ISACARuSec
generating_anomalies_improves_return.pdf
Как генерирование аномалий влияет на ROI(return-on-investment) SIEM
Возможны последствия для рынка ИБ
https://www.opennet.ru/opennews/art.shtml?num=49515
https://www.opennet.ru/opennews/art.shtml?num=49515
www.opennet.ru
Компания IBM объявила о покупке Red Hat
Компания IBM официально объявила о достижении соглашения о покупке компании Red Hat. Red Hat интересует компанию IBM прежде всего своими решениями в области облачных технологий. Утверждается, что покупка Red Hat поможет компании IBM стать крупнейшим провайдером…
Действующим ciso будет полезно узнать как у коллег. Остальным оценить подходят ли они для роли ciso.
Обращаю внимание, что 37% процентов опрошеных ciso сертифицированные ISACA CISM.
https://www.kaspersky.com/blog/ciso-report/24288/
Обращаю внимание, что 37% процентов опрошеных ciso сертифицированные ISACA CISM.
https://www.kaspersky.com/blog/ciso-report/24288/
Kaspersky
What it takes to be a CISO: Success and leadership in corporate IT security
Some comments from Kaspersky Lab’s head of information security on the results of the CISO survey.
Introducing COBIT 2019: The Motivation for the Update?
https://www.isaca.org/COBIT/focus/Pages/introducing-cobit-2019-the-motivation-for-the-update.aspx
https://www.isaca.org/COBIT/focus/Pages/introducing-cobit-2019-the-motivation-for-the-update.aspx
The COBIT 2019 update improves COBIT in the following areas:
It better addresses the importance of I&T governance for the enterprise. To achieve benefits realization, risk optimization, resource optimization, and business and IT alignment for the enterprise, an I&T governance program needs to be in place, supported by the board of directors and executive management. That governance program must be maintained on a basis that enables and encourages continuous improvement. This is a major differentiator for successful organizations.
It addresses new trends in technology. For example, Development Operations (DevOps) and Agile development concepts are added; off-premises operations are considered; the impact of third-party providers is addressed; outsourcing activities are more thoroughly discussed; and, although not singled out, the Internet of Things (IoT) is addressed.
It is more up to date, with latest standards and working methods. The COBIT model allows referencing and alignment to concepts originating in other sources (e.g., other IT standards, compliance regulations).
It provides more flexibility. The addition of the COBIT Design Guide: Designing an Information and Technology Governance Solution1 provides additional guidance for defining and using design factors, which allow COBIT content to be tailored for better alignment with each organization’s and each user’s particular context.
It introduces focus area concepts. A focus area describes a certain governance topic, domain or issue that can be addressed by a collection of governance and management objectives and their components. Examples include: small and medium enterprises, cybersecurity, digital transformation, and cloud computing. Focus areas can contain a combination of generic governance components and variants. The number of focus areas is virtually unlimited; new ones can be added as required or as subject matter experts and practitioners contribute. This is what makes COBIT open-ended.
It is perceived as more prescriptive. Frameworks such as COBIT can be descriptive and prescriptive. The COBIT conceptual model is constructed and presented such that its instantiation—that is, the tailored COBIT governance components—is perceived as a prescription of how to set up a customized governance system for I&T.
It is a better instrument to manage performance of I&T.The structure of the COBIT performance management model is integrated into the conceptual model. The maturity and capability concepts are introduced for better alignment with Capability Maturity Model Integration (CMMI).
It adds a new online collaboration feature. Future updates will be recommended by COBIT users, vetted by a COBIT Steering Committee, to ensure consistent COBIT core framework quality and timelier updates.
It supports decision-making. The key asset for all organizations is information. This information must be accurate, reliable, timely and available when needed for critical decision-making. The information is made available to all organizations through the use of technology, which must be secure and cost-effective.
It better addresses the importance of I&T governance for the enterprise. To achieve benefits realization, risk optimization, resource optimization, and business and IT alignment for the enterprise, an I&T governance program needs to be in place, supported by the board of directors and executive management. That governance program must be maintained on a basis that enables and encourages continuous improvement. This is a major differentiator for successful organizations.
It addresses new trends in technology. For example, Development Operations (DevOps) and Agile development concepts are added; off-premises operations are considered; the impact of third-party providers is addressed; outsourcing activities are more thoroughly discussed; and, although not singled out, the Internet of Things (IoT) is addressed.
It is more up to date, with latest standards and working methods. The COBIT model allows referencing and alignment to concepts originating in other sources (e.g., other IT standards, compliance regulations).
It provides more flexibility. The addition of the COBIT Design Guide: Designing an Information and Technology Governance Solution1 provides additional guidance for defining and using design factors, which allow COBIT content to be tailored for better alignment with each organization’s and each user’s particular context.
It introduces focus area concepts. A focus area describes a certain governance topic, domain or issue that can be addressed by a collection of governance and management objectives and their components. Examples include: small and medium enterprises, cybersecurity, digital transformation, and cloud computing. Focus areas can contain a combination of generic governance components and variants. The number of focus areas is virtually unlimited; new ones can be added as required or as subject matter experts and practitioners contribute. This is what makes COBIT open-ended.
It is perceived as more prescriptive. Frameworks such as COBIT can be descriptive and prescriptive. The COBIT conceptual model is constructed and presented such that its instantiation—that is, the tailored COBIT governance components—is perceived as a prescription of how to set up a customized governance system for I&T.
It is a better instrument to manage performance of I&T.The structure of the COBIT performance management model is integrated into the conceptual model. The maturity and capability concepts are introduced for better alignment with Capability Maturity Model Integration (CMMI).
It adds a new online collaboration feature. Future updates will be recommended by COBIT users, vetted by a COBIT Steering Committee, to ensure consistent COBIT core framework quality and timelier updates.
It supports decision-making. The key asset for all organizations is information. This information must be accurate, reliable, timely and available when needed for critical decision-making. The information is made available to all organizations through the use of technology, which must be secure and cost-effective.
Forwarded from Пост Лукацкого
На сайте TК26 опубликован для обсуждения проект рекомендаций Использование алгоритмов ГОСТ Р 34.10-2012, ГОСТ Р 34.11-2012 в сертификате, списке аннулированных сертификатов (CRL) и запросе на сертификат PKCS #10 инфраструктуры открытых ключей X.509https://t.co/BrcexLOTZN
— Russian cryptography (@CryptographyRU) October 30, 2018
— Russian cryptography (@CryptographyRU) October 30, 2018
Отличный портал по ИБ для малого бизнеса от федеральной торговой комиссии США.
Cybersecurity for Small Business | Federal Trade Commission
https://www.ftc.gov/tips-advice/business-center/small-businesses/cybersecurity
Cybersecurity for Small Business | Federal Trade Commission
https://www.ftc.gov/tips-advice/business-center/small-businesses/cybersecurity
Federal Trade Commission
Cybersecurity for Small Business
Кибердружины в США.
It’s Time to Organize Volunteer Hackers, Think Tank Says - Nextgov
https://www.nextgov.com/cybersecurity/2018/10/its-time-organize-volunteer-hackers-think-tank-says/152310/
It’s Time to Organize Volunteer Hackers, Think Tank Says - Nextgov
https://www.nextgov.com/cybersecurity/2018/10/its-time-organize-volunteer-hackers-think-tank-says/152310/
Nextgov.com
It’s Time to Organize Volunteer Hackers, Think Tank Says
The Civilian Cyber Corps would be modeled on the Civil Air Patrol and volunteer firefighters.
И дружины у нас...
В России появятся казачьи кибердружины: Интернет: Интернет и СМИ: Lenta.ru
https://m.lenta.ru/news/2016/11/11/kiberkazaki/
В России появятся казачьи кибердружины: Интернет: Интернет и СМИ: Lenta.ru
https://m.lenta.ru/news/2016/11/11/kiberkazaki/
Lenta.RU
В России появятся казачьи кибердружины
В России появятся казачьи кибердружины, призванные защитить российский интернет от опасного контента. Дружины сформируют в рамках соглашения, которое Лига подписала с Первым казачьим университетом. Сотрудничество также предусматривает просвещение детей, подростков…
8 Keys to a Defensible Network Architecture And How Zeek Can Help You Get There - SANS Institute
https://www.sans.org/webcasts/8-keys-defensible-network-architecture-zeek-109320
https://www.sans.org/webcasts/8-keys-defensible-network-architecture-zeek-109320
www.sans.org
8 Keys to a Defensible Network Architecture And How Zeek Can Help You Get There - SANS Institute
If your network architecture is largely unmapped, unmonitored and unmanned then you have a significant security risk you need to mitigate. Without a comprehensive inventory of your network infrastructure, an ability to make fast sense of the traffic, and…
Forwarded from RUSCADASEC news: Кибербезопасность АСУ ТП (Anton Shipulin)
Опубликован отчет об иследовании доступности в Интернет компоннент промышленных систем в отрасли энергетики и водоснабжения: Critical Infrastructures Exposed and at Risk: Energy and Water Industries. На основании данных из открытых источников показаны устройства, их георгафическое расположение, экраны операторов систем, а так же обсуждения темы на dark web форумах
https://documents.trendmicro.com/assets/white_papers/wp-exposed-and-vulnerable-critical-infrastructure-the-water-energy-industries.pdf
https://documents.trendmicro.com/assets/white_papers/wp-exposed-and-vulnerable-critical-infrastructure-the-water-energy-industries.pdf
Неплохое мероприятие со свободным входом, при условии предварительной регистрации.
https://cyberday.timepad.ru/event/821670/
https://cyberday.timepad.ru/event/821670/
cyberday.timepad.ru
Skolkovo Cyberday 2018 / События на TimePad.ru
Skolkovo Cyberday - ведущая ежегодная международная конференция, посвященная актуальным вопросам развития технологий в области информационной безопасности. Конференция пройдет 30 ноября - 01 декабря 2018 года в центральном здании «Большой Технопарк» в Инновационном…
Understanding Big Data and Machine Learning Projects - ISACA Now
https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=1094
https://www.isaca.org/Knowledge-Center/Blog/Lists/Posts/Post.aspx?ID=1094
Forwarded from Пост Лукацкого
Текст СТО 1.5 по форматам взаимодействия с ФинЦЕРТ- https://t.co/bH0Rk7cD6q
— Alexey Lukatsky (@alukatsky) November 1, 2018
— Alexey Lukatsky (@alukatsky) November 1, 2018