6 Tips for Securing Privileged Accounts in the Enterprise

Posted by Heather Howland on Mar 2, 2018 6:00:00 AM

Protecting privileged accounts and actively responding to any potential compromises has become a critical initiative for many CISOs. Stolen credentials are at the heart of most all modern attacks and breaches. Attackers can easily obtain credentials via phishing attacks, brute force, keyloggers, pass-the-hash techniques, or using a database of previously stolen credentials. And once an account is compromised, the attacker can see and do anything that is allowed for that user or account.

Read More

Topics: CISO, Privileged Users, Privileged Accounts

Getting the Most out of a Security Product POC

Posted by Eran Cohen on Jan 21, 2018 3:00:00 PM

Vendors, especially in the over crowded security space, often must help buyers justify their investment. But what happens when there isn’t a real problem during the test period? This can make it difficult to properly assess. Some security vendors will simulate problems, others may sponsor penetration tests, or they may provide a list of tests and tools, and so on. In the highly competitive End Point market (aka AntiVirus) they will use any tool they may have in the box.

Read More

Topics: CISO, POC

Corporate Culture Shift: Using Adaptive Security to Influence Employee Security Behavior

Posted by Heather Howland on Jan 12, 2018 7:19:33 AM

I’ve heard it many times from customers: “IT Security needs to be transparent to users in order to be successful.” Unfortunately, we are now in a digital age where things have dramatically changed and research has shown over and over that credential compromise is the top way that hackers breach an organization.

Read More

Topics: User Behavior, CISO, Risk, Identity Verification, Identity, Adaptive Threat Prevention

Study Finds Employee Security Habits Reveal Risky Imbalance

Posted by Heather Howland on Nov 16, 2017 5:12:33 AM

Human nature motivates us to enhance productivity, make things easy, find workarounds and to crave information that is being kept from us. How do these motivations change the way people work? Do their actions put their company at risk? Do IT Security teams need to understand basic psychology to protect their organizations?

Read More

Topics: CISO, Credential Compromise, Passwords, Insider Threat, CARTA, NIST

Reduce Harm by Refocusing on the Basics

Posted by Eran Cohen on Aug 11, 2017 10:22:02 AM

Full disclosure: I wasn’t physically at BlackHat 2017. But my colleagues who attended told me about the keynote by Alex Stamos, CSO at Facebook.

Read More

Topics: CISO, Risk, Passwords, Identity, Informaton Security

CARTA - The Evolution of IT Security Beyond Black and White

Posted by Ajit Sancheti on Jun 16, 2017 10:04:54 AM

Gartner’s 2017 Security Summit began this week with a keynote from Neil MacDonald, Eric Ahlm and Ramon Krikken introducing a new charter that will transform all areas of information security moving forward. They introduced a new strategic approach called CARTA* – Continuous Adaptive Risk and Trust Assessment.

Read More

Topics: CISO, Adaptive Response, Risk, CARTA

1 in 5 Enterprise Passwords Can Be Easily Compromised

Posted by Yaron Zinar on Jun 14, 2017 5:00:00 AM

Recently, the new draft of NIST guidelines was released and proposed a shift in password strategy from periodic changes with complexity requirements to use of a long "memorized secret.” Many organizations have forced regular password changes and password complexity but this has failed them.

Read More

Topics: CISO, Passwords

The Cybersecurity Penalty Box. Yes or No?

Posted by Heather Howland on Jun 9, 2017 10:01:03 AM

Earlier this week, I published an article with ITSP Magazine that discusses a newly brewing concept within Enterprises around penalizing employees for bad security behavior. Can you imagine if your company penalized you for clicking on a phishing link? Or because you bent the security rules in order to get something done more easily?  

Read More

Topics: User Behavior, CISO, ueba, Insider Threat

Top IT Security Trends for Law Firms at LS-ISAO

Posted by Ajit Sancheti on May 3, 2017 8:05:28 AM

Last week, I had the opportunity to spend a day at a Legal Services Information Sharing & Analysis Organization(LS-ISAO) workshop in New York City, hosted by a leading law firm. Close to 100 security professionals from law firms around the country participated. While most law firms have small dedicated security teams, what was apparent from the beginning was that the challenges ahead of them were not small.

Read More

Topics: CISO, Risk, Law Firms, Insider Threat

Going on the Offense: How to Eliminate Insider Threats

Posted by Heather Howland on Apr 28, 2017 12:19:30 PM

In the past year I have seen a big shift in the conversations I've had with CISOs. What used to be all about how to keep the bad guys out, is now about, how do I manage the threats that are already on the inside. Their security strategies are broadening to address Insider Threats and they are implementing, or looking to implement, technologies and solutions to help them better understand what’s really going on inside their organization and to find ways to reduce their risk.

Read More

Topics: User Behavior, CISO, Insider Threats, User and Entity Behavior Analytics, ueba