Ken “The Virus Doctor” Dwight on Malware Threats at SpiceWorld 2017

The Virus DoctorKen “The Virus Doctor” Dwight and I sat down at SpiceWorld 2017 to discuss ransomware and other malware threats to you and your security. Ken Dwight has been in the cybersecurity business for as long as cybersecurity has been a thing and long before anyone coined the term, cybersecurity.

Ken also offers his book and a Virus Remediation class from his website. He has helped many companies recover from virus infestations, ransomware attacks, and various malware infections. He is a consultant, a speaker, and a practitioner in the dark art of virus killing.

It was a pleasure to speak with Mr. Dwight on camera at SpiceWorld 2017.

Copyright 2017 The SecurityNOW Show. License: CC BY.

ISACA Report Confirms SSH Keys Need To Be Properly Managed To Ensure Compliance and Reduce Risk

HELSINKI, WALTHAM, Mass. and ROLLING MEADOWS, Ill., Sept. 12, 2017 – The use of Secure Shell (SSH) is ubiquitous, a critical service on which the security profile of most organizations depends. Yet, according to a new report issued by ISACA and sponsored by SSH Communications Security, only rarely is that usage appropriately secured, assessed, documented and managed in a systematic and risk-aware way. Consequently, poorly managed SSH key environments may lead to compliance challenges and security breaches. The full report can be downloaded free of charge from the ISACA or SSH Communications Security websites.

The report outlines considerations that technology risk professionals, auditors, security practitioners and governance professionals should take into account as they approach the use of SSH in their enterprises. It offers guidance for the assessment of SSH usage, including items to incorporate in audit plans to ensure SSH access control and management is in place. Key areas auditors should consider regarding SSH keys include:

  • Security issues: Practical challenges include managing and tracking cryptographic keys at scale, responsibility for “key hygiene” and executive oversight for the use of SSH.
  • Assurance considerations:The ubiquity and transparency of SSH access makes the surface area for consideration very large, while the underlying mechanics of operation make it specialized and potentially complex. The report explores the core areas that auditors should consider when evaluating SSH usage.
  • Suggested controls: ISACA recommends specific areas to focus on when evaluating enterprise networks for SSH compliance, including configuration management and provisioning.

Frank Schettini, Chief Innovation Officer, ISACA, said: “SSH is one of those rare technologies that is in frequent use in almost every type of organization around the world. The report from ISACA examines the specific steps audit practitioners should take to ensure that they are not ignoring SSH usage and the access it provides, and gives general guidance on appropriate controls to assess and manage SSH keys. Our goal is to provide a practical starting point for improving any organization’s security posture and overall governance.”

Fouad Khalil, VP of Compliance, SSH Communications Security, said:

“Audit, risk, security and governance practitioners have a huge and complex job on their hands when it comes to SSH user key management. ISACA’s new report recommends that practitioners systematically address, assess and periodically re-evaluate the mechanics of SSH usage within their environments. Our robust set of solutions removes the complexity and difficulty from these urgent, critical tasks so organizations can become or remain secure and compliant.”

About ISACA

Nearing its 50th year, ISACA® (isaca.org) is a global association helping individuals and enterprises achieve the positive potential of technology. ISACA leverages the expertise of its half-million engaged professionals in information and cyber security, governance, assurance, risk and innovation, as well as its enterprise performance subsidiary, CMMI® Institute, to help advance innovation through technology.

About SSH Communications Security

SSH Communications Security (NASDAQ OMX) is a leading provider of enterprise cybersecurity solutions that monitor, control and automate trusted access to critical data. Customers worldwide trust our flagship Universal SSH Key Manager® and other solutions to manage access, enhance security and achieve compliance. SSH sells direct through offices in North America, Europe and Asia and through a global network of certified partners. Access more at www.ssh.com

Cybersecurity Law with Heidi L. Shadid, Attorney at Law (Video)

Eller & DetrichHeidi Shadid of the Eller & Detrich Law Firm and I sat down for an interview that covered several aspects of Cybersecurity Law. We discussed how to engage her firm, what to do after a hack or breach, and what your responsibilities are for reporting a breach. Ms. Shadid is an Attorney with the Eller & Detrich Law Firm in Tulsa, Oklahoma and includes Cybersecurity Law in her practice.

Her practice encompasses the following specialties:

Core areas of practice and experience

  • General Civil Litigation
  • Business Litigation
  • Construction Litigation
  • Employment Disputes
  • Cybersecurity Risk Management

Bar admissions

  • Oklahoma, 2010
  • Missouri, 2009
  • Kansas, 2009
  • U.S. District Court, Northern, Eastern & Western Districts of Oklahoma
  • U.S. District Court, District of Kansas
  • U.S. District Court, Western District of Missouri
  • U.S. District Court, District of Colorado
  • U.S. Court of Appeals, Tenth Circuit

Copyright 2017 SecurityNOW – License: CC BY

SecurityNOW’s Mid-Year 2017 Cybersecurity Review

HalfPreston and I took a few minutes to recap the year so far in cybersecurity and to catch you up on what’s going on with breaches, security tips, and ransomware. We have a lengthy (for us) conversation that covers all things cybersecurity for the first half of 2017 and all that it had to offer. I want you to pay particular attention to my five rules concerning ransomware. Please take this advice as wisdom from not only Preston and myself but from other cybersecurity professionals as well.

Podcast details:

Length: 33:56 minutes. Format: MP3. Rating: G for all audiences.

True Digital SecurityThis podcast was sponsored by True Digital Security.

Introducing True Digital Security and CEO and Founder Dr. Jerald Dawkins (Podcast and Video)

True Digital SecurityPreston and I had the pleasure of speaking with, Dr. Jerald “Jerry” Dawkins, the CEO and founder of True Digital Security, the premier local security company here in Tulsa, Oklahoma. For this one, I stayed behind the scenes (literally) and Preston took the solo spotlight for this rare interview with Dr. Dawkins. This podcast is actually the audio extract from the video (Coming soon) we captured during the interview. True Digital Security is headquartered in Tulsa but has offices in Tulsa and Oklahoma City and cover clients globally.

Jerry and Preston discuss passwords, compliance issues, security pain points, and how to engage True Digital Security for your corporate security needs. This is a special focus on a growing company of security experts who are ready to help you navigate HIPAA, PCI, FFIEC, NERC CIP, and your other corporate security requirements and needs.

I think you’ll agree that after listening to this interview that Dr. Dawkins and his team knows security. You’ll also agree that this discussion is far too short. We hope to have Jerry and other True Digital Security folks on the show in the future so that you can get to know the whole team.

Podcast details:

Length: 22:12 minutes. Format: MP3. Rating: G for all audiences.

Our video interview is up and ready and available above. You can meet some of the True Digital Security team in their spotlight video.

Copyright 2017 SecurityNOW. Licensed CC BY.

Mayday! Mayday! Breaches and The Merry Month of May (Podcast)

Help!Preston and I visited our favorite Tuesday landing for this May overview where we briefly discuss what to do after you discover a breach, a compromise, a hack, or a ransomware infection on your network. My advice is “Don’t Panic.” Preston has more, and probably better, advice. One of the things you need to do is know what’s on your network, know what’s supposed to be on your network, and to establish a security baseline.

A security baseline is a starting point from which you will judge your systems from now on. Scan everything with anti-malware scanners. Clean up any infections. Plug security holes. Update your systems. And that is your baseline–a clean, uninfected, uncompromised network. It will be easier in the future to discover breaches if you know what’s going on now and keep track along the way. This short podcast is a topic of a longer, more in-depth future podcast.

Podcast details:

Length: 6:42. Format: MP3. Rating: G for all audiences.

All podcasts are Safe for Work and school and are licensed CC BY.

SSH Communications Founder Tatu Ylönen Speaks on IoT Security (Podcast)

SSH CommunicationsPreston and I had the rare honor of speaking with SSH Communications founder, Tatu Ylönen about IoT device security. For those of you who don’t know, Tatu Ylönen is the inventor and original programmer of the SSH protocol. There’s absolutely no one in the world more qualified to speak on security than Tatu.

Tatu YlönenHe single-handedly protected us all from plain text transmissions and essentially destroyed the old Telnet protocol for good. In this podcast, we discuss the importance of IoT security. IoT security has traditionally been ignored because the few devices that existed weren’t particularly vulnerable to hacking either because no one cared or no one had access to the hardware and software to do so. That’s no longer true. Everyone has access to exploitation tools and the time for focusing on a more secure IoT has arrived.

For IoT manufacturers, you should listen carefully to Tatu’s advice and insights. Some of these devices and networks carry high-value data, including possibly personal data and that needs to be protected.

Podcast details:

Length: 14:43 minutes. Format: MP3. Rating: G for all audiences.

A special thanks to Tatu Ylönen and to the Nadel Phelan agency for connecting us.