Assessing your risk in the New Year

This is the season for look-backs and look-forwards to what is/was big in every aspect of life and business. Cybersecurity features heavily in these articles, naturally, because effective cybersecurity can the thin line between chaos and order in a world that relies ever increasingly on computer systems and the internet.

I’m not going to rehash these various lists for you. I will however give a few examples to show that the key to effective cybersecurity is not ...

Read More →

16
JAN
2020

0

Identity Theft, Information Security, IoT, IT Security

2020, deepfakes, IoT, phishing, ransomware, smart devices, top threats

(Internet of) Things Change, and Not Always for the Better

Posted by: Carole Theriault

I was chatting with one of my IT Admin friends the other day. Let’s call him Gary to spare him blushes. He has been working in offices for years, and I asked him what little things annoy him these days. Not the Big Stuff like ransomware and corporate spying, I just wanted to know about the day-to-day frustrations.

He said:

“When I started out as ‘The IT Guy’ in the office, people would come and ask ...

Read More →

10
DEC
2019

2

Compliance, cyber-security, Data Breach, Information Security, IoT, IT Security, Penetration Testing

devices, Internet of Things, IoT, Risk Assessment, smart

Security Benefits and Perils of Serverless Computing

Posted by: Carole Theriault

Whether you run your infrastructure in house or in the cloud, you’ve probably heard of serverless computing, and how it can make running applications easier and cheaper. But is it all it’s cracked up to be, and is it more secure than running ‘always on’ servers?

Let’s start with the obvious advantages:

No infrastructure to maintain, not even virtual

With serverless computing, you don’t have to worry about provisioning servers, not even virtual ones. Your code runs ...

Read More →

22
NOV
2019

0

CISO On Demand, Cloud Security, Data Breach, Incident Response, Information Security, IT Security, Network Security

Audit trails, DOS, injection flaws, over privilege, Serverless computing

The current state of privacy laws in the USA 2020: what you need to know

Posted by: Carole Theriault

After the introduction of the CCPA in 2018 a whole slew of states got on board the data privacy bandwagon, and it looked like there was real momentum in the direction of increased rights for citizens over their own data. By the middle of 2019 more than a dozen states had introduced some kind of privacy bill, either from scratch or as an amendment to existing privacy laws.

So how has that turned out?

Well, if you’re an advocate for increased user ...

Read More →

12
NOV
2019

0

IoT, IT Security, Network Security, Penetration Testing, Ransomware

america, legislation, privacy, risk, state legislation, USA

How to evidence your way thru compliance

Posted by: Carole Theriault

I’m not usually a fan of nouns being used as verbs. As Calvin said to Hobbes in Bill Watterson’s wonderful comic strip, “Verbing weirds language”.

I mean, who really ‘dialogues’ with colleagues, or ‘greenlights’ tasks for them to ‘action’?

But there’s one denominal verb https://en.wikipedia.org/wiki/Denominal_verb (yes of course there’s a word for it) which I find myself using, and that is ‘evidencing’. This is a wonderfully concise way of saying “proving ...

Read More →

29
OCT
2019

0

Compliance, cyber-security, Identity Theft, Information Security, PCI DSS, Ransomware

Baltimore, evidencing, IT Security, policies, ransomware

Why it is high time to consider a CISO on demand

Posted by: Carole Theriault

Many years ago I went to the doctor with a weird arm. If I held my elbow and wrist just-so, it seemed to stop the blood supply going to my fingers. Nothing too dramatic, but worth getting checked out. I was referred to the local hospital where the specialist remarked that he had never seen anything like it and he was keen to investigate further.

“I should add that you’ve been referred to the wrong department. This ...

Read More →

11
OCT
2019

0

Blog, CISO On Demand, Incident Response, Information Security, IT Security, Network Security

CISO, CISO-on-demand, cybersecurity

Isn’t it time we talk seriously about a nation-wide Privacy Act?

Posted by: Carole Theriault

Would you be surprised if someone told you that they felt even less secure online today, compared to five years ago?

All we hear about are big companies screwing up and losing user data

Nah. Me neither. As reports Mitchell Noordyke from iapp, “state level momentum for comprehensive privacy bills is at an all time high.

One of the hot topics now is whether the United States, Like the EU, ...

Read More →

27
AUG
2019

0

201 CMR 17.00, Compliance, Data Breach, GDPR, Identity Theft, Information Security, IT Security, Network Security, Ny Cybersecurity Rule, PCI DSS

CCPA, compliance, cybersecurity, GDPR, infosec, national, policies, privacy, regulations, US, USA

How to avoid nasty flies in your bug bounty program

Posted by: Carole Theriault

Bug bounties are increasing in popularity, but are there any steps to consider to ensure you keep any annoying flies at bay? Let’s take a quick look.

Late last week, Google told security researchers that they have upped the bug bounty reward, making it significantly more attractive for researchers to invest in bug hunting.

Media reports cite that Google has received more than 8,500 security bug reports since the launch of its Chrome Vulnerability Rewards ...

Read More →

30
JUL
2019

0

Compliance, Information Security, Penetration Testing

bug bounties, bug programs, bug reports, exploits, Risk Assessment, vulnerabilities

Take aways from the NASA Raspberry Pi “incident”

Posted by: Carole Theriault

Some of you might be thinking that it being an IT security guy is not all that tough. All an expert has to do is block the bad stuff and grease the wheels for the good stuff.

But you’d be wrong. While yes, there are a growing number of tools out there to help IT security officers better manage their networks, the sheer complexity of the machines that basic users have at their fingertips can give a ...

Read More →

9
JUL
2019

0

Cyber Criminals, Incident Response, IoT, IT Security, Penetration Testing

JPL Network, NASA, Raspberry Pi

The ins and outs of single sign on

Posted by: Carole Theriault

With many technology and security events, such as Infosecurity Europe 2019, being in full swing, a number of tech goliaths are making some pretty bold statements.

It seems that the tectonic plates making up the technology landscape are indeed shifting, but it is anyone’s speculation to envision the end result…yet.

The biggest one by far this week was Apple announcing its plans to develop an Apple ID as an authenticator for online products and services.

So many of us ...

Read More →

11
JUN
2019

0

Identity Theft, IoT, IT Security, Uncategorized

Apple, Facebook, Google, MasterCard, Microsoft, Single Sign On, Twitter