Archives

Categories

Risk assessment

23.06.2019 Cyber assessment, cyber crime, cyber security, cyberprism, privacy, Risk assessment, security Comments Off on Hope is not a cybersecurity strategy

Hope is not a cybersecurity strategy

Take the time now to assess your enterprise cyber risk and discover where best to invest for the best defense!

Since 2013, there have been 169 cyber attacks against city/state government agencies; 22 so far this year. Of the 169, 45 targeted law enforcement

In a recent cybersecurity conference I attended, CISO panelists were asked for their #1 cybersecurity issue. Surprisingly, their answers was NOT better cyber security tools, more cybersecurity staff (that was their second priority), or more cyber intelligence.

Their #1 answer?

More action by executives and boards of directors to do what needs to be done to help better protect their cyber assets.

Now, to be fair to those executives (public and private sector), “cyber” is just one of numerous front-burner issues they must deal with, and unfortunately taking the time to learn about and effectively address cyber risks doesn’t always make the cut – until their agency/company is attacked.

I refer to this the “911 effect“…Terrorism was a problem on September 10th; however, it took the horrific events of September 11th to get the attention and investment that others, like FBI SA John O’Neil* and others knew it desperately needed.

So, as an executive, how can you avoid the “Cyber 911 Effect” for your agency? I offer three steps:

  1. Elevate cyber risk as a priority at the executive/board level and do the work needed to better understand what your organization’s cyber risk really is;
  2. Conduct an enterprise-wide cyber security assessment to become informed for how your current cybersecurity behaviors and investments stack-up to your inherent risk; and
  3. Implement a program of continuous risk monitoring and mitigation to build stronger cybersecurity maturity against the threats you face.

What? You say you don’t have the time or funds to do these three things? Well the truth is that it’s going to cost you a LOT more time and money if you do get attacked and you don’t do them…a few examples:

  • Albany, NY – city services and police department impacted, cost not yet known
  • Atlanta, GA – city services impacted; estimates vary, $5,000,000 and $17,000,000
  • Baltimore, MD – weeks with many city services offline; $18,000,000 recovery estimated
  • FBI National Academy – websites breached, stolen PII of thousands of LEOs exposed
  • FEMA – personal information on 2.5 million disaster victims exposed by subcontractor
  • Indiana – health information of >31,000 patients exposed
  • Massachusetts – attack shuts down parts of Public Defender Agency
  • Oklahoma – millions of government files exposed, some pertinent to FBI investigations
  • Riverside, TX – 10 months of police/fire department files affected

While I’d love you to call me in (410-903-6289) to help you get it done, there are many good cyber risk assessment offerings out there. Whichever way you go, take the time and make the investment now (less than $10k) and just do it.

To learn more about my cyber risk assessment offering, please read this posting: https://www.linkedin.com/pulse/nowheretohide-now-offering-enterprise-cyber-security-risk-georgo/

Thank you…r/Chuck

* Note: John O’Neil died in the September 11, 2001 attacks on the WTC, 2001. Believe it or not, it was his first day on the job as the Chief Security Officer for the WTC compound. You can read more about him in the book Securing the City.

14.09.2013 counterintelligence, cyber crime, cyber security, Economic espionage, espionage, information security, INSA, insider threat, Risk assessment, security, security threats Comments Off on Message to Government and Private Sector: YOU are the reason for insider threats

Message to Government and Private Sector: YOU are the reason for insider threats

spy v spyEveryone is missing the boat on the insider threat issue – INSA too…to paraphrase James Carville, “It’s leadership stupid.”

Government and private sector organizations are the primary reason for insider threats – senior leaders and the boardroom grow them internally.

With very minor exception, NO ONE COMES TO WORK FOR YOU ON DAY ONE WITH THE INTENT TO HURT YOU, steal your secrets, or sell your intellectual property.

It’s how you treat them, over time, that turns them into insider threats.

  • You put them in the wrong jobs;
  • You fail to trust them;
  • You make it hard for them to do their jobs;
  • You put asshole/untrained managers over them;
  • You treat them like furniture;
  • You , threaten their existence in your companies and agencies;
  • You kill their spirit; and
  • Then, you wonder why they decide to hurt you.

Want to reduce/eliminate the insider threat? Treat you staff the way you did on day one:

  • Welcome them as a human being;
  • Be aware of how they are cared for in your organization;
  • Show them you care about them and their families;
  • Give them a future;
  • Put r-e-a-l leaders over them;
  • Give them a voice; and
  • Pay them well.

In other words, treat them as you would want to be treated.

Now, why is that so hard?

And, why do NONE of the plans I have seen for combatting the insider threat even mention poor leadership as a factor?

INSAonline.org | 9.12.13 Assessing Insider Threat Programs of U.S. Private Sector http://www.insaonline.org/i/f/pr/9.12.13_InsiderThreat_WP.aspx