Summary Bullets:              

• IT security specialists need to expand their skills range, especially in technology areas that are seeing  the greatest amount of new investment
• Employers looking for good candidates need to put resources into training and mentoring programs in order to cultivate the mix of skills they are seeking

Here’s an interesting conundrum:  There is an acute skills shortage in the IT security job market, but at the same time those with security skills are being turned away when they seek to advance through new job openings.  It appears to be a combination of factors that have created this scenario.  In a recent TechTarget article, George Hulme argues that there are unrealistic expectations on the part of those hiring.  Many organizations appear to be looking for candidates with multiple talents.  Not only do they want specialists, they want candidates to be specialists in multiple areas, and they want those candidates to have some leadership skills or business acumen. Continue reading “The Great Security Skills Shortage” →

Summary Bullets:

• Antimalware innovators are increasingly successful in pitching their endpoint alternatives as supplemental to incumbent AV products.
• This raises the question:  why continue to pay premium prices for less effective, traditional protection?

Yet another study claimed recently that anti-virus products fail to detect 60% of the malware in the wild, according to the Security Engineering Research Team (SERT) Solutionary, a managed security services provider.  Those kind of statistics hardly raise eyebrows anymore, but large enterprises continue to pay premium prices for their endpoint protection. This is not to say that the large anti-malware providers aren’t trying to adapt to the changing threat landscape, but they are slow to innovate and are taking baby steps to move beyond the broken signature-based approach to malware protection, in which each new malware and its variant must be identified and a signature created for endpoint-based scanners to identify. Continue reading “Why Are Enterprises Still Paying Premium Pricing for Less Effective Endpoint AV?” →

Summary Bullets:  

• It takes only minutes for a sophisticated attacker to breach an enterprise network, but it can take months to uncover their presence.

• Reducing that time to discovery can minimize the damage done, but there are multiple ways to try to achieve faster detection.  Which route should you choose?

I had an interesting conversation the other day with a company in the still fairly small market niche called incident response, and it got me thinking about the evolution of the threat landscape and the time that it takes enterprises to respond to new market conditions – especially in the security market.  I think by now most large enterprise security administrators and CISOs understand that it is not a matter of if, but when their organization will experience a breach – one that could potentially be very painful for the whole organization.  But recognizing that sad fact does not help those administrators and executives understand the most effective way to tackle the new challenge presented by more sophisticated, stealthy, multi-stage attacks.  Exacerbating their dilemma is an increasingly porous enterprise perimeter, where computing workloads are shifted outside the traditional DMZ and end users are allowed (or go around policies that prohibit) access to corporate data from their own smartphones, tablets and even laptops. Continue reading “Okay, Breaches Are Inevitable: So Now What Do We Do?” →

Summary Bullets:                

• Before enabling online banking for payroll or other payments, SMB IT personnel should carefully review the bank’s security procedures and understand what guarantees the bank offers for securing funds against cyber losses.
• SMB IT managers should take special pains to educate the payroll manager on the risks and safe online behavior, and encourage hyper-vigilance in conducting company business online.  If possible, a system should be dedicated to online banking, and blocked from accessing any other web sites or email.

Past studies have indicated that small and medium-sized businesses (SMBs) and non-profits are a target for cyber criminals because they don’t have the same level of protection that larger companies do.  That is especially true for small and medium-sized banks, because they don’t have the same sophisticated online banking cyber-fraud controls that large banks have.  That could be why the SMB/non-profit market has become so attractive to security vendors such as McAfee, which in the last year has made a concerted push to improve its presence and offerings for that market segment.  In fact, security for SMBs is pegged to be about a $5.1 billion opportunity.  Besides that bull’s eye they’re sporting on their backs, there’s another reason for SMBs and non-profits to be hyper vigilant about protecting their finances:  should cyber thieves manage to gain access to their online bank accounts and steal their money, they are legally held responsible for the loss – not the bank.  A Tennessee construction company found that out the hard way, according to security blogger Brian Krebs.  Cyber thieves using the widely available Zeus Trojan toolkit managed to steal an employee’s user credentials as the user logged on to the firm’s online banking site, redirect the employee to a fake web page that claimed the bank’s site was under maintenance, and hijacked the employee’s online banking session to put through multiple fake payroll payments to a series of money mules.  For some unknown reason, the bank failed to call the company for approval before it processed the automated clearing house payments, even though it had done so on a regular basis before the breach.   Despite that lapse on the part of the bank, the construction company was left holding the bag. Continue reading “Online Banking for SMBs: Like Playing Russian Roulette” →