”Active Responses” to CyberAttacks are Losing Propositions May 22, 2014
Posted by Chris Mark in cybersecurity, Data Breach.Tags: active, active response, Chris Mark, cybercrime, cybersecurity, data breach, data security, deterrence, fight, InfoSec & Privacy, PCI DSS, response, security
1 comment so far
“Everyone has a plan until the’ve been hit” – Joe Lewis
Having spent numerous years providing armed and unarmed physical security in combat zones, hospital emergency rooms, psychiatric wards, and anti-piracy operations off the coast of Somalia has given me a deep respect for force continuum and the dangers of unnecessarily provoking an escalation by a volatile and dangerous adversary.
As cyberattacks continue to plague American companies as well as the payment card industry, there is a growing voice within the cybersecurity industry to allow and empower companies to take offensive action against cyber attackers. This is frequently referred to as ‘hacking back’ or ‘offensive hacking’. Several prominent security experts as well as some companies who have fallen victim to cyber-attacks have begun advocating that ‘a good offense is the best defense’. On May 28th, 2013 there was an online discussion in which an author of the upcoming book: The Active Response Continuum: Ethical and Legal Issues of Aggressive Computer Network Defense[1] posted the following excerpt:
“There are many challenges facing those who are victimized by computer crimes, who are frustrated with what they perceive to be a lack of effective law enforcement action to protect them, and who want to unilaterally take some aggressive action to directly counter the threats to their information and information systems.”[2] (emphasis added) (more…)
Chris Mark in September 2013 – SC Magazine (Interview and Article) August 21, 2013
Posted by Chris Mark in cybersecurity, Industry News, PCI DSS.Tags: AT&T, Chris Mark, cybercrime, cybersecurity, data security, SC Magazine, Secure Computing, security
add a comment
In the August, 2013 edition of Secure Computing Magazine (SC Magazine), I have an interview and article included. The interview is for the cover story called “Beyond the Checkbox; PCI DSS” and the article is called “Understanding Parallax and Convergence to Improve Security”. Below is an excerpt from the article..be sure to check them out!
“To address today’s threats, companies require a high degree of convergent perspective, information expertise, and coordination between personnel and groups. Previously, companies could “make do” with basic security controls such as firewalls, Intrusion Detection System (IDS), and anti-virus. Attempting to understand the threats facing an organization and analyzing risk was often an afterthought, as companies relied upon simple compliance matrices and lists of “best practices” to secure their environment. This is no longer sufficient to address the threats of 2013. A major mistake in information security implementation is what can be referred to as “security parallax.””
Update on Blogging and New Articles in TransactionWorld March 8, 2013
Posted by Chris Mark in cyberespionage, cybersecurity, Industry News.Tags: AT&T, Chris Mark, cyber security, data breach, Heather Mark, Network Exchange Blog, PCI, PCI DSS, requirements
add a comment
I want to apologize for not blogging as frequently. My new job has me hopping at the moment and I am writing extensively for AT&T’s Networking Exchange Blog. You can check out my blog posts at AT&T’s Networking Exchange Blog . In addition to my own articles, there are a number of other valable posts from other contributors. Finally, Heather Mark and I both have articles in the March edition of TransactionWorld Magazine. You can read Heather’s article here and Chris’ article here.
Chris Mark’s Article in “The Counter Terrorist Magazine” January 28, 2013
Posted by Chris Mark in cyberespionage, cybersecurity.Tags: china, Chris Mark, cyber espionage, cybersecurity, Duqu, Flame, security, The Counter Terrorist, Unlimted warfare
add a comment
I received my copy of February/March 2013 International edition of The Counter Terrorist Magazine and imagine my surprise when I am the cover article! I have written for a number of publications but I have to say my favorite is The Counter Terrorist. It is a great periodical for anyone interested in World affairs, Terrorism, and Counter Terrorism. My article is titled “World Cyber War”. In the article I talk about the differences in the perspectives of war between the East and the West, as well as provide examples of how cyber operations have already been used to further national interests. China is highlighted for their interpretations of war and warfare in “Unlimited War”, as well as Russia, and a few others. Overall, I think it is one of my better articles. To read The Counter Terrorist, you must subscribe either online or in print. Check out…The Counter Terrorist Magazine.
Beating an Old Drum October 27, 2012
Posted by Heather Mark in cybersecurity, Data Breach, Industry News, InfoSec & Privacy.Tags: cybersecurity, data security, Dr. Heather Mark, Heather Mark, InfoSec, mark consulting group, privacy, security
add a comment
It’s the end of what has already been a tough year for data security. And the news just got worse. South Carolina has announced that its Department of Revenue suffered a major breach. The breach is so massive, in fact that more than 75% of the state’s residents have been affected. The compromised data consisted of the (unencrypted) social security numbers of more than 3.6 million residents. Also included in the breach were about 390,000 payment cards. Most of those were encrypted, though.
This is disturbing on a number of levels. I find it curious, for example, that while encryption was deployed, it was only deployed on payment cards (and not even on all of those). Consumers have built in protections on payment cards. As long as those cards are branded by one of the major card brands, consumers are protected against liability for fraudulent transactions. The far more sensitive data, the social security numbers, were not encrypted, though. This defies logic. Consumers have little to no protection against misuse of SSNs. Not only can very real financial damage be done, consumers have to spend enormous resources (time, money, emotions) in untangling the identity theft knot that comes with stolen SSNs.
Secondly, in the wake of the breach, Governor Nikki Haley issued an executive order that read: “I hereby direct all cabinet agencies to immediately designate an information technology officer to cooperate with the State Inspector General who is authorized to make recommendations to improve information security policies and procedures in state agencies.” WHAT? If I’m inferring correctly, it seems that these agencies didn’t have an information technology officer already?? That is very troubling, particularly considering the types of data that state agencies hold. After 3.6 million (out of about 4.7 million) residents have had their sensitive data stolen is not a great time to decide that data security and privacy should become priority.
Private sector organizations have been working for years to shore up their data security, and in some cases (PCI DSS, HIPAA/HITECH, GLBA, SOX, state laws) face real consequences for failure to protect that data. It’s long past time states put forth the same level of protection. On the plus side, the state did comply nicely with its own data breach notification law.
Global Security, Privacy, & Risk Management 