Cybersecurity Policies Need to Be Centralized: Board Member

SAN FRANCISCO– Companies need to centralize cybersecurity policy and not leave it up to business groups in various countries, said Richard Goodman, board director and chair of the audit committee at several Fortune 500 companies.

The breaches at Target Corp.TGT -0.56% and Sony Pictures Entertainment have raised awareness of cybersecurity in general by boards. One consequence is  that boards now are calling for clear and consistent cybersecurity policies, said Mr. Goodman, who is on the boards of Johnson Controls Inc.JCI -0.64%, Kindred Healthcare Inc.KND -1.31%, Western Union Co.WU -0.15% and Toys “R” Us Inc.

“You can’t give people in the field decision-making authority about whether you decide to do something or not on cybersecurity,” he said.

Those central polices may create tensions with business units in various countries but it’s important to mitigate risk, he said. Just as global corporations have moved to centralized accounting policies, cybersecurity needs to be approached in the same way, he said, speaking to CIO Journal at A.T. Kearney’s annual CEO retreat in San Francisco, Monday.

All of Mr. Goodman’s audit committees are looking at cybersecurity at every meeting or every other meeting.

“Everybody realizes this is a big deal,” he said. The biggest challenge, though, is trying to figure out what the industry benchmarks should be for cybersecurity, he said. “The goal posts are going to move,” he said, adding that frequent changes in the industry have led to lots of meetings.

The U.S. Securities and Exchange Commission last June called on corporate boards to make sure they’re taking the necessary steps to address and oversee their companies’ cybersecurity risks. “There may be a gap that exists between the magnitude of the exposure presented by cyber-risks and the steps, or lack thereof, that many corporate boards have taken to address these risks,” Securities and Exchange Commissioner Luis Aguilar told directors at a June 2014 cybersecurity conference at the New York Stock Exchange.

View the original content and more from this author here: http://ift.tt/1C6zKur

from cyber security caucus http://ift.tt/1NvnBzZ
via IFTTT

APAC countries slow to produce comprehensive national cybersecurity strategies

Cybersecurity is an increasingly urgent issue for governments around the world, but a new study from BSA | The Software Alliancefinds that markets in the Asia-Pacific (APAC) region have been slow to produce comprehensive national cybersecurity strategies, and implement the necessary legal frameworks for security and critical infrastructure protection.

At the same time, the study finds tremendous opportunities exist in each market to improve the systems needed to protect against, prevent, mitigate, and respond to cyberattacks. Doing so, BSA advises, will bolster confidence in cutting-edge, Internet-enabled technologies and services, and at the same time drive economic growth and productivity.

“This study is an important tool not only for APAC government leaders, but for governments worldwide to understand how their cybersecurity efforts compare to other countries,” BSA President and CEO Victoria Espinel said. “We hope the Dashboard will help public and private stakeholders effectively prevent and respond to cyberattacks and incidents and that it serves as a valuable tool to help reduce the costs and risks associated with growing cyber threats.”

Launched recently, BSA’s APAC Cybersecurity Dashboard is an in-depth study of the cybersecurity approaches of 10 APAC markets, comprising Australia, China, India, Indonesia, Japan, Malaysia, Singapore, South Korea, Taiwan and Vietnam.

The Dashboard examines, in detail, the foundational steps needed to increase cybersecurity and improve cyber resilience within these markets.

“The Dashboard highlights that policymakers should establish the proper policy, legal and operational frameworks; improve collaboration with relevant stakeholders’ communities; effectively share meaningful cybersecurity information; and prioritize the protection of critical infrastructures. Accomplishing these goals is an urgent matter, and the Dashboard aims to facilitate the discussions and debates needed to advance the cybersecurity infrastructures of APAC markets,” said Boon Poh Mok, Director, Policy – APAC.

The Dashboard finds that broadly, most governments are not leveraging public-private partnerships to benefit from the private sector’s cybersecurity knowledge and best practices.

APAC has shown strength and consistency in the establishment of computer emergency response teams (CERTs) and the implementation of national cybersecurity education campaigns.

The study also showed that markets like China, Indonesia and Korea are hampered by the imposition of local standards and testing requirements that are inconsistent with a truly international approach to addressing cybersecurity.

Markets, such as Australia, India, Japan, Singapore and Taiwan, have detailed and comprehensive cybersecurity structures in place, while Indonesia has not yet developed a national cybersecurity strategy.

Others such as China, Korea, Malaysia and Vietnam have implemented some cybersecurity measures, but their national cybersecurity infrastructures are still being developed.

Another finding is that implementation of sector-specific responses to cybersecurity in the APAC region is very limited; Australia, Malaysia and Singapore are the leaders in this field.

View the original content and more from this author here: http://ift.tt/1R42A5c

from cyber security caucus http://ift.tt/1GYTezC
via IFTTT

Allen University adds cybersecurity courses with funding from grant program

Allen University is expanding cybersecurity studies for its students and into the community as part of a $25 million grant program through the federal energy department.

Officials with the historically black university are developing new courses and programs to fill future jobs geared to fight online privacy breaches in government, education and the private sector.

“From the National Nuclear Security Administration perspective, there is no pipeline in general at the moment for people, especially minorities, for careers in this area,” said Michelle Young, director of grants with Allen University “Technology is changing so much. We are being reactive at this point; NSSA wants to be proactive and outthink the hackers and criminals out there.”

The university joined several other colleges and public school systems to formthe Cybersecurity Workforce Pipeline Consortium. The five-year $25 million grant program will target students at all levels to encourage careers in cybersecurity.

“Allen University is looking at the role of the HBCU in the 21st century, and sees that it’s moving toward making sure all of our programs can be successful bridges to careers for our students to serve the needs in our community,” said Charlene Spearen, interim vice president of academic affairs at Allen University.

The university will offer minor concentrations this fall in cybersecurity within the math department and information assurance in the business department. The courses will focus on the fundamentals of computer science including networking, ethics and policy, according to Young.

Students who have expressed an interested in computer science and can demonstrate a financial need will be selected for 10 scholarships worth $6,000 per year to pursue their studies. A professor who specializes in cybersecurity also will be hired, Young said.

Young said Allen University likely will offer a full computer science major with a concentration in cybersecurity within the next two years.

High school students in Columbia will have a chance this summer to explore a career in cybersecurity through a five-day workshop. The university will host a STEM camp next summer for middle and high schoolers on cybersecurity.

Two students from Allen University also are completing internships at the Department of Energy’s Lawrence Livermore National Labs in California, according to Young.

“We’re looking to have minorities that are prepared for careers and those who can think critically,” she said.

View the original content and more from this author here: http://ift.tt/1dwSXt0

from cyber security caucus http://ift.tt/1eiA3qz
via IFTTT

CompTIA Advises on Maximising Cyber Security in the Middle East as estimated costs to businesses exceeds $1 billion

With the cost of cybercrime to businesses in the Middle East exceeding $1 billion and predictions that the volume of cyber-attacks will increase, CompTIA, the leader in vendor-neutral skills certifications for the global IT workforce, explains why the provision of ongoing cyber security training is key to risk reduction.

“Staff armed with certifications from associations like CompTIA can perform support and security tasks more efficiently and reliably,” said Graham Hunter, Vice President, Skills Certifications at CompTIA. “Certified personnel are more vigilant and better equipped to research, assess and protect against the various elements of security risk.”

Commenting further on the issue, he said: “CompTIA’s recent Trends in Information Security study highlighted 52% of human errors account for the root cause of security breaches. This is predominantly down to lack of understanding of new threats with many employees failing to fully grasp security implications. Training is the clear answer for mitigating human error, but companies struggle to understand how to investment in it. Only 54% of companies offer some form of cybersecurity training.”

When security threats are growing and changing at pace it is particularly important to equip staff to understand and operate in a dynamic environment. For example, CompTIA’s Security+ certified training covers security skills and techniques in enterprise security, risk management, research and analysis, and integration of computing, communications and business disciplines. The more advanced CompTIA Advanced Security Practitioner covers the technical knowledge and skills required to design, and engineer secure solutions across complex enterprise environments. This kind of knowledge delivers real value to companies in the long term through staff trained to understand the environment and continue developing their professional knowledge in the future.

Hunter continued: “Awareness creates action, which is invaluable for tightening security. However, companies should use policies to create awareness — by routinely implementing, updating and communicating them rather than wait for it to happen through a cyber security breach.”

View the original content and more from this author here: http://ift.tt/1Jwt0IG

from cyber security caucus http://ift.tt/1FQv1Yo
via IFTTT

New Chinese law to boost cyber security

BEIJING (AP) – China on Wednesday passed sweeping new legislation reinforcing government controls over cyberspace in the wake of what it describes as growing threats to Chinese networks and national security.

The vaguely worded National Security Law calls for strengthened management over the web and tougher measures against online attacks, theft of secrets, and the spread of illegal or harmful information.

It said core information technology, critical infrastructure and important systems and data must be “secure and controllable” in order protect China’s sovereignty over its cyberspace.

The law offered no details on how China would achieve the goals set out, although a vast government Internet monitoring system has been in place for years.

China says it is a major target of hacking and other cyber-attacks, while the ruling Communist Party has expended vast efforts in blocking content available in China deemed by it to be subversive or illegal.

China is also accused of running a state-sponsored effort to hack computers and steal government and commercial secrets overseas, while also spying on and harassing pro-democracy, Tibetan and human rights groups based abroad.

Most recently, Beijing was suspected as being behind a massive hack into a U.S. federal government computer server that resulted in the theft of personnel and security clearance records of 14 million employees and contractors. Chinese officials always deny engaging in such actions.

The National Security Law, passed overwhelmingly by the Standing Committee of the National People’s Congress, China’s rubberstamp legislature, replaces an earlier version that focused more narrowly on counter-espionage.

In addition to cyberspace, the new legislation covers a wide range of areas including the economy, social stability, territorial integrity, the military, culture, finance, technology, the environment and food safety.

Spokeswoman Zheng Shu’na said an overarching legislation was needed to deal with “ever-growing security challenges”.

“Externally speaking, the country must defend its sovereignty, as well as security and development interests, and … it must also maintain political security and social stability,” Zheng was quoted as saying by the official Xinhua News Agency.

View the original content and more from this author here: http://ift.tt/1f0i2hM

from cyber security caucus http://ift.tt/1GNIl1o
via IFTTT

China’s hackers become its cyber gatekeepers

CHINA, long accused by the US of rampant cyber aggression, may be synonymous with hacking exploits these days, but that does not mean every Chinese hacker is out to pilfer and destroy.

As Chinese companies grapple with a sharp increase in the number of cyberattacks, many hackers are finding it increasingly lucrative to go above board and join the country’s nascent cybersecurity industry.

Zhang Tianqi, a 23-year-old Beijinger, cut his chops in high school trying to infiltrate foreign websites, skirting domestic law by probing for vulnerabilities on overseas gaming networks.

Now, after a stint working at internet blue chip Alibaba Group, he is the chief technology officer of a Shanghai-based cybersecurity firm that owns Vulbox.com, a site offering rewards for vulnerability discoveries, and internet security media site FreeBuf.com.

National priority

“I’d been messing around in the field in my early years, but luckily it just so happens now that there’s this trend of China taking information security very seriously,” Zhang said on June 18.

China’s President Xi Jinping has made cybersecurity a national priority as the country starts to feel the impact of rapid economic growth occurring without a corresponding development in data protection.

In May, China’s National Computer Network Emergency Response Technical Team, a non-profit agency, said it had recorded 9 068 instances of data leaks in 2014, three times as many as in 2013, reflecting the “grim challenges” of Chinese cybersecurity, according to the official Xinhua news agency.

To try and tackle this, dozens of cybersecurity companies are cropping up across China according to industry observers, populated by young techies with genuine security skills and work experience at firms like Alibaba, Tencent and Baidu.

China is hoping that domestic cybersecurity groups will provide most of its companies with defences against hacking, rather than them relying on foreign firms like Symantec, Kaspersky and EMC Corporation’s RSA.

The gradual professionalism of China’s bedroom hackers traces the country’s rise as an economic and technological force, and its sometimes conflicted position in the escalating global data security arms race.

The US government has attributed sophisticated attacks – including the large-scale data theft this month from the Office of Personnel Management (OPM) – to increasingly advanced state-affiliated teams from China.

But former hackers say the majority of their peers are joining a burgeoning industry to help China firms fend off the numerous attacks they face.

China has denied any connection with the OPM attack and little is known about the identities of those involved in it.

Crackdown

The Cyberspace Administration of China told Reuters in a June 19 fax that it opposed “any form of network attack” and did “not allow any groups or individuals to engage in network-attacking activities” within its borders.

The cybersecurity industry’s growth was partly spurred by a government crackdown on China’s hacking community five years ago – around the same time Beijing passed a series of laws banning hacking and spamming tools and requiring telecom operators to help suppress attacks.

Government sweeps largely silenced once-raucous online forums like kanxue.com, where hackers traded tips and boasted about their conquests.

Many chose to shift from “black hat” activities to “white hat” ones, using their skills to find network vulnerabilities so that they can be fixed.

China’s government has also been working to ramp up the data security of the country as a whole. Agencies, including the Cyberspace Administration of China, have led educational efforts around promoting data security.

Zhang said China was still playing catch up with the US on both the cyber security, and cyber espionage fronts. – Reuters

View the original content and more from this author here: http://ift.tt/1GM5kdh

from cyber security caucus http://ift.tt/1GM5kdj
via IFTTT

Should Investors Take A HACK At This Idea?

Summary

• The latest case of cyber espionage has resulted in the theft of personal information of more than 4 million government employees.
• The sophistication, scale and frequency of cyber-attacks has only increased, and threats are becoming more and more complicated.
• Let’s get a lay of the land of companies that are poised to help put down such criminal behavior, and how investors can play this secular theme.
• You may be surprised by our favorite idea in this space.

“The new generation of cyber-attacks on organizations, including large and small enterprises and governments worldwide, is characterized by an unprecedented escalation in the complexity and scale of advanced malware created by criminal organizations and nation-states. These modern attacks are built on dynamic, stealthy and targeted malware that penetrates defenses in multiple stages and through multiple entry points of an IT network. These highly targeted, “single-use” cyber-attacks easily circumvent legacy security solutions that rely on pattern-matching detection technologies. Additionally, because legacy solutions reference outdated signatures of past threats, they also generate a high number of false-positive alerts.” – FireEye (NASDAQ:FEYE) Annual Report, 2014

The statistics are striking.

According to a 2011 survey of ~580 US IT experts by research center Ponemon Institute, an estimated 90% of organizations have at one time suffered a cybersecurity breach. Believe it or not, the Pentagon said in a 360+ page report that as of 2014, nearly every US weapons program that was tested showed “significant vulnerabilities” to cyberattacks. The news reminds us of the 1980s flick WarGames. It flat-out irks us that there’s a chance that hackers can access US weapons programs.

Just this week, US officials announced that it believes China was behind a breach affecting the information of at least 4 million federal employees. This was allegedly the second intrusion by the country in the past few months, andthe largest breach of federal employee data in some time. Russia has also been tied to cybercrimes against White House computers. It appears the US is fighting yet another war – not one with guns, and bullets but one against cyber adversaries. The plot of that 1980s teenage Matthew Broderick movie can’t happen in real life, can it?

The world is simply not prepared for the latest round of criminal activity… in cyberspace.

The sophistication, scale and frequency of cyberattacks, coupled with the complexity of new technologies from cloud computing and virtualization to enterprise mobility and social networking have made it incredibly difficult to keep important information and data safe. Reports from the Snowden documents, for example, contend that China stole “many terabytes” of data about Lockheed Martin’s (NYSE:LMT) F-35. China’s new J-31 Gyrfalcon doeslook a lot like the F-35. In 2014 alone, there were 20 major data breaches, with Home Depot (NYSE:HD), Target (NYSE:TGT), and JPMorgan (NYSE:JPM) perhaps making the biggest headlines, but even companies such as Staples (NASDAQ:SPLS), Bebe (NASDAQ:BEBE), and Sony (NYSE:SNE) were impacted. Sony’s network was taken hostage by a grinning skull.

Some estimates peg the cyber security market to surpass $150 billion by 2019 from under $100 billion today, but the reality is that the changing and evolving landscape could make this figure much larger. Traditional players such as Hewlett-Packard (NYSE:HPQ), Cisco (NASDAQ:CSCO), Check Point Software Technologies (NASDAQ:CHKP), Computer Sciences Corp. (NYSE:CSC), IBM Corp. (NYSE:IBM), Booz Allen (NYSE:BAH), Lockheed Martin, Northrop Grumman (NYSE:NOC), Trend Micro (OTCPK:TMICY), Fortinet (NASDAQ:FTNT), Barracuda Networks (NYSE:CUDA), and Symantec Corp. (NASDAQ:SYMC) will be vying for share. But there are others as well. FireEye, Palo Alto Networks (NYSE:PANW), Imperva (NYSE:IMPV), VASCO Data Security (NASDAQ:VDSI), Zix Corp. (NASDAQ:ZIXI), Qualys (NASDAQ:QLYS), Proofpoint (NASDAQ:PFPT), AVG Tech (NYSE:AVG), and CyberArk Software (NASDAQ:CYBR) will be looking to capture a piece of the pie (potential industry earnings). Many of these firms are losing money hand over fist at the moment.

From an investment standpoint, it’s simply too early to pick the long-term winners. But even if we we’re pinned down to selecting just one or two potential winners, we’d maintain that the best consideration for investment exposure to rapidly expanding cybersecurity demand is via the PureFunds ISE Cyber Security ETF (NYSEARCA:HACK), which seeks to track the investment results of the ISE Cyber Security Index (the ETF’s holdings can be downloadedhere). Our investment thesis on HACK rests not on identifying which company will capture the greatest share of industry earnings, but on the view that spending on cybersecurity will increase considerably more than current expectations – a far “safer” bet.

View the original content and more from this author here: http://ift.tt/1Ip8pEI

from cyber security caucus http://ift.tt/1CGzuNg
via IFTTT