Business Management

Why is user awareness training important for IT security? Phishing operations represent 41% of cyber breach incidents according to the IBM X-Force report. Deloitte estimates phishing to be the initial attack vector in 91% of cyber breaches.   These estimates put phishing at the forefront of corporate attack surface because they identify phishing as the most successful method used by attackers to compromise a system and gain initial access to a victim’s network.  In response, organizations need to increase their resilience against phishing and other types of social engineering attacks. By testing their staff’s ability to effectively identify phishing attempts and malspam and providing educational material, an organization can identify potential weaknesses and reduce the chance that an employee will fall prey to an attack.  Of course, secondary cybersecurity measures should be in place to detect and respond to a successful phishing attack, user awareness training is a good practice…

Read more

Nessus is an enterprise vulnerability scanner that can perform external and internal credentialed scans and can support a continuous vulnerability management program.  Nessus favors ease of use as compared to granular control over scanning which allows quick and efficient scanning configuration.  Nessus comes with many pre-configured scans for PCI-DSS, compliance OVAL, and SCAP scanning, and many scans for novel threats such as Solarigate, CISA threat advisories, Log4Shell, Ransomware attacks, and more. Watch the video below to get the full scoop on how Nessus can support enterprise vulnerability management.    

Read more

What is Snyk and how does it contribute to DevSecOps?

What is Snyk?  It’s classified as an SCA (software composition analysis) security tool meaning it scans your source code for use of known vulnerabilities in functions, libraries, packages, and can also scan entire docker images, cloud servers, and IaC (Infrastructure as Code) deployments for vulnerabilities.  Watch the video below for a summary and demo on how Snyk’s can contribute to your DevSecOps program.

Read more

We Have All Heard This Story Before It’s no doubt that ransomware is is the biggest threat in the modern cybersecurity landscape. The highest amount of ransom ever paid by a single company for a single incident is $40 million US dollars. Companies can incur millions more in remediation costs, service downtime, legal settlements, higher insurance premiums, and potentially suffer long-term deleterious effects to their brand reputation. Blockchain research group Chainalysis suggests that nearly $700 million USD in ransomware ransom was paid in 2020. Defenders have all been hearing this story for years, and know how to secure against ransomware right? The most common initial access vector is phishing so staff training sessions educating our staff on how to spot a deceptive url is required to keep the bad guys out. Installing endpoint security products and keeping them updated, and of course keep bulletproof backups right? Well, yes and no….

Read more

Let’s talk about a critical intersection in the world of security; the combination of physical security and brand reputation. On January 9th 2022, a woman was killed while pumping gas when a 65 year old man backed up his SUV into the gas pump. The pump exploded into flames. The woman who was standing beside it was burned to death. This is a horrific and tragic situation that should never have happened. The gas station should have installed bollards to protect the physical pumps from being hit by a car. There should be a federal law that all gas pumps are required to have bollards protecting them. However, there is no such law and so instead, when loss of life happens from such a preventable incident we are left to ask whether the franchise owner is partially responsible.  Many will rightfully criticize the owner and the brand for allowing such…

Read more

When Best Practices Are Infeasible

Cloud Security

IT Security Best Practices are processes and configurations outlined by industry leading standards organizations such as SANS, NIST, and OWASP amongst others. Some examples of best-practices include: keeping software and systems updated, uninstalling all but required applications and services, segmenting critical network resources, and configuring host and network firewalls to first block all traffic, then allow only required traffic by IP and protocol. But are best practices always feasible for an organization? To some, this may seem like a ridiculous question. Most CISO’s would likely rather consider the question the other way around: “Is not having best practices feasible?”, since their jobs depend on the performance of security controls. So why then did John Mandia of Mandiant Security LLC to respond with “it depends” when responding to that question before a US congressional special hearing in response to the SolarWinds malware [1]? Senator Wyden’s question specifically referenced NIST firewall best…

Read more

The Recorded Future web-conference today was a great insight into the deep Cyber-Intelligence technology the company has developed and what it offers organizations. On display were both a definitive set of broad trend data combined with deep and granular information on every aspect of the MITRE ATT&CK framework and beyond. Recorded Future’s LinkedIn profile reports the company as having had Series E funding of $25 million dollars, however Crunchbase reports an even higher total investment of over $50 million dollars.  A press report on PRNewswire in October 2021 outlines Recorded Future’s recent investment in CVE intelligence company Cyber Threat Cognitive Intelligence (CTCI)  and describes the Intelligence Fund; Recorded Future’s investment platform. For anyone as passionate about Cyber-Security, predictive forecasting, and Intelligence as I am, there is a ton to be excited about with Recorded Future’s platform and capabilities.  Here’s what I learned from the conference today. Recorded Future aggregates data…

Read more

Various patent indicators, such as number of citations, technology-cycle-time (TCT), number of claims, renewal status have been used to measure the value of patents with respect to economic value through competitive advantage a company patent holding company gains by holding legal rights to sale of the described technology.  Another use of patent indicators attempts to gain insight into the emerging innovation landscape or “technology lifecycle”. Analysis of knowledge stock demonstrated by a group of patents can forecast potential novel technologies which will hold advantages over existing ones. Forward Citations A patent’s forward citations are references to it received by a later filed patent as opposed to a backward citation which are references listed on a patent grant (or application) itself.  The use of forward citations as a positive measure of a patents importance has been reviewed numerous times in academic literature. The more (forward) citations a firm’s patents receive, the…

Read more

Commercially Viable Nuclear Fusion Is Closer Than Ever

Engineering 3D model of a TOKAMAK thermal nuclear fusion engine

The Goal of Reducing Climate Change The OECD advisory on climate change (Green Grown Studies) states that a multi-pronged approach is required to reduce, stop, or reverse climate change. The critical stages in the energy lifecycle that need to be addressed include: Energy generation Transportation Conversion Storage Consumption Smart-grid technology Smart-homes Smart Manufacturing Smart circuits and computer chips Of all the green / renewable sources of power, nuclear fusion has the biggest potential impact. Nuclear fusion is the holy grail of renewable green energy sources and has the potential to drastically reduce CO2 output by replacing other fossil fuels such as coal-fired electricity plants. Other potential sources of renewable power such as solar, wind, geothermal, and hydro offer benefits over non-renewable power such as coal, and oil and gas, but none have the potential to output as much clean energy as realizing commercial of nuclear fusion.  However, a future global…

Read more

Climate Change Patents

Climate Change

Global Patent Activity for Climate Change Related Patents The Cooperative Patent Class (CPC) Scheme includes a class specifically dedicated to climate change inventions.  This CPC patent class is Y/02. The earliest patents granted with the CPC class Y/02 are in 2013. The two charts below show there is little difference between overall patenting activity and patenting in the CPC class Y/02 with an almost identical group of countries and rate of activity in the top 12 for each set of data. See WIPO ST.3 to translate two-letter country codes. See WIPO ST.3 to translate two-letter country codes. Climate Change Patents by Country Country 2013 2014 2015 2016 2017 2018 2019 2020 2021 Total US 18 568 1.817 2.269 2.521 2.459 2.778 2.557 1.841 16.828 JP 6 265 925 1.185 1.410 1.201 1.289 1.068 736 8.085 KR 1 126 305 458 576 508 508 427 331 3.240 DE 2 99 362…

Read more