|Excerpted from CyberheistNews Vol 7 #50|
2017 was a dumpster fire of privacy and security screw-ups.
To start 2018 with a simple, effective, IT security strategy is an excellent New Year’s resolution and helps your CEO to keep their job. Better yet, thousands of your peers will tell you this was the best and most fun IT security budget they ever spent… hands-down.
This list is the high-power ammo you need to get budget and roll out new-school security awareness training, ideally right now.
Here are the Top 5 reasons…
Former US CISO on Why Awareness Training Is Priority Number 1:
In an information technology environment where personnel are on the cyber front line at work and also at the house, the key to ensuring security is still awareness training, says former U.S. CISO Gregory Touhill, who was the Air Force General responsible for Cyber Training before he became the first US CISO.
“A congressman asked me when I took my post as the first federal CISO: ‘If I gave you an extra dollar, how would you spend it on cybersecurity?’ And I told him I would spend it on better training my people. I find a very well-trained, well-informed workforce is better prepared to help an organization buy down their cyber risk,” Touhill says in an interview with Information Security Media Group.
Training at All Levels
Touhill calls for daily security drills and exercises at all levels of an organization to help reinforce defensive strategies.
“Board and C-suite officers are increasingly large targets for whale phishing,” Touhill says. “Everybody has a stake in cybersecurity and I would contend everyone is on cyber front lines. That training needs to be tailored and continuous for the entire workforce.”
Touhill is now president of the Cyxtera Federal Group and teaches cybersecurity and risk management for the CISO certification program at Carnegie Mellon University’s Heinz College.
Scam of the Week: New Massive Data Breach Poses Major Threat
Here’s a fun question to pose to the family dinner table: Have you ever heard of Alteryx?
100 to 1 you never heard of them, but chances are good that they have heard of you. Alteryx is a data analytics company that makes its money by repackaging data that it’s collected from different sources. And it became the latest reminder of how much data little-known companies have collected on us – and how little oversight there is over the security of that data.
Companies You’ve Never Heard of Are Exposing Your Personal Data
Earlier this week, an analyst from the security firm Upguard shared that Alteryx had not properly protected detailed information it had collected on 123 million U.S. households (All told, there are about 126 million American households, according to the Census Bureau.)
This data leak was discovered by a researcher, and not (we hope) by a criminal. But the leak affects about as many people as the massive hack Equifax reported in September, which affected 145.5 million Americans, or nearly every adult.
Another Leaky AWS Bucket
The data had been left unprotected in an Amazon Web Services storage bucket available to anyone with a free AWS account. After being informed of the data breach, Alteryx secured the information, however, it had been available to identity thieves and scammers for a considerable period of time.
Alteryx and credit reporting agency Experian—which was the source of the data—both downplayed the risk of identity theft because no names were included in the data included in the data breach. This response is just PR and disingenuous as 248 data fields for every household were included in the data breach which are easy to map to the names.
This is just another example of the lack of important laws in the United States protecting people from data aggregators’ negligence and requiring these companies to employ security measures to protect our personal data. Many other countries require such measures by law, the new European GDPR is an excellent example.
What to Do About It
I suggest you send the following to your employees, friends, and family. You’re welcome to copy, paste, and/or edit:
“There is another major data breach, that pretty much covers every living adult in the United States. At this point you have to assume that cyber criminals have highly personal information that they can use to trick you. You need to watch out for the following things:
Here are 5 things you can do to prevent identity theft:
Quotes of the Week
“By three methods we may learn wisdom: First, by reflection, which is noblest; Second, by imitation, which is easiest; and third by experience, which is the bitterest.” – Confucius
“Wisdom comes from experience. Experience is often a result of lack of wisdom.” – Terry Pratchett
“Here is an example of a young man gaining wisdom by experience. LOL:”