Tags: Chris Mark, security, InfoSec & Privacy, data security, PCI DSS, cybersecurity, cybercrime, data breach, deterrence, active, response, active response, fight
1 comment so far
“Everyone has a plan until the’ve been hit” – Joe Lewis
Having spent numerous years providing armed and unarmed physical security in combat zones, hospital emergency rooms, psychiatric wards, and anti-piracy operations off the coast of Somalia has given me a deep respect for force continuum and the dangers of unnecessarily provoking an escalation by a volatile and dangerous adversary.
As cyberattacks continue to plague American companies as well as the payment card industry, there is a growing voice within the cybersecurity industry to allow and empower companies to take offensive action against cyber attackers. This is frequently referred to as ‘hacking back’ or ‘offensive hacking’. Several prominent security experts as well as some companies who have fallen victim to cyber-attacks have begun advocating that ‘a good offense is the best defense’. On May 28th, 2013 there was an online discussion in which an author of the upcoming book: The Active Response Continuum: Ethical and Legal Issues of Aggressive Computer Network Defense posted the following excerpt:
“There are many challenges facing those who are victimized by computer crimes, who are frustrated with what they perceive to be a lack of effective law enforcement action to protect them, and who want to unilaterally take some aggressive action to directly counter the threats to their information and information systems.” (emphasis added) (more…)
Chris Mark in AT&T Network Exchange Blog February 20, 2014Posted by Chris Mark in Uncategorized.
Tags: AT&T, Chris Mark, cybersecurity, DSS, Exchange Blog, information, PCI, security
add a comment
As the AT&T PCI National Practice Director, I write and blog on numerous topics that I hope are of interest to those who have to protect data. Aside from the GlobalRiskInfo blog here I also publish some blog posts on the AT&T Network Exchange Blog. Please take a spin through. Also, there are a very large number of great writers on the AT&T Network Exchange Blog. Take some time and look through the other authors…
CyberEspionage (Again)…The Counter Terrorist Magazine February 19, 2014Posted by Chris Mark in Uncategorized.
Tags: risk management, Chris Mark, security, PCI DSS, cybersecurity, cybercrime, cyberespionage, AT&T
add a comment
In light of the continuing attacks against companies by Eastern European organized criminal groups, I thought it appropriate to remind everyone that state sponsored attacks are still a major issue. Here is a link to an article I wrote in The Counter Terrorist Magazine on the topic of CyberEspionage. “The economics of cyber-theft is simple: Stealing technology is far easier and cheaper than doing original research and development. It is also far less risky to the spy than historic cloak and dagger economic espionage.”
Tags: AT&T, Chris Mark, cybercrime, cybersecurity, data security, SC Magazine, Secure Computing, security
add a comment
In the August, 2013 edition of Secure Computing Magazine (SC Magazine), I have an interview and article included. The interview is for the cover story called “Beyond the Checkbox; PCI DSS” and the article is called “Understanding Parallax and Convergence to Improve Security”. Below is an excerpt from the article..be sure to check them out!
“To address today’s threats, companies require a high degree of convergent perspective, information expertise, and coordination between personnel and groups. Previously, companies could “make do” with basic security controls such as firewalls, Intrusion Detection System (IDS), and anti-virus. Attempting to understand the threats facing an organization and analyzing risk was often an afterthought, as companies relied upon simple compliance matrices and lists of “best practices” to secure their environment. This is no longer sufficient to address the threats of 2013. A major mistake in information security implementation is what can be referred to as “security parallax.””
Tags: cybercrime, cybersecurity, data protection, data security, online privacy, privacy, VPN
add a comment
This article is written by Christopher Reynolds, head of business development at IVPN – a VPN service, and EFF member, dedicated to protecting users’ online privacy. I don’t often allow guest posts but Mr. Reynolds and IVPN have done a great job of providing valuable info. Certainly worth taking a look!
Online privacy is coming under increasing attack from governments around the world. Legislation such as CISPA in the US, the CCDP in the UK and Australia’s data retention proposals, have generated real worry among privacy-conscious internet users over our law enforcement’s desire to increase their powers of surveillance to unprecedented levels. This culture of fear is driving more and more people toward commercial Virtual Private Networks (VPNs), which promise to protect user data and offer online anonymity. But choosing a VPN that actually protects privacy is not straightforward. In this blog post I will go over the key issues you must consider before signing up to any VPN service.
The biggest issue when it comes to using a VPN in order to protect your privacy is data retention. Government surveillance is primarily facilitated by the data retention policies of your ISP. In Europe your ISP’s data retention policy is mandated by the EU Data Retention Directive, which forces all European ISPs to retain users’ personal information for between 6 months and 2 years after the user leaves the ISP’s service. This data includes web logs, which essentially means a record of every website you’ve visited and the times you visited them. The data your ISP holds won’t typically contain email logs – despite popular perception- unless you use your ISPs own email service. But it will include which third party email services you use and when you’ve used them. (more…)