Dark Reading: Security, Networking Collaboration Cuts Breach Cost

Archive for the ‘News’ Category

Dark Reading: Security, Networking Collaboration Cuts Breach Cost

Posted by Wolf Goerlich

CISOs report increases in alert fatigue and the number of records breached, as well as the struggle to secure mobile devices in a new Cisco study.

Excerpt from: Security, Networking Collaboration Cuts Breach Cost.

“We’re starting to see this move toward fewer consoles and move toward greater collaboration with other teams,” says Wolf Goerlich, advisory CISO with Duo Security (now under Cisco). “CISOs who act on those two trends have better outcomes for the organization.”

More than 91% of respondents say they are “very” or “extremely” collaborative; collaboration between endpoint and security teams is also high, at 87%. This trend can have financial benefits in the aftermath of a breach. In 2020, 59% of companies that say they are very/extremely collaborative between networking and security teams experienced a financial impact under $100,000 for their biggest breach, the lowest category offered for breach cost.

“A lot of it has to do with dwell time: How do we detect what’s going on in our environment; how do we remediate what’s going on in our environment,” Goerlich explains. “To detect, you have to have a really solid understanding of what’s going on in our networks and the cloud infrastructure we’re plugged into.”

And who better to detect than the subject matter experts? The networking team has a better understanding of the environment; as a result, team members know what’s typical and what isn’t. “There’s a reduction in time to detect because they understand what normal looks like, so they can help us understand what abnormal behaviors are,” he continues.

The networking team can also help stop threats. When a security operations center analyst spots an event, often because good practices they won’t pull out the equipment. They’ll pass this off to the subject matter experts, and the networking team takes over for quarantine, remediation, and cleanup.

“When you have those tight collaborations, you can say, ‘This is what we see, this is what needs to happen,’ and the handoff is much smoother,” Goerlich says.

Read the full article: https://www.darkreading.com/cloud/security-networking-collaboration-cuts-breach-cost/d/d-id/1337132

Wolf’s Additional Thoughts

When I built one of the first DevOps teams, a decade ago, I recognized the need for collaboration but greatly underestimated the impact of bringing teams together. By all metrics, our new combined team significantly and surprisingly beat out our previous separate teams. The industry has seen improvements year-after-year based on this simple concept. Create a common language, use a common set of tools, set a common set of goals, reduce barriers, and let the magic happen.

This is what excites me about SASE (Secure Access Service Edge). Imagine if we do with network operations and security operations what we previously did with development and IT operations. A decade from now, if we get that right, the productivity and pace of operations will be completely transformed.

Of course, that means pushing through the pushback to get staffing, reporting relationships, and budgets aligned. I’m not suggesting this is going to be easy. I’m simply saying we have a playbook to follow. Let’s do it.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

InfoSecurity Magazine: Mental Health Toolbox

Posted by Wolf Goerlich

Noting the warning lights to assess your levels of stress and mental health now, and in the future, can save a lot of anguish in your working life.

Excerpt from: Mental Health Toolbox

Speaking at 44CON in London on the issue of dealing with mental health, Duo Security CISO advisory group member J Wolfgang Goerlich recommended a strategy of a “career owners manual” and knowing what to do to “make sure you have got a career and what you’re doing well.”

“You need to be sure the inputs line up, as different companies have different values” he said, as if we are unhappy, it is too easy to ignore warning lights around our mental health, and it is too easy to take a “teenager’s action” as they ignore warning lights on a car. These warning lights should be around:

  • Physiological effects
  • Non-competitive compensation
  • Lack of training
  • Lack of career path
  • Poor teamwork
  • Poor leadership
  • No appreciation or recognition
  • Misaligned values and culture

Read the full article: https://www.infosecurity-magazine.com/news/44con-mental-health-toolbox/

Wolf’s Additional Thoughts

I burned out hard in 2014. I ended up taking a quarter off to refresh and renew. Since then, I’ve been very vocal about the need for managing the stresses of IT and cyber security.

I ran an apprenticeship from 2015-2019. This allowed me to hone my career advice with 67 junior-level security analysts. Quite sure they taught me more than they learned from me. It became readily apparent that no one advises on how to cope with stress, and how to separate bad stress from good stress, in cyber security degree programs.

I was therefore excited and pleased to have the opportunity to present on this topic at 44con, in collaboration with Mental Health Hackers.

If you’d like to talk, hit me up on my coaching page. We absolutely must do more to support each other, mentally and physically.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Dark Reading: OS, Authentication, Browser & Cloud Trends

Posted by Wolf Goerlich

New research shows cloud apps are climbing, SMS authentication is falling, Chrome is the enterprise browser favorite, and Android leads outdated devices.

Excerpt from: OS, Authentication, Browser & Cloud Trends

Application integration is up across most key categories. The number of customers per cloud app is up 189% year-over-year, and the number of authentications per customer per app is up 56%.

The massive spike in cloud applications means any given employee has at least two or three cloud apps they use to do their jobs, says Wolfgang Goerlich, advisory CISO for Duo Security. “It was a big explosion of shadow IT,” he adds. “It really got away from a lot of the organizations.” Some people often use the same applications for personal and business use, driving the need for businesses to enforce their security policies for cloud-based applications and resources.

Read the full article: https://www.darkreading.com/cloud/security-snapshot-os-authentication-browser-and-cloud-trends/d/d-id/1335262

Wolf’s Additional Thoughts

IT history repeats itself.

The organization moves slow to provide employees with tools and technology. Consumer tech fills in the gap outside of the office. People get savvier and more experienced with tech. People innovate with what they know, to get done what they need to get done.

The organization notices people doing things in an innovative yet ad hoc way. Work is done to standardize tech use. More work is done to secure the tech use. The wild ways of people, the wilderness of shadow IT, is tamed and brought into the light.

We’re at this point now. That’s what the numbers show. But tamed IT is slower than shadow IT. If the past has taught us anything, it is that the cycle will repeat.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

With continuous security, Sec DevOps deconstructs CI/CD

Posted by Wolf Goerlich

Nothing is set in stone when an organization follows a DevOps methodology — a DevOps security model pushes developers and ops to constantly retune, slow down and speed up.

Excerpt from: With continuous security, SecDevOps deconstructs CI/CD

“All of the DevOps teams I work with have some integration between cybersecurity and development,” said J. Wolfgang Goerlich, cybersecurity strategist at Creative Breakthroughs Inc., a Detroit-based IT security consultancy. Some organizations have embedded security architects in the DevOps teams. Others have security champions within DevOps who work directly with the cybersecurity team. “In both cases, the partnership is a means to introduce security concepts while maintaining DevOps velocity,” he said.

Goerlich said roughly one in four DevOps teams integrate and automate some level of security controls. “This integration is generally performing scans and checks against the static code, the application, and the underlying environment composition,” he said.

But this level of automation often requires tuning and adjustments to ensure it keeps pace with DevOps. For example, he said, traditional code-level scans take several days. “That’s not effective when DevOps is changing the code on a daily or even hourly basis,” Goerlich said.

Effective SecDevOps teams secure without slowing, and they add continuous security without exceeding the team’s capacity to change, he said. “It’s paradoxically fast and slow, with security controls being added slowly while tuned to execute very quickly.”

Success comes from balancing protection for the DevOps product while protecting the DevOps productivity.

Read the full article: http://searchitoperations.techtarget.com/feature/With-continuous-security-SecDevOps-deconstructs-CI-CD

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Hybrid cloud security: 8 key considerations

Posted by Wolf Goerlich

Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting. While security fears are declining as cloud matures, security remains an ongoing challenge that needs to be managed in any organization. And a hybrid cloud environment comes with its own particular set of security considerations.

 

1. Ensure you have complete visibility.

Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure, says cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI.

Now that companies and their end users can use hundreds of cloud-based apps, and multiple departments can spin up their own virtual server on an Infrastructure-as-a-Service platform, complete visibility across private cloud, public cloud, and traditional infrastructure is a must. A lack of visibility, says Goerlich, snowballs into much greater security risks than are necessary.

2. Every asset needs an owner.

If you lack 360-degree visibility, you probably lack ownership. Every piece of your hybrid cloud architecture needs an owner.

“A key tenet in IT security is having an owner identified for every asset, and having the owner responsible for least privilege and segregation of duties over the asset,” Goerlich says. “Lack of visibility results in a lack of ownership. This means, quite often, hybrid cloud environments have loosely defined access controls and often are without segregation of duties. Excessive permissions introduce risk, and unowned risk is unaddressed risk.”

Read the full article:

Hybrid cloud security: 8 key considerations
https://enterprisersproject.com/article/2017/7/hybrid-cloud-security-8-key-considerations

Enterprisers Project: Expert advice on securing hybrid cloud environments

Posted by Wolf Goerlich

Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting.

Excerpt from: Hybrid cloud security: 8 key considerations

Ensure you have complete visibility. Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure, says cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI.

Now that companies and their end users can use hundreds of cloud-based apps, and multiple departments can spin up their own virtual server on an Infrastructure-as-a-Service platform, complete visibility across private cloud, public cloud, and traditional infrastructure is a must. A lack of visibility, says Goerlich, snowballs into much greater security risks than are necessary.

Read the full article: https://enterprisersproject.com/article/2017/7/hybrid-cloud-security-8-key-considerations

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Poynter: Don’t want the public to see your newsroom’s gossip?

Posted by Wolf Goerlich

Newsroom instant messaging apps have only gained momentum since then, with Slack among the vanguard thanks to its ease of use and its cool-kid factor.

Excerpt from: Don’t want the public to see your newsroom’s gossip? Don’t put it on Slack.

Journalists should exercise more caution when it comes to digital tools like Slack, said J Wolfgang Goerlich, director of cyber security strategy at CBI, a risk management firm that provides security solutions for companies.

“As no chat system is immune to being misconfigured or misused, my advise is to limit any information over such channels,” Goerlich said. “Meeting in person for conversations remains the gold standard for the highest level of privacy.”

Goerlich’s advice for newsrooms is to select communication apps wisely, assume all exchanges are potentially public information and protect individual accounts of employees with good privacy and security measures.

Read the full article: https://www.poynter.org/tech-tools/2017/dont-want-the-public-to-see-your-newsrooms-gossip-dont-put-it-on-slack/

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Don’t want the public to see your newsroom’s gossip?

Posted by Wolf Goerlich

Last year, instant messages from Gawker staffers were cited as evidence in the defamation lawsuit filed by professional wrestler Hulk Hogan.

What they revealed wasn’t pretty: tasteless jokes about the former pro-wrestler’s sexual trysts and his genitals, snide remarks that weren’t meant for publication.

The transcripts quickly became a cautionary tale for journalists who might exchange sensitive information via instant message (and the companies that host them).

Newsroom instant messaging apps have only gained momentum since then, with Slack among the vanguard thanks to its ease of use and its cool-kid factor.

Journalists should exercise more caution when it comes to digital tools like Slack, said Wolfgang Goerlich, director of cyber security strategy at CBI, a risk management firm that provides security solutions for companies.

“As no chat system is immune to being misconfigured or misused, my advise is to limit any information over such channels,” Goerlich said. “Meeting in person for conversations remains the gold standard for the highest level of privacy.”

Read the full article:

Don’t want the public to see your newsroom’s gossip? Don’t put it on Slack.
https://www.poynter.org/2017/dont-want-the-public-to-see-your-newsrooms-gossip-dont-put-it-on-slack/444202/

 

 

Prevent ransomware threats to cloud apps with backup, security tools

Posted by Wolf Goerlich

Ransomware — a form of cyberattack that interrupts access to an organization’s data until that organization pays a ransom fee — has grown from a rare occurrence in IT to a substantial and growing threat for enterprises. Ransomware encrypts files with a key only the attacker has, making it impossible for target organizations to crack it.

Ransomware has blossomed to the point where it now represents about one-third of the incidents handled by Creative Breakthrough Inc. (CBI), a managed services provider focused on IT security and risk assessments, based in Detroit.

“This is a reflection of the criminalization of hackers that we have seen over the past several years,” said J. Wolfgang Goerlich, director of security strategy at the company, adding that, just because your workloads are in the cloud, “doesn’t mean you are in the clear.”

Read the rest here: http://searchcloudcomputing.techtarget.com/tip/Prevent-ransomware-threats-to-cloud-apps-with-backup-security-tools

Drowning in a sea of cybersecurity tools

Posted by Wolf Goerlich

Posted on TechTarget SearchSecurity: Drowning in a sea of cybersecurity tools?

How can CISOs get the information and benchmarks they need to evaluate the enterprise effectiveness of promising technology and find the best security tools beyond point solutions?

“There is too much for any one leader to take in; therefore, the first step is in focusing on key areas,” says J. Wolfgang Goerlich, a cybersecurity strategist at Creative Breakthrough Inc. (CBI) in Ferndale, Mich. A former information systems and security manager at Munder Capital Management, Goerlich recommends networking with CISOs in other organizations to gain insight into the best security tools and industry-specific trends. “Building a strong peer network within the organizations gives visibility into the line-of-business technologies,” he explains.

Enterprises should leverage the resources and interactions available through clearinghouses like the Information Sharing and Analysis Centers (ISACs) for financial services, healthcare and other industries to focus on emerging threats. “Taking into account these areas, a CISO can then pare down the list to essential technologies and get deep in the areas that directly affect their organization,” Goerlich says.

Read the full article at: http://searchsecurity.techtarget.com/feature/Drowning-in-a-sea-of-cybersecurity-tools