Company CISOs and Boards Brace for New SEC Cybersecurity Regulations

The U.S. Securities and Exchange Commission (SEC) is proposing new cybersecurity regulations that would require public companies to report cybersecurity incidents within four business days and to have a board-approved cybersecurity policy in place. The regulations are designed to protect investors from the risks of cybercrime and to hold public companies accountable for their cybersecurity practices.

Company CISOs (chief information security officers) and boards are bracing for the new regulations, which they believe will be costly and burdensome to implement. However, they also recognize that the regulations are necessary to protect companies and their investors from the ever-growing threat of cybercrime.

In this blog post, we will discuss the SEC's proposed cybersecurity regulations and what they mean for company CISOs and boards. We will also provide tips for companies on how to prepare for the regulations.

The SEC's Proposed Cybersecurity Regulations

The SEC's proposed cybersecurity regulations would require public companies to do the following:

• Report cybersecurity incidents within four business days. Companies would be required to report any cybersecurity incidents that have a material impact on the company or its investors.

• Have a board-approved cybersecurity policy in place. The policy should address the company's cybersecurity risks and how it will manage those risks.

• Conduct regular cybersecurity assessments. The assessments should identify and fix vulnerabilities in the company's systems and networks.

• Have a plan in place to respond to a cyberattack. The plan should include steps to contain the damage, notify regulators and customers, and restore operations.

The SEC's proposed regulations are based on the Cybersecurity Framework, a voluntary framework developed by the National Institute of Standards and Technology (NIST). The Cybersecurity Framework provides a set of best practices for organizations to follow to improve their cybersecurity posture.

The SEC's proposed regulations are likely to face opposition from some companies, who argue that they are too burdensome and costly. However, the SEC is likely to move forward with the regulations, given the increasing risk of cybercrime.

What the Regulations Mean for Company CISOs and Boards

The SEC's proposed cybersecurity regulations will have a significant impact on company CISOs and boards. CISOs will need to ensure that their companies are in compliance with the regulations, which will require them to implement and maintain a robust cybersecurity program. Boards will need to oversee the company's cybersecurity program and ensure that it is effective.

The regulations will also have a financial impact on companies. Companies will need to invest in cybersecurity controls and staff to comply with the regulations. The costs of compliance will vary depending on the size and complexity of the company.

Tips for Companies on How to Prepare for the Regulations

Companies can take the following steps to prepare for the SEC's proposed cybersecurity regulations:

• Assess your cybersecurity risks. The first step is to assess your company's cybersecurity risks. This will help you to determine which areas need the most attention.

• Implement appropriate security controls. Once you know your risks, you can implement appropriate security controls to mitigate them. This could include things like firewalls, intrusion detection systems, and data encryption.

• Train your employees. Your employees are your first line of defense against cyberattacks. Make sure they are trained on cybersecurity best practices, such as how to identify and avoid phishing scams.

• Stay up-to-date on cybersecurity news and trends. The cybersecurity landscape is constantly changing. Make sure you stay up-to-date on the latest news and trends so you can protect your company from new threats.

• Conduct regular cybersecurity audits. Regular cybersecurity audits can help you to identify and fix vulnerabilities before they are exploited by attackers.

• Implement a cybersecurity awareness program. A cybersecurity awareness program can help your employees to understand the risks of cybercrime and how to protect themselves and the company.

By taking these steps, you can help your company to comply with the SEC's proposed cybersecurity regulations and protect itself from the ever-growing threat of cybercrime.

Ensure Cyber Resilience by Developing Your Cyber Resilience Plan

Cybersecurity risks are common in the digital age, but we should not allow them to limit our business goals. Cybersecurity consulting and security breaches have gradually become critical parts of the IT department. We cannot tackle cyber threats without the expertise of cybersecurity consultants or cybersecurity breach experts.

Whether starting from scratch or looking to improve your existing cybersecurity resources, hiring a qualified cybersecurity consultant or security breach expert is always a good idea first.

Cybersecurity Vulnerabilities, Exploits, and Threats

Cybersecurity vulnerabilities are more likely to occur when old software versions are in use. Cybercriminals may exploit any software bugs they find. They may even write malware to specifically target older applications, which are less secure and easier to hack than their newer counterparts.

If you want to protect your company from cyber attacks, here are a few ways:

• Use the latest version of any application that is essential for your business (e.g., antivirus software);

• Have an expert conduct regular audits and penetration tests;

• Install operating system patches as soon as possible;

• Train employees on cybersecurity best practices;

• Strengthen network defenses by having an active firewall, two-factor authentication, and strong passwords policies in place;

• Let employees know what they can do to keep their devices safe at home and work.

• Implement ransomware backup best practices

Cyber Risk Mitigation Solution

When considering an organization's cyber security approach, the initial needle-moving goal should not be to avoid all risks, but instead, the strategy should contemplate how much security and what type of risk level is appropriate for different vulnerabilities.

The vulnerability analysis techniques present an opportunity for organizations to address the weaknesses in their current system and security framework. The flaw-based techniques help in assessing risks, hypothesizing breach points as well as benefits and disadvantages produced as a result of these risks. The damage potential (DP) technique offers this kind of precise information about vulnerable areas within cyber-systems that are commonplace features of computers and mobile devices.

Companies are getting hit by ransomware attacks, but there are things that both companies and employees can do to protect themselves by hiring an organization like CyberSecOp to implement a robust security program.

Security breaches can have disastrous effects as they potentially expose sensitive data to hackers. Companies are advised to plan their security measures in a preventive way and commit to these methods. The response should also be planned in order to restore the state prior to or minimize the damage caused by a security breach effectively.

Governmental agencies are investing in cybersecurity.

Cybersecurity has become a major issue. Governmental agencies are investing in the cybersecurity domain and focusing on security advancements. For example, Cybersecurity Strategy 2020 and expanding U.S. Cyber Task Force under DHS relate to this area of security and address the broad scope of cyber threats to federal networks, systems, or communications infrastructure identify priorities for cyber risk management, ensure persistent attention to counterterrorism with respect to cyberspace policymaking, execution baseline resilience against digital interference, reduce interstate conflict over jurisdictional responsibilities related to cybersecurity matters by improving key information-sharing practices among relevant federal entities in order to promote operational coordination on cybersecurity matters.

Healthcare is a Top 3 Cyber Target

 Attacks on the healthcare industry are on the rise as noted in a recent article published in CYBERSECOP.  Healthcare providers of all sizes are subject to attack and in this case, CHRISTUS Health learned of “unauthorized access” likely similar to 254 ransomware incidents targeting patient care facilities between June 2020 and April 2022 worldwide.  Patients are at risk, both their health and their PII where threat actors can alter and/or add to patient billings with no notice of impropriety.  The true impact will be hard to discern until more time and data are collected but we know one thing for sure, the healthcare industry needs to take cybersecurity as seriously as they do patient care and follow their own advice; Plan, Prevent, Protect and Respond.

Plan – Get a Risk Assessment to identify and understand your cybersecurity vulnerabilities is one of the most critical steps as the awareness will lead to a prioritized remediation plan.  Even a chink in the armor will have your patients, employees, and community concerned as a cyber-attack will likely affect critical operations because the prize is financial data, patient, and employee Personally Identifiable Information (PII).

Prevent - After an assessment is completed, you need a trusted and reliable security cyber organization to assist in leveraging the right framework and controls to be measured by such as HITURST, HITECH, HIPAA and PCI.  These guidelines assist in defining the appropriate critical security controls for effective cyber defense.  These efforts can be awareness training, policy creation & enforcement, and security controls as well as incident response readiness and governance.  It’s a journey, not a sprint.

Protect – Within most remediation plans include investments in endpoint protection dark web monitoring and focusing on digital trust goals to ensure the technology investments already made as well as those in the future work in harmony.  Like a Rubik’s cube, the goal is to have every facet of your organization in order, not just celebrating a single win.  It is important to have a managed security partner to protect your patients, employees, devices, and data with monitored protection systems along with managed & encrypted backups with a Security Operations Center staffed with certified security professionals watching and engaging on your behalf 24x7x365.

Respond – Did you know that a threat actor will live in your ecosystem for an average of 121 days mining sensitive data, passwords, organization charts, and behaviors before acting?  Nearly 95% of ransomware attacks are preventable so what starts as a threat becomes a technology issue, then a business risk issue, and eventually decision-making and communications issue at the board level.  Do you pay the ransomware or not?  Are we able to recover our data?  Has the threat actor accessed our PII?  And equally important is how do you keep from reaching this point again.  Having an incident response assessment and plan might be the one thing you do if you don’t buy into everything else.  You should receive an IT assessment of “how capable are we to thwart an attack?” and “how able are we to recover if breached?”  Buying cyber insurance is not the silver bullet it used to be so having an incident partner who is proactively focused on your company’s sensitive data and reputation is paramount.

Not unlike a hospital, there are two main ways to address cyber security by coming through the Emergency Room or the front door proactively for testing; I recommend the latter.  A proactive health check is the best step to understanding your ability to fight off an attack like a stress test.  The results may drive adjustments in behavior and readiness, such as point endpoint detection, policy creation & enforcement, and security training.  If you enter the ER, then don’t panic because you read this blog and signed up a reputable security partner to react & respond, including quarantining affected systems to prevent the ransom spread, resetting all passwords, checking your backups, activating your existing crisis/DR plans and negotiate with the threat actor if that is the best business decision communicating carefully along the way with detailed documentation.  The moral of this story is that hope is not a strategy, so know your security scorecard and realize cyber readiness is a journey, not a sprint.

Author: Christopher Yula

So, What Exactly Is the Dark Web, Anyway?

The first time I heard the term ‘Dark Web’ was in the context of a case of misappropriated identity.  A close relative of mine had begun receiving all sorts of communications from credit card companies and debt collectors concerning delinquencies that they were completely unfamiliar with.  One even included an attempt at collecting back premises rent for an apartment in Dallas, Texas where my relative had never visited in their life.  After spending months fighting off financial claims and trying to repair their credit history, my relative contracted a computer security professional to perform a forensic investigation of their home PCs.  It was ultimately discovered that some or all of the data breach enabling the identity theft had been the outcome of a fairly sophisticated spear-phishing attack combined with the installation of a key logger agent.  The forensics also revealed that much of their Personal Identifying Information had migrated to the Dark Web and was presently freely available to whomever-or whichever entity-might be interested.

Dark Web and how it functions

Dark Web, I thought.  Huh.  I’ve heard of the Dark Web but don’t know much about what it is or more specifically, how it functioned.  Heretofore I’d (wrongly) believed it was composed of a bunch of gamers sharing logins to cloud gaming services along with the ever-present and always thriving market for pornography.  My investigatory efforts yielded that the Dark Web is so, so much more, however; and I thought it was important to share my findings to clear up any popular misconceptions of which there is legion.  Therefore, I’ve decided to put together a brief post that provides the nuts and bolts of what’s become an increasingly important cog in the global economy for ill-gotten bits and pieces of data and information.  It turns out, the Dark Web wasn’t nearly as elemental as I’d initially suspected.

The Dark Web is a collection of thousands of websites that use anonymity tools to hide their IP addresses. While it's most famously been used for black market drug sales and even child pornography, the Dark Web also enables anonymous whistleblowing and protects users from surveillance and censorship.  Readers will recall that the Dark Web played an intermediary role in WikiLeaks dissemination of certain confidential U.S. Department of Defense documents related to the conflicts in Iraq and Afghanistan.

Who created the Dark Web and how can it be assessed?

The majority of Dark Web sites use the anonymity software Tor with was created by the U.S. Department of Defense, though a smaller number also uses a similar tool called I2P. Both of those systems encrypt web traffic in layers and bounce it through randomly-chosen computers around the world, each of which removes a single layer of encryption before passing the data on to its next hop in the network. In theory, that prevents any spy—even one who controls one of those computers in the encrypted chain—from matching the traffic’s origin with its destination.  In layman’s terms-traffic on the Dark Web is untraceable.

Though the Dark Web is most commonly associated with the sale of drugs, weapons, counterfeit documents, and child pornography, not everything on the Dark Web is quite so “dark.” One of the first high profile Dark Web sites was the Tor hidden service WikiLeaks created to accept leaks from anonymous sources.  Even Facebook has launched a Dark Web site aimed at better catering to users who visit the site using Tor to evade surveillance and censorship. The Dark Web is also a vehicle for hackers to buy and sell personal information such as names, addresses, social security numbers, credit card information, etc. The more information they obtain from the unsuspecting victim, the higher the price.

Can Dark Web provide privacy

Just how completely Dark Web users can evade the surveillance of highly-resourced law enforcement and intelligence agencies, however, remains an open question. The FBI and EUROPOL have both launched successful Dark Web investigations aimed at stopping human trafficking, identity theft, and drug smuggling, and in most cases, the agencies were able to identify the threat actor by setting up relays and scripts on websites they frequently visit.  It's also possible that the agencies employed sophisticated DNS attacks on TOR servers or used other exploits; then again, it’s also possible they were able to rely on good old Human Intelligence-informants.  Everyone seems to have a price. 

So in summary, we know that the Dark Web exists, it’s a marketplace for all sorts of data and information exchange, not all of it legal or voluntarily disclosed.  The best way to ensure you don’t wind up on the wrong side of information exchange?  Secure your information systems, be very, very judicious in responding to emails and if you have any questions or concerns, contact a licensed information technology security professional.  The stakes are high, and only getting higher.

Author: Rich Fiore

Benefits of Mobile device management (MDM)

Mobile device management (MDM) is a type of security software used by an IT department to monitor, manage and secure employees' mobile devices that are deployed across multiple mobile service providers and across multiple mobile operating systems being used in the organization. Mobile device management (MDM) capabilities give you the fundamental visibility and IT controls needed to secure, manage, and monitor any corporate or employee owned mobile device or laptops that accesses business critical data.

Mobile device management (MDM) solution provides immediate, on-device threat protection, protecting against device, app and network threats even when the device is offline.d:

• Detect the attack immediately

• Notify the device user through mobile clients and enterprise admin through centralized console

• Take preventive actions to protect company data through custom compliance actions

Administrators can use our capabilities to find all the devices that have the vulnerable versions of WhatsApp on them and assign compliance actions to only those devices, while not affecting the productivity of users running updated version of the compromised app.

Benefits of Mobile device management (MDM)

More control and security

An effective MDM system guarantees the protection of company data, e-mails, and confidential documents. If a device is lost or stolen, the administrator can easily lock, disconnect, or lock the mobile device. SIM cards can also be blocked for employees’ mobile devices and if somebody tries to transfer the SIM to another device they will need a PUK code.

MDM offers better control over their devices. For example, a company’s sales employee will not have to register and configure all devices used by their sales agents. Instead, you can configure the device and use the security software automatically. Certain tools and applications can also be sent to agent devices. If you want the app to be configured at start-up or if you want an automatic application or replacement updates throughout the enterprise, you can easily do it manually without having to call the device.

Powerful and Highly Efficient Management

Practically, mobile devices can distract employees. If organizations want to limit or prohibit the use of certain apps on their devices and avoid unnecessary data costs, IT managers can block YouTube, Facebook, or other social media apps. Take, for example, the company’s rescue services. As drivers need to focus on the road, some companies use MDM to prevent them from using other apps than the transport app and Waze or Google Maps while driving. This not only ensures operational efficiency, but also security

Increased flexibility

Working from anywhere with a mobile device gives access to relevant files anytime, anywhere and in any situation. Some tools gives you that luxury, for example, the vendors of the company do not need to download the resources separately from different portals. The centralized MDM system enables more efficient distribution of business documents, such as training forms and learning materials, accessible only to authorized individuals.

Find the right MDM solution

As the businesses focus on productivity, efficiency, and security, and with more and more companies choosing BYOD (Bring your own device), MDM is ready to respond to feature requests that help them take control of the device while providing their employees with freedom, security, and productivity.

How to Improve Data Security & Data Privacy

What are the biggest challenges currently facing data security and privacy? 

As organizations embark on digital transformation, there is a clear need for enterprise data privacy and protection. New data privacy laws and the growing enforcement of existing regulations challenge organizations. And most organizations face rapid data growth and proliferation across the enterprise. Organizations have more data, more use cases, and more locations than ever before

First what is data privacy?

Data privacy and data protection are very closely interconnected, so much so that users often think of them as synonymous. But the distinctions between data privacy vs. data protection are fundamental to understanding how one complements the other. Privacy concerns arise wherever personally identifiable information is collected, stored, or used.

Second what is data security?

Data security is about securing data against unauthorized access. Data privacy is about authorized access — who has it and who defines it. Another way to look at it is this: data protection is essentially a technical issue, whereas data privacy is a legal one.

Data encryption ensure only privilege users has access

Data encryption isn't just for the technical advanced; modern tools make it possible for anyone to encrypt emails and other information. "Encryption used to be the sole province of geeks and mathematicians, but a lot has changed in recent years. In particular, various publicly available tools have taken the rocket science out of encrypting (and decrypting) email and files. based on what your need are our firm can help you implement the right technologies to ensure data security.

Stronger Password and Multi-factor Authentication

Password and Multi-Factor are essential when protecting data and data privacy from unauthorized users, or attackers. unfortunately many user don’t understand the importance of passwords. So much so that the 20 most commonly used passwords not only contain highly insecure passwords like the word “password”, they also account for a whopping 10.3% of all passwords that are being used. CyberSecOp recommend creating passwords that contain a minimum of 8 characters. If your password protects something sensitive, like access to your bank account, then use a minimum of 12 characters. all password should contain at lease one upper and lower case, and a symbol. don’t use the same passwords for every site, you can use difference variations of the password making it easier to recall. Example: Chase Bank : Iwanttolive1o8chase% Facebook:Iw@nttoliv3fb.

Enable two-factor authentication.

On top of having good passwords, consider enabling two-factor authentication when you sign into your email, bank website or any other sensitive account. When using two-factor authentication, a code will be sent to your phone when you sign in. You then input the code to access your account. Hackers likely don’t have access to your phone, so this can be a great way to add a layer of password security and data security. It may feel like additional work, but the extra protection can go a long way.

All organization needs an Ethical Hacker team like CyberSecOp

An ethical hacker is one who mimics the actions of a malicious hacker so as to detect security risks in advance and thus prevent breaches and attacks.

Any organization or business can hire the services of an ethical hacker to test/monitor the organization’s defenses, perform IT health checks and penetration tests, to assess the security of the systems and to evaluate the overall security of the organization’s network. An ethical hacker can provide valuable help to an organization by detecting vulnerabilities in a system/network on time and thus prevent the exploitation of data (customer data, financial data and other sensitive data), which could happen as a result of cybercriminals exploiting the vulnerabilities.

Backup is an essential part of data security

Backups are most often overlooked, data protection and backing up your data is essential when you have a major security event such has ransomware. Basically, this creates a duplicate copy of your data so that if a device is lost, stolen, or compromised, you don't also lose your important information. It's best to create a backup on a different device, such as an external hard drive, so that you can easily recover your information when the original device becomes compromised. It is critical that once the backup has complete to physically disconnect the backup device for the system, if the backup drive stay connected and your system becomes affect by ransomware, your backup data could also be affected.

Data Security, Data Privacy & Compliance

CyberSecOp can provide guidance and assistance with addressing privacy and data security practices, as well as to ensure that the practices and program implemented are compliant with relevant laws and regulations. The EU and some US Federal agencies, including the Federal Trade Commission (FTC) and the National Institute of Standards and Technology (NIST), have been promulgating updated guidelines and recommendations for privacy and data security best practices in a variety of industries, including some of the newer Internet of Things and peer platform (sharing economy) marketplaces. Additionally, several industry groups have adopted self-regulatory programs and rules, including certification programs, to which a company can voluntarily abide.

In view of these guidelines and others, companies are further encouraged to establish internal policies and procedures to ensure compliance. Business policies may include a top-level information security and privacy policy, which expresses a commitment to data security and privacy from the top-level officers of a company, a risk management program, an acceptable use policy, access compartmentalization, communications monitoring, breach reporting, a document retention policy and outsourcing policies. Technical policies may include a variety of commitments to technical controls to ensure the protection of data, including encryption, passwords, authentication protocols, disaster recover, intrusion detection, physical security, patching and the like.