Optiv Blog

Having an Identity Crisis? CISO’s Need to Own IAM

· By Richard Bird · 0 Comments

Within any company, we can find owners for every key function throughout the enterprise. If we ask, “who is in charge of human resources?” we know the name of the SVP or director of human resources will surface. If we ask, “who ultimately owns the uptime of our technology infrastructure?” our chief technology officer will raise her hand. If we want to know the strategic plan for product development, we can clearly articulate the rings of the organizational tree that represent every single leadership role supporting this function.

Continue reading 0 Shares

Three Steps for Management and Remediation of Security Vulnerabilities with Third Parties

· By James Robinson · 0 Comments

Over the years, security organizations have had to deal with many vulnerabilities that required quick response and remediation. Some examples that come to mind include Heartbleed, Shellshock, numerous specific vendor product vulnerabilities, and as we saw recently: WannaCry. All of these advisories require our organizations to quickly assess the exposure and impact; however, many of us stop at our own infrastructure. As we have seen with mobile, cloud and continued outsourcing, maintaining focus within our own virtual walls is not enough. There is significant risk and exposure to information if we have decided to leverage a service offering or third party.

Continue reading 0 Shares

Top 20 CIS Critical Security Controls (CSC) Through the Eyes of a Hacker – CSC 19

· By Dan Kottmann · 0 Comments

Protect the organization’s information, as well as its reputation, by developing and implementing an incident response infrastructure (e.g. plans, defined roles, training, communications, management oversight) for quickly discovering an attack and then effectively containing the damage, eradicating the attacker’s presence and restoring the integrity of the network and systems.

Continue reading 0 Shares

WannaCry Ransomware Recommendations from the Trenches

· By Nick Hyatt · 0 Comments

Approximately one year ago, I wrote a blog post containing actionable recommendations to protect your environment from ransomware threats. In the wake of the recent WannaCry attack, I thought it would be prudent to update that blog and talk about what concepts have both changed and remained the same in the world of ransomware during the previous year.

Continue reading 0 Shares

Ransomware Kill Chain and Controls - Part 2: Once the Crying is Over, the Controls Must Kick In

· By James Robinson, Nick Hyatt · 0 Comments

In the first part of the blog series, we alluded to the impending danger of ransomware campaigns. It appears the concerns were justified, given the size of the most recent cyber attack that hit countries worldwide on May 12. The WannaCry ransomware program, also called WannaCrypt, WanaCrypt0r and Wanna Decryptor, was launched by a group of cyber criminals causing computers in more than 100 countries to lock up and be held for ransom.

Continue reading 0 Shares

PCI Compliance Every Day

· By Jeff Hall, Scott Chimner · 0 Comments

The title of this post sounds daunting, does it not? However, achieving PCI compliance every day is not as daunting as you might think. With the release of PCI Data Security Standard (DSS) v3.2, the PCI Security Standards Council (SSC) introduced the concept of business as usual (BAU). BAU is meant to embed those relevant PCI DSS requirements into the business operations of organizations.

Continue reading 0 Shares

Shedding Light on the Dark Web – What is it, Really, and How Can it Help Me?

· By Ken Dunham · 0 Comments

Dark web, darknet, deep web – all sexy new terms that are often overused and not well understood. Definitions are all over the place ranging from illegal and nefarious, to private, commercial, encrypted and so on. When looking at Internet content in 2017, I use the following definitions to describe the three layers of the web.

Continue reading 0 Shares

Top 20 CIS Critical Security Controls (CSC) Through the Eyes of a Hacker – CSC 18

· By Mike Hodges · 0 Comments

Manage the security lifecycle of all in-house developed and acquired software in order to prevent, detect and correct security weaknesses.

Continue reading 0 Shares

Maturing IR Capabilities into an Incident Management Program – Part 3 of 3

· By Jenn Black · 0 Comments

Incident response has become one of the most critical aspects of any overall security strategy, but a solid incident response program (IRP) is something many organizations – both large and small – either lack entirely or don’t take seriously enough.

Continue reading 0 Shares

Secure SDLC Lessons Learned: #5 Personnel

· By Shawn Asmus · 0 Comments

t’s no secret that finding and retaining dependable, well-trained application security professionals is a serious challenge, and has been for years. Part of the problem is that the breadth and depth of AppSec knowledge is rather astronomical; one could argue that it’s exponentially wider than network security and grows at a much faster rate. Based on what I’ve seen, teams tend to be perpetually short-staffed and undertrained.

Continue reading 0 Shares
(529 Results)