Summary Bullets:

• Vendors are prioritizing portfolio and marketing effort on the most common types of COVID-19 related cyber events, covering phishing and identity attacks.

• Cybersecurity vendors are reconfiguring their service and support functions encompassing remote working. Vendors face internal operational challenges in scaling up quickly with the right level of security posture.

The COVID-19 pandemic is having a huge impact globally across families and communities. In turn, this is having a massive impact on businesses of all sizes, including global multinationals. Almost all Fortune 100 and 500 companies have experienced major disruptions to their operations and markets, resulting in some economists predicting losses of more than $1.1 trillion worldwide. COVID-19 has created shutdowns and major disruptions in employee working styles and supply chains in all sectors, and in particular across government, finance, manufacturing, IT, and media. As these sectors reconfigure their operations, one of the most critical issues arising are increased cyber-attack threats as organizations become more dependent on technology. Continue reading “COVID-19: Impact on Cybersecurity” →

Summary Bullets:

• Verizon’s annual Payment Security Report captures a snapshot of organizations struggling to continue successful controls and best practices over time.
• The evidence shows those who do are rewarded with a better fortified defense against breaches.

Fifteen years after the payment card industry settled on a single data security standard with PCI DSS, there are indications that too many organizations’ security practices haven’t risen to the level of maturity which would have been anticipated at this point.  In Verizon’s annual survey of payment card industry security practices, only 37% of the 302 surveyed enterprises sustain full compliance with the 12 specifications outlined in PCI DSS consistently over time.  Effectively, most organizations are focusing on meeting the basic requirements rather than developing consistent and effective security practices – not unlike a procrastinating student who is just looking to pass the test.  Just 18% check to see if they are meeting PCI DSS specifications more often than what the standard mandates. Continue reading “Verizon Payment Security Research Exposes Execution Issues” →

Summary Bullets:

• Orange Cyberdefense has an aggressive strategy to drive its cybersecurity business by capitalizing on its strengths in its home market and expanding its security portfolio.
• Acquisition is part of its expansion strategy, with the purchase of SecureLink and SecureData. The seamless integration of these businesses will be important to its success.

The strategic growth plans laid out by Orange Cyberdefense at its recent Analyst Day in Paris were impressive and tactical. The cybersecurity business has grown since its inception, mainly because it has been able to capitalize on its strengths in the home market with a strong security offering addressing global multinationals with multi-country locations, as well as serving the midmarket. Continue reading “Security Providers Should Focus Less on Selling Security and More on Selling Trust by Becoming Service-Centric” →

Summary Bullets:

• After a protracted legal battle that spanned nearly a decade, Cisco settled a lawsuit accepting accountability for a security flaw in a video surveillance system sold to Homeland Security, the Secret Service, and other U.S. government agencies.

• As part of the settlement, the partner’s employee who originally reported the vulnerability will receive $1.5 million.

Eight years after the filing of a lawsuit against Cisco on behalf of U.S. public sector customers and more than a decade after a Cisco contractor initially called attention to a serious security flaw in one of the vendor’s video surveillance solutions, the IT equipment maker reached an $8.6 million settlement with the aggrieved parties and admitted culpability. In a blog posted in late July, Cisco General Counsel Mark Chandler wrote that software developed by Broadware – a company acquired by Cisco – used an open architecture that could be vulnerable to a breach. The settlement amount equates to a partial refund to the U.S. federal government and 16 states that bought products between 2008 and 2013. And the $8.6 million settlement included a $1.6 million payment to the person who first identified the vulnerability, although ultimately, no breach ever occurred. Continue reading “Cisco’s Settlement Over Video Surveillance Flap Signifies a New Era in Vendor Accountability” →