware – what you need to know

This article has been indexed from The State of Security What is this BlackCat thing I’ve heard about? BlackCat (also known as ALPHV) is a relatively new ransomware-as-a-service (RaaS) operation, which has been aggressively recruiting affiliates from other ransomware groups…

Tripwire Patch Priority Index for January 2022

This article has been indexed from The State of Security Tripwire’s January 2022 Patch Priority Index (PPI) brings together important vulnerabilities for Apache, Open Source Policy Kit, Adobe, and Microsoft. First on the patch priority list this month are patches…

Cybersecurity and Drones: How to Address the Security Threats

This article has been indexed from The State of Security The Unmanned Aerial Systems (UAS) industry has become a massive technological playground worldwide. Their extensive applications make UAS very popular for the public and the private sector. Armed forces, agricultural…

What Data Privacy Day 2022 Means for Individuals

This article has been indexed from The State of Security Data Privacy Day (DPD) is January 28. Sounds exciting, right? I’m sure you’ve got the pinata stuffed and the presents on the way. What is DPD about? It’s all about…

ISO27001:2021 – A New Way of Working

This article has been indexed from The State of Security It has been a long time coming! The upgrade to the international standard for information security management systems, ISO27001:2013, is here (almost). Hallelujah! If you’re reading this article, then there’s…

ISO27001:2022 – A New Way of Working

This article has been indexed from The State of Security It has been a long time coming! The upgrade to the international standard for information security management systems, ISO27001:2013, is here (almost). Hallelujah! If you’re reading this article, then there’s…

Kubernetes Incident Response: Building Your Strategy

This article has been indexed from The State of Security Kubernetes is the popular container orchestration platform developed by Google to manage large-scale containerized applications. Kubernetes manages microservices applications over a distributed cluster of nodes. It is very resilient and…