Over a quarter (29%) of threats spotted in Q4 2020 had never before been detected in-the-wild, giving attackers an advantage over their victims, according to HP Inc. The tech giant’s latest Quarterly Threat Insights Report was compiled from data gathered from its global customers’ Sure Click virtual machines from October to December 2020. While these isolated micro-VMs effectively segment malware from the endpoint and let it execute harmlessly, the widespread use of packers and obfuscation…

Security and compliance – a phrase often uttered in the same breath as if they are two sides of the same coin, two members of the same team or two great tastes that go great together. As much as I would like to see auditors, developers, and security analysts living in harmony like a delicious Reese’s cup, a recent gap analysis that I was part of reminded me that too often the peanut butter and…

As you start your ISO 27001 implementation project, you probably want to know about much as possible. Some people attend training courses to pick up the knowledge of ISO 27001, and others go one step further, hiring an ISO 27001 consultant to guide them through the process. Those are both excellent options for those with the time and budget, but what if you’re looking for a less expensive approach? In those cases, you can never…

The objective of an organization when implementing cybersecurity controls is to eliminate risk, but this oftentimes involves settling for managing risk at an acceptable level. Each organization defines what that acceptable level is depending on several factors including the environment, the criticality of function, the asset type, etc. There are many methods and techniques that an organization can then use to manage this risk. One of the most commonly used methods is patching. At the…

Another year, another new set of cybersecurity threats to overcome, outwit and mitigate against. At the beginning of 2021, the cybersecurity world was informed by CISA (the USA Cybersecurity and Infrastructure Security Agency) of a spate of attacks targeting cloud environment configurations, supposedly occurring as a result of the increase in remote working. Once you add to the mix the fact that corporate and personal devices were being used – often simultaneously – to access…