Sinopsis
Welcome to the C-IT Security website, where corporate leaders are informed of the latest news relating to information assurance, protection and privacy. This website is not just for the IT professional, but any professional who is concerned about his/her company ending up in the news. We will brief you on the latest security news around the globe and provide suggestions for high level controls to explore in your organization. By no means is this podcast a consulting service. The idea is to foster creative thinking for the prudent business leader to make intelligent decisions based upon the impact other businesses are experiencing by current threat actors.
Episodios
-
![8-25-14 An attack targeting JP Morgan and Chase Customers in the United States]()
8-25-14 An attack targeting JP Morgan and Chase Customers in the United States
25/08/2014 Duración: 08min“Diligence is the mother of good fortune and idleness, its opposite never brought a man to the goal of any of his best wishes.” -Miguel De Cervantes JPMorgan Chase customers targeted in massive phishing campaign http://www.scmagazine.com/jpmorgan-chase-customers-targeted-in-massive-phishing-campaign/article/367615/ http://www.darkreading.com/jp-morgan-targeted-in-new-phishing-campaign/d/d-id/1306589? C-IT Recommendation Provide social engineering awareness for your customers. Ensure you communicate specifically how your organization will communicate […]
-
![8-20-14]()
8-20-14
21/08/2014 Duración: 09min“Out there in some garage is an entrepreneur who’s forging a bullet with your company’s name on it.” -Gary Hamel Cybercriminals Deliver Point-of-Sale Malware to 51 UPS Store Locations http://www.securityweek.com/cybercriminals-deliver-point-sale-malware-51-ups-store-locations http://www.scmagazine.com/ups-announces-breach-impacting-51-us-locations/article/367257/ C-IT Recommendation Create new non-intuitive usernames for POS accounts. Disable the default usernames. Use Strong password for Terminal log in accounts and change them […]
-
![8-18-14 The problem with former employees retaining access to companies they no longer work for]()
8-18-14 The problem with former employees retaining access to companies they no longer work for
18/08/2014 Duración: 09minBulk of Ex-Employees Retain Access to Corporate Apps: Survey http://www.securityweek.com/bulk-ex-employees-retain-access-corporate-apps-survey http://www.infosecurity-magazine.com/news/uk-smbs-manage-exemployee-risk/ C-IT Recommendation Verify your company has an effective and enforced access control standard and policy which requires that access be removed when an employee transfers within the organization or leaves the organization. Use Role based Access Control. Roles should be specifically defined by the […]
-
![8-13-14 A tech support scam targeting trusting users, a report describing 2014 as the year of the data breach, Microsoft’s plan to stop supporting older versions of Internet Explorer]()
8-13-14 A tech support scam targeting trusting users, a report describing 2014 as the year of the data breach, Microsoft’s plan to stop supporting older versions of Internet Explorer
13/08/2014 Duración: 11min“It is not the strongest of the species that survive, nor the most intelligent, but the one most responsive to change.” – Charles Darwin Windows tech support scammers take root in the U.S. http://www.csoonline.com/article/2464030/security-leadership/windows-tech-support-scammers-take-root-in-the-u-s.html Article Resources Malwarebytes blog on the scare tactic https://blog.malwarebytes.org/fraud-scam/2014/08/beware-of-us-based-tech-support-scams/ 2014 So Far: The Year of the Data Breach http://www.infosecurity-magazine.com/news/2014-the-year-of-the-data-breach/ C-IT […]
-
![8-12-14 The PCI Council publication advising companies how to ensure security compliance with third party service providers, New malware that hides in media files, Microsoft patch Tuesday bulletins]()
8-12-14 The PCI Council publication advising companies how to ensure security compliance with third party service providers, New malware that hides in media files, Microsoft patch Tuesday bulletins
12/08/2014 Duración: 14min“It doesn’t take great men to do things, but it is doing things that make men great.” -Arnold Glasow PCI Council Publishes Guidance on Working With Third-party Providers http://www.securityweek.com/pci-council-publishes-guidance-working-third-party-providers http://www.scmagazine.com/pci-council-releases-third-party-security-assurance-guidance/article/365658/ C-IT Recommendation Require your third party service provider to provide a report of compliance and require the entity to conform to conducting a risk analysis […]
-
![8-11-14 A letter issued to Automotive CEOs to beef up automobile security, New bank malware activity in the United States, a website vulnerability that your company may need to fix]()
8-11-14 A letter issued to Automotive CEOs to beef up automobile security, New bank malware activity in the United States, a website vulnerability that your company may need to fix
12/08/2014 Duración: 12min“Great men undertake great things because they are great; fools, because they think them easy.” -Luc de Vauvenargues Hackers Demand Automakers Get Serious About Security http://www.securityweek.com/hackers-demand-automakers-get-serious-about-security http://www.darkreading.com/application-security/automakers-openly-challenged-to-bake-in-security/d/d-id/1297902 C-IT Recommendation Find out if your organization has Security embedded into the Product Development Life Cycle. There should be no new systems released to the public or deployed […]
-
![8-7-14 A report by Cisco Systems alleging most enterprises are exposed to browser attack, 1.2 Billion email accounts globally hacked by a Russian attack group]()
8-7-14 A report by Cisco Systems alleging most enterprises are exposed to browser attack, 1.2 Billion email accounts globally hacked by a Russian attack group
07/08/2014 Duración: 16min“The purpose of business is to create and keep a customer.” ― Peter F. Drucker Over 90% of Enterprises Exposed to Man-in-the-Browser Attacks: Cisco http://www.securityweek.com/over-90-enterprises-exposed-man-browser-attacks-cisco http://www.csoonline.com/article/2459954/data-protection/cisco-patches-traffic-snooping-flaw-in-operating-systems-used-by-networking-gear.html C-IT Recommendation Perform regular security assessments in your organization Corporate leaders must establish a security debrief cadence with the information security teams. CSOs/CISO’s should meet with operational teams weekly […]
-
![8-5-14 Data thieving software posing as a security application on Android Devices, a report explaining that most top free and paid mobile apps pose threats to organizations]()
8-5-14 Data thieving software posing as a security application on Android Devices, a report explaining that most top free and paid mobile apps pose threats to organizations
05/08/2014 Duración: 12min“Genius is one percent inspiration and ninety–nine percent perspiration.” – Thomas A. Edison Android malware SandroRAT disguised as mobile security app http://www.scmagazine.com/android-malware-sandrorat-disguised-as-mobile-security-app/article/364455/ Article Resources McAfee Blog Post http://blogs.mcafee.com/mcafee-labs/sandrorat-android-rat-targeting-polish-banking-users-via-e-mail-phishing Emory Libraries Information Security Awareness covering Phishing http://it.emory.edu/security/security_awareness/phishing.html Most Top Free and Paid Mobile Apps Pose Threat to Enterprises: Report https://www.securityweek.com/most-top-free-and-paid-mobile-apps-pose-threat-enterprises-report C-IT Recommendation Perform an asset […]
-
![8-4-14 A report that shows many c-level executives have little respect for their Information Security Leaders, a social engineering campaign that takes advantage of Microsoft Word weaknesses, The US Department of Homeland Security’s report on Point of Sal]()
8-4-14 A report that shows many c-level executives have little respect for their Information Security Leaders, a social engineering campaign that takes advantage of Microsoft Word weaknesses, The US Department of Homeland Security’s report on Point of Sal
04/08/2014 Duración: 20min“If you work just for money, you’ll never make it, but if you love what you’re doing and you always put the customer first, success will be yours.” – Ray Kroc C-Level Execs to CISOs: No Seat for You! https://www.securityweek.com/c-level-execs-cisos-no-seat-you http://www.scmagazine.com/study-ciso-leadership-capacity-undervalued-by-most-c-level-execs/article/364231/ C-IT Recommendation Corporate leaders must establish a security debrief cadence with the information security […]
-
![7-30-14 Weakness in the Android software that could allow attackers to take over devices, Major security flaws in the majority of networkable tvs, webcams, alarm systems and other home and office electronics, a security issue with Instagram on Apple mobil]()
7-30-14 Weakness in the Android software that could allow attackers to take over devices, Major security flaws in the majority of networkable tvs, webcams, alarm systems and other home and office electronics, a security issue with Instagram on Apple mobil
31/07/2014 Duración: 14min“Opportunity is missed by most people because it is dressed in overalls and looks like work.” – Thomas Edison Vulnerability impacting multiple versions of Android could enable device takeover http://www.scmagazine.com/vulnerability-impacting-multiple-versions-of-android-could-enable-device-takeover/article/363414/ http://www.securityweek.com/android-fake-id-vulnerability-lets-malicious-apps-impersonate-trusted-apps C-IT Recommendation Perform an asset inventory of all company owned Android devices using company provided cell phone service. Your company should have a configuration […]
-
![7-29-14 Attacks originating from an Amazon cloud based technology platform, fourteen companies fined $5M pretending to provide AV Software the request from the Electronic Frontier Foundation to declare the NSA activities unconstitutional]()
7-29-14 Attacks originating from an Amazon cloud based technology platform, fourteen companies fined $5M pretending to provide AV Software the request from the Electronic Frontier Foundation to declare the NSA activities unconstitutional
29/07/2014 Duración: 12min“The golden rule for every business man is this: Put yourself in your customer’s place.” Orison Swett Marden Cybercriminals Abuse Amazon Cloud to Host Linux DDoS Trojans http://www.securityweek.com/cybercriminals-abuse-amazon-cloud-host-linux-ddos-trojans C-IT Recommendation Perform a risk analysis for utilizing cloud based services. Understand your limitations of using the cloud including Not having have total control Having your data […]
-
![7-28-14 A weakness impacting between 50,000 and 2 million websites, a survey highlighting how a significant number of organizations are leaving themselves open to cyber threats]()
7-28-14 A weakness impacting between 50,000 and 2 million websites, a survey highlighting how a significant number of organizations are leaving themselves open to cyber threats
28/07/2014 Duración: 12min“My own business always bores me to death; I prefer other people’s.” ―Oscar Wilde WordPress Plugin Vulnerability Exploited to Compromise Thousands of Websites https://www.securityweek.com/wordpress-plugin-vulnerability-exploited-compromise-thousands-websites http://www.csoonline.com/article/2457668/data-protection/thousands-of-sites-compromised-through-wordpress-plug-in-vulnerability.html C-IT Recommendation From the Website Perspective Ensure your organization has a strong asset inventory with an accurate configuration management database. Identify if any of your websites are using WordPress and […]
-
![7-25-14 A class action law suit filed against eBay after data breach, Sony’s $15 Million Settlement pay out for its 2011 data breach]()
7-25-14 A class action law suit filed against eBay after data breach, Sony’s $15 Million Settlement pay out for its 2011 data breach
25/07/2014 Duración: 13min“Good executives never put off until tomorrow what they can get someone else to do today.” -Anonymous eBay faces class-action suit over breach http://www.scmagazine.com/ebay-faces-class-action-suit-over-breach/article/362670/ http://www.csoonline.com/article/2457981/data-protection/ebay-faces-class-action-suit-over-data-breach.html Article Resources Ebay’s publication of Breach http://www.ebayinc.com/in_the_news/story/ebay-inc-ask-ebay-users-change-passwords The Courtroom Paperwork for the Lawsuit http://media.scmagazine.com/documents/88/ebaysuit_21893.pdf Sony to shell out $15M in PSN breach settlement http://www.scmagazine.com/sony-to-shell-out-15m-in-psn-breach-settlement/article/362720/ Article Resources Original Court Filings […]
-
![7-24-14 A cyber attack that may have cost ticket sales giant StubHub $10 million in tickets, a survey revealing the continued concerns of companies’ bring your own device practices]()
7-24-14 A cyber attack that may have cost ticket sales giant StubHub $10 million in tickets, a survey revealing the continued concerns of companies’ bring your own device practices
24/07/2014 Duración: 12min“The two basic processes of education are knowing and valuing.” -Robert J. Havighurst StubHub Hit in Cyber-Attack That May Have Stolen $10M in Tickets http://www.securityweek.com/stubhub-hit-cyber-attack-may-have-stolen-10m-tickets http://www.scmagazine.com/six-charged-in-global-stubhub-scheme-company-defrauded-out-of-1-million/article/362482/ C-IT Recommendation Ensure your organization has a security awareness program that educates users on basic security practices including not utilizing the same passwords on multiple systems. Ensure your systems […]
-
![7-23-14 Consumer distrust of retailers handling of their personal information, Wall Street Journal and Vice.com hack, a possible hack of Goodwill Industries]()
7-23-14 Consumer distrust of retailers handling of their personal information, Wall Street Journal and Vice.com hack, a possible hack of Goodwill Industries
23/07/2014 Duración: 16min“Every man, however wise, needs the advice of some sagacious friend in the affairs of life.” -Plautus Quarter of UK Shoppers Don’t Trust Retailers on Card Fraud http://www.infosecurity-magazine.com/view/39417/quarter-of-uk-shoppers-dont-trust-retailers-on-card-fraud/ C-IT Recommendation Pay attention to the news regarding data breach. Communicate your security efforts to your customer base Provide customer awareness and communicate the importance of the […]
-
![7-22-14 A study revealing prevalent password misuse in American businesses, Wall Street Journals Facebook account compromised Backdoor, a severe weakness in the Apple mobile device software that reveals private information]()
7-22-14 A study revealing prevalent password misuse in American businesses, Wall Street Journals Facebook account compromised Backdoor, a severe weakness in the Apple mobile device software that reveals private information
22/07/2014 Duración: 12min“He that will not reason is a bigot; he that cannot reason is a fool; and he that dares not reason is a slave.” -Sir William Drummond Password Misuse is Rampant at US Businesses http://www.infosecurity-magazine.com/view/39408/password-misuse-is-rampant-at-us-businesses/ C-IT Recommendation Ensure your organization has a security awareness program that educates users on basic security practices including not utilizing […]
-
![7-18-14 A report revealing that over half of company executives speak to their security teams less than twice a year, a study revealing that privileged user accounts are the root to most breaches]()
7-18-14 A report revealing that over half of company executives speak to their security teams less than twice a year, a study revealing that privileged user accounts are the root to most breaches
18/07/2014 Duración: 15min“The successful man is the one who finds out what is the matter with his business before his competitors do.” –Roy L. Smith 31 percent of IT security teams don’t speak to company execs http://www.scmagazine.com/report-31-percent-of-it-security-teams-dont-speak-to-company-execs/article/361263/ C-IT Recommendation Corporate leaders must establish a security debrief cadence with the information security teams. CSOs/CISO’s should meet with operational […]
-
![7-17-14 The prevalance of malware on Amazon web hosted services web sites, the lack of budget being provided for increased protection for computers in companies]()
7-17-14 The prevalance of malware on Amazon web hosted services web sites, the lack of budget being provided for increased protection for computers in companies
17/07/2014 Duración: 12min“We generate fears while we sit. We over come them by action. Fear is natures way of warning us to get busy.” -Dr. HenryLink Amazon Web Services Increasingly Used to Host Malware http://www.securityweek.com/amazon-web-services-increasingly-used-host-malware-report C-IT Recommendation Perform an information security risk assessment to see if the partnering organization handles risk in accordance with your company’s risk […]
-
![7-16-14 A major system weakness existing in 95% of fortune 1000 companies, a survey revealing the incorrect reporting of the majority of organizational security incidents, Oracle’s quarterly patch releases]()
7-16-14 A major system weakness existing in 95% of fortune 1000 companies, a survey revealing the incorrect reporting of the majority of organizational security incidents, Oracle’s quarterly patch releases
16/07/2014 Duración: 12min“Even if you are on the right track, You’ll get run over if you just sit there.” – Will Rogers Active Directory flaw opens enterprise services to unauthorized access http://www.scmagazine.com/active-directory-flaw-opens-enterprise-services-to-unauthorized-access/article/361017/ http://www.securityweek.com/active-directory-vulnerability-puts-enterprise-services-risk http://www.darkreading.com/active-directory-flaw-lets-attackers-change-passwords/d/d-id/1297298? http://www.csoonline.com/article/2454367/identity-access/why-the-microsoft-active-directory-design-flaw-isnt-serious.html Aorato Mitigation Techniques Detecting authentication protocol anomalies. For instance, the use of a non-default encryption algorithm. Identifying the attack by correlating the […]
