Tag Archive for: CISOs

Why CISOs need zero trust as a ransomware shield


Head over to our on-demand library to view sessions from VB Transform 2023. Register Here


This year is on pace to be the second-costliest for ransomware attacks ever, with threat actors relying on new deceptive approaches to social engineering combined with weaponized AI. The recent MGM breach began with attackers studying the social media profiles of help desk employees, then calling the help desk and impersonating them to get privileged access credentials and logins.

Zero trust security needs to be a mindset that pervades everything from consolidating tech stacks to managing identities at scale. CISOs and their teams must start with the assumption that a breach has already happened, and an organization’s network needs to be designed to limit an intrusion’s blast radius and depth.

“Zero trust requires protection everywhere — and that means ensuring some of the biggest vulnerabilities like endpoints and cloud environments are automatically and always protected,” said Kapil Raina, VP of zero trust marketing and evangelist for identity, cloud and observability) at CrowdStrike. “Since most threats will enter into an enterprise environment either via the endpoint or a workload, protection must start there and then mature to protect the rest of the IT stack.”

Gartner introduces a new Hype Cycle for Zero Trust Networking

Gartner’s inaugural Hype Cycle for Zero Trust Networking comes at a time when CISOs and the organizations they serve are under siege from near-record ransomware attacks. All hype cycles and market frameworks have limitations, yet they do help to filter out vendor noise and those overstating their zero trust capabilities. The Hype Cycle examines 19 key technologies — including microsegmentation, Kubernetes networking, secure access service edge (SASE) and security service edge (SSE) — and maps their maturity level and hype cycle position. 

Event

VB Transform 2023 On-Demand

Did you miss a session from VB Transform 2023? Register to access the on-demand library for all of our featured sessions.

 


Source…

CISO Conversations: HP and Dell CISOs Discuss the Role of the Multi-National Security Chief


HP and Dell Technologies are two of the world’s largest international computer manufacturers. Their CISOs, Joanna Burkey (HP) and Kevin Cross (Dell), both manage security teams comprising many hundreds of people, and are responsible for corporate security across multiple jurisdictions. The role of CISO is different for a multinational corporation compared to a national company.

Reporting and budget

Historically, the CISO reports to the CIO, and this remains the most common reporting structure. Not all CISOs agree with this because of the inherent conflict of interest between IT and security. Both Burkey and Cross believe it is right for some companies, but wrong for others.

There’s no one size fits all solution to the hierarchy issue, says Burkey. “Every company has a different culture and different value prop; and it is these that determine the right location for the CISO.”

Cross has a very similar view. “There is no right or wrong answer to this,” he says. “It is dependent on the company culture and the business landscape how things should best be structured.” Supporting this, he notes that Dell’s structure is slightly unusual. “I report to a chief security officer who reports to general counsel, who reports to the CEO.” A stronger than usual integration with Legal could be considered important for a firm working across multiple jurisdictions with different privacy and data security requirements.

Joanna Burkey, CISO at HP
Joanna Burkey, CISO at HP

Budget is always an issue for any CISO – getting sufficient funds to do what is important. One of the weaknesses in having the CISO report to the CIO is that it is still common for the security budget to be taken as a percentage of the IT budget. But security has grown beyond IT alone. 

“Cybersecurity is a strategic horizontal in most enterprises,” comments Burkey. “Cyber is important everywhere and it is really important that the funding model and the financial partnerships for cyber span the enterprise.”

Achieving this is complex and governed by the individual business landscape. “I’ve seen different models that can work,” she continued. “Budget could be received from a single source, such as the CFO or CTO, but…

Source…

NeGD, MeitY organises 30th Batch of Chief Information Security Officers’ (CISOs) Deep Dive Training Programme under Cyber Surakshit Bharat Initiative


NeGD, MeitY organises 30th Batch of Chief Information Security Officers’ (CISOs) Deep Dive Training Programme under Cyber Surakshit Bharat Initiative – Odisha Diary

Source…

Smishing – what is it? And why should it be a top priority for CISOs?


Anyone who uses a smartphone has likely been the target of at least one smishing attack.  Short for SMS phishing, smishing is an increasingly popular choice of attack vector, where the user is deceived into downloading virus or malware onto their mobile devices.   

Smishing as a form of attack is of particular concern as people are trusting and responsive to text messages rather than email. Only 1 in 4 emails are opened by consumers, whereas 82 percent of text messages are read within five minutes.  

Source…