Ineffective Response and Perverse Insurance Incentives Compound Ransomware Problems
Cybercriminals are mining a lucrative revenue source – ransomware. These attackers launch malware to encrypt digital files and demand bitcoin payment to unlock them. We know that local governments are often paying ransom and that private industry is also suffering… Continue reading
Questions to Ask Your Cyber-Insurance Provider
The breach problem has increased and cyber insurance is on the radar screen for many CEOs. The U.S. Congress is likely to create supportive legislation for cyber-insurance as a vehicle for improved security data sharing and a market-based solution … Continue reading
The Future of Security Architecture Certification
Would you drive over a Bay Bridge built from an amateur building architect’s blueprints? What if the architect passed a multiple choice test first – is that good enough? Society’s answer to these questions is obviously NO. But unlike… Continue reading
After the Breach (Part 2): Cyber-Insurance?
APTs and cybercriminals are in the news again with more end-of-2014 breach statistics emerging from the analysts. Here’s an update of my After the Breach (Part 1) post with links to some of the latest information, and a new… Continue reading
After the Breach (Part 1)
As I suggested in my CSA Privacy Heat Index post, the extraordinary volume of privacy abuses in the U.S. may be due not only to its permissive regulations on personal data sharing, but also to its dominance of online… Continue reading
Cyber-Insurance: A Market-Based Approach to Risk Management
Cyber-insurance has never taken off in the industry. But that may be about to change with recent announcements from a major underwriter that a larger pool of policies, and larger policies, than were provided in the past are now going… Continue reading
Industrial Control Systems (ICS) ISAC Vision for Security Information Sharing
At first, the Industrial Control System Information Security and Analysis Center (ICS-ISAC) was just a notion Chris Blask got in 2006 that ICS facilities needed situational awareness of computerized systems at the facility level, and that better regional,… Continue reading
Fearless Security
I ran across a web site called Fearless Security themed “Taking the Fear out of Security Decisions.” The site also headlines with Roosevelt’s quote: “The only thing we have to fear is fear itself.”
This is a great message for… Continue reading