SecOps and DevOps: From Cooperation to Automation
Dark Reading Videos | 4/7/2021 | Omdia Principal Analyst Eric Parizo discusses the major obstacles SecOps organizations face as they seek to build ties with DevOps teams, and offers a programmatic approach to help create a path toward DevSecOps.
Supporting Women in InfoSec
Dark Reading Videos | 8/5/2020 | Maxine Holt, senior research director from Omdia, explains why the time is right for women to step into more cybersecurity jobs.
Ransomware Trains Its Sights on Cloud Providers
Dark Reading Videos | 8/23/2019 | Ransomware writers are now targeting cloud service providers with network file encryption attacks as a way to hold hostage the maximum number of customers that they can, notes Chris Morales, head of security analytics for Vectra. He also discusses Vectra's new ransomware report, which offers tips for protecting against virtual hostage taking.
Qualys Launches Free App for IT Asset Discovery and Inventory
Dark Reading Videos | 8/23/2019 | Qualys's Chairman and CEO, Philippe Courtot talks about changes in the security landscape he's witnessed during the company's 20-year lifespan, as well as what motivated the vendor to give away its Global IT Asset Discovery and Inventory app for free.
Virtual World of Containers, VMs Creates New Security Challenges
Dark Reading Videos | 8/23/2019 | Containers, virtual machines, and the advent of DevOps as a software creation tool all put new pressures on organizations' security strength, according to Dan Hubbard, CEO of Lacework. Cloud's ability to offer scale, capacity, and processing power may even exacerbate the vulnerabilities unless properly managed, he adds.
Spirent Nixes Over-Reliance on Compliance Checklists for Good Security
Dark Reading Videos | 8/23/2019 | Enterprises must regularly validate their security efficacy based on real-time conditions, not compliance criteria, says John Weinschenk, General manager, Enterprise Network and Application Security of Spirent. That sort of testing returns actionable data to tune devices, update policies, and fortify defenses before they are compromised, he adds.
App Security Still Dogs Developers, End-User Organizations
Dark Reading Videos | 8/23/2019 | Lots of re-used code, cost pressures and long lead times for application software all lead to porous security where application software is concerned, says Chris Eng, Chief Research Officer for Veracode. But an emerging role he calls a "security champion" can help circumvent those problems and make apps safer for everyone.
Cloud Services Require a Shift in Security Strategy
Dark Reading Videos | 8/22/2019 | End-user organizations have their security management tools, but so do cloud service providers, and that forces some hard questions about whose tools will be used to keep everything locked down, says Jesse Rothstein, CTO and Co-Founder of ExtraHop. And he makes the case that better data hygiene can help decrease the chances of a breach.
Regular User Training Most Effective Security Antidote
Dark Reading Videos | 8/22/2019 | Social engineering remains the top vulnerability organizations face because humans remain the easiest way to access networks or databases, says Stu Sjouwerman, Founder and CEO of KnowBe4. Regular training sessions coupled with creation of a "human firewall" remain the most effective protections against social engineering and phishing, he adds.
Analytics and Data Prove Effective Security Hybrid
Dark Reading Videos | 8/22/2019 | Against the backdrop of consolidation in the SIEM and SOAR sectors, infosec professionals are deploying some combination of analytics and security, according to Haiyan Song, Senior Vice President & General Manager of Security Markets for Splunk. Analytics helps organizations make better decisions and detect anomalies faster, she adds.
Time to Get Smarter About Threat Intel
Dark Reading Videos | 8/22/2019 | Bad actors move faster than threat intelligence feeds and the infosec pros who monitor them, notes Joakim Kennedy, Threat Intel Manager for Anomali Research. Organizations need to establish a dedicated team to manage threat intel, and an adequate budget. Kennedy also encourages intelligence sharing as part of a stepped-up protection strategy.
Make DNS a Cornerstone of Your Cyber Security Arsenal
Dark Reading Videos | 8/22/2019 | Better known for their essential role in networking, Domain Name Servers should be tapped as a means to identify – and shut down – suspicious or destructive activity, according to Anthony James, VP of Marketing for Infoblox. He also explains how to combine DNS with DHCP and IP address management to improve an organization's security.
Endgame Boosts Apple Security to Be Commensurate with Windows Security
Dark Reading Videos | 8/22/2019 | Gone are the days when users could take refuge from Windows threats with Apple devices, as malware writers are exploiting OSX and iOS with real vigor, says Mark Dufresne, VP of R&D at Endgame. And though it's taken a while, Mac security has achieved parity with Windows so that Apple users need no longer settle for "protected enough."
Secureworks Pushes Human Intelligence, Machine Learning to Work Together
Dark Reading Videos | 8/22/2019 | Eschewing the either-or approach with machine learning, security operations centers must learn to identify and exploit the best of both approaches according to Secureworks' Tim Vidas and Nash Borges. Taken together, human and machine intelligence can be a force multiplier against human cyber adversaries, they say.
Asset Management Becomes the New Security Model
Dark Reading Videos | 8/22/2019 | While security pros once rallied around end-device management as their organizing principle, that approach is being subsumed by asset management, according to Dean Sysman, CEO and Co-Founder of Axonius. Device management becomes a subset of asset management, as organizations create a hierarchy to protect what's most valuable to them, he adds.
eSentire Blends Managed Detection and Response With Machine Learning
Dark Reading Videos | 8/21/2019 | While many infosec pros believe they're getting managed detection response (MDR) from their managed security service providers, that's not necessarily the case, according to Eldon Sprickerhoff, Founder and Chief Innovation Officer of eSentire. Adding machine learning to the mix helps automate MDR, strengthening an organization's security posture.
Bad Actors Find Leverage With Automated Active Attacks
Dark Reading Videos | 8/21/2019 | Once used only by nation-state attackers, automated active attacks have gone mainstream and allow the average cyber-criminal to gain entry and engage in malfeasance, says Chet Wisniewski, Principal Research scientist with Sophos. Luckily, organizations are getting smarter at spotting these stealthy, customized attacks earlier than they used to.
Deep Instinct Touts Predictive Aspects of Deep Learning
Dark Reading Videos | 3/7/2019 | Deep learning, as a subset of machine learning (which is itself a subset of artificial intelligence), can help transform a company’s security posture, says Deep Instinct’s Guy Caspi. Deep learning’s predictive capabilities also change the security management equation reactive to proactive, an important breakthrough in forecasting and risk management.
Regular User Awareness Training Still the Best Security Tactic
Dark Reading Videos | 3/7/2019 | Email continues to be the largest area of exposure for most organizations, and phishing emails lead the charge, according to Stu Sjouwerman, founder and CEO of KnowBe4. And while AI and machine learning can make a difference, these same tools are used by the bad guys, Sjouwerman adds. Regular, monthly trainings help reduce phishing click rates.
eSentire: Boost Security with Managed Detection & Orchestrated Response
Dark Reading Videos | 3/7/2019 | By integrating endpoint security with network security, end-users can reduce their risk and greatly improve their overall security, says Ashley Fidler of eSentire. For managed detection to deliver an orchestrated response, they must tap a reliable framework for decision-making and management, she adds.
Raytheon IIS Seizes the Moment with Cybersecurity as a Service
Dark Reading Videos | 3/7/2019 | Tapping the flexibility and reach of the cloud makes good sense for customers, according to Jon Check, senior director, cyber protection solutions for Raytheon Intelligence, Information and Services. Cybersecurity as a Service (CYaaS) ensures both data resilience and cyber resilience by integrating analytics and automation features into the mix.
AT&T Cybersecurity Ensures Companies SOAR with Security Strategy
Dark Reading Videos | 3/7/2019 | SOAR, or Security Orchestration, Automation and Response, helps customers ensure the sanctity of their infrastructure, data and end-users, according to Sanjay Ramnath, vice president, product marketing, of AT&T Cybersecurity. Integrating analytics, automation and threat intelligence helps customers eliminate the seams where the bad guys get in.
Code42: Data Loss Protection is the New DLP
Dark Reading Videos | 3/7/2019 | Data loss protection helps companies get more proactive than data loss prevention and will help customers in an era of Big Data, says Vijay Ramanathan of Code 42. Data loss protection helps with both time to awareness and time to response; its reliance on automation also means greater volumes of data can be managed.
Contrast Security Boosts App Security with Self-Protecting Software
Dark Reading Videos | 3/6/2019 | Vulnerability rates in application software remain as high as they were 15 years ago, according to Jeff Williams, CTO and Co-Founder of Contrast Security. But by injecting intelligent agents into code, app software gets instruments with thousands of smart, agile sensors that detect and correct vulnerabilities before deployment, and protect apps in operation.
Endgame Encourages Users to Balance Detection and Response Vs. Prevention
Dark Reading Videos | 3/6/2019 | Not all security data that’s publicly shared gets analyzed or vetted, but Forrester’s recent independent analysis of MITRE ATT&CK evaluation offers up useful insights to infosec pros and can guide their procurement and security strategy, according to Mike Nichols of Endgame. These reports can help with intelligent evaluation of detection and response versus prevention approaches.
Anomali: Integration of Disparate Security Systems is Essential
Dark Reading Videos | 3/6/2019 | With a record number of cyber-attacks recorded in 2018 and even more expected this year, integrating multiple security sub-systems is essential for enterprises, says Anomali’s Hugh Njemanze. He also encourages companies to operationalize their threat intelligence and to get better at sharing threat intel data.
Gemalto Helps Navigate Security in the Cloud Era
Dark Reading Videos | 3/6/2019 | With digital transformation in full swing and Big Data accumulating, end-user organizations have their hands full to manage, store and protect all their data, according to Todd Moore of Gemalto. While end-users have access to cloud-based encryption and other security services, Moore warns that the bad guys have access to them too.
From Silicon to Security: Synopsys Bolsters App Security with New Platform
Dark Reading Videos | 3/6/2019 | Application security is always important to infosec professionals, and as Ravi Iyer of Synopsys points out, software development trends like Agile, DevOps and CI/CD push app security to the forefront. Polaris, the new software integrity platform from Synopsys, can help with early detection of software vulnerabilities.
Lockpath Advocates Benefits of Continuous Security Management
Dark Reading Videos | 3/6/2019 | Risk management and compliance technologies emerge from the intersection of technology, security, and regulation; continuous security management helps professionals from multiple departments and disciplines access the info they need, when they need it, according to Sam Abadir of Lockpath.
Cisco: 'Brute Force' Attacks Outweigh AI Threat
Security TV | 12/14/2018 | In a wide-ranging interview, Cisco security boss Gee Rittenhouse talks about how machine learning, AI, blockchain and other emerging technologies fit into the security landscape.
How Secure are our Voting Systems for November 2018?
Dark Reading Videos | 9/14/2018 | Anomali CEO Hugh Njemanze discusses the importance of sharing threat intelligence across the country’s highly decentralized voting systems to safeguard the integrity of upcoming elections.
How Better Intel Can Reduce, Prevent Payment Card Fraud
Dark Reading Videos | 8/20/2018 | Royal Bank of Canada machine learning researcher and Terbium Labs chief scientist discuss how they use intelligence about the carding market to predict the next payment card fraud victims.
Malicious Cryptomining & Other Shifting Threats
Dark Reading Videos | 8/17/2018 | Skybox Security CMO Michelle Johnson Cobb discloses research results that include a spike in malicious cryptomining during Bitcoin’s peak, a shift to outside-the-perimeter mobile threats, and more.
The Economics of AI-Enabled Security
Dark Reading Videos | 8/17/2018 | While AI greatly enhances security, Securonix CTO Tanuj Gulati points out the need for predictable cost models that insulate SOCs from the variables of massive data volume and intense real-time processing.
Using Threat Deception on Malicious Insiders
Dark Reading Videos | 8/17/2018 | Illusive Networks CEO Ofer Israeli reveals how distributed deception technology can be as effective against insider threats as it is against outsiders, since it thwarts the lateral movement common to both.
Filtering the Threat Intelligence Tsunami
Dark Reading Videos | 8/17/2018 | Reversing Labs CEO Mario Vuksan contends that SOCs are overwhelmed by global threat intelligence, and can benefit more from a targeted "pull" model that focuses on YARA-type binary pattern matching.
Ensuring Web Applications Are Hardened, Secure
Dark Reading Videos | 8/17/2018 | Ofer Maor of Synopsys Software Integrity Group describes how automated testing can non-intrusively pinpoint where developers may be inadvertently exposing data and/or violating compliance mandates.
Building Security into the DevOps Pipeline
Dark Reading Videos | 8/17/2018 | As companies pump more code into production at a faster pace, CA Veracode VP of Security Research Chris Eng stresses the importance of avoiding vulnerabilities by building security directly into the DevOps pipeline.
Supplementing the SOC with Cyber-as-a-Service
Dark Reading Videos | 8/17/2018 | Raytheon Cyber Protection Solutions CTO Mark Orlando suggests under-resourced SOCs enhance their effectiveness at-scale by tapping the advanced cyber defense automation his company has developed.
Leveraging the Power of your End-Users’ Human Cognition
Dark Reading Videos | 8/17/2018 | Cofense CEO Rohyt Belani makes a case for more aggressively leveraging the unique ability of your most perceptive and well-trained end-users to help you more quickly spot and stop email threats.
How Orchestration, Automation Help SOCs Do More With Less
Dark Reading Videos | 8/17/2018 | Splunk’s Haiyan Song and Oliver Friedrichs - co-founder of recently acquired Phantom - explain how security orchestration, automation, and response (SOAR) can empower SOCs to do more with less.
|
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
