On this week's "Sound Off," we ask John Kindervag, the founder of Zero Trust, for his reaction to the recently released Office of Management and Budget federal strategy to move the U.S. government toward a mature Zero Trust architecture.
People think cloud is a silver bullet, but it’s not. It's not even copper. And people think cloud it easy and someone else’s problem. But it's not. The cloud is nothing more than a highly resilient, outsourced data center with a lot of bells and whistles.
A massive data breach has been uncovered by researchers who say the incident totals in excess of 172 GB of data and affects an estimated 19 million people. The victims are primarily customers of online appointment company FlexBooker, researchers say.
Ransomware attacks in 2021 amassed a record number of victims in critical infrastructure sectors across Australia, the U.K. and U.S., those countries' lead cybersecurity agencies warn. They share intelligence on attackers' latest tactics to better equip domestic organizations to defend themselves.
The SEC voted 3-1 to advance new, mandatory cybersecurity rules for registered investment advisers, companies and funds. The proposal - open for a 30-day public comment period - would require entities to adopt and implement written cybersecurity policies and a 48-hour incident reporting mandate.
Jeff Williams, co-founder and CTO of Contrast Security, says people have a right to know if the products they use are secure. It's difficult to tell if software is secure, he says, so companies need incentives to build good security programs, improve their software and disclose any flaws they find.
In a U.S. Senate hearing on Tuesday, the Apache Software Foundation and leaders from Cisco, Palo Alto Networks and The Atlantic Council discussed open-source software security, urging both government and private sector entities to recognize the breadth of the free-to-use software and adversaries' willingness to...
As a CISO in financial services, Bradley Schaufenbuel of Paychex enjoys the velocity of change - no two days are alike. But with that pace comes a corresponding uptick in supply chain risk, which adds a new degree of difficulty to an already challenging leadership role.
The House of Representatives on Friday passed a bill that Democratic lawmakers say will help the U.S. compete with China economically when it comes to manufacturing semiconductor chips and bolstering both supply chains and the technology workforce.
Four ISMG editors discuss important cybersecurity issues, including misconceptions around Zero Trust implementation, lessons learned from the crippling NotPetya malware attack of 2017 that nearly sank logistics giant Maersk and how a Russian cyberwar in Ukraine could move beyond its borders.
U.S. DHS Secretary Alejandro Mayorkas confirmed on Thursday that the department is establishing a Cyber Safety Review Board, as directed by President Joe Biden's sweeping cybersecurity executive order signed in May 2021. The board aims to mirror the work of the National Transportation Safety Board.
The security world continues its fight against potential widespread exploitation of the critical remote code execution vulnerability - tracked as CVE-2021-44229 - in Apache's Log4j software library, versions 2.0-beta9 to 2.14.1, known as "Log4Shell" and "Logjam." This is a digest of ISMG's updates.
The House Oversight and Reform Committee today advanced its version of the Federal Information Security Modernization Act of 2022, which entails cybersecurity updates for federal civilian agencies. The bipartisan measure was sent to the full House on a voice vote.
Israeli spyware company NSO's flagship product, Pegasus, was tested by the FBI, according to reports, prior to the company being sanctioned by the U.S in the wake of revelations of misuse of its tools. Now, U.S. venture capital company Integrity Partners is in negotiation to take control of the company.
Attack scans and attempts related to the Log4j flaw may have declined, but some security experts believe the attack vectors will continue to pose a problem up to two years. Also, the Ukraine Computer Emergency Response Team reports Log4j could be a possible attack vector in recent cyberattacks.
Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.com, you agree to our use of cookies.
