Cavirin Blog

Everything CISO and Cybersecurity During Black Hat 2018

Black Hat celebrated its 21^st anniversary this year, bringing together over 15,000 cybersecurity professionals to learn and network in Las Vegas.  At the Cavirin booth, people flooded to get their “Got CyberPosture” t-shirt and learn how the Cavirin CyberPosture Intelligence platform provides “credit like” scoring, with actionable insights, helping enterprises align their security resources to more effectively address pressing threats of cyber attacks in their hybrid environments (multi-cloud, containers, and on-premise). 

Additionally, BrightTALK was at the heart of the action, streaming live panel sessions and engaging in conversations with some of the world's top security leaders. These panels offer a collaborative atmosphere, enhanced by speaker presentations and insights. Cavirin’s CSO, Joe Kucic participated in two of the thought-provoking panels:  Key Factors for CISO Success & Managing Your Cyber Risk!  If you were unable to join us in Vegas, we highly recommend tuning into these two panels available on the BrightTALK website. Here is a little more information about the webinars: 

The Key Factors for CISO Success was a Part 1 of 2 CISO panels during Black Hat. This panel was an in-depth focus on the ever-changing role of the CISO and the factors influencing their success. There was also a focus on why identifying your organization’s security culture matters. With the huge shift to cloud services, CISOs are needed to recruit, develop, and retain strong security talent.  Today’s cyber threats and the introduction of the hybrid cloud is forcing CISO’s to build a new arsenal of talent and tools to accommodate its present complexity. Kucic believes that CISO’s are beginning to adapt the continuous security model to address the frequency and acts of today’s threats.  CISO’s are required to know what their levels of exposures are based on different assets. Further, they must be able to prioritize the remediation actions that help improve the overall security posture of an organization.  Taking that data and being able to present it to leadership is key for a CISO’s success.   Lots more great insight from Joe and other members of the panel: Mark Weatherford (vArmour), Azi Cohen (WhiteSource) and Mark Whitehead (Trustwave).

The second panel that Cavirin’s CSO, Joe Kuicic, was featured on was Managing Your Cyber Risk lead by ITSPmagazine, based on detecting and responding to threats within your organization. This panel was a Q&A based around managing security risk. The key takeaway was that every company has it whether they want to acknowledge it or not. Kucic says that “risk management has evolved to be a business enabler, a differentiator if they do it right.  It allows companies to move quicker with technologies and go to market faster than their competitors if they look at it the right way and not just as a compliance requirement”. Continuous visibility is important because risks and breaches are ongoing and not just a single occurrence.  Finally, he adds that remediation and mitigation are things that companies continue to struggle with today.  Both webinars are available on BrightTALK for free! Tune in for the full coverage.

Overall, Cavirin’s participation at Black Hat was awesome due to the relationships built, conversations enjoyed, and insights gained this year. To continue the BH momentum, if you want to see a demo of our CyberPosture Intelligence Platform, This email address is being protected from spambots. You need JavaScript enabled to view it.!  We would love to keep the connections going! We even might be able to get you the hot “Got CyberPosture” t-shirt.  See you soon.

Details

Category: Continuous Security Assessment & Remediation

• Cloud Security
• Compliance
• Hybrid-Infrastructure
• security platform
• Cybersecurity
• RiskManagemet

Cybersecurity Scoring Blog Series

This is the second in three-part blog series designed to help your organization understand and leverage your own cybersecurity scoring posture.  Over the course of the series, we will present the concept of cybersecurity posture along with a framework and an approach to calculate your overall posture score.  

1. Introduction to CyberPosture Scoring
2. Cybersecurity Posture Scoring vs Risk Scoring
3. Using a Security Framework to Measure Your CyberPosture Score

Comparing Cyber Security Posture Scoring to Cyber Security Risk Scoring

 When building a cybersecurity program to defend your digital assets, the plan should be developed by assessing three critical aspects:

• Step One: What assets are you trying to protect?

Identifying the systems, applications, data, business processes and end-users that need to be protected

• Step Two: What are the risks?

Determining through cyber risk scoring which assets are left open to cyber-attacks, and the impact of each system going offline and/or leaking data

• Step Three: How well are you protected?

Documenting the controls in place to protect the assets and the strength of those controls by using CyberPosture scoring

Many security-mature businesses adequately address Step One, identifying the assets to be protected. And a variety of methods and tools have been around a long time for Step Two, determining the risks. But in our discussions with clients, we find that many have not taken that important Step Three, finding out just how well they are protecting the things that matter to the business by using posture scoring. 

An Overview of Risk Scoring

An important part of going through all three steps is gaining an understanding of how CyberPosture scoring compares to cyber risk scoring. When conducting cyber risk scoring, you analyze what could go wrong. You first take an inventory of your systems, applications, data, business process, and end users (Step One) and the role they play in allowing you to run the business. Then you assess their weaknesses and vulnerabilities:

• What systems can be hacked and taken offline?
• What data can be stolen, leaked or changed?
• Can private information or intellectual property be lost or stolen?

Risk scoring combines the extent of the weakness and the value of the asset. The assessment requires an understanding of the CIA triad (confidentiality, integrity, and availability), which measures the business impact of an asset that’s taken down or experiences a data breach. Those that play a critical role in running the business and lack sufficient cybersecurity mechanisms will score as a high risk. Those that aren’t mission-critical, and those with few weaknesses and/or with limited exposure, will score as a low risk.

Using a scoring system for each asset—which may be as simple as Red-Yellow-Green, or as granular as a scale of 1-100 - allows IT to prioritize which risks to address first. By having a risk scoring method and system, IT can also more easily communicate the overall level of risk for assets to the business leaders. This is particularly important when additional resources need to be purchased to address those risks!

Risk Scoring Leads to Posture Scoring

The risk scoring process then drives the compensating security controls that will be deployed to address the vulnerabilities and weaknesses, to reduce their exposure, and to ultimately mitigate the risks. These may be a combination of hardware and software systems as well as corporate policies that govern end-user activities when utilizing company devices. It could even include end-user awareness training to minimize the impact humans can have on the systems, data, and surrounding processes.

After the compensating policies and controls are in place, the cybersecurity posture scoring then comes into play to determine how strong those controls are in mitigating the risks. It’s essentially a reassessment of the IT environment to see how strong it is in defending against potential threats. As with risk scoring, posture scoring can be based on a three-color scheme or a wide-ranging numbered scale.

The leading cybersecurity posture platforms generate results that are comprehensible to personnel with minimal cybersecurity training. The results represent the strengths of the compensating controls in order to adequately drive prioritized action plans for upgrading or replacing inadequate controls.

The scoring results are based on industry-standard cybersecurity frameworks. In addition, they incorporate all the risk signals that an organization is aware of and then compare those risks to the controls in place to mitigate the risks.

Cybersecurity posture scoring can also be integrated with other security management applications. This makes it possible to incorporate risk signals added in the future to ensure your security controls keep pace with new threats.

An On-Going Scoring Process

As your cybersecurity posture score increases, your cybersecurity risk score will decrease. Ideally, you want to find a balance of controls that justifies the investment in hardware and software and returns the required digital-asset protection value. The two-pronged risk/posture scoring process also needs to be conducted on a recurring basis as new business processes are introduced creating more exposure and new cyber threats emerge, creating new risks that current controls cannot mitigate.

In the final blog, we present the basic elements of a posture scoring framework, how cyber security posture scoring works, and how to get started with scoring your cybersecurity posture - including what you need to do to prepare before you can start scoring. 

• Using a Security Framework to Measure Your CyberPosture Score

Download our whitepaper on the topic: Your CyberPosture Score.

Details

Written by Anupam Sahai

Category: CyberPosture

Cybersecurity Scoring Blog Series

To help your organization understand and leverage a cybersecurity scoring posture as part of our overall information security management program, you will find this first in the three-part blog series the jump-start you need. Over the course of the series, we will present the concept of a cybersecurity posture along with a framework and an approach to calculate your overall posture score.

1. Introduction to CyberPosture Scoring
2. Cybersecurity Posture Scoring vs Risk Scoring
3. Using a Security Framework to Measure Your CyberPosture Score

Cyber Security Posture Scoring: How Strong Are Your Controls?

For many years, security frameworks have presented a common methodology for assessing cybersecurity risks. Recently, frameworks have begun to emerge as a way to also assess an organization’s cybersecurity posture—a measurement of the strength of the deployed controls that are meant to protect the digital infrastructure. 

One way to understand the difference between a risk assessment and a posture assessment is to consider the case of a major city located on the coastline. A risk assessment can identify the extent to which the city harbor is susceptible to storm surges and flooding. In reaction to that assessment, the city might choose to install offshore barriers. 

A posture assessment would then measure just how effective those barriers are in defending against potential storm surges and floods. The stronger the barriers, the lower the risk becomes in future assessments.

The Key Attributes of a Cyber Posture Scoring Platform

While generating an overall cyber security posture score is important, the platform you utilize should also include attributes that allow you to put that score to good use. This includes making the results comprehensible to personnel with minimal cybersecurity training. The results must also be meaningful and represent the strengths of the risk controls in order to adequately drive prioritized action plans starting at the board and executive level, working its way down to the security operations center and the security analysts. 

The scoring results provided by the leading cybersecurity scoring platforms are based on industry-standard cybersecurity frameworks. They are also comprehensive—incorporating all the risk signals that the organization is aware of, and then comparing those risks to the controls in place to mitigate the risks. 

Leading solutions also provide extensibility to integrate cybersecurity posture scoring with other security management applications. In addition, you can incorporate risk signals added in the future to ensure your security controls keep pace with new threats.

The Benefits of Cyber Posture Scoring

While risk assessments are meant to help you lower your risk score, control assessments are meant to help you raise your cyber posture score. The higher the number, the better your security posture. By applying cyber posture scoring, organizations reap several benefits:

• Measures the efficacy of the information security and compliance programs for the enterprise.
• Creates a better understanding of the security and compliance posture, and how to address important concerns.
• Compares internal security and compliance controls against the most common threats.
• Produces a benchmark to compare security performance against industry peers and competitors.
• Facilitates communication of cybersecurity reports with executives by explaining security program effectiveness within the business context.
• Provides additional guidance to help reduce and mitigate cybersecurity risk.
• Generates machine learning insights to enable proactive measures against risk-inducing behaviors.

In the blogs that follow, we compare and contrast posture assessments vs. risk assessments, the basic elements of a posture scoring framework, how cybersecurity posture scoring works, and how to get started with scoring your cybersecurity posture—including what you need to do before you can start scoring. 

• Cybersecurity Posture Scoring vs Risk Scoring
• Using a Security Framework to Measure Your CyberPosture Score

Download our whitepaper on the topic: Your CyberPosture Score

Details

Written by Anupam Sahai

Category: CyberPosture

Instituting Solid Security Standards in Tough Times

The modern Chief Information Security Officer (CISO) faces myriad challenges as he or she strives to protect company data, meet regulatory requirements, and spread security awareness. Their mission to institute solid security standards is often hampered by a lack of readily available talent and a limited budget.

It’s a difficult, often thankless task, but resourceful CISOs with the right strategy, support, and tools can prevail. 

A Varied Role

The lack of a common, widely agreed upon definition of a CISO’s job muddies the waters considerably. The first wave of CISOs were often tasked with defining the role as they worked and there are still major differences in the responsibilities bestowed by different organizations.

First and foremost is the need to manage security and protect data, but many CISOs are also now expected to help build security into the infrastructure and train the workforce to be vigilant.

With the mass adoption of cloud services and the proliferation of complex hybrid environments, exacerbated by the rise of the IoT, the virtual office, and shadow IT, CISOs really have their work cut out for them.  A difficult job that requires synergy with various departments is fast-becoming more difficult.

CISOs must recognize potential threats and evangelize for the security cause to secure the budgets and cooperation they need to be successful.

Spreading Awareness

As cloud adoption continues to gather pace and organizations look for safe ways to migrate vast amounts of data, some security risk is inevitable. Perhaps the single greatest action CISOs can take to combat and mitigate that threat is to train the workforce and advance security awareness. After all, Gartner suggests that through 2022, at least 95 percent of cloud security failures will be the customer’s fault.

CISOs must develop a set of policies that enumerate precisely what action employees need to take when an incident occurs, whether it’s a suspected breach, a malware infection, or something else. Embrace the reality that people make mistakes and focus on how to deal with errors to swiftly correct them and minimize their potential impact.

Every employee should regularly complete a constantly evolving security training program that reflects the latest threats. It’s not enough to tick the completion box and move on; employees also need to be tested to ensure they are following policies. When people fail, further training is required.

Providing Proper Support

When CISOs were asked about their concerns for this year by the Ponemon Institute most of them named “lack of competent in-house staff” as their primary worry. There’s a dearth of experienced security professionals and this often leads to people being promoted from unrelated departments and training up in the job. Mistakes are the inevitable consequence.

To help support these security fledglings, CISOs can deploy supportive tools and software that offer an accessible overview of their organization’s cyber posture. (Know what is your CyberPosture Score.)
Automated alerts that highlight potential security issues, alongside clear advice on how to meet security standards and adhere to regulatory requirements can elevate the performance of inexperienced employees.
By conducting a full analysis of an organization’s security posture, compared with the necessary compliance considerations, best practices, and the latest benchmarks, CISOs can identify gaps in their defenses. This allows them to laser focus limited resources in the right places.

It’s crucial to bolster novice security teams with configurable software tuned to the required security standards. To effectively safeguard business-critical data, CISOs need the right strategy coupled with the right tools.

Details

Written by Anupam Sahai

Category: Trending in Security

New Generation Companies

IT has changed from driving the bottom line to driving the top line for enterprises. Most of these new applications are developed and built using the DevOps model. This movement was driven by new generation companies such as Google, Facebook, LinkedIn, Pinterest, Twitter, etc. Places where open collaboration is key, and more contributors are encouraged. In addition to changing the business landscape, these companies also built the next set of tools for big data, cloud, AI/machine learning and containers. All of these technologies are mostly open-source. This means the demand is rising for companies to get onboard. There has been a tremendous growth in recruitment activities among organizations that want to boost their open source technology presence. Hiring open source talent was a priority for 83 percent of hiring managers, an increase from 76 percent in 2017. Additionally, containers have been growing rapidly in popularity with 57 percent of hiring managers seeking container expertise (rise from 27 percent in 2017). Overall, we are now entering the scale of massive adoption across the business landscape hence driving the need for open source talent.

What are some steps companies and job candidates can take to benefit from this data?

Time to market is key. In the current business landscape, the speed of innovation has gone up dramatically with this new generation of open source tools. Companies need to recognize that they need in-house talent with the right set of expertise for their chosen toolset. Community-based technology fuels big structured and unstructured data. This also means innovative data-management and storage solutions. Both DevOps and SecOps must respond with an “open-source first” approach when it comes to deploying new software and security infrastructure. Almost any business that plans to survive wants motivated, creative people. They need a talent pool that’s more agile. They need the right mix of enterprise-grade folks who know what it takes to build enterprise-grade – secure, highly available, and robust applications. The newer generation of fast learners that can pick up the new toolset and drive innovation, with security, for business is in high demand.

How can people who are interested in a career in open source enter the field? 

 Jump with both feet into the pool. There are tons of amazing technologies available in the market to choose from. Pick the technology area that’s most aligned with your interest. Study it in and out and become an expert in the field. Participate and contribute to free and open source software (aka FOSS). These projects can offer a variety of learning opportunities. This can even help you start to build a portfolio of your work for prospective employers.  Another strategy is to learn how to make the best use of today's powerful open source technologies. Most of these technologies are new (a handful of years old) hence it depends on an individual’s attitude and aptitude to become the expert in the field and command top dollars from their perspective enterprises for their talent and deliver the results to their employers.

Details

Written by Brajesh Goyal

Category: Trending in Security

Introduction of the Cavirin Connect Global Channel Partner Program

This week, we announced our new Cavirin Connect Program, empowering resellers, integrators, and MSSPs to offer the Cavirin CyberPosture Intelligence solution to customers worldwide, solving full spectrum hybrid cloud security challenges.

In the very competitive security market, the channel is looking for new ways to solve customer problems and differentiate themselves. The demand for a solution that provides controlled secure asset migration in complex hybrid cloud infrastructures represents just such a challenge and an opportunity.

Cavirin is ideal for this, as we have the perfect solution for organizations looking to maintain business continuity while moving critical assets in the cloud and in multi-faceted hybrid environments! Cavirin’s CyberPosture Intelligence solution, which includes a wizard-based, API-driven control plane, is simple to ingest by the channel. Cavirin Connect brings tremendous value to their customers while offering low cost of sale. Cavirin cloud security automation addresses that!

For MSSPs, the program aligns with evolving cloud service offerings and allows them to focus on hybrid cloud service delivery that has meaningful bottom-line impact most important to their consumers.

We help the channel better address C-level concerns of their customers too – security and visibility. Cavirin makes it simple for executives to understand their cloud security defensive posture, to understand potential risk, and to improve their stance against potential threats at low cost.

Unfortunately, organizations haven’t had access to a best-in-class solution like Cavirin that prevents data breaches by giving them unified control over all hybrid assets. It’s simply hard to control and protect what you can’t see! We deliver the visibility and control necessary to secure their entire hybrid cloud theater through our Cavirin Connect Channel Partners.

We’re in the business of making it easy to manage security in complex environments without having channel customers drive multiple silo viewing tools into their hybrid workloads. Cavirin’s atmospheric global control and visibility of the hybrid-cloud security plane allows our partners to deliver value highly sought after by today’s enterprise organizations.

Cavirin Connect equips our partners with the necessary technical and business acumen to enable them to deliver cutting-edge hybrid cloud security to their customers.

We also spent a great deal of time thinking about the onboarding and channel management process. In conjunction with the announcement, Cavirin’s partner management portal based on Allbound is now live, a one-stop shop for deal management, co-marketing, training, all with a goal of reducing the sales cycle and increasing the partner’s win rate. Key components of the program include tiered discounts and a 100% deal registration model to avoid channel conflict while increasing margins.

Inaugural members of the Cavirin Connect Partner Program include Astadia in the UK, Bodega Technologies, InterVision, Lite Distribution in Australia, Logicworks, Scalar in Canada, Titans Security in Israel, Veristor and others. Though less than 20% of our revenue today is via the channel, we intend for this to grow to 100% over time. Partner-driven lower-touch engagements will be the domain of our commercial team, while larger enterprises will follow a high-touch model, also driven through the channel.

Our promise is to deliver an unparalleled onboarding and ‘day-2’ experience that will generate value and cause partners to want to work with us…. a win-win for all involved.

Partnership, Protection, Profit with Technical and Business Superiority for our trusted Cavirin Connect Partners. This is Cavirin Connect.

Get information on Cavirin Connect.

Details

Written by Tom Hance

Category: CyberPosture

• Cloud Security
• Compliance
• Cybersecurity
• hybrid cloud
• CyberPosture
• Partner Program