Ingredients of a Good Insider Risk Program

Suparna Goswami • December 3, 2021

Any technology that allows you to do a full-person assessment by taking into account nontechnical data as well as technical data is a value-add to an insider risk program, says Peter J. Lapp, former special agent at the FBI. He discusses the ingredients in a good insider risk program.

►

Critical Infrastructure Security

'The Shared Responsibility That Cyberspace Is'

Latest

Account Takeover Fraud

ISMG Editors: Are We Close to Cracking Cybercrime Ecosystem?

Anna Delaney • December 3, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including how the FBI has seized bitcoins from an alleged REvil ransomware affiliate, how to mitigate risks from BIN attacks and the latest COVID-19 trends globally.

Business Continuity Management / Disaster Recovery

Need to Negotiate a Ransomware Payoff? Newbies: Start Here

Anna Delaney • December 3, 2021

The latest edition of the ISMG Security Report features an analysis of best practices for negotiating a ransom payment. Also featured: Busting Zero Trust myths and the dangers of mythologizing defenders.

Analytics

Using Behavioral Biometrics to Secure Against Digital Fraud

Geetha Nandikotkur • December 2, 2021

A risk-based approach to secure against digital fraud requires putting in the correct security controls in proportion to the organizational risk, which is determined by understanding the customer's subconscious habits, says Australia-based Tim Dalgleish, senior director, a global advisory, at BioCatch.

Video

Overcoming the Hesitancy to Move to the Cloud

Suparna Goswami • December 2, 2021

"Enterprises are reluctant to move to the cloud because they are concerned about the infrastructure and data security that cloud vendors are going to offer," says Deepak Prasad, customer engineer, security specialist at Google Cloud. He gives advice on making the digital transformation journey smoother

Cybercrime

Identifying and Countering BIN Attacks

Suparna Goswami • December 1, 2021

In order to identify BIN attacks, it is important for payment card brands to leverage AI and automated systems for monitoring transaction data to look for unusual patterns, says Keri Crane, advisory technical product manager with Jack Henry & Associates. She also discusses mitigation tips.

Governance & Risk Management

Troublemaker CISO: Penny-Wise, Pound-Foolish & Insider Risk

Ian Keller • December 1, 2021

The saying "Penny-wise, pound-foolish" is relevant when we talk to those friendly, knowledgeable finance people about ongoing employee screening due to the dreaded insider threat and the costs associated with it - which leads to us pulling out our hair in utter frustration. This rant is about that.

Fraud Management & Cybercrime

Why Today's Security Rhetoric is Harmful and Must Change

Anna Delaney • November 30, 2021

In her latest book, "Rhetoric of InSecurity: The Language of Danger, Fear and Safety in National and International Contexts," academic Victoria Baines questions the imagery and rhetoric we use to communicate safety and security issues, and details their unwelcome impact on the workforce.

3rd Party Risk Management

Forrester Predictions: Rethinking Supply Chain Management

Anna Delaney • November 30, 2021

Forrester's Sandy Carielli and Jeff Pollard discuss their latest research, Predictions 2022: Cybersecurity, Risk and Privacy, which highlights the need for gaps in third-party relationships, collaboration and trust to be addressed.

Cybercrime

Making the Case for Centralized IAM Management Control

Anna Delaney • November 27, 2021

The problem with decentralized access management, says Manuel Garat, head of IAM at digital travel company Booking.com, is that while you might know who or what needs access to your network, applications and data, you "don't always know who shouldn't have access."

Cybercrime

The Best Gift for the Holidays? An Incident Response Plan

Anna Delaney • November 26, 2021

In the latest weekly update, four editors at Information Security Media Group discuss important cybersecurity issues, including why security teams are still unprepared for cyberattacks over weekends and holidays, which experts warn is when attackers love to strike.

Endpoint Security

Medical Data Exposed in Breach at True Health New Mexico

Jeremy Kirk • November 26, 2021

A health insurer in New Mexico is warning of a data breach that exposed customers' personal and medical information. True Health New Mexico reports that nearly 63,000 individuals' personal details were exposed in the "early October" incident. It's offering all victims prepaid credit monitoring services.

3rd Party Risk Management

Essential Preparations for the Holiday Season Attack Surge

Anna Delaney • November 26, 2021

The latest edition of the ISMG Security Report features an analysis of how organizations can reduce risk especially over holidays and weekends, when attackers are most likely to strike. Also featured: Highlights from Ireland's IRISSCON 2021 cybercrime conference; what's ahead for COVID-19 and the workplace?