Search By Category
By Structured Staff -- Does resilience planning factor into your cybersecurity strategy? If not, it should. And here’s why: While prevention is a great objective, it is increasingly difficult to defend a complex attack surface from all threats – especially the sophisticated and advanced threats we encounter today. Instead, organizations are bolstering prevention efforts with tactics and tools that enhance resilience. This is the ability to quickly identify attacks, limit their damage, and recover rapidly, thereby avoiding lengthy and disruptive downtime and data loss. To that point, MITRE released its Cyber Resiliency Engineering Framework (CREF) Navigator™, which is a free visualization tool for engineers designing cyber-resilient systems. The CREF framework, which aligns with NIST SP 800-160 standards, offers guidance along four primary principles: Anticipate: Maintain a state of informed preparedness. Withstand: Continue essential business functions through an attack. Recover: Restore all business functions after an attack. Adapt: Improve processes and business functions to better support the requirements of technical and operational environments. There is evidence to support the notion that focusing on resilience – as opposed to prevention alone – is sound strategy. Gartner reports that the average midsized business will experience 20 days of disruption following a successful ransomware…
So Vulnerable: Common Findings from Penetration Testing
By Chris Green, Structured Security Engineer, CISSP-ISC2, CISA ISACA, QSA PCI SSC, PCIP PCI SSC Amid rising global tensions and numerous warnings from the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA), organizations across the globe can expect to see an increase in cyber attacks from nation-states, criminal gangs, and copycats riding the…
Worried about Higher Cybersecurity Insurance Premiums? Here’s How to Limit Your Exposure.
By The Structured Security Team -- Experts agree, it isn't a matter of if your organization will come against a cybersecurity threat, it's a matter of when. And companies that provide cybersecurity insurance are passing along the costs, increasing premiums to combat the risk of increasing payouts. Cybersecurity Insurance Costs Are Increasing Rapidly Cybersecurity insurance…
Protect Identities with MFA, Validation and Strict Management
By Brad Pierce, Structured Managing Director of Security, CISSP/CISA/PCIP -- Last week in the news were reports of more than a billion accounts being leaked online from just two sources (Facebook (533M) and LinkedIn (500M)). The data is still being validated, but the source seems to largely be public information that has been aggregated, bundled…
Trust is Dead, Long Live Trust!
By Brad Pierce, Structured Managing Director of Security, CISSP/CISA/PCIP -- Zero Trust is a philosophy, a journey. No one manufacturer or security product will get you where you’re going. It will take all of your technologies, and likely some new ones, to arrive at a Zero Trust architecture. Trust is dead, long live trust! Zero…
Supply Chain Hacks: Fallout from a nation-state-backed attack
By Jesse Wilson, CISSP, Sr. Security Engineer -- Two weeks have passed since the discovery of Sunburst (https://us-cert.cisa.gov/ncas/alerts/aa20-352a), an exploit so vast it likely will become the biggest breach in history – at least to date. Government agencies and private businesses alike are scrambling to detect indicators of compromise (IOCs), install patches and implement damage…
Secure Critical Infrastructure Demands Proactive Measures
By Collin Miller, Director of Cloud Security -- Given the emergency brought on by rapid spread of COVID-19, many businesses have been shut down or are transitioning to telework to comply with public health measures. However, for the group of organizations that make up our critical infrastructure, shutting down is not an option. Critical infrastructure…
Back to Basics – Inventory Documentation and Network Visibility
By Brad Pierce, Structured Managing Director of Security, CISSP/CISA/PCIP -- One of the first things you must do as a network or systems administrator is document. Oh, Documentation! The bane of IT professionals everywhere. In our harried work lives, it is a tedious, time-consuming process. Most people prefer to avoid documentation. But, when it is…
Privacy Matters: A Look at the California Consumer Privacy Act
By Rob Wayt, CISSP-ISSEP, HCISPP, CISA, CISM, CRISC, CEH, QSA Sometimes we could all use a little privacy. Some downtime to unwind without being bothered by phone calls, emails and social media updates. Our world is moving faster and faster in the digital age, with no signs of slowing down. In a related way, this…
Supply Chain Hacking 101
An educational piece about the supply chain attack By Jesse Wilson, CISSP, @CyberWarior1775 To start, let’s talk about what the supply chain is in relation to Information Technology. In this case, the supply chain refers to the coordination of order generation; order processing; order fulfillment via the distribution of products, services and/or information; manufacturing; and…