NSA Director Defends Surveillance Of Phones, Internet
The director of the National Security Agency, Gen. Keith Alexander, today (Tuesday June 18) defended US spying on phone calls and internet traffic, saying it had prevented some 50 terror attacks around the world In remarks to the House Intelligence Committee, Alexander said: “In recent years, these programs, together with other intelligence, have protected the US and our allies from … Read more
Moving from Compliance to Risk-Based Security – Part 2
In my previous post, Moving from Compliance to Risk-Based Security – Part 1, I mentioned that I would share my discussions with two security executives who feel strongly about this topic. Both of them participated in the Wisegate CSO peer discussion documented in the report Moving From Compliance to Risk-Based Security. These experts clearly confirm the need to embrace risk … Read more
PRISM Leaker Stirs US-China Cyber Feud
Edward Snowden, the source of the leaks about the US government’s PRISM cyber spying program, claimed this week that the US has been hacking computers in China for at least four years. Snowden, who is now in hiding in Hong Kong – a Chinese-controlled territory – made the claims in an interview with the Hong Kong newspaper South China Morning … Read more
Posted in Governance, Risk and Compliance, Uncategorized
Tagged China Cyber Feud, cyber spying, Edward Snowden, PRISM
Leave a comment
Moving from Compliance to Risk-Based Security, Part 1
After 10 years of managing an IT audit function for an international energy company, I had the opportunity to head up their IT Strategy group that was charged with creating Organizational IT Security and Risk profiles and plans. The charge of this function was to annually evaluate organization-wide internal and external risk as it relates to IT, and to communicate … Read more
Posted in Governance, Risk and Compliance
Tagged Compliance, FISMA, HIPPA, IT Security, PCI, Risk-based Security
Leave a comment
Storm Over PRISM Leaks Widens
The saga of one of the most significant leaks of government information in recent US history has taken a new twist with the decision by the whistleblower – former CIA technical staffer Edward Snowden – to go public. In an interview carried out in Hong Kong with the UK newspaper The Guardian, Snowden said that after leaving the CIA he … Read more
US Government Angry Over Internet Spying Leaks
Director of National Intelligence James Clapper has denounced leaks to The Washington Post and Guardian newspapers this week which revealed that his agency is spying on e-mails and other internet traffic obtained from nine major companies. In a statement on Thursday, Clapper confirmed the surveillance was taking place but accused the newspapers of making unspecified errors in their reporting. “The … Read more
Posted in Governance, Risk and Compliance, Network Security
Tagged Internet spying, PRISM, spying programme
Leave a comment
Hagel Accuses China of Cyber Attacks
Defense Secretary Chuck Hagel publicly accused the Chinese government and military at the weekend of carrying out cyber attacks and expressed Washington’s determination to work “vigorously” to keep cyberspace safe. The accusation was made in an address on Saturday to the Shangri-La security conference in Singapore, which was attended by government and military representatives from Beijing. Speaking a week before President … Read more
Posted in Governance, Risk and Compliance, Security Management, Security Threats
Tagged Cyberspace, Hagel, Obama, Pentagon
Leave a comment
Privacy Advocates Vs. Legislators: House To Revisit CISPA This Week
Call it ‘cybersecurity’ week in our nation’s capital, as Internet privacy advocates clash with legislators on the best way enact quality cybersecurity legislation. The House Intelligence Committee plans to revisit the polarizing Cyber Intelligence Sharing and Protection Act (CISPA) this week, scheduling a “mark up” session today to revamp some of the bill’s amendments. This could eventually lead to a … Read more
IBM: Web Application Vulnerabilities Threaten The Enterprise
Web application vulnerabilities remained one of enterprises most pressing issues, rising 14% in 2012 over 2011 end of year numbers, according to a recent report. These vulnerabilities were exploited by attackers who, more often then not, injected malicious scripts and executables onto legitimate websites, targeting client side vulnerabilities in the browser core and in plugins such as those in Internet … Read more
Posted in Application Security, Governance, Risk and Compliance, Mobile Security, Network Security, Security Management, Security Threats, Uncategorized
Tagged DDoS, DDoS Attacks, IBM X-Force 2012 Annual Trend and Risk Report, malware, security information and event managemetn (SIEM), spam
Leave a comment
Survey: The Trouble With SIEM
Security Information and Event Management (SIEM) was supposed to make life easier for IT professionals, analyzing the torrent of incoming security data from the network perimeter to provide real-time analysis on security threats. Instead, it seems to have become a bit of an albatross for security pros who have to wrestle with increased complexity and management, according to a survey … Read more
